DuPAL - A dedicated toolset for reverse engineering PAL/HAL SPLD's

[Kai Robinson]

If like me you're into the reverse engineering of stuff like the SPLD PAL/HAL chips used on early 68k macs, you might be interested in this - DuPAL

DuPAL - PAL Reversing Tools

Collection of tools I use to reverse engineer PAL devices. These tools are meant to satisfy my needs. I'm sharing them here in case someone finds them useful. - DuPAL - PAL Reversing Tools

github.com

It's not just software, it's also an open source hardware project you can build yourself. Once assembled, you put a PAL chip into the board, run the software, and essentially it should 'reverse' the chip functions for you.

It's been possible to reverse PAL's previously, but generally only devices which are purely combinatorial in nature, not registered ones - DuPAL does all of these:

Combinatorial

• PAL10L8
• PAL16L8
• PAL20L8

Registered

• PAL16R4
• PAL16R6
• PAL16R8
• PAL20R4
• PAL20R6
• PAL20R8

 

[demik]

I build one of theses a while ago. It's not magical on complex PALs, like combinatorial ones with multiple feedbacks. But they do help.
Registered ones are better reversed using the DuPAL_Peeper tool than brute forcing with the DuPAL_Analyzer

Good stuff !

 

[Bolle]

Just as the readme on github says, this is by far not a tool to "dump" PALs at all.
It's more or a just a tool to assist manually rewriting equations to match existing PALs. (no need to say - it's great at that though)
So figuring out PALs using DuPAL still takes a lot of time, effort and knowledge about the circuit it's sitting in (#3 not necessarily needed but it helps A LOT if you at least roughly know what's going on)

Most of the time it's just like demik already said, it's the combinatorial PALs that are hard, not the registered ones. On a combinatorial PAL with feedbacks everything happens asynchronously... depending on how things are set up there will be states that happen so fast (at the speed of the propagation delay of the device) that you can't see them while probing the device. In some cases (more often than you think) this turns out to be important, for example when you're working with timing sensitive components... DRAM control is what comes to mind and where I have seen exactly this happening in multiple different devices.
A registered PAL has strictly defined states that you can easily clock through and take notes of the changes and write equations or build truth tables accordingly. This is actually much easier.

 

[Kai Robinson]

Amended the title to better reflect the toolset