LINDBERGH BASE BOARD HARDWARE DEBUGING

Naomi & all other arcade tech questions forum
Post Reply
OldFoo

LINDBERGH BASE BOARD HARDWARE DEBUGING

Post by OldFoo »

I receipt a lot of emails and PM's from people asking for trips for investigate how the Lindbergh is works.



Also two guys asked me if it's possible to recover the BaseBoards, after bad flashing, without the need of removing the Flash memory from the PCB.



The answer to this is Yes, is possible to reflash the motherboard without removing the flash memory from the PCB.



The Baseboard uses a Freescale MPC8248 that is a QUICC II Security Microcontroller.



The core is basically a Power PC 603.



The MPC8248 has and embeded JTAG Debug Port, the interface is a bit different of the standard JTAGs on the market, the interface is called by Freescale JTAG / COP and uses a standard 16 pins header (8x2) male in the PCB.



There is only one lowcost tool available and is the USB TAP from Freescale, exactly is the part number 900-75115.



The Baseboard of the Lindbergh has embeded the JTAG /COP interface but is necesarry to solder an 8x2 pins male connector in the PCB.



Instead of put a 8x2 male footprint on the PCB, Sega has hidden a bit the position of the JTAG connector.



One year ago, at begining of my investigation, i suspect that the JTAG signals will be available on the right side of the PCB on the 3x10 pins array.



FIrst i suspect that the JTAG signals will be random ordered so i decided to sacrify a Baseboard PCB and i remove the Power PC from the PCB, to easely trace the signals.



See the picture:



Image



Then i saw that the Jtag pins are on the left side and aligned to the top.



To make things a bit more difficult, Sega has put some series resistors on the JTAG/ COP lines, and they are not populated.



For reconstruct the JTAG interface is only necesary to mount from R22S to R27S with a value to 10 to 47 ohms in footprint 0603.



Here some pictures of the interface reconstructed:



Image



And the soldering side, on the left near to the 30 pins array you can see the resistors that are necessary to mount, in total 6 resistors.



Image



One picture of the PCB attached to the USB TAP Interface:



Image



Image



Image



The interface working with VT3.



Image



And here you can see the code dumped with Codewarrior 8.2.



With Codewarrior you can read and write the flash memory....



An evaluation version of Codewarrior for Power PC Arquitecture can be downloaded from the Freescale Website.



Image



Is so nice the debugger that you can stop the Lindbergh Game and run thru the code and then resume the exectuion on the point you left it.



Later I'm going to make a video and i will uplaod it to Youtube.
Post Reply