PAL Brute Forcing

Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on very simple devices.

readpal

http://techno-junk.org/readpal.php

Summary:

• An EPROM like adapter to enable brute forcing using COTS programmers
• Fast since it uses standard algorithms
• Doesn't handle registers
• Reference post processing workflow

This approach does not work for the following devices:
All registered PAL devices. (PAL16R4, PAL16R6, PAL16R8, etc.)
All GAL devices configured to be registered. (GAL16V8, etc.)
PEEL devices (18CV8, etc.) which have a different architecture than PALs/GALs.
Non-PAL or GAL devices (82S153, PLS153, etc.) which have a different architecture and pinout than PALs/GALs.

http://techno-junk.org/readpal.php

• https://github.com/pascalorama/paldumper
• Eagle design files provided for EPROM adapter
• Windows binary provided to analyze EPROM into equations

DuPAL

https://github.com/DuPAL-PAL-DUmper

Summary:

• Hardware + software toolchain for copying PAL devices
• As a stand alone solution, board is much more complex than readpal
• More powerful than others?

pal866

https://github.com/JohnDMcMaster/pal866/

Summary

• FOSS tl866 software to read out PAL16 family devices
• Registered PAL WIP
• Doesn't require any adapters

Test vectors

"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"