11 Feb
2008
11 Feb
'08
1:44 p.m.
On Sun, 2008-02-10 at 18:51 +0000, Tony Duell wrote:
No, the ASIC is *only* for playing back samples. The address latch is a
75HC573
I assume you have a '573 pinout... In which case it is _very_ easy to
trace the known data pins on the processor to the D inputs of that latch,
and from the Q outputs of the latch to the EPROM address pins. That will
tell you which order the address lines are wired up in.
Basically
I'm trying to reverse-engineer the firmware of a couple of
late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
custom ASIC for the sample playback and an 80C31 for the clever stuff.
I assume the ROM address latch is hidden in that ASIC, and isn't a
seprate '373 or '572 chip If it was, it would be trivial to trace out the address bit order, of course. Do the ROM data
pins connect straight to
the 8031 (without going through the ASIC). At least you could make sure
the data bits are in the expected order.
The OS ROM connects up as you'd expect. AD0-AD7 through the latch,
A8-A15 direct. What aobut using a logic analyser, connected to
the EPROM? You could
capture the first few instructions and the addresses _at the ROM pins_.
You can spot jumps, etc and thus work out what the addresses _should_ be
and thus work out which bit ends up on which EPROM pin.
Actually, just looking at the PDFs of the datasheets and the physical
layout on the board provided the clue I needed. I didn't even need to