Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - SP-400's MCS-48 dump

Reply to topic
Author Message
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
SP-400's MCS-48 dump
Post Posted: Sat Sep 25, 2021 10:22 am
HoverEel of this forum recently dumped the SP-400's MCS-48 code.
Here is the commented disassembly

Unfortunately the font seems to be stored in the 6805, which is proving to be more difficult to dump, but I am hoping it'll be possible (see this).
  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Sat Sep 25, 2021 11:25 am
kamillebidan wrote
HoverEel of this forum recently dumped the SP-400's MCS-48 code.
Here is the commented disassembly

Unfortunately the font seems to be stored in the 6805, which is proving to be more difficult to dump, but I am hoping it'll be possible (see this).

Great! What that IC is used for?
  View user's profile Send private message
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Sat Sep 25, 2021 2:31 pm
It just implements a circular buffer and a serial to parallel conversion. The heavy lifting is done by the 6805
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Sat Sep 25, 2021 2:32 pm
Do we have some PCB photos or schematics for the SP-400?
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Sun Sep 26, 2021 4:10 am
I attach them, all courtesy of HoverEel.
I started drawing the schematic, unfortunately many of the interesting connections are vias under the IC and thus are not visible.

We found something weird. It mounts a HD6805V1, which according to
this datasheet is an Hitachi clone of motorola's 6805.
The problem is that the datasheet does not match at all what is on the board. The chip on the board has VCC on pin 40, gnd on pin 20, crystal on pins 5 and 6. The closest things I found are MC146805G2, which matches power, but not the crystal, and MC146805F2 which matches the crystal as well, but has less pins (I guess less I/O).

IC5 is the eeprom whose content was dumped and disassebled.

BASIC's LPRINT just sends the chars you passed over the printer port in serial form, inverted from classic TTL level serials(i.e. the line is normally low instead of being normally high).

This means the font is encoded in the 6805. I really hope it can be read using the above trick despite being a PROM.
3VZ7zYo.jpeg (2.2 MB)
3VZ7zYo.jpeg
4MoDvC9.jpeg (1.66 MB)
4MoDvC9.jpeg
aGHLrYt.jpeg (2.21 MB)
aGHLrYt.jpeg
HEK5GZ8.jpeg (1.57 MB)
HEK5GZ8.jpeg
jYhvofu.jpeg (1.8 MB)
jYhvofu.jpeg
VhaL2Kb.jpeg (1.31 MB)
VhaL2Kb.jpeg
vWLUNlv.jpeg (1.58 MB)
vWLUNlv.jpeg

  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Sun Sep 26, 2021 3:00 pm
Quote
We found something weird. It mounts a HD6805V1


Very strange! What do pins 1, 2 and 4 connect to on the board?

If the 6805 can't be dumped, would it be possible to make the printer print all possible characters and then capture the digital outputs (however many are used to drive the print head) to extract font data that way?
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Sun Sep 26, 2021 3:23 pm
Charles MacDonald wrote
Quote
We found something weird. It mounts a HD6805V1

Very strange!

Even weirder, have a look at
this service manual of something else using the same chip. They used it, so they surely did not stop at the datasheet, yet the connections match the datasheet

[quote="Charles MacDonald"]
What do pins 1, 2 and 4 connect to on the board?
[\quote]
I could not trace those yet, except for pin 1 which seems to go to pin 39 of the same IC. The function is unknown at the moment.

Charles MacDonald wrote

If the 6805 can't be dumped, would it be possible to make the printer print all possible characters and then capture the digital outputs (however many are used to drive the print head) to extract font data that way?


I hoped to dump using the NUM pin as stated here
http://www.seanriddle.com/mc6805p2.html

Quote

I was able to electronically dump the ROM using the non-user-mode pin. I used a 1 MHz clock on the EXTAL pin with XTAL grounded, tied /RESET, /INT and TIMER high, and connected NUM to +5. I tied the PORT A pins to +5 and ground using 8 1K resistors to set it to $9D, the opcode for NOP, and I tied PORT C 3 high. The ROM contents were output on PORT B; I captured the bytes using a logic analyzer.


if this is a feature of the EEPROM versions only (that is likely, unfortunately), yes, the last resort is the black box approach of printing each font and counting the steps in x and y direction. That may require doing the number of char times the number of sizes, and I did not check yet if there's any bold / italic /etc.
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Sat Oct 02, 2021 5:40 pm
Quote

I was able to electronically dump the ROM using the non-user-mode pin.


It's a good idea. For an experiment I bought a HD6805V1P and want to try the self-check mode Hitachi documented. I can investigate NUM too.

Though if it's an EPROM part and not mask ROM there may be nothing to read. It would be an interesting exercise regardless.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Fri Oct 08, 2021 12:17 pm
By the way, with further pictures from HoverEel we found that the IC matches the datasheet, false alarm.
Please let me know about your results with the hitachi chip, indeed the masked rom version may be different, but if the trick works with the eprom version there's some more hope.
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Mon Nov 01, 2021 5:50 am
kamillebidan wrote
By the way, with further pictures from HoverEel we found that the IC matches the datasheet, false alarm.
Please let me know about your results with the hitachi chip, indeed the masked rom version may be different, but if the trick works with the eprom version there's some more hope.


It works! I've made an Arduino shield and Windows software to dump the HD6805V1 and have been able to read the two chips I bought. The full ROM data can be recovered as the entire 4K address space gets read. The first 128 bytes are RAM and I/O which can be ignored, and the remainder is the customer ROM data and self-check ROM data.

The technique is somewhat different on HD6805 compared to MC6805. Perhaps Hitachi made some changes but the general idea works with a few tweaks. It took some time to figure all this out, sorry for the delay.

I'll publish the project files and code on GitHub and provide some documentation on the low level details soon.

BTW if you try it yourself on a breadboard please be careful: don't connect NUM to +5V directly. For HD6805 it is a bidirectional pin and should be pulled up to +5V instead with a 1K-ohm resistor. It outputs a synchronization signal used to demultiplex the scrambled address and data on Port B and is definitely not an input-only pin.
hdread1.png (1.08 MB)
HD6805V1P reader
hdread1.png

  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Mon Nov 01, 2021 9:15 am
Thank you,this is great news!!
I will contact HoverEel, he's the one who has the IC.
I am really looking forward your docs.
In the meanwhile I drafted a dumper https://drive.google.com/drive/u/2/folders/1Dggey5hojhSHYM7P5vKGTn7adViE0FZR . I imagined using a signal analyzer with a free running clock, but it seems you went the extra step and realized the dumper with an arduino isn't it.
  View user's profile Send private message
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Fri Dec 03, 2021 8:33 am
Charles MacDonald wrote

I'll publish the project files and code on GitHub and provide some documentation on the low level details soon.

Your github is this isn't it? Or do you have an additional one?
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Fri Dec 03, 2021 11:44 pm
Sorry I've been busy, I'll try to get to this tomorrow and post an update here.
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Mon Dec 06, 2021 6:40 am
OK here's everything. Let me know if you need any information or help.

https://github.com/charlesmacd/HD6805_Reader
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Mon Dec 06, 2021 8:51 am
Thank you, wow!
I'll immediately contact HoverEel.
  View user's profile Send private message
  • Joined: 22 Aug 2021
  • Posts: 9
Reply with quote
Questions
Post Posted: Thu Dec 16, 2021 2:44 pm
Hi Charles! Thanks for your work on this, it should make dumping this chip a lot easier. I've ordered some pin headers, a 40-pin ZIF socket, Arduino Uno Rev 3, and had the Gerber files sent off to OSHPARK for fabrication.

I'm not so well-versed on building these things from schematics these days, so I had a couple questions to make sure I'm doing this right. Can provide a shot of the bottom of the board on Github? I see there's some resistors and capacitors that need to be installed and sometimes just seeing the actual board helps me go through and make sure everything is soldered where it should be.

Second, do you have a bill of materials for this, or specific resistors/caps you'd recommend? I've gone hunting for console capacitors a few times and get spun up worrying about temperature ratings, tolerances, etc. I'm probably overthinking it, but don't want to risk frying a chip when we may not get another chance to dump one for a while.

Thanks again for working on this, and for any info you can provide!
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Sun Dec 19, 2021 6:43 am
Quote
Can provide a shot of the bottom of the board on Github?


Yes although it will be for the older V1 board as I didn't make the V2, but for the most part it's all the same minus some extra wires. I'll post it tomorrow once there's better outdoors lighting to get a clear shot.

Quote
Second, do you have a bill of materials for this, or specific resistors/caps you'd recommend?


Oops I totally forgot that, thanks for bringing it up. I've added a bill of materials to the github page. Let me know if you need input on picking alternatives depending on what's available thanks to the global parts shortage.

Quote
don't want to risk frying a chip when we may not get another chance to dump one for a while.


That's a pretty good point. Can you PM me your email address if you'd like any more tech support? I don't check the forum as often as I should these days and don't want to leave you hanging, and maybe once you build the adapter we can walk through some diagnostic checks first, measure some voltages, etc, to be sure things are good.

You probably already have the gear needed but if you need a recommendation for a tool to desolder the chip the Hakko FR-301 is a game changer for removing DIP parts, especially large ones like the HD6805.
  View user's profile Send private message Visit poster's website
  • Joined: 22 Aug 2021
  • Posts: 9
Reply with quote
Re: Questions
Post Posted: Sun Dec 19, 2021 9:07 pm
Thanks Charles! I see the bill of materials on there now. The FR-301 is definitely a game changer. I never would have gotten the HD6805 off the board without it. Pulled the trigger on one like 6 months ago or so when I got tired of fighting caps on a Sega CD lol. I'll put together an order for those parts through mouser.com or Digikey today, so long as they have everything. Need to place an order anyway, since the resistors I bought on Amazon only had 25 pieces when it said 50, and now I don't have enough for my PKE meter...

I'll PM you my email address right after sending this.
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Sun Dec 19, 2021 10:34 pm
I've added a close-up photo of the back of the board to the GitHub page.

Note at the time I ran out of 10K resistors and just used 1K for everything, but those are part of the optional power switching circuit that ended up not being necessary anyway. In case you see more 1K resistors on that photo than expected.

Across the HD6805 power and ground pins I added the missing 0.1uF cap and then a spare 10uF electrolytic cap for decoupling, the latter isn't not needed and was just part of an experiment.
  View user's profile Send private message Visit poster's website
Reply to topic



Back to the top of this page

Back to SMS Power!