cartridge | The Amstrad CPC news portal

Bryce announced the MITM (man-in-the-middle) cartridge adapter, which sits between a Plus cartridge and the Plus. With this adapter, you just need an original cartridge with an ACID protection chip which is directly connected to the CPC, but it will read the contents of the EPROM on the adapter. Maybe you know the same principle from playing Super Nintendo games from foreign countries – they used such an adapter to bypass the protection chip, too.

You can find an [[MITM|article about the adapter]] in the CPC Wiki. The schematics and layout will follow soon.

I already wrote a news article about the search on how to decrypt the ACID protection of the Amstrad Plus computers. Now NoCa$h, also known for his No$cpc emulator for DOS, received a Amstrad CPC Plus cartridge by Fano and decrypted the ACID protection of the cartridge within a few days. To do this, he desoldered the ACID protection chip from the cartridge and connected it to the printer port of the PC. With a small program he sent data to the chip and tried to find a way to reproduce the signals of the chip. He found an algorithm which produces the same sequence.
With the decryption of the chip, the last big unknown mystery of the CPC is now resolved. In the future we can produce new cartridges for the CPC Plus and maybe someone will develop a reprogrammable cartridge.

You can find the pseudocode in the thread about the ACID protection in the CPCWiki forums and this information will also be included in the [[ACID|CPCWiki article about the ACID protection]] in the future, too.

;ACID reverse-engineered 13-16 February 2010 by nocash (Martin Korth)
;below is repeated on every CLK cycle...
CmpVal=13596h, XorVal=0c820h
if PinA0=1 then CmpVal=CmpVal XOR 0000ch, XorVal=XorVal XOR 00004h
if PinA1=1 then CmpVal=CmpVal XOR 06000h, XorVal=XorVal XOR 06000h
if PinA2=1 then CmpVal=CmpVal XOR 000c0h, XorVal=XorVal XOR 00080h
if PinA3=1 then CmpVal=CmpVal XOR 00030h, XorVal=XorVal XOR 00020h
if PinA4=1 then CmpVal=CmpVal XOR 18000h, XorVal=XorVal XOR 08000h
if PinA5=1 then CmpVal=CmpVal XOR 00003h, XorVal=XorVal XOR 00000h
if PinA6=1 then CmpVal=CmpVal XOR 00600h, XorVal=XorVal XOR 00000h
if PinA7=1 then CmpVal=CmpVal XOR 01800h, XorVal=XorVal XOR 00800h
if PinCE=0 AND (ShiftReg OR 100h)=CmpVal then ShiftReg=ShiftReg XOR XorVal
NewBit=ShiftRegBit0 XOR ShiftRegBit9 XOR ShiftRegBit12 XOR ShiftRegBit16
ShiftReg=(ShiftReg SHR 1) + (NewBit SHL 16)
Wait for falling edge on PinCLK
if PinCCLR=0 then ShiftReg=1FFFFh      ;\done at falling CLK edge
PinSIN=ShiftRegBit0                    ;/
;Mind that above is a software example - a hardware solution obviously
;wouldnt require CmpVal and XorVal registers - instead, hardware would
;directly deal with the PinAx (or NOT PinAx) signals.

MITM cartridge adapter

ACID protection decrypted