Motorola MC68705P5

The MC68705P5 is one model of a family of microcontrollers from Motorola. It has 1804 bytes of EPROM and 112 bytes of RAM.

I was able to electronically dump the EPROM using non-user mode. I used a 1 MHz clock on the EXTAL pin with XTAL grounded, tied /RESET, /INT and TIMER high, and connected PC0 to 7.5V via a 1K resistor. I tied the PORT A pins to +5 and ground using 8 1K resistors to set it to $9D, the opcode for NOP. The entire 2K address space contents were output on PORT B, including the I/O ports, RAM, EPROM and bootstrap ROM; I captured the bytes using a logic analyzer.

Here are some pictures of the ROM dumper and a schematic.

In NUM, the chip outputs address information, fetches an opcode from memory as normal, outputs that opcode, then executes the opcode input on port A. Since the resistors feed it NOPs, it just keeps fetching the next byte and outputting it, dumping all of memory. The address info that's output is a permutation of 8 of the address bits; additional information is output on port C<3:1>.

I erased and reprogrammed the chip, using a PIC 18F46K22 in place of the EPROM and counter circuit that the datasheet describes. It takes 82 seconds to program the chip and less than 1 second to verify. I burned a small program that outputs the accumulator to port B, then increments it and loops. I set the SNM bit to set secure non-user mode, and the EPROM contents were no longer output when I tried to electronically dump them; instead, the programmed code ran normally. But then I shined a laser pointer into the erase window and the chip glitched into NUM and dumped the ROM.

MC68705P3 is identical except that it does not have the SNM bit to secure non-user mode.