| |
Fresh
Registered: Jan 2005
Posts: 101 |
MPS803 external EPROM
Hi everyone,
some time ago I purchased for nearly nothing an old MPS803 and these days I found the time to open it to clean it up and, well, to take a look at what's inside.
It turns out the motherboard has a couple of free sockets where you can put, respectively, a 74373 and a 2732 (or 2764).
The Service Manual states that by adding those ICs and shorting a jumper you can switch from internal D7811G ROM to external EPROM.
Looking at the emulators I only found a font file (mps803) so my first guess is it can only be used for fonts. Still, according to the Service Manual, the EPROM should basically replace the internal ROM.
Now, I do know the hardware is heavily limited, but I'm pretty curious about this extension: is it only useable for fonts or is it possibile to put code there?
And if the latter, is there any documentation about it?
Thanks you all! |
|
| |
chatGPZ
Registered: Dec 2001
Posts: 11385 |
If you find out, let us know, so we can emulate it :)
I have only ever heard about alternative font ROMs for that matter |
| |
BiGFooT
Registered: Mar 2002
Posts: 33 |
7811 can operate with an external ROM when the M0 (pin 29) and M1 (pin 27) set to low. Unfortunately, I'm not aware about any kind of dump or hacked MPS803 ROM in the wild. You can run any code with this external ROM method. In theory, running code above 4K and switching the M1 pin on-the-fly it's even possible to dump the internal ROM.
Here's a good read about 7811 hacking: http://zine.r-massive.com/casio-rz-1-firmware-hacking/ |
| |
Fresh
Registered: Jan 2005
Posts: 101 |
Thanks Bigfoot,
yes, that's the same site I found yesterday and I had the same idea: trying to add a switch to change MODE 1 while the device is on.
This evening I traced down some ports I'll use to test if my code is actually working. I'll test them tomorrow.
Then I'll try to create something more complex, copy it on both $0000 and $1000, and move the execution to $1000+: if changing M1 doesn't trigger reset or some other IRQs/NMIs, and - most of all! - if I've understood it correctly, the execution should transparently continue above $1000 on the first block of my EPROM.
If confirmed, this indeed could be used to dump the mask ROM.
There are a lot of assumptions but maybe it's going to work.
Will surely let you know! |
| |
chatGPZ
Registered: Dec 2001
Posts: 11385 |
It isnt the same MCU as in 1520, right? https://e4aws.silverdr.com/hacks/6500_1/ |
| |
Krill
Registered: Apr 2002
Posts: 2980 |
Hmm no, should be one of https://en.wikipedia.org/wiki/78K#78K1_Series - more specifically https://www.cpcwiki.eu/imgs/7/74/UPD7811G_Datasheet.pdf =) |
| |
Walt
Registered: May 2004
Posts: 47 |
Many years ago a friend and me wanted to modify the font of a Commodore printer (can't remember the model). It used an EPROM and we did get it to work after debugging the power-up code and realising it did a checksum of the whole EPROM and would halt if it was wrong... |
| |
Fresh
Registered: Jan 2005
Posts: 101 |
Ok, I've just completed some first coding attempts.
At least the first assumption is verified: I could indeed execute code using the EPROM.
I read the button status (Port C - Bit 0) and used it to control power led (Port C - Bit 4).
As of now, the only downside is that playing with this stuff is quite slow as I need to reburn a EPROM everytime, nevertheless I'll try to go further. |
| |
Fresh
Registered: Jan 2005
Posts: 101 |
It worked!
I managed to dump the whole mask ROM of the MCU of the printer so now I can start disassemble it.
I'd be glad to share both the dump codes and the dump itself somewhere, for preservation. Do you think there may be copyright problems putting it here? |
| |
chatGPZ
Registered: Dec 2001
Posts: 11385 |
Not sure in what form it would qualify a release here - i'd put it on github and then send Bo Zimmermann a mail so he can put it on zimmers.net too |
| |
Fresh
Registered: Jan 2005
Posts: 101 |
Ok, thanks Groepaz.
If you're curious you can find all the stuff here: https://bitbucket.org/freshness79/78c11romdumper/
I'll drop a drop email to Zimmermann, as you suggested. |
... 7 posts hidden. Click here to view all posts....
|
| Previous - 1 | 2 - Next |
