My CD64 self boot, load any protected cartridge mod (Any game up to 256Mb)

Discussion in 'Modding and Hacking - Consoles and Electronics' started by Seeds, Dec 24, 2016.

  1. Seeds

    Seeds Member

    Joined:
    Aug 21, 2012
    Messages:
    13
    Likes Received:
    6
    Hello, not that many of you would probably care because this thing is so old, kind of obscure, and severely outdated; but I thought I should share what I did here for anyone interested, and that I'm kind of proud of this.

    I spent a ridiculous amount of time on this mod, mostly due to inexperience with electronics and soldering. It was a good beginner practice project and I've learned a lot about soldering so this little project wasn't all that pointless to me. I am an electrician by trade so I know a little about electricity and continuity but zip about computer chips, so by metering things out I understand what connections have to be made where to make them but I do not fully understand what the chips are doing.
    If anyone can give me any pointers, tips, or what I could have done to make this project better looking, more efficient, or some insider knowledge on how the N64 games protection chips work in the way a complete bumbling idiot would understand, please let me know!

    For anyone that doesn't know the CD64 is a backup unit that sits underneath the N64 that allows you to play backup games from a CD rom. You can read a little about it here: https://en.wikipedia.org/wiki/CD64_(Nintendo).
    [​IMG]
    This is a picture of my CD64 collection.

    The CD64 requires a game inserted it with a 6102 boot chip boot the CD64. To play certain games, or load cartridges with a different boot chip you would have to use a device called the parallel cartridge decoder.
    [​IMG]
    With a parallel cartridge decoder you insert a game with a 6102 chip on top and the protected game on the bottom. The problem I have with this is how irritating, inconvenient and ugly this thing looks. So I finally took the challenge and decided wire the protected cartridge decoder into the CD64 itself.


    The inside of the parallel cartridge decoder looks like this:
    [​IMG]
    It's cut in half because I had an idea originally for this project that just didn't pan out.

    There is very limited room inside the CD64 with the CDROM drive inside so I had to do some serious thinking how I was going to fit this in.
    Basically how the deprotect cartridge is connected is: Pins 1(ground),3,4,5,7,9(+.3.3V),11,12,15,16, ,28,29,30,32,33,36,37,40,41 from the boot cartridge and protected cartridge (When inserted) are all connected in parallel to the pins on the chip inside the deprotect cartridge. There are 3 separate pins on the chip for pin 35; one intercepts 35 on boot cartridge, one intercepts 35 on the protected cartridge, and one connects from 35 to the CD64. Pins 43 and 18 are disconnected completely from the protected cartridge, and are connected straight through from the boot cartridge to the CD64. All the rest of the pins required to load a game are paralleled from the protected cart and boot cart straight to CD64. (I used the bare minimum connections using this forum post as a guide http://bitfixgaming.boards.net/thread/99/bungles-pin-n64-wiring-guide.

    I first started this project by taking apart a boot cartridge (in this case I chose winback). This game doesn't have a save chip, but if it did I would have removed it so I can still use a cartridge inserted into cd64 for saving. I removed the 6102 chip and inserted an UltraCIC II chip (This chip resolves compatibility issues with many non-6102 games and also add the option to switch between pal and non pal games. This chip is originally designed for the Everdrive but works the same in this case. We can all now finally play banjo-tooie problem free on the CD64! I bought the chip from aliexpress for $8 here: https://www.aliexpress.com/store/pr...4Plus-N64-Flash-Cart/1902006_32431977887.html
    I then desoldered the chip from the protected cartridge decoder and I glued it on to the front of the boot cart PCB (I know this is probably not the best way to do it, but with limited space inside the CD64 I was out of ideas. Any better suggestions?) I then soldered all my interconnecting wires from the boot cart on to the deprotect chip.
    [​IMG]
    [​IMG]
    My next step was to fit this into the CD64 somehow and the only way I could possibly get it to fit was sideways like the EDO ram card. So I used the metal holder thingy that was was inside the boot cartridge, trimmed it down a bit with tin snips and bolted it into the CD64.
    [​IMG]
    The wires you see soldered in were from a previous attempt at this idea that didn't work. I reused those wires for this project.
    I then simply soldered all the pins from the CD64 to their corresponding spots on the boot cartridge.
    [​IMG]
    I cut off pins 18, 43, and 35 from the CD64 cartridge loader slot.
    Ran a wire from 18 and 43 on the CD64 motherboard to the corresponding spots on the boot cart. Then soldered on a wire and rerouted pin 35 from the cd64 cartridge loader to the deprotected cartridge decoder chip.
    [​IMG]

    Now the front CD64 front slot will load any game and boot with no problem even without a cartridge inserted into the slot!!!!

    My next list of mods is to have a multi-save chip install built in (Sram, 4kb eeprom, Flashram, 16KB eeprom) And possibly find a way to hack the bios to load from a compact flash instead of crappy failing CDDrives. I know there is compact flash CD64 bios on these boards; but from my understanding it doesn't function well and has been left uncompleted. I really like the current CD64 bios and if only I could just change CD loading code to CF loading I would be so sooooooo happy.
     
    nodots, Taijigamer2 and DeChief like this.
  2. DeChief

    DeChief Rustled.

    Joined:
    Jan 25, 2014
    Messages:
    1,704
    Likes Received:
    713
    For a so-called beginner's practice project this is really damn impressive, well done.
     
  3. Pikmin

    Pikmin Resolute Member

    Joined:
    Dec 24, 2009
    Messages:
    936
    Likes Received:
    95
    I would've personally tried to get better at soldering before attempting this but yeah well done
     
  4. sanni

    sanni Intrepid Member

    Joined:
    May 30, 2008
    Messages:
    653
    Likes Received:
    77
    But why didn't you sell your CD64 to a collector instead of modding it so you could just buy an ED64+, Everdrive 64 or 64drive?

    The last CD64 on ebay went for $152.50 and it was broken, you'd probably get double the price for a working unit in good condition. It seems to me by modding it you ruined its value while not achieving anything other than not having to use the adaptor.
     
    Bad_Ad84 likes this.
  5. DeChief

    DeChief Rustled.

    Joined:
    Jan 25, 2014
    Messages:
    1,704
    Likes Received:
    713
    But modifying things and finding ways around problems is half of the fun, you do it just for the hell of it, and to see how far you can push things beyond what they were meant for.
     
    nodots, WolverineDK and Mord.Fustang like this.
  6. pr0cess0r

    pr0cess0r Spirited Member

    Joined:
    Oct 22, 2016
    Messages:
    109
    Likes Received:
    8
    did you th8nk about integrati g an ultracic
     
  7. Ronnie

    Ronnie Spirited Member

    Joined:
    Sep 13, 2012
    Messages:
    132
    Likes Received:
    40
  8. TriMesh

    TriMesh Site Supporter 2013-2017

    Joined:
    Jul 3, 2008
    Messages:
    2,355
    Likes Received:
    779
    Nice job, and nicely analyzed.

    I can tell you what the signals that are being intercepted are:

    Pins 43 and 18 are data to and from the CIC - basically, the PIF sends out a pseudo-random sequence and the CIC sends a response that gets decoded by the PIF and starts up the console boot process.

    Pin 35 is one of the address latch signals - specifically the one that latches the high 16 bits of the address when asserted. Because the N64 carts have internal address decoding they won't respond at all until addressed - and suppressing the high order ALE line (which is the first to be asserted in every memory cycle) will prevent the cart from detecting any access - so depending on which cart the PAL routes the signal to it can control which ROM chip responds.

    The biggest issue I can see with simplifying this is figuring out what the PAL on the protected card decoder PCB is doing.
     
  9. Seeds

    Seeds Member

    Joined:
    Aug 21, 2012
    Messages:
    13
    Likes Received:
    6
    Thank you!
    Thank you, I find the best way for me to learn is to just dive right in and challenge myself, my next project is an RGB mod on a smoke funtastic console and I really didn't want to mess that one up first try (The console I bought of from ebay in extremely good condition).
    I would gladly pay that price for a broken CD64!
    I own an everdrive 64 V3 and I would consider myself a bit of a collector as well. I cherish my CD64 and have had it for a long time, if I were to sell it, it would be for a much more higher value then $500. The unit and motherboard itself is in still pretty good condition. If I were on the lookout for a new CD64 (as a collector and retro gamer) I would pay more for this modified unit, as the protected cartridge decoder is a horrbile after thought as I'm sure the most CD64 owners would agree. My CD64 now functions like the manufacturers should have made it from the start. People used to install fan modifications back in the day to extend the life of the CD64 and would sell for a higher price then an unmodified unit. The difference with my mod is I am not cutting away or messing around with the shell and if someone really wanted they could very easily remove everything I have done. That being said, anyone want to sell me their broken CD64?!!!
    I have installed an UltraCICII chip, is there something you have in mind?

    Thank-you! I still have the CD64 mostly apart, I will look into this for you sometime during the week.
    EDIT: I am a pretty impatient person myself so out of empathy I took a picture for you right away. I posted it to your post. You should be able to find a compatible regulator on ebay no problem now.
    Interesting, thank you! This makes some sense to me. If I had the know how I have no doubt in my mind I would be trying to figure out what this chip is doing, and how it works.
     
    Last edited: Dec 24, 2016
  10. BimboBoop

    BimboBoop Rapidly Rising Member

    Joined:
    Jul 7, 2016
    Messages:
    84
    Likes Received:
    12
    Awesome dude collection dude, I am so sad finding your post within a month the site will close. I own a couple of working CD64 plus and I owned a couple of parallel cartridge adapters, but I sold one. I also used them to load some pals games directly to my NTSC U console, but I never was able to load the Taz pal exclusive one. But I never was able to found a DS1 ram card ( And I am still looking for one until now) or even more that Super game saver , that I never heard before. I wonder if you were able to finish your project here.
     
  11. Domspun

    Domspun Spirited Member

    Joined:
    Mar 25, 2016
    Messages:
    195
    Likes Received:
    43
    The site was suppose to close a monthe ago, so nobody knows when it's gonna close. Enjoy it while it last!
     
  12. BimboBoop

    BimboBoop Rapidly Rising Member

    Joined:
    Jul 7, 2016
    Messages:
    84
    Likes Received:
    12
    Dude thats saddest than the dead of Tony Stark
     

Share This Page