9 Feb
2008
9 Feb
'08
4 a.m.
Offtopic-ish, but does anyone know of a good 80C32 emulator for Linux?
There seem to be a lot of closed-source ones for Windows, but since
there's no apparent way to add specific emulated devices to them I can't
see how useful they'd be for what I'm doing.
Gordon
9 Feb
9 Feb
10:11 a.m.
Gordon JC Pearce wrote:
Offtopic-ish, but does anyone know of a good 80C32
emulator for Linux?
There seem to be a lot of closed-source ones for Windows, but since
there's no apparent way to add specific emulated devices to them I can't
see how useful they'd be for what I'm doing.
Gordon
Grab a emulator source and hack it.
Any good programmer should be able to put together a set of crufty tools
in a week or two.
10:31 a.m.
On Feb 9, 2008, at 7:00 AM, Gordon JC Pearce wrote:
Offtopic-ish, but does anyone know of a good 80C32
emulator for Linux?
There seem to be a lot of closed-source ones for Windows, but since
there's no apparent way to add specific emulated devices to them I
can't
see how useful they'd be for what I'm doing.
SDCC comes with one; have you looked at that? There's also j51
(written in Java) but I've not messed with it.
What's your project, if you don't mind my asking? I do stuff with
mcs51-architecture processors pretty much all the time.
-Dave
--
Dave McGuire
Port Charlotte, FL
4:35 p.m.
On Sat, 2008-02-09 at 13:31 -0500, Dave McGuire wrote:
On Feb 9, 2008, at 7:00 AM, Gordon JC Pearce wrote:
SDCC does look good for this.
Offtopic-ish, but does anyone know of a good
80C32 emulator for Linux?
There seem to be a lot of closed-source ones for Windows, but since
there's no apparent way to add specific emulated devices to them I
can't
see how useful they'd be for what I'm doing.
SDCC comes with one; have you looked at that? There's also j51
(written in Java) but I've not messed with it. What's your project, if you don't mind my
asking? I do stuff with
mcs51-architecture processors pretty much all the time.
Basically I'm trying to reverse-engineer the firmware of a couple of
late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
custom ASIC for the sample playback and an 80C31 for the clever stuff.
The firmware contains the locations in the sample ROMs of the start and
end of each sample.
The only thing is, a simple disassembly of the ROM leads nowhere,
possibly because the contents are scrambled in some way. I suspect but
haven't been able to prove that some of the lower address bits are
flipped, possibly to avoid routing problems on the board.
It's worth noting that the Alesis MMT-8 is based on almost identical
hardware (much simpler though, and I have a schematic for this. Tony
Duell would be pleased to note that there's not a custom chip in sight!)
and has a "normal" ROM, ie. running strings(1) on it will show up the
messages.
I can give you a dump of the ROMs if you feel like having a go.
Gordon
10 Feb
10 Feb
7:42 a.m.
From: gordonjcp at gjcp.net
---snip---
The only thing is, a simple disassembly of the ROM leads nowhere,
possibly because the contents are scrambled in some way. I suspect but
haven't been able to prove that some of the lower address bits are
flipped, possibly to avoid routing problems on the board.
Hi
It should be relatively easy to trace the board to see if
there are any swapped address lines. Most circuits at most
have an address latch to catch the multiplexed address and
then go to the 80C32. As I recall most used a 74LS373 to
latch half addresses. The other half would be directly connected
to the 80C32.
Dwight
_________________________________________________________________
Climb to the top of the charts!?Play the word scramble challenge with star power.
http://club.live.com/star_shuffle.aspx?icid=starshuffle_wlmailtextlink_jan
10:51 a.m.
Basically I'm trying to reverse-engineer the
firmware of a couple of
late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
custom ASIC for the sample playback and an 80C31 for the clever stuff.
I assume the ROM address latch is hidden in that ASIC, and isn't a
seprate '373 or '572 chip If it was, it would be trivial to trace out the
address bit order, of course. Do the ROM data pins connect straight to
the 8031 (without going through the ASIC). At least you could make sure
the data bits are in the expected order.
What aobut using a logic analyser, connected to the EPROM? You could
capture the first few instructions and the addresses _at the ROM pins_.
You can spot jumps, etc and thus work out what the addresses _should_ be
and thus work out which bit ends up on which EPROM pin.
-tony
2:08 p.m.
On Sun, 2008-02-10 at 18:51 +0000, Tony Duell wrote:
No, the ASIC is *only* for playing back samples. The address latch is a
75HC573
Basically
I'm trying to reverse-engineer the firmware of a couple of
late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
custom ASIC for the sample playback and an 80C31 for the clever stuff.
I assume the ROM address latch is hidden in that ASIC, and isn't a
seprate '373 or '572 chip If it was, it would be trivial to trace out the
address bit order, of course. Do the ROM data pins
connect straight to
the 8031 (without going through the ASIC). At least you could make sure
the data bits are in the expected order.
The OS ROM connects up as you'd expect. AD0-AD7 through the latch,
A8-A15 direct.
What aobut using a logic analyser, connected to the
EPROM? You could
capture the first few instructions and the addresses _at the ROM pins_.
You can spot jumps, etc and thus work out what the addresses _should_ be
and thus work out which bit ends up on which EPROM pin.
Actually, just looking at the PDFs of the datasheets and the physical
layout on the board provided the clue I needed. I didn't even need to
put the new battery I just bought in the meter ;-)
I've sussed out what's going on, and written a wee proggy to unscramble
the ROM images. Took about five minutes once I'd figured out how it was
all connected.
Gordon
11 Feb
11 Feb
1:44 p.m.
On Sun, 2008-02-10 at 18:51 +0000, Tony Duell wrote:
No, the ASIC is *only* for playing back samples. The address latch is a
75HC573
I assume you have a '573 pinout... In which case it is _very_ easy to
trace the known data pins on the processor to the D inputs of that latch,
and from the Q outputs of the latch to the EPROM address pins. That will
tell you which order the address lines are wired up in.
Basically
I'm trying to reverse-engineer the firmware of a couple of
late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
custom ASIC for the sample playback and an 80C31 for the clever stuff.
I assume the ROM address latch is hidden in that ASIC, and isn't a
seprate '373 or '572 chip If it was, it would be trivial to trace out the address bit order, of course. Do the ROM data
pins connect straight to
the 8031 (without going through the ASIC). At least you could make sure
the data bits are in the expected order.
The OS ROM connects up as you'd expect. AD0-AD7 through the latch,
A8-A15 direct. What aobut using a logic analyser, connected to
the EPROM? You could
capture the first few instructions and the addresses _at the ROM pins_.
You can spot jumps, etc and thus work out what the addresses _should_ be
and thus work out which bit ends up on which EPROM pin.
Actually, just looking at the PDFs of the datasheets and the physical
layout on the board provided the clue I needed. I didn't even need to
2:26 p.m.
On Mon, 2008-02-11 at 21:44 +0000, Tony Duell wrote:
Don't keep me in suspense. What did they do?
Have a look at the pinout for a JEDEC EPROM and an 80C32, and line them
up so that all the pin 1 ends are level. Now imagine the HC573 in
between.
What pins does the 80C32 use for AD0-7? What about A0-7 on the EPROM?
Yup. They're flipped.
Gordon
3:38 a.m.
What aobut using a logic analyser, connected to the
EPROM? You could
capture the first few instructions and the addresses _at the ROM pins_.
You can spot jumps, etc and thus work out what the addresses _should_ be
and thus work out which bit ends up on which EPROM pin.
Add to that - stuff in an EPROM full of NOPs ... Makes it very easy to
trace the address bus (it just increments).
To the OP: Once you do figure out the address/data bit mapping (assuming
it's not "normal"), I can give you a utility I wrote which will read an
Intel or Motorola format download file and rearrange the data / address
bits according to maps you provide. Figure out the mapping, read the EPROM,
run this utility to "fix" it and you should be good to go with a
disassembler or emulator.
Dave
--
dave06a (at) Dave Dunfield
dunfield (dot) Firmware development services & tools: www.dunfield.com
com Collector of vintage computing equipment:
http://www.classiccmp.org/dunfield/index.html
5:56 a.m.
On Mon, Feb 11, 2008 at 06:38:35AM -0500, Dave Dunfield wrote:
Add to that - stuff in an EPROM full of NOPs ... Makes it very easy to
trace the address bus (it just increments).
Good idea
To the OP: Once you do figure out the address/data bit
mapping (assuming
it's not "normal"), I can give you a utility I wrote which will read an
Intel or Motorola format download file and rearrange the data / address
bits according to maps you provide. Figure out the mapping, read the EPROM,
run this utility to "fix" it and you should be good to go with a
disassembler or emulator.
Oh, I figured out the mapping after looking at the PCB for about 10
seconds ;-)
Now the fun starts - working out how to emulate the hardware. I've a
rough idea of where the keyboard matrix and the display are mapped...
Gordon
6159
days inactive
6161
days old
10 comments
6 participants
participants (6)
-
ard＠p850ug1.demon.co.uk -
dave06a＠dunfield.com -
davis＠saw.net -
dkelvey＠hotmail.com -
gordonjcp＠gjcp.net -
mcguire＠neurotica.com