Reading Mask ROMs – With Python image processing

Mask ROM

Users of the Python programming language often say it can do anything, and that may just be true.  Microcontrollers through out their history have had a variety of ways to store the programs they run.  Unlike a microprocessor, a microcontroller typically has a fixed, or somewhat fixed, program that it runs.  This program is often referred to as firmware (its not software, as its cant easily be changed, and its not hardware as it isn’t discrete chips, thus firmware).

There are several common ways to store firmware:

• UV-EPROM: The microcontroller has a UV-EPROM as part of its die (or in some cases separate but on the same package).  This can be programmed using higher voltages, and erased/updated, albeit not in the field.  This was popular in the 80’s for prototyping work.
• Flash (or EEPROM):  This replaced UV-EPROM program storage as it was update-able in circuit, allowing for such things as user BIOS upgrades, updating firmware on CD/Hard Drives etc.  This has become fairly standard for any firmware that is likely to need to be upgraded in the future.
• 

  Intel B2616 – Unless you clean the paint off

  OTP: One Time Programmable Read Only Memory is useful for medium to large scale production runs.  This allows the code to be ‘burnt’ onto a chip prior to shipping. Often all these were were UV-EPROM chips in a plastic package.  Early Intel’s even used UV-EPROM chips, and simply painted over the window.  a 2708 UV-EPROM became a 2608 PROM with the simple application of some nail polish.  There has been some experimentation and success in erasing/reusing these with the use of X-Rays. (they can penetrate the plastic package).

• Mask ROM: A Mask ROM is just as it sounds, the program code is actually added to the actual mask itself when making the microcontroller die.  This is the most economical  and reliable for very large production runs.  Obviously one wants to make very sure the code is correct before cutting a mask with it, masks are expensive, and manufacturers are not keen on giving do overs.   In 1978 Intel charged $1000 Mask fee, and a minimum order of 100 units for an 8k ROM (~$10).   By 1986 that Mask fee had risen to $3000 and min units to 1000.

So what happens when 20+ years later you need to figure out whats ON a mask ROM?  The paper tape, 8″ floppy or punch card the program original was stored on is long since gone.  Being that its a mask ROM one can actually SEE the connections, so its possible to decap a device, and visually determine the code, albeit with a lot of tedious work.  Adam Laurie of Aperture Labs developed a Python script to automate some of it, and wrote an article explaining it, which covers some every interesting Mask ROM info.  Not to mention some very nice pictures, so check it out.