Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - SP-400's MCS-48 dump

Reply to topic
Author Message
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
SP-400's MCS-48 dump
Post Posted: Sat Sep 25, 2021 10:22 am
HoverEel of this forum recently dumped the SP-400's MCS-48 code.
Here is the commented disassembly

Unfortunately the font seems to be stored in the 6805, which is proving to be more difficult to dump, but I am hoping it'll be possible (see this).
  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 135
Reply with quote
Post Posted: Sat Sep 25, 2021 11:25 am
kamillebidan wrote
HoverEel of this forum recently dumped the SP-400's MCS-48 code.
Here is the commented disassembly

Unfortunately the font seems to be stored in the 6805, which is proving to be more difficult to dump, but I am hoping it'll be possible (see this).

Great! What that IC is used for?
  View user's profile Send private message
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Sat Sep 25, 2021 2:31 pm
It just implements a circular buffer and a serial to parallel conversion. The heavy lifting is done by the 6805
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1176
Reply with quote
Post Posted: Sat Sep 25, 2021 2:32 pm
Do we have some PCB photos or schematics for the SP-400?
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Sun Sep 26, 2021 4:10 am
I attach them, all courtesy of HoverEel.
I started drawing the schematic, unfortunately many of the interesting connections are vias under the IC and thus are not visible.

We found something weird. It mounts a HD6805V1, which according to
this datasheet is an Hitachi clone of motorola's 6805.
The problem is that the datasheet does not match at all what is on the board. The chip on the board has VCC on pin 40, gnd on pin 20, crystal on pins 5 and 6. The closest things I found are MC146805G2, which matches power, but not the crystal, and MC146805F2 which matches the crystal as well, but has less pins (I guess less I/O).

IC5 is the eeprom whose content was dumped and disassebled.

BASIC's LPRINT just sends the chars you passed over the printer port in serial form, inverted from classic TTL level serials(i.e. the line is normally low instead of being normally high).

This means the font is encoded in the 6805. I really hope it can be read using the above trick despite being a PROM.
3VZ7zYo.jpeg (2.2 MB)
3VZ7zYo.jpeg
4MoDvC9.jpeg (1.66 MB)
4MoDvC9.jpeg
aGHLrYt.jpeg (2.21 MB)
aGHLrYt.jpeg
HEK5GZ8.jpeg (1.57 MB)
HEK5GZ8.jpeg
jYhvofu.jpeg (1.8 MB)
jYhvofu.jpeg
VhaL2Kb.jpeg (1.31 MB)
VhaL2Kb.jpeg
vWLUNlv.jpeg (1.58 MB)
vWLUNlv.jpeg

  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1176
Reply with quote
Post Posted: Sun Sep 26, 2021 3:00 pm
Quote
We found something weird. It mounts a HD6805V1


Very strange! What do pins 1, 2 and 4 connect to on the board?

If the 6805 can't be dumped, would it be possible to make the printer print all possible characters and then capture the digital outputs (however many are used to drive the print head) to extract font data that way?
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Sun Sep 26, 2021 3:23 pm
Charles MacDonald wrote
Quote
We found something weird. It mounts a HD6805V1

Very strange!

Even weirder, have a look at
this service manual of something else using the same chip. They used it, so they surely did not stop at the datasheet, yet the connections match the datasheet

[quote="Charles MacDonald"]
What do pins 1, 2 and 4 connect to on the board?
[\quote]
I could not trace those yet, except for pin 1 which seems to go to pin 39 of the same IC. The function is unknown at the moment.

Charles MacDonald wrote

If the 6805 can't be dumped, would it be possible to make the printer print all possible characters and then capture the digital outputs (however many are used to drive the print head) to extract font data that way?


I hoped to dump using the NUM pin as stated here
http://www.seanriddle.com/mc6805p2.html

Quote

I was able to electronically dump the ROM using the non-user-mode pin. I used a 1 MHz clock on the EXTAL pin with XTAL grounded, tied /RESET, /INT and TIMER high, and connected NUM to +5. I tied the PORT A pins to +5 and ground using 8 1K resistors to set it to $9D, the opcode for NOP, and I tied PORT C 3 high. The ROM contents were output on PORT B; I captured the bytes using a logic analyzer.


if this is a feature of the EEPROM versions only (that is likely, unfortunately), yes, the last resort is the black box approach of printing each font and counting the steps in x and y direction. That may require doing the number of char times the number of sizes, and I did not check yet if there's any bold / italic /etc.
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1176
Reply with quote
Post Posted: Sat Oct 02, 2021 5:40 pm
Quote

I was able to electronically dump the ROM using the non-user-mode pin.


It's a good idea. For an experiment I bought a HD6805V1P and want to try the self-check mode Hitachi documented. I can investigate NUM too.

Though if it's an EPROM part and not mask ROM there may be nothing to read. It would be an interesting exercise regardless.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Fri Oct 08, 2021 12:17 pm
By the way, with further pictures from HoverEel we found that the IC matches the datasheet, false alarm.
Please let me know about your results with the hitachi chip, indeed the masked rom version may be different, but if the trick works with the eprom version there's some more hope.
  View user's profile Send private message
Reply to topic



Back to the top of this page

Back to SMS Power!