DECRYPTION AND REMOVAL OF SUICIDE BATTERIES
IN SEGA BOARDSETS

REPLACING THE BATTERY IN AN FD1094 - DECRYPTED ROMS

This page contains information and files to help you remove the dreaded "suicide battery" processors from Sega boardsets. The NEC was the first with a battery to be used on System 2 boards. Before that, Sega used custom Z80s, with mask encryption, that was still locked to the game, but had no battery component. The FD1089 was introduced on the Pre-System 16 PCB for Alien Syndrome, and was used through to the System 16B, where the FD1094 was then introduced. These were used extensively from around 1986, until 1992, when Sega decided to use more elaborate methods of protecting their software on the System 32 boardset with the FD1149 and non-battery custom chips, before giving up on protection altogether by the time they reached the Model 1.

For both processors, the data in the RAM cannot be read out (by normal means). The game ROMs are encoded with the same data, and therefore the processor is locked to the particular game it was written for, and cannot be copied. As the data in the game ROMs are encoded too, they will not work with a standard processor.

There are also two other variants of Encrypted processor found on Sega boards

There are two solutions to this problem, replacement of the battery in the FD1094, but this is only useful if the processor has not yet died, as if it has, there is no way to revive it. Secondly, and the much preferred option, is to replace the encrypted program ROMs with decrypted ones, that use standard processors. Both solutions are explained now.

REPLACING THE BATTERY IN THE FD1094

Firstly for the FD1094, it is possible to replace the battery, if you're careful. You can remove the top plate, being sure not to pull the battery out. There is a wire attached to the top plate underneath, but it can be left attached, and the plate pushed over to one side.

The FD1094 with the top plate removed, and pushed over.
You can see where the wire is attached to the top plate.

The FD1089 is easier to open, with a plastic cover.

The FD1149 cover is underneath, and also comes off easily, but replacement will be a pain!

The battery is equivalent to a 3 volt lithium CR2032, but there are tags soldered onto it, so you must either carefully solder tags onto a standard CR2032, or use one with tags already attached, such as RS 597-403 (Available from http://rswww.com). You must first attach a "helper" battery of the same type to the wires, keeping mind of the + and -. This prevents any data loss, as you remove the main battery. It would be extremely difficult to connect a helper battery to the FD1149, as the solder pads which hold the battery on don't leave enough for attaching wires to a helper. Solder the new battery in place, and remove the helper. Check the voltage before replacing the cover.

**PLEASE NOTE: You do the above procedure at your own risk. The instructions given here are for guidance only, and I can take no responsibility for any problems that may arise, though you can EMail me, and I will try to help if I can.

DECRYPTED ROMS

The best and most desired solution to the problem of "suicide processors", is to remove them from the equation altogether. To do this, we need to reprogram the EPROMs that contain the encrypted data with ones that contain standard code, that can be read by a normal processor. Some games exist in more than one version, and maybe one of the versions is not encrypted, such as Thunderblade. The Export version has the FD1094 with the battery, but the Japanese version uses a standard 68000, and is not different in gameplay or language to the Export one. We can therefore simply replace all the Export-specific EPROMs with Japanese versions.

For other games such as Shinobi, and Altered beast, where the encryption is in the Z80 which controls the sound, bootleggers that produced copies of the games succeeded in breaking the code, and we have copies of those images, which we can use to get rid of the NEC processor, and replace it with a standard Z80.

But most of the games remain well and truly locked. Work is not really progressing on this unfortunately, as it is seen as a somewhat low-priority task, and the FD1094s and their batteries seem to be very reliable, and very few actually die through battery failure. But die they will, and one day work will have to speed up to solve this problem. I have a few theories about getting the data table out of an FD1094, or even using it as a weapon against itself, to decrypt it's own ROMs, but that is something for the future.

Below is a set of links to .zip files, which contain "decryption kits". Each .zip file contains a set of instructions, and a set of ROM images, to replace the ones on the boards, and allow you to put a standard processor in place of the NEC or FD1094. There are not too many at present, because I will only post these up, as I have tested them. There is a lot of mis-information about what chip to put where, add to that the fact that it is sometimes difficult to locate the right image, and the work of removing a suicide processor remains awkward.

These images can be supplied on EPROM, along with a replacement processor for a small fee, if you do not have the means to burn them yourself. I will only supply them if you have an original version of the game already, and I will NOT supply complete game images on EPROM.

More will follow as I find them, and test them. If you know of any other fixes that work, and you have the images for them, please let me know, and I will add them to the list. The above files are NOT complete ROM images of the game, and only contain the files needed to remove the suicide processors.

For more information on suicide processors and battery encryption systems on other manufacturers boards, please visit The Dead Battery Society.

Back to home page