|
ForumsSega Master System / Mark III / Game GearSG-1000 / SC-3000 / SF-7000 / OMV |
Home - Forums - Games - Scans - Maps - Cheats - Credits Music - Videos - Development - Hacks - Translations - Homebrew |
Author | Message |
---|---|
|
SP-400's MCS-48 dump
Posted: Sat Sep 25, 2021 10:22 am
|
HoverEel of this forum recently dumped the SP-400's MCS-48 code.
Here is the commented disassembly Unfortunately the font seems to be stored in the 6805, which is proving to be more difficult to dump, but I am hoping it'll be possible (see this). |
|
|
Posted: Sat Sep 25, 2021 11:25 am |
Great! What that IC is used for? |
|
|
Posted: Sat Sep 25, 2021 2:31 pm |
It just implements a circular buffer and a serial to parallel conversion. The heavy lifting is done by the 6805 | |
|
Posted: Sat Sep 25, 2021 2:32 pm |
Do we have some PCB photos or schematics for the SP-400? | |
|
Posted: Sun Sep 26, 2021 4:10 am |
I attach them, all courtesy of HoverEel.
I started drawing the schematic, unfortunately many of the interesting connections are vias under the IC and thus are not visible. We found something weird. It mounts a HD6805V1, which according to this datasheet is an Hitachi clone of motorola's 6805. The problem is that the datasheet does not match at all what is on the board. The chip on the board has VCC on pin 40, gnd on pin 20, crystal on pins 5 and 6. The closest things I found are MC146805G2, which matches power, but not the crystal, and MC146805F2 which matches the crystal as well, but has less pins (I guess less I/O). IC5 is the eeprom whose content was dumped and disassebled. BASIC's LPRINT just sends the chars you passed over the printer port in serial form, inverted from classic TTL level serials(i.e. the line is normally low instead of being normally high). This means the font is encoded in the 6805. I really hope it can be read using the above trick despite being a PROM. |
|
|
Posted: Sun Sep 26, 2021 3:00 pm |
Very strange! What do pins 1, 2 and 4 connect to on the board? If the 6805 can't be dumped, would it be possible to make the printer print all possible characters and then capture the digital outputs (however many are used to drive the print head) to extract font data that way? |
|
|
Posted: Sun Sep 26, 2021 3:23 pm |
Even weirder, have a look at this service manual of something else using the same chip. They used it, so they surely did not stop at the datasheet, yet the connections match the datasheet [quote="Charles MacDonald"] What do pins 1, 2 and 4 connect to on the board? [\quote] I could not trace those yet, except for pin 1 which seems to go to pin 39 of the same IC. The function is unknown at the moment.
I hoped to dump using the NUM pin as stated here http://www.seanriddle.com/mc6805p2.html
if this is a feature of the EEPROM versions only (that is likely, unfortunately), yes, the last resort is the black box approach of printing each font and counting the steps in x and y direction. That may require doing the number of char times the number of sizes, and I did not check yet if there's any bold / italic /etc. |
|
|
Posted: Sat Oct 02, 2021 5:40 pm |
It's a good idea. For an experiment I bought a HD6805V1P and want to try the self-check mode Hitachi documented. I can investigate NUM too. Though if it's an EPROM part and not mask ROM there may be nothing to read. It would be an interesting exercise regardless. |
|
|
Posted: Fri Oct 08, 2021 12:17 pm |
By the way, with further pictures from HoverEel we found that the IC matches the datasheet, false alarm.
Please let me know about your results with the hitachi chip, indeed the masked rom version may be different, but if the trick works with the eprom version there's some more hope. |
|
|
Posted: Mon Nov 01, 2021 5:50 am |
It works! I've made an Arduino shield and Windows software to dump the HD6805V1 and have been able to read the two chips I bought. The full ROM data can be recovered as the entire 4K address space gets read. The first 128 bytes are RAM and I/O which can be ignored, and the remainder is the customer ROM data and self-check ROM data. The technique is somewhat different on HD6805 compared to MC6805. Perhaps Hitachi made some changes but the general idea works with a few tweaks. It took some time to figure all this out, sorry for the delay. I'll publish the project files and code on GitHub and provide some documentation on the low level details soon. BTW if you try it yourself on a breadboard please be careful: don't connect NUM to +5V directly. For HD6805 it is a bidirectional pin and should be pulled up to +5V instead with a 1K-ohm resistor. It outputs a synchronization signal used to demultiplex the scrambled address and data on Port B and is definitely not an input-only pin. |
|
|
Posted: Mon Nov 01, 2021 9:15 am |
Thank you,this is great news!!
I will contact HoverEel, he's the one who has the IC. I am really looking forward your docs. In the meanwhile I drafted a dumper https://drive.google.com/drive/u/2/folders/1Dggey5hojhSHYM7P5vKGTn7adViE0FZR . I imagined using a signal analyzer with a free running clock, but it seems you went the extra step and realized the dumper with an arduino isn't it. |
|
|
Posted: Fri Dec 03, 2021 8:33 am |
Your github is this isn't it? Or do you have an additional one? |
|
|
Posted: Fri Dec 03, 2021 11:44 pm |
Sorry I've been busy, I'll try to get to this tomorrow and post an update here. | |
|
Posted: Mon Dec 06, 2021 6:40 am |
OK here's everything. Let me know if you need any information or help.
https://github.com/charlesmacd/HD6805_Reader |
|
|
Posted: Mon Dec 06, 2021 8:51 am |
Thank you, wow!
I'll immediately contact HoverEel. |
|
|
Questions
Posted: Thu Dec 16, 2021 2:44 pm
|
Hi Charles! Thanks for your work on this, it should make dumping this chip a lot easier. I've ordered some pin headers, a 40-pin ZIF socket, Arduino Uno Rev 3, and had the Gerber files sent off to OSHPARK for fabrication.
I'm not so well-versed on building these things from schematics these days, so I had a couple questions to make sure I'm doing this right. Can provide a shot of the bottom of the board on Github? I see there's some resistors and capacitors that need to be installed and sometimes just seeing the actual board helps me go through and make sure everything is soldered where it should be. Second, do you have a bill of materials for this, or specific resistors/caps you'd recommend? I've gone hunting for console capacitors a few times and get spun up worrying about temperature ratings, tolerances, etc. I'm probably overthinking it, but don't want to risk frying a chip when we may not get another chance to dump one for a while. Thanks again for working on this, and for any info you can provide! |
|
|
Posted: Sun Dec 19, 2021 6:43 am |
Yes although it will be for the older V1 board as I didn't make the V2, but for the most part it's all the same minus some extra wires. I'll post it tomorrow once there's better outdoors lighting to get a clear shot.
Oops I totally forgot that, thanks for bringing it up. I've added a bill of materials to the github page. Let me know if you need input on picking alternatives depending on what's available thanks to the global parts shortage.
That's a pretty good point. Can you PM me your email address if you'd like any more tech support? I don't check the forum as often as I should these days and don't want to leave you hanging, and maybe once you build the adapter we can walk through some diagnostic checks first, measure some voltages, etc, to be sure things are good. You probably already have the gear needed but if you need a recommendation for a tool to desolder the chip the Hakko FR-301 is a game changer for removing DIP parts, especially large ones like the HD6805. |
|
|
Re: Questions
Posted: Sun Dec 19, 2021 9:07 pm
|
Thanks Charles! I see the bill of materials on there now. The FR-301 is definitely a game changer. I never would have gotten the HD6805 off the board without it. Pulled the trigger on one like 6 months ago or so when I got tired of fighting caps on a Sega CD lol. I'll put together an order for those parts through mouser.com or Digikey today, so long as they have everything. Need to place an order anyway, since the resistors I bought on Amazon only had 25 pieces when it said 50, and now I don't have enough for my PKE meter...
I'll PM you my email address right after sending this. |
|
|
Posted: Sun Dec 19, 2021 10:34 pm |
I've added a close-up photo of the back of the board to the GitHub page.
Note at the time I ran out of 10K resistors and just used 1K for everything, but those are part of the optional power switching circuit that ended up not being necessary anyway. In case you see more 1K resistors on that photo than expected. Across the HD6805 power and ground pins I added the missing 0.1uF cap and then a spare 10uF electrolytic cap for decoupling, the latter isn't not needed and was just part of an experiment. |
|