Reversing the asciiPad SG-6 serial link (part 2)
Tags: reversing, electronics
Published: 2022-07-24 23:42:45

_This is a writeup I've moved here from my personal website. It was originally published on 4/13/19_

So remember how I said you could probably just hook your controller up to a bench power supply? Yeah, don’t do that. It’s a no-go. Apparently the Sega controller receives a clock signal from the Sega that drives some of the pin output. The controllers for the Sega Genesis don’t behave at all like the pinout I showed you yesterday. This is what a good trace of a stock Sega Genesis controller looks like:

![logic-1](https://dev-to-uploads.s3.amazonaws.com/i/0ugiq24x0mqok8a9wl1w.png)

Let me explain how I learned this.

This morning I woke up energized and ready to go (masala chai tea for the win!), so I tackled the issue of getting the Sega to actually output video to a TV. While I was twiddling the video cable I learned something exciting.

![sega-loose-connector](https://dev-to-uploads.s3.amazonaws.com/i/4w69bssw5d9416acbt7x.jpeg)

My Sega’s video output now comes in two pieces! Lovely. I futzed with this a bit until it fit snugly back into its housing. This resulted in a sort of okay video output to the TV. I could at least see that the game was booting up and enjoy visual feedback when I pressed controller buttons. I decided it was time to eliminate some variables and go back to the baseline — I hooked up the stock controller.

![logic-2](https://dev-to-uploads.s3.amazonaws.com/i/qicc2cq9hhxeuri0kiqm.png)

![logic-3](https://dev-to-uploads.s3.amazonaws.com/i/vx9df7tim1u8ozhd1you.png)

Without pressing any buttons, we get three lines with an even clock signal. This was way different from what I saw yesterday messing with the asciiPad. It could be a difference in the controller, but it could also be a result of having a game loaded. I rebooted the Sega and took a trace of it at startup to see when the clocked signals appeared. If they appeared as soon as the controller got power, it would be likely that the controller was generating the clock and sending it to the Sega. But if there was a delay between when the lines went high and when they gained a clock, it was more likely that the clock was a result of the game being loaded, and therefore generated by the Sega and sent to the controller.

![logic-4](https://dev-to-uploads.s3.amazonaws.com/i/pdag9lsj3sfl7pb2n8o2.png)

Sure enough, we see the latter case. For further sanity checking and information gathering, I replaced the OEM Sega controller with the asciiPad after bootup and took a trace while pressing buttons.

![logic-5](https://dev-to-uploads.s3.amazonaws.com/i/ae9xbkkwmxo96aq9i4rp.png)

This is a logic trace with clock, and a number of button presses in order of: up, down, left right, z, c, x, y, a, b, start, mode

We still see the clocked signals, which continues to support the idea that they’re coming from the Sega. But more than that, check out what happens when you press buttons! With the clock, we can actually see many of the buttons that were missing yesterday. You’ll note that the standard buttons exactly match the trace with the stock controller, but we get one additional button here that we didn’t have there — we have Z, which apparently drives all of the clock lines (and possibly just all of the lines in general) high. This is interesting because without a clock signal, other button presses like Start should not be possible.

X and Y are still missing from the trace. It doesn’t make sense to me that the AsciiWare folks would put non-functional buttons on the controller unless they used this controller interface for other systems too. In that case, it’d be a cost savings for them to only manufacture one controller and program the chip inside with whatever logic it needed to interface with the game system it’s marketed for. I could do some research to try and figure this out, but I had another theory I wanted to poke at first.

Recall the trace of the lines at bootup. There’s a little blip at the beginning that’s separated from the rest of the uniform clock signal. This could be the Sega telling the controller “hi, I’m here.” It could just be noise. But it’s definitely different from the rest of the trace. I zoomed in on it, and saw something weird.

![logic-6](https://dev-to-uploads.s3.amazonaws.com/i/6hlz13vvxd5ak3e27r5o.png)

The clock signal after this “blip” has pairs of short pulses instead of the usual single pulse. I thought maybe it was an anomaly in the reading, but when I took another, I saw the same thing. The double pulses continue for quite a while, about 8 seconds, before they switch to the single pulse.

This got me thinking, do different games have different bootup behavior with respect to the clock? I’ve got a plethora of old Sega games, so I went to town plugging and unplugging them, taking traces of their behavior at bootup (only cursing occasionally as I blew into cartridges and enjoyed all of that old-timey dust-and-electronics smell). Here are a few traces just for your viewing pleasure.

A Sonic 2 bootup trace:

![logic-7](https://dev-to-uploads.s3.amazonaws.com/i/17tvnc4zdvsgpob3s3yu.png)
 
NFL 95 bootup trace:

![logic-8](https://dev-to-uploads.s3.amazonaws.com/i/qv5qoeuadjqe7ct8c3ry.png)

Lion King bootup trace:

![logic-9](https://dev-to-uploads.s3.amazonaws.com/i/q0nf7guled8wh01igzm9.png)

NHL Hockey bootup trace:

![logic-10](https://dev-to-uploads.s3.amazonaws.com/i/ovzkphrf4m9o1xzklkwp.png)
 
Beyond each game having their own unique clock bootup shenanigans, they also clock different lines, and clock them inconsistently. Check out this zoomed-in view of the NFL 95 game. This is one clock “pulse” as it appears on several different lines.

![logic-11](https://dev-to-uploads.s3.amazonaws.com/i/ghh4ffv2j18ryh5t3ocp.png)

Since NFL 95 drove clock signals over more lines, I decided to see if I could find my missing buttons in them. I didn’t, but I did find a few other interesting things. First, when running NFL 95 it seems (under most circumstances) pressing a button related to a clocked line doesn’t remove the clock signal from the line. This is different from other games, where pressing a button makes a clocked line steady at 5v or ground. The exception to this is when you press Start. In this case, we see a single pulse on pin 9, and then all of the lines are drive high for about a second, including pin 9. The duration of the silence on the lines is not dependent on how long you hold the start button.

![logic-12](https://dev-to-uploads.s3.amazonaws.com/i/ww9j8eki2d6eew1nnpzd.png)

![logic-13](https://dev-to-uploads.s3.amazonaws.com/i/w2nedfncybettrh3k0x6.png)

It’s hard to tell whether the game is intentionally removing the clock from the lines in order to prevent button presses from registering (if the controller doesn’t have a clock signal, it can’t send most button signals, as we saw yesterday) or if it’s a side effect of some processing going on in the Sega. Either way, it seems that the way the Sega handles the controller coms is completely dependent on the game. This is cool because it means a game developers can ship their own unique equipment to enhance a game if they want to, without being tied to the template provided by Sega — but it’s also annoying for anyone who wants to manufacture a controller for the game, because it means there is no guarantee that it will actually work with all games.

![cartridge-1](https://dev-to-uploads.s3.amazonaws.com/i/ig5hj3fhlalf78tdowzq.jpeg)

![cartridge-2](https://dev-to-uploads.s3.amazonaws.com/i/vbybtkb6jr9y6cv1jkvw.jpeg)

![cartridge-3](https://dev-to-uploads.s3.amazonaws.com/i/yrhb843ud6629lrt2dki.jpeg)

![cartridge-4](https://dev-to-uploads.s3.amazonaws.com/i/sclyrjk0w9z0r47necce.jpeg)

They’re about what I expected. There’s a package that is probably just storage that the CPU on the Sega reads in order to get the game’s program. The only thing that surprised me was that the game name is printed right on the chip — that suggests a custom run of these chips just for that cartridge.

The [RetroShock](http://retroshock.bplaced.net/mdg.html) project has a ton of information about individual cartridges, including which chips are used in which games, and the pinouts used by the different cartridges. The two photos I took are of cartridges that use the same pinout, but there are several different schemes, with some using all of the pins available on the 64-pin header and some using only a few.