← back to the Capcom custom chip sheet (85605-A-2 1/1)

The dirty board — PAL16L8 riser at 10M

MAME commandob, bootleg set 1 · daughter board in the custom socket
What the original chip does. Capcom's DIP48 at 10M sits between the program ROM and the Z80's data bus. On opcode fetches only (it watches M1/SYNC) it swaps the two 3-bit groups of the byte, leaving bits 0 and 4 alone: 
decrypted = (src & 0x11) | ((src & 0xE0) >> 4) | ((src & 0x0E) << 4)

   bit   7  6  5  4  3  2  1  0
   from  3  2  1  4  7  6  5  0        (bits 0 and 4 stay put)
Ordinary data reads pass through untouched. The permutation is its own inverse, so the same wiring works in both directions — which is exactly why a bootlegger can replace a custom LSI with a handful of TTL.

What is actually on the board

A small green daughter board plugs into the 48-pin custom socket at 10M. The photograph of this board shows, unmistakably, a DMPAL16L8NC (National, date code 8835), an SN74LS367AN (TI, Portugal 8522) and a third 20-pin device above them — the 74LS244. That is exactly what MAME records for commandob: “a 16L8A PAL (with a 74LS244P and a 74LS367AP) on a tiny sub-board… plugged on what seems to be a ROM socket.” The program ROM beside it is a single AM27256DC, so this board needed no ROM tricks.

THE DIRTY BOARD - PAL16L8 RISER AT 10M (MAME commandob, bootleg set 1) a daughter board in the 48-pin custom socket: DMPAL16L8NC + 74LS244 + SN74LS367AN COMMANDO 85605-A-2 CUSTOM CHIP REPLACEMENT the dirty board (reverse-engineered) reconstructed - not a Capcom drawing MEMORY SIDE CPU SIDE 9M 27256 PROGRAM 11 D0 12 D1 13 D2 15 D3 16 D4 17 D5 18 D6 19 D7 11M Z80 14 D0' 15 D1' 12 D2' 8 D3' 7 D4' 9 D5' 10 D6' 13 D7' D0 direct - never swapped D4 direct - never swapped PAL16L8 DMPAL16L8NC straight through 1 19 2 18 3 17 5 15 6 14 7 13 not an opcode fetch: unchanged 74LS367 cross-wired 2 3 4 5 6 7 10 9 12 11 14 13 read path DURING an opcode fetch -> the B-side wiring swaps the groups D1 <-> D5 D2 <-> D6 D3 <-> D7 CONTROL 9 /M1 10 /MREQ 8 -> PAL 4 6N/'08 12 ROM /CE 13 /RD 11 -> PAL 9 '08 5 /M1 6 -> PAL 8 11J/'14 74LS244 write path, 8 bits the '367 is unidirectional, so a separate buffer carries Z80 -> memory writes. PAL 12 -> '367 enables (pins 1, 15) decoded from the dumped fuse map (set 2 PAL): OE(D1'..D7') = P8 * P9 * P11 Dn' = Dn (a plain buffer) /OEbuf = /( P4*P9*( /P8 + /P11 ) )

How it works

The PAL was dumped on the sibling set-2 board and the fuse map decodes to something surprising: every data output is simply its own input (D1'=D1, D2'=D2…). The PAL is a plain tri-state buffer — it does not do the swap. The scramble lives in the wiring of the second buffer, and the PAL only decides which of the two may drive the CPU bus:

OE(D1',D2',D3',D5',D6',D7')   =  P8 * P9 * P11          Dn' = Dn
/OE of the cross-wired buffer  =  /( P4*P9*( /P8 + /P11 ) )
CycleWho drives the CPU busResult
Normal data readPAL outputs enabledbyte passes through unchanged
Opcode fetchPAL tri-stated, '367 enabledcross-wiring swaps the bit groups
Write'244 enabledCPU data out to memory

The '367 is a hex buffer — six channels, exactly the six bits that move. Because it only goes one way, a separate 74LS244 carries the CPU→memory write direction. Bits D0 and D4 are hard-wired straight across, matching the src & 0x11 term that leaves those two alone.

Why this board's ROM differs by one byte

MAME runs this set through init_spaceinv — decrypt everything, including the very first opcode fetch — so its ROM stores byte 0 pre-encrypted:

Boardbyte 0 storedCPU executes
Capcom original3E raw3E = LD A,n
this boardF2 encryptedF2 → 3E

That byte is the fingerprint of an always-on decryptor, and it is how this board was identified: the ROM burned during its repair is byte-identical to MAME's commandob_04_9m_27256.bin (CRC 348A7654), which differs from the original cm04.9m in exactly that one byte. The clean board goes the other way.

Provenance

photographed The riser and its three chips, on this board.
measured PAL equations decoded from commandob2_pal16l8.bin (CRC BDBCAF02) — the sibling set-2 device; this board's own PAL is not dumped in MAME.
documented The riser parts list, from commando.cpp.
deduced The cross-wiring, and the split of roles between '367 and '244 — forced by the logic (the PAL path is straight, the '367 has exactly six channels, and something must carry writes), but not traced pin by pin.

Commando reverse-engineering project · generated by Web/gen_variants.py