Now we can read and write the DRAM. To inspect the basic behavior of the memory array, i displayed the first word of every of the 256 pages after turning on the power:

All memory cells start with the same voltage on the capacitor (0V I presume, since the memory was powered off). However, half the memory cells are set to 0 and half to 1, depending on the row.

The reason for this is that the read amplifiers are actually differential amplifiers. Half of the memory cells are connected to the inverting branch and half to the noninverting branch. The purpose of this is to balance bitline capacitance by ensuring that the same number of memory cells is connected to each bitline. When the a row is activated it will either change the voltage on the inverting or noninverting bitline and hence we either get a 0 or a 1 for 0V initial charge on the capacitor.

As a rather curious observation, I found that the pattern inverts when the DRAM is left powered on (VDD=5V) for a while without refresh. I believe that in this case the voltage on the capacitors is increasing due leakage form a rail with positive to the capacitor - possible from the bitlines which are held at VDD/2 while the DRAM is inactive.

How the positive and negative rows are distributed among the rows depends on how the wordline decoder is designed. I have seen some DRAMs that alternate even and odd rows and some that even alternative bits.

One particularily interesting case is the reset pattern of the U2164C DRAM (manufactured in East Germany during cold war times). I suppose they saved some µm² by connecting the cells in a wild pattern?

There is a die-shot of a similar device here, and it seems that they segmented the 64k array into several sub arrays, which may explain the weird behavior. Probably it's segmented by even and odd bits.

Ok, on to the actual hacking.