Sanguino based PAL reader

PAL shield

Inspired by the interesting blog of Chuck Guzis on reading and analysing PALs and HALs, I created this shield for my Sanguino board and some software (sketches in Arduino speak) to read some PALs I have.

The goal is to create a sketch for each type of HAL/PAL that results in a file that can be analysed, manually or by some smart program. Currently only the first part is being developed.

As HAL and PAL devices vary wildly in their pinout, no shield with a socket is used. Instead I use an experimenters board and a flatcable terminated with compatible pins. This means that for every type of PAL the reader has to be rewired, but for low volumes this is acceptible. It is also allows easy rearrangement of the pins.

PAL being read

Created so far are these sketches. Each sketch contains a rudimentary description of how the pins should be wired and the signals interpreted. The output is in text-binary (0s & 1s) format.

An example:

GAL16V8 read v1.1
B0, B1,  B2, B3, B4, B5, B6, B7, A0, A1, C0,  C1,  C2,  C3,  C4, C5,     C6,   C7
1   2    3   4   5   6   7   8   9   11  12   13   14   15   16  17      18    19

A0-A1,B0-B7  C0-C7
0000000000   1111111
0000000001   1111111
0000000010   1111111
0000000011   1111111
skipping some uninteresing stuff
1011111100   1111111
1011111101   1111111
1011111110   1111111
1011111111   1111111
1100000000   0111100
1100000001   1111111
1100000010   0111100
1100000011   1111111
1100000100   0110010
1100000101   1110110
1100000110   0111010
1100000111   1111111
1100001000   0101110
1100001001   1111111
1100001010   0101110
1100001011   1111111
1100001100   1111111

Tri-state detection

Quite a lot of PALs have tri-state capable pins. To detect this, two pins of the microcontroller are used, as shown on the diagram, one as output, one as input.

detecting tristate pins

By measuring the level at the PAL pin, both when pushing it high and pulling it low, a tri-state can be detected. If the pin follows the output, it is tri-state. If it remains stuck at one level it is an output. The PAL16R6 sketch has the tri-state detection. The current program does not try to detect the state itself, it just prints both levels. Note the difference between a tri-state output or 'buried' output pin and a input pin cannot be detected. Only if the analysis finds more terms are needed to describe the behaviour than would fit inside the PAL, some 'buried' outputs should be assumed.

Registered pins

Even some of the older PALs have pins that clocks a value in a register. For the PAL16R6 this happens on the transition from low to high. Every combination for the other input pins has to be checked in this order. Note it is not simple to find matching terms for registered PALs which also use 'buried' outputs.

Using this method to crack PAL based dongles is probably a waste of time.

Sketches completed

Additional remarks:


Last update: 2012-09-17