
                       Disabling the NES "Lockout Chip"
                       ================================

Introduction

This document details a simple modification that can be performed on a
Nintendo Entertainment System video game console in order to remove the
"lockout chip" protection system.

Why might this be needed? Well, here are several reasons:
 To play unlicensed games which can't be played on the current model of NES;
 To play foreign games & currently have no adapter system. For example, after
  performing the modification, most European games can be played on a
  U.S. console & vice-versa.

The procedure given here should work for ANY old design NES (i.e., any front-loading
model). The new NES design (the NES2) doesn't have a lockout chip anyway.

With this modification, all PAL games (European, Hong Kong or U.K.) can be played on
all PAL consoles & all NTSC games (North America) can be played on all NTSC consoles.
However, not all PAL games are compatible on the U.S. consoles & vice-versa.
Some games are incompatible with the different display standards. Examples of
this are High Speed, Pin Bot (both of which hang the console), Time Lord, Digger T.
Rock & various other games developed by Rare Ltd. However, the majority of games do
work fine.

This procedure has been reported to work on a U.S. model NES, revision
NES-CPU-11.


Background

Before the NES was first released in the U.S.A., Nintendo developed a system
for preventing the use of unauthorised software with it. A lot of counterfeit
software had apparently been produced for their Famicom (Family Computer) game
system, & Nintendo wanted to avoid this happening for the NES.

Another benefit (to Nintendo, at least) of the system was that legal third-party
development was severely hindered. Only Nintendo licensees could buy the
lockout chips, one of which was fitted inside every game cartridge. Licensees
were apparently charged around US$9 for each chip.

Some companies managed to get around the lockout system & produce their own
unlicensed games. Examples of this are Active Enterprises, Codemasters/Camerica,
Color Dreams & Tengen (though Tengen's system was ruled to infringe Nintendo's
copyright on the "10NES" firmware program, the program inside the lockout chip).
Macronix Inc. filed U.S. patent 5,004,232, which details a method for
getting around the lockout.

However, during the life of the NES Nintendo periodically modified the console,
meaning that some unlicensed games no longer worked. For example, "Action 52"
& "Crystal Mines" do not work on a U.S. NES. If the NES has board revision
NES-CPU-11, it will be unable to play these games without modification. Disabling
the lockout chip solves this problem.

Nintendo also used the lockout system to provide a "territorial protection".
This means that European games can't work with a U.S. console & vice-versa. At least
four different types of lockout chips are used in U.K., European, Hong Kong & U.S.
machines. A cartridge with one type of lockout chip is incompatible with a console
containing any other type.


How The Lockout System Works

This is a very brief description. Consult Nintendo's patent for detailed
information.

Identical chips are fitted to the console & inside every game cartridge.
Depending on whether a certain pin (pin 4) of the chip is grounded or at +5V,
the chip functions as either a lock or as a key. Inside the console, pin 4 of
the lockout chip is at +5V (lock), & inside the game cartridge pin 4 is at 0V
(key).

When the NES is turned on, the CPU & PPU are held in a reset state. The two
lockout chips talk to each other. Since the chips are identical, they should be
saying exactly the same thing at exactly the same time. Each chip compares its
output with that of its counterpart. If they match, the lock chip releases the
reset state of the console, & the game can start. The two chips still talk to
each other, & if the outputs of the two chips ever differ, the lock chip
causes the console to repeatedly reset, & the key chip inside the game
cartridge may use the chip select lines of the cartridge ROM chips to disable
them (though this disabling of the ROMs was probably never done).

The lockout chip is in fact a 4-bit, 16-pin microprocessor with its own internal
ROM & RAM. The program in the ROM is called "10NES" & the microprocessor's product
number varies from nation to nation.

The microprocessor's product numbers are as follows

  3193A  USA
  3195A  European
  3196A  Hong Kong
  3197A  UK

In any case, the chip will always have a product number that is 5 characters long &
ends with an A. It will also say  198X Nintendo.


How The Modification Works

This depends on changing the lock device to think that it's actually a key. If
both devices are configured to be the same type (i.e., both keys), to quote
Nintendo's patent "an unstable state takes place & no operations are
performed at all."

This means that the two chips will do nothing. So the console will not be
reset, & the key device will not disable the cartridge ROM chips.

To carry out the modification, disconnect pin 4 of the lockout chip,
& connect this pin to ground (0V) instead. If the entire pin breaks off, don't
worry. This has the same effect as connecting the pin to ground.


Performing the Modification

The following tools are needed:
 A crosshead screwdriver suitable for opening the NES case & removing the
  screws inside;
 A very sharp, very small knife, side cutter or razor blade to cut the IC pin
  - a two-sided implement (e.g. a side cutter) is preferable to a knife;
 A soldering iron & solder, & optionally some desoldering braid;
 A short length of thin insulated wire, with the ends stripped of insulation -
  2cm is enough.

When removing screws, remember which type goes in which hole!

Here are step-by-step instructions:
1. Remove the six screws from the base of your NES & lift off the upper part
   of the case.

2. Remove the seven screws which attach the upper metal shielding of the PCB,
   & remove this shielding.

3. Remove the two screws from around the modulator. One is to the left of the
   RF jack, the other in front of the A/V jacks.

4. Remove the six screws which attach the cartridge tray to the PCB, case &
   black plastic connector. Note that the "middle" pair are different to the
   others - they are longer, & a silver colour.

5. Now gently lift the PCB, cartridge tray & lower shielding up out of
   the case. Remove the leads from the controller ports & power/reset switch
   PCB, & remove the lower metal shielding.

6. Slide the cartridge tray forwards, lifting it away from the PCB &
   connector. You can leave the connector attached to the PCB.

7. Turn over the PCB, with the component side up & the black cartridge
   connector towards you.

8. Note the PCB revision. It's printed in white ink near the centre of the PCB.
   For example: "NES-CPU-11". There is a white sticker on the PCB which tells
   the type of console at hand. For example, my U.K. model says "PAL-MTL"
   (MTL is short for Mattel). An American console says "NTSC", & a Hong Kong
   console says "PAL-ASI" (ASI is probably short for Asia).

9. Find the lockout chip. "U10     CIC" will be printed above it on the PCB.
   (The U number is not relevant; "CIC" is.) The lockout chip on should have
   the following text printed on it:

                                    3193A/3195A/3196A/3197A
                                  198X Nintendo

    Note that the chip has 16 pins.

10. Locate pin 4 of the lockout chip. To do this, turn the PCB so that the writing
    on the chip is right-side up. Then, starting from the lower-left corner of the
    chip, count the first pin as pin 1 & keep on counting up to pin 4.

11. Cut this pin, & bend it up & away from the PCB. If something goes
    wrong & the entire pin breaks off, don't worry - see the  "How the Modification
    Works" section. It may help to desolder the pin first; desoldering braid can be
    used for this. Try & cut as close as possible to the PCB, so that a decent length
    of the pin is left attached to the chip.

    A neater way of doing this would be so desolder the entire chip, bend out
    pin 4, & resolder the chip, leaving pin 4 sticking out. However, this is
    quite difficult without special IC removal tools.

12. This step is optional. Things seem to work fine with pin 4 left
    disconnected. But one ca connect it to ground.

    Solder the length of wire from pin 4 to ground. Suitable places to
    connect to are pins 11, 12, 13, 14 or 15 of the lockout chip, since these
    are all grounded. If the PCB is turned in such a way that the writing on the
    chip is right-side up, pin 15 is on the top row & is the second from the
    left.

13. That's it! It's a good idea to test the NES before fitting it back together.
    Put the PCB back in the case & connect the power & controller
    connectors. Slide the cartridge tray into position, making sure the lip is
    below the PCB. Put a game cartridge in & switch on. Hopefully everything
    will work! To check whether the lockout chip has really been bypassed,
    switch on with no cartridge inserted. There should just be a blank screen,
    with no 'flashing' effect.

14. Now reassemble the console & enjoy the new "universal" NES!