MM2758Q : The world has gone mad... too many bits!

[NivagSwerdna]

I am just starting to look at an arcade game repair and on the board are a set of ROMs, it's a bootleg board and probably a conversion of a previous bootleg so the provenance of the chips is unknown...

Anyway in one socket I have a ROM that is marked MM2758Q... it's rather fancy with shiny gold legs... now looking at the datasheet the MM2758 is a 1kx8 device but I'm pretty sure that the game actually requires 2kx8 at this position... 

Now the only difference between a MM2758 and a 2716 is pin 19 with is A10 on a 2716... on the MM2758 this pin should be a chip select with active LO for the MM2758Q-A.

So... why when I read it as a 2716 can I get 2k bytes out of the device!  It has double the capacity it should!!!  It reads reliably... every time... SHA-1 hash 472038dedfc01c995be889ea93d4df8bef2b874c matches the 2k ROM image which should be in that position in the game.   

This cannot be happening!!!!

Code: [Select]

0000 : 00 cd 27 38 3a 3b 82 fe 04 da 24 38 3a 3c 82 b7 c2 24 38 3a 9b 80 3c 32 9b 80 af 32 26 82 32 27 
0020 : 82 cd 96 39 cd 10 03 00 cd 61 3d 3a 2d 82 b7 ca 36 38 3d 32 2d 82 00 3a 26 82 21 27 82 b6 c2 9a 
....
07C0 : a7 20 ad 0e 20 21 00 98 79 c6 2f 77 2c 20 fa 3a 00 b8 26 98 79 c6 2f be 20 0c 2c 20 f8 3a 00 b8 
07E0 : 0d 20 e2 c3 ad 00 21 00 98 af 77 2c 20 fc 3e 03 c3 41 3f 7f ff ff ff ff ff ff ff ff ff ff ff f

SHA1 Hash: 472038dedfc01c995be889ea93d4df8bef2b874c
Identified as: m7.bin

This chip looks so genuine and old and crusty.... is it really a 2716 pretending to be a MM2758?

I removed the label and took some photos...

[Benta]

Sure. Standard procedure, even today.
A 2K x 8 with dodgy bits will be relabelled as a 1K x 8 that's fully functional (the dodgy part set to non-functional).

That yours reads great doesn't mean that it will at +70 deg C, or at marginal supply voltage.

[NivagSwerdna]

I used my rather inadequate USB microscope for a die shot... and look what we see...



So the question is... is this original or is it a black top?

And... how on earth did the person who programmed this know that they could squeeze double the number of bits in?  (Definitely a violation of the datasheet?)

[nctnico]

Maybe the  MM2758Q is the 2kB version. It obviously has different pins functions. Unfortunately I don't have any old datasheet book at hand (stored somewhere or thrown out) to see if I can find something more.

[amyk]

Maybe the  MM2758Q is the 2kB version. It obviously has different pins functions. Unfortunately I don't have any old datasheet book at hand (stored somewhere or thrown out) to see if I can find something more.

No it's not.

The datasheet says that pin A10 is "AR" or "select reference input level", and that depending on the -A or -B versions should either be tied high or low, but no further mention of that pin. The phrase "select reference input level" also shows up in Intel's datasheet and may have been the original source, but even there, the amount of information about that pin is very low.

Digging further, the story unfolds: https://www.cpushack.com/2016/11/22/more-eprom-die-fun/

tl;dr: many 2758s are actually 2716 with half the die defective. Maybe people found out that "defective" means that some bits are stuck, and for the specific ROM they wanted to put on there, they were stuck in exactly the right way.

Given the amount of cloning going on with arcade games, I suspect this might've also been an attempt at rudimentary obfuscation --- "it's a 2758, so I'll read only 1K of the ROM".

[BrokenYugo]

tl;dr: many 2758s are actually 2716 with half the die defective. Maybe people found out that "defective" means that some bits are stuck, and for the specific ROM they wanted to put on there, they were stuck in exactly the right way.

Given the amount of cloning going on with arcade games, I suspect this might've also been an attempt at rudimentary obfuscation --- "it's a 2758, so I'll read only 1K of the ROM".

I wonder if 2758 was cheaper than 2716, and how large the supply of half bad 2716s was compared to demand for the 2758, it may be that most 2758s are really full function 2716s and this was just a cheap trick. Sounds like something a bootlegger would do.

[NivagSwerdna]

Given the amount of cloning going on with arcade games, I suspect this might've also been an attempt at rudimentary obfuscation --- "it's a 2758, so I'll read only 1K of the ROM".

This board is really the lowest of the low... it was a bootleg to start with and then converted for another game.  I think the converter just used what they had lying around. 

In my googling I found a random seller listing.... http://4sale.sbszoo.com/ic_eprom.htm

On that page it puts MM2758Q-A etc down as 4k x 8 i.e. 32k bit.   What's going on!  Doesn't anybody read the data sheet!!!