keenerb wrote on 2020-02-13, 16:11:

My understanding is that the L chip is logic only, while the R chip actually contains some form of microcode.

PAL R and GAL in registered mode has a D flip-flop on each output. All the registers share common clock source but the output can be fed back to the combinatorial matrix area, so you can create a state machine. As in, the output is not just a function of the inputs, but also previous internal state - that is updated on each clock cycle.
That makes simple brute-force attack of mapping all possible inputs to outputs combination impossible, or at least not easy. It's still kinda doable for the 8-class chips, as these are rather simple, all flip-flops are connected to outputs so there is no way to hide the internal state from the observer. With some additional knowledge of how a particular PAL/GAL is connected in the cicruit it might be possible to figure out its logic.

you are looking into reverse engineering that aplleII hardware emulator card right? It was kinda disappointing seeing it has 8 PALs... it makes no sense sending them for cracking it will be too expensive for this many chips 🙁

keropi wrote on 2020-02-13, 19:35:

you are looking into reverse engineering that aplleII hardware emulator card right? It was kinda disappointing seeing it has 8 PALs... it makes no sense sending them for cracking it will be too expensive for this many chips 🙁

Yep precisely. The Trackstar 128 can be upgraded to an E by swapping those chips out, which would be a huge bump to their utility.

I am hoping to see if a simple ROM swap gives any additional utility.

Theres always the possibility that they may be unprotected but I dont think thats likely.

From what I have seen PALs that have part numbers printed on them are almost always read-protected... you can certainly try reading them but keep in mind you need a good programmer that supports the model exactly else you will get weird results...

yeah. We'll see. Do you know of anyone off-hand that does this kind of work, and how much it costs? Not afraid to drop a little bit of money into a project like this.

if you find a "company" nowdays that can do this prepare to pay something like 2k $/chip .... I have no idea who can do this nowdays or who you can trust... also keep in mind you might need more than 1 pal of each type since accidents are most likely to happen :\
in the past more people could do it for sure - nowdays their number is so limited (and basically china-based only) that prices are unreal.

ofcourse this is what I know, someone else might know more!

I wonder if the guy who decoded the SOundblaster CMS upgrade PAL would be up for trying these? I'll have to find his thread.

A while ago I needed to clone a PAL16L8.
There is a simple adapter that you can use to read the PAL as a 27C020. Although I have a compatible programmer (TL866CS), this method didn't work for me, producing different results each time I read the chip.
There is also this post by Chuck(G) on vcfed.org, unfortunately a bit steep for me at my level of knowledge in electronics and programming.
I'm not sure, but I think the guys at jammarcade.net can provide some PAL cracking services.

keenerb wrote on 2020-02-13, 20:27:

I wonder if the guy who decoded the SOundblaster CMS upgrade PAL would be up for trying these? I'll have to find his thread.

From what I know, these were never decoded but recreated from observations using a logic probe.

yeah the CMS decoding derived from understanding what the card does and how it should work and then recreated with the help of what derSammler wrote... because of that the new code is actually better than the creative one and it works with all SB2.0s

the method quicknick linked still assumes you know what you are looking at (meaning you have some basic understanding what the pal does) and you are prepared to some manual work in the produced code before it is of any use... at least this is what I understood from the page