Reading a GAL16V8

[jasonsbeer]

I'm trying to read the GALs from a Supra Wordsync SCSI card using a TL866II programmer. The output below is an example of what I get, which is not what I expected. I fear the read protect fuse may be set on these. Any thoughts?

*QP20
*QF2194
*G0
*F0
*L00000 11111111111111111111111111111111
*L00032 11111111111111111111111111111111
*L00064 11111111111111111111111111111111
*L00096 11111111111111111111111111111111
*L00128 11111111111111111111111111111111
*L00160 11111111111111111111111111111111
*L00192 11111111111111111111111111111111
*L00224 11111111111111111111111111111111
*L00256 11111111111111111111111111111111
*L00288 11111111111111111111111111111111
*L00320 11111111111111111111111111111111
*L00352 11111111111111111111111111111111
*L00384 11111111111111111111111111111111
*L00416 11111111111111111111111111111111
*L00448 11111111111111111111111111111111
*L00480 11111111111111111111111111111111
*L00512 11111111111111111111111111111111
*L00544 11111111111111111111111111111111
*L00576 11111111111111111111111111111111
*L00608 11111111111111111111111111111111
*L00640 11111111111111111111111111111111
*L00672 11111111111111111111111111111111
*L00704 11111111111111111111111111111111
*L00736 11111111111111111111111111111111
*L00768 11111111111111111111111111111111
*L00800 11111111111111111111111111111111
*L00832 11111111111111111111111111111111
*L00864 11111111111111111111111111111111
*L00896 11111111111111111111111111111111
*L00928 11111111111111111111111111111111
*L00960 11111111111111111111111111111111
*L00992 11111111111111111111111111111111
*L01024 11111111111111111111111111111111
*L01056 11111111111111111111111111111111
*L01088 11111111111111111111111111111111
*L01120 11111111111111111111111111111111
*L01152 11111111111111111111111111111111
*L01184 11111111111111111111111111111111
*L01216 11111111111111111111111111111111
*L01248 11111111111111111111111111111111
*L01280 11111111111111111111111111111111
*L01312 11111111111111111111111111111111
*L01344 11111111111111111111111111111111
*L01376 11111111111111111111111111111111
*L01408 11111111111111111111111111111111
*L01440 11111111111111111111111111111111
*L01472 11111111111111111111111111111111
*L01504 11111111111111111111111111111111
*L01536 11111111111111111111111111111111
*L01568 11111111111111111111111111111111
*L01600 11111111111111111111111111111111
*L01632 11111111111111111111111111111111
*L01664 11111111111111111111111111111111
*L01696 11111111111111111111111111111111
*L01728 11111111111111111111111111111111
*L01760 11111111111111111111111111111111
*L01792 11111111111111111111111111111111
*L01824 11111111111111111111111111111111
*L01856 11111111111111111111111111111111
*L01888 11111111111111111111111111111111
*L01920 11111111111111111111111111111111
*L01952 11111111111111111111111111111111
*L01984 11111111111111111111111111111111
*L02016 11111111111111111111111111111111
*L02048 11111111111111111111111111111111
*L02080 11111111111111111111111111111111
*L02112 11111111111111111111111111111111
*L02144 11111111111111111111111111111111
*L02176 111111111111111111
*C10F1

[torsti76]

Originally Posted by jasonsbeer

I'm trying to read the GALs from a Supra Wordsync SCSI card using a TL866II programmer. The output below is an example of what I get, which is not what I expected. I fear the read protect fuse may be set on these. Any thoughts?

All '1' means it's read protected.

[hooverphonique]

Originally Posted by torsti76

All '1' means it's read protected.

or erased/empty..

[torsti76]

Originally Posted by hooverphonique

or erased/empty..

Would be unusual for a GAL from a once working expansion to erase itself completely...

Btw., Matze from a1k.org has developed an Arduino shield called Galdurino and accompanying software that is able to read the contents of read protected GALs by exploiting a bug in the read protection.
It's very hacky, but it works (have one myself).

[hooverphonique]

Originally Posted by torsti76

Would be unusual for a GAL from a once working expansion to erase itself completely...

Sure

Originally Posted by torsti76

Btw., Matze from a1k.org has developed an Arduino shield called Galdurino and accompanying software that is able to read the contents of read protected GALs by exploiting a bug in the read protection.
It's very hacky, but it works (have one myself).

That's cool!

[jasonsbeer]

Originally Posted by torsti76

Btw., Matze from a1k.org has developed an Arduino shield called Galdurino and accompanying software that is able to read the contents of read protected GALs by exploiting a bug in the read protection.
It's very hacky, but it works (have one myself).

Oooooo....I'll need to check that out.

On a side note, has anyone here reverse engineered a GAL to determine the equations or logic behavior?

[torsti76]

Originally Posted by jasonsbeer

Oooooo....I'll need to check that out.



On a side note, has anyone here reverse engineered a GAL to determine the equations or logic behavior?

People like Cosmos and Matze did such things. Essentially, the jedec file can be disassembled if you can read it out of the GAL.

[jasonsbeer]

Originally Posted by torsti76

Btw., Matze from a1k.org has developed an Arduino shield called Galdurino and accompanying software that is able to read the contents of read protected GALs by exploiting a bug in the read protection.
It's very hacky, but it works (have one myself).

After reading about the Galdurino and here, it seems the secret is to apply voltage to the write pin before applying Vcc. That causes the write protect to be ignored.

I wonder if that is possible with the TL866II with some hacked together adapter board? I do not want another gadget around. I also do not want to fry my existing GALs. That would brick my working Wordsync card.

[Wrangler]

Originally Posted by jasonsbeer

On a side note, has anyone here reverse engineered a GAL to determine the equations or logic behavior?

Yes, I did it as part of getting the DSP working on AA3000+. It's a pain in the bum to do because the only software I found that could do it was ancient - it meant running OpalJr via dosbox... It works though.

[lesta_smsc]

Originally Posted by torsti76

Would be unusual for a GAL from a once working expansion to erase itself completely...

Btw., Matze from a1k.org has developed an Arduino shield called Galdurino and accompanying software that is able to read the contents of read protected GALs by exploiting a bug in the read protection.
It's very hacky, but it works (have one myself).

Can you use this method to extract code from GAL found on Amitek HD floppy drives?

[torsti76]

Originally Posted by lesta_smsc

Can you use this method to extract code from GAL found on Amitek HD floppy drives?

Maybe. But these GAL driven HD implementations all work outside C= spec, so it's rather pointless.
I developed my own little addon board to convert PC floppy drives to Amiga HD floppies. Only need to find the time to convert the 40 or so floppy drives I have... ;-)

[lesta_smsc]

Originally Posted by torsti76

Maybe. But these GAL driven HD implementations all work outside C= spec, so it's rather pointless.
I developed my own little addon board to convert PC floppy drives to Amiga HD floppies. Only need to find the time to convert the 40 or so floppy drives I have... ;-)

Wow! Is there any possibility of sharing how you did that? Hoping to convert one myself as would be nice to add to my A1200

[torsti76]

Originally Posted by lesta_smsc

Wow! Is there any possibility of sharing how you did that? Hoping to convert one myself as would be nice to add to my A1200

Not yet. It took me ages to figure it out, so I'd like to sell some of my converted drives first.

But it's planned to become open source at some point, yes.

[lesta_smsc]

Originally Posted by torsti76

Not yet. It took me ages to figure it out, so I'd like to sell some of my converted drives first.

But it's planned to become open source at some point, yes.

I hope that day is not long to come lol...