# PS1 Power Replay Datel clone - RE Notes

## Introduction

I found one of these cloned Datel cheat carts for PlayStation 1 in a box of junk at a flea market.
I decided to reverse engineer it just for fun, and maybe to build a better variant of it.

![Screenshot of the traced PCB](pics/traced_board.jpg)

## Hardware

### Memory map and protocol

Information on the protocol can be found [here](https://psx-spx.consoledev.net/cheatdevices/#cheat-devices-datel-io), but here is the basic memory map of this device:

```
  1F000000h-1F01FFFFh R/W Flash (first 128K)
  1F020010h           R   Comms Link STB pin state (bit0)
  1F020018h           R   Switch Setting (bit0: 0=Off, 1=On)
  1F040000h-1F05FFFFh R/W Flash (second 128K)
  1F060000h           R   Comms Link data in (byte)
  1F060008h           W   Comms Link data out (byte, pulses ACK to Comms Link)
```

## Notes

The PCB was fully disassembled, scanned, and traced to reconstruct the schematic.
It's a simple dual-layer board containing a diode, a PLD, an EEPROM and a transceiver, plus a few passives.

### Power regulation

While the PCB has provisions to fit a 78L05 voltage regulator plus filter caps, the actual regulation on
this board was cheaply hacked together using a 5.1V Zener plus a 150 ohm resistor for current limiting.

### EEPROM size

The EEPROM used on this board is a PLCC AM29F010, 128KB. The Board is wired in a way that a 29F020 can be installed and the a second bank of 128KB used.

### PLD

A GAL16V8B provides signal decoding to enable the transceiver, EEPROM, read the state of the STROBE signal on the DSUB-25 connector and of the sliding switch.

This IC was protected on my board, so I proceeded with an analysis of the signals and their combinations.
The results can be seen in the `PLD` directory, and **have not been tested yet**. Interestingly, while connected, the A20 line seems to be ignored in all the calculations performed by this PLD.