Making a Wombat Fast

Making a Wombat Fast

Or, how to bump your Centris 650, Quadra 650 or Quadra 800 to 40 MHz with minimal effort.

A 40 MHz Quadra 650 (“Current System”)

Traditionally, the way we have overclocked the Wombat family of Macs (the 650s and the 800) is to desolder the CPU clock “G3” and replace it with a faster part, or alternatively, use a commercial product that “clips” onto the clock, disables it, and injects its own clock signal. Through a mixture of experimentation and, let’s be honest, the sudden availability of the schematics, I made the most awesome discovery, I’ve found that 40 MHz is easy without messing with the clock. This is great news, because…

  • The clock is a surface mount part, meaning if you want to swap between speeds, you need to make a socket / adapter.
  • The clock is right up hard against a NuBus slot meaning you have to be very careful when desoldering and soldering in the area.

It actually turns out that the logic board in these machines has a built in function that lets you select the clock source, either from G3, or a clock derived from the NuBus clock. Selecting the NuBus clock as a source just straight up runs your computer’s bus at 40MHz without having to do any particularly fiddly mods.

There are a number of “levels” of effort you can put in, each with different advantages and disadvantages. You can either just hard set your computer to 40MHz and overclock in terms of the timings (because the ROM still runs with 25 or 33MHz timings), change the timings to the correct ones for 40MHz by swapping resistors, or by adding an extra resistor and two jumper headings, make it that by just removing or fitting two jumpers, you can select (independently) the RAM/ROM/VRAM timings and the CPU clock speed (between either 20 and 25 MHz, or between 33 and 40 MHz).

Basic 40 MHz Overclock

This is the simplest overclock with the minimal effort.

Advantages – This is effectively an overclock, so you’ll get super fast video performance as well as fast RAM and ROM.

Disadvantages – This uses whatever timings you already have, so almost certainly be unstable if you have a machine that shipped as 25 MHz, and possibly unstable if you have a 33 MHz machine.

How to do the Basic 40 MHz Overclock…

  1. Remove the logic board from your computer and place it on a heat-proof and static safe surface suitable for soldering.
  2. Find the pair of pads next to the CPU called “J29” on the silkscreen.
  3. Bridge the two pads, either with a blob of solder, or a little length of wire soldered between them. Alternatively, fit a two pin male header (2.54mm pitch) for a jumper.
  4. Reassemble your computer and test to see that everything works.
J29 on the Schematic

The modification works because U71 is wired to select between two clock sources depending on if J29 is fitted or not. As shipped, J29 is always open, ClkSel is always “high” and so the clock signal (half the bus speed) is always taken from G3. If you short J29, ClkSel goes low and the chip switches to using C20M – a 20MHz clock used by things like the SCSI and EtherNet chip, sourced from the NuBus circuit. Whichever clock is selected is doubled by the MC88916 chip before being fed into the CPU. Don’t worry that R235 isn’t fitted – it isn’t needed.

The Location of J29

I recommend leaving a CPU in the socket while soldering to protect the socket from slips. In the photo above I’ve used solder wick / braid and flux to remove the solder that was in the through holes. You only need to do this if you want to fit a jumper (so you can select between the stock speed and 40 MHz by removing and fitting a jumper. The following shows my setup.

J29 with a Header and Jumper Fitted

If you don’t already have a CPU heatsink, consider fitting one.

Adding 40 MHz Timings

This is a more stable solution that requires a little more soldering. This mod is required if your computer originally shipped as a 25 MHz machine.

Advantages – This reduces the overclock on systems such as RAM, ROM and VRAM, likely making the system more stable at 40 MHz. Doing this change will make a 25 MHz machine work at 40 MHz.

Disadvantages – Benchmarks will score a bit lower than using 33 MHz timings at 40 MHz (in line with a real 40MHz machine if Apple had ever released one). The machine ID (gestalt) will change to an unreleased Mac – 7.6.1 will boot OK (but might not install without tricking the installer), but 7.1 won’t boot unless you can find a hacked System Enabler. (Update – I believe I’ve managed to make the required changes and have the magic System Enabler working now. Drop me a message and I’ll send you a copy).

How to select 40MHz timings…

  1. Remove the logic board from the case and place it somewhere suitable to do some soldering.
  2. If there is a resistor fitted to R152, remove it.
  3. If there is a resistor fitted to R151, remove it.
  4. Save any resistors in case you want to put them back.
  5. Reassemble your computer and test to see that everything works.
Setting 40 MHz Timings

The way I remove 0805 surface mount resistors is by putting a little flux on them, and then placing the iron on one end for about 3 seconds, before quickly moving the iron to the other pad and pushing the resistor off. Sometimes it takes a couple of tries, but it is easier than faffing with other methods and I usually already have my iron set up. It is especially helpful if there is plastic parts nearby on the board that hot air might damage.

The Ideal Setup

This last modification is closest (see the “Other Tweaks” section) to how I have my system configured as it gives the best flexibility. It lets you have jumpers to select CPU speed and timings. Removing both jumpers gives you the stock CPU speed (whatever it is on your machine), with (always) 33 MHz timings, while fitting both jumpers gives you 40 MHz and 40 MHz timings. You can also mix and match.

Advantages – Flexibility – you can change the CPU clock between stock (hopefully 33 MHz) and 40 MHz, and also the timings between 33 MHz and 40 MHz settings. All without even removing the logic board from the case (once the modification has been done).

Disadvantages – If you have a machine fitted with the original 12.5MHz clock for 25MHz, it will be slower than as shipped when you pick 25MHz by jumpers, because you will only be able to select timings designed for higher clocks.

If you have a 25MHz machine, I recommend just doing the first two mods above and basically hard wiring it to 40MHz. Make sure you have a heatsink fitted and consider finding a 33MHz grade CPU.

Dual Jumpers

To fit dual jumpers…

  1. Remove the logic board to somewhere you can do soldering.
  2. Make sure no resistor is fitted at location R151.
  3. Fit a 1.2k 0805 resistor (usually labelled 122) at location R152.
  4. Fit a 330 ohm 0805 resistor (usually labelled 331) at location R233.
  5. Fit a header at location J28.
  6. Fit a header at location J29 if you didn’t previously.
  7. Reassemble your computer and test to see that everything works.
J28 in Situ – This Selects 40MHz Timings when Fitted
R151, R152 (I didn’t have a 1.2k Resistor so used a 1.5k) and R233

At this point, as described above and if you started with a 33MHz board, you will be able to select 33 MHz with 33 MHz timings by removing both jumpers (I store them by placing them so they are on only one pin of the header), or 40 MHz with 40 MHz timings by fitting both jumpers. If you fit J29 and not J28, you will get a 40 MHz bus / CPU speed, with 33 MHz timings. This is an overclock with regards to the timings, so you will have boosted video, RAM and ROM performance. Most noticeable in the video benchmarks like the following :

Video Benchmark Score at 40 MHz with 33 MHz Timings

Note that while 40 MHz timings are selected, you will have the machine ID (gestalt) of an unreleased Mac, and System 7.1 won’t boot as mentioned above. If you want to boot in 7.1, just remove jumper J28.

Other Tweaks

  • Fit a 40 MHz Grade CPU and a heatsink.
  • Fit a socket for trying other clock speeds.
  • Fit a 25MHz clock to aim for 50 MHz.
  • Spoof a Quadra 800 power LED by shorting the appropriate two pins on the LED connector location. This makes your computer think it is a Quadra 800, which shipped with faster RAM, so I believe the ROM sets up slightly faster RAM timings.
  • Install the Wish I Were control panel to override the machine ID gestalt and reduce (but not completely) the number of issues from running a machine with an unreleased ID.
  • Replace the MC88916DW55 with an MC88916DW80 as this makes 50 MHz more likely in combination with a faster clock at G3. Fitting J29 still selects 40MHz, but removing it selects the faster clock at G3. Remember G3 is half the bus speed.
  • Remove onboard RAM and fit a single stick of very fast RAM (50ns EDO).
  • Fit a PowerPC Upgrade Card. Some will run at 80 MHz using the modifications described on this page.

I have personally done all the mods listed above to my machine, although I can’t promise they’ll all work for you, or are worthwhile.

Further Research

I worked out how to modify the System Enabler so that 40MHz works with System 7.1! Drop me a message if you want a copy. I might have previously posted it on Tinker Different – I forget.

Additionally, if your board shipped from factory with J28 and or J29 fitted, and especially R233 fitted, I’d be interested to hear from you. It’s likely that such a board would be a prototype and it would be great to check some component values.

This page is making a record of information I originally posted on 68kmla.

G3 / G4 Processor Upgrade Speed Settings

Some G3 and G4 processor upgrades for beige macs from the 90s have dip switches for setting the processor and bus speed, as well as a special switch for when you install it in a PowerBase (a clone). With so much information falling off the internet and getting harder to find, I thought I’d post the settings for some cards here.

PowerLogix PowerForce G3 Speed Settings

This is what my PowerLogix card looks like, it is a 400MHz, 1MB Cache G3 (PFG3 400/200/1) upgrade for PCI macs with the processor slot, for example things like the 7500 to the 9600, and some clones.

Here are the settings :

XLR8 Mach Speed Settings

The following settings apply to a number of XLR8 cards, including Mach branded cards. The first 8 switches seem to control the host bus speed, the remainder set the CPU multiplier.

You can also additionally set the Backside Cache speed using XLR8s software.

Newer Technology MaxPowr

See the following site for experimental research regarding the four switches on the non-ZIF variant, or the manual extract for settings on the ZIF card.

https://siber-sonic.com/mac/MAXpowrG3.html

Installing “Unsupported” Software on an Overclocked LC 475

Installing “Unsupported” Software on an Overclocked LC 475

(Or more generally, installing software on any unsupported classic Macintosh)

You might find that if you have overclocked your LC 475, Performa 475, Performa 476 or Quadra 605 by moving the speed selecting resistors on the underside of the board, you can no longer install some operating system versions, including Mac OS 8.1 for example.

The reason for this, is that the machine id gestalt, effectively the number representing the computer model from the operating system’s perspective, changes when you change the computer’s speed in this way. When you launch some System installers, they check the machine id gestalt, and some, but not all, don’t include the id for a 33MHz LC 475 type computer.

There are three easy solutions for this, depending on your exact needs…

Try Forcing it to Install

Some Apple Installers will ignore the machine check if you hold down the opting key while launching the software. Note this unfortunately doesn’t work with the Mac OS 8.1 installer, but it does work with some older Apple installers. To do this, you can hold it down prior to double clicking, but make sure you keep it held down through the dialogue boxes until you get to the one that lets you pick your install type. At this point, remembering that the installer doesn’t have an appropriate profile for what it thinks your computer is, select “Universal System for any Supported Computer” to make sure everything that is needing gets installed. Note this will be a bigger system install than you really need as it will include all sorts of machine specific extras and even probably PPC code, that your specific computer likely doesn’t need.

Override Your Machine ID

It is possible to set your Machine ID Gestalt in software and there are a couple of different tools for doing it. The most famous one is “Wish I Were”, but for this specific job, it isn’t actually the best choice. Wish I Were is great if you want to change your machine ID long term as it changes it fairly early in the boot process (not early enough if the OS doesn’t support the computer at all, but that isn’t an issue here).

On the other hand, the software “MachID Wannabe”, available here from Macintosh Garden : https://macintoshgarden.org/apps/wannabe-macintosh lets you instantly change your machine ID and it only stays changed until you change it again or shutdown / restart. This is great as without restarting you can change it, then run the installer, and get on with your life. You do still need to install MachID in the Control Panels folder and restart to be able to use it though!

If you’re trying to make an LC / Performa 475 or 476 appear stock, you’ll want to set it to 89. A Quadra 605 would be 94. It doesn’t really make a difference which of these two you pick.

Put the Resistors Back

The third and final option is to just put the resistors back to the default configuration, and instead, install my software overclock Control Strip Module. The module lets you change the speed between more configurations and on the fly. Because the resistors are in their default position, the computer retains its stock Machine ID Gestalt and all installers, software and OSes that check the machID get the expected value for an LC 475, maximising compatibility. I might be bias, but this really seems like the best solution to me!

The latest version can be found here on Macintosh Garden : https://macintoshgarden.org/apps/control-strip-475-overclock

Useful Information

For information about overclocking an LC 475 or related computer, or many other classic Macs, as well as useful information about the machine ID gestalt (commonly called just “gestalt”, although technically the machine ID / machID is one of many gestalts), please check out the amazing http://applefool.com, and specifically http://appplefool.com/clockchipping/.

If you want to know more background about the software overclocking method, check out my post here, and the original 68kmla forum thread by mustermann here.

How Registration Details are Stored in ClarisWorks 2.0 and 2.1

How Registration Details are Stored in ClarisWorks 2.0 and 2.1

Where is the Registration Data Stored?

Older versions of Claris software store the registration details in the data fork. In the 68k only versions of software, it is the only information stored there and so deleting all data in the data fork resets the software to unregistered (only ever try this on a duplicate copy of the program) and you are prompted to enter new registration details when you next launch the software. This is how utilities such as Repersonalize clear the registered details in early Claris software, as well as Microsoft software.

PowerPC code in Mac applications is actually stored in the data fork, in both PPC and FAT applications. This means that running a program like Repersonalize on a PPC version will damage the application by removing all the PPC code. Looking at the data fork and comparing before and after registering a fresh copy, I found that the registration information is stored at the very end of the data fork and if you know which section it is, it can be still manually removed. I used the software Resorcerer which lets you view the data fork as well as the resource fork.

The first version of ClarisWorks to support PowerPC processors natively that I know of is version 2.1, and it is specifically 2.1CDv3 that I’ve been looking at. In this exact version, the data/code at the end of the PowerPC code in the data fork is “0012 24EC” and the first offset of the registration data is at offset 134448. This will likely vary between versions.

I might write an automated tool for this at some point if I can make sure it works with various versions.

How is the Registration Data Stored?

When you register ClarisWorks 2.1CDv3 (and some other Claris software), there are three fields, Name, Company and Serial Number. All three accept just about any text. The three strings are obfuscated, concatenated, and then appended to the data fork as three pascal strings. This means that the first byte of each string is the length of the string, and the three strings are joined together (each starting with their length).

The strings are not readable as stored because each character has been XOR’d with a number. Claris alternated between two numbers, 79 and 66 (at least in ClarisWorks 2.1CDv3). XOR means Exclusive OR, and is a binary operation. XORing a byte with another byte (which we’ll call Brian for clarity) effectively inverts (flips) any bits in the byte that match locations that are a ‘1’ in Brian, when viewed in binary notation.

For example, if our byte is 11110000, and Brian is 10101010, then XORing our byte with Brian will give the result “01011010” – we flipped every second bit. By applying Brian a second time, the bits are flipped back, and we get the original data.

You can work out what the XOR value is (i.e. Brian), if you have the input byte and the result, by XORing the original value and recorded result. So, because

Result = Byte XOR Brian

It is also true that…

Brian = Byte XOR Result

Remembering that in this case the byte is the ASCII value of a known letter in the registration details.

A Worked Example

Imagine we enter the following data into the three fields in ClarisWorks to register the software…

First, lets consider the easy bit. The first string is 8 characters long, the second is 7, and the third is 6. We now know that the three lengths that will be included will be those. I made a little spreadsheet to get the ASCII values of each letter, XOR it with 79 or 66, and then display the result in Hex.

Putting the lengths and three strings together in hex we would have…

080A 2E2A 3227 2321 3607 0C2A 2621 2427 2106 1C27 3D2B 2E2E

So lets check if we got it right by loading the registered copy of ClarisWorks in Resorcerer…

Yay! It matches, so I’m not daft. The reverse is also possible, lets start with the data as stored in the datafork…

So our hex data is…

060C 2E2E 3026 3105 182D 3D29 3C03 7D6C 7E

We can see the first byte is a 6 (in hex remember, but in this instance it is 6 in hex and in decimal), so we count 6 bytes, then one more, to find the next length… which is 05, so we count 5 bytes, then one more, and find 03. So our three strings are 6, 5 and 3 characters long. Lets make another spreadsheet.

Oh look, it says “Claris”, “Works” and “2.1”! If you would like a play, you can download the spreadsheet (in OpenOffice format, compatible with Excel and LibreOffice) here :