Previous Thread
Next Thread
Print Thread
Page 261 of 289 1 2 259 260 261 262 263 288 289
#112117 - 01/09/18 11:47 PM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2010
Posts: 1,041
seanriddle Offline
Very Senior Member
seanriddle  Offline
Very Senior Member

Joined: May 2010
Posts: 1,041
I'm pretty sure I'm dumping all of the external ROM; I'm using all the pins, so the only possibility is that /OE or /CE is really another address pin. I'll test that out later tonight. I thought I saw 6502 code in the ROM dump, but haven't spent a lot of time on it. It's odd to me that the AMIC die would be more ROM, and another similar board Klaus sent me has CPU, ROM and SRAM. The CPU die says ELAN EU3A05: www.seanriddle.com/spaceinvaderselan20xs.jpg There's definitely lots of ROM on it, so maybe that is it.

#112118 - 01/10/18 12:38 AM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: Mar 2001
Posts: 15,954
R. Belmont Offline
R. Belmont  Offline

Very Senior Member

Joined: Mar 2001
Posts: 15,954
USA
Starting a little after 0xF0000 there's almost 64K of clear 6502 code, but I couldn't come up with a mapping where the vector at FFFFE made any sense. I even found what's likely the boot entry point.

#112119 - 01/10/18 12:45 AM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2004
Posts: 1,499
Haze Offline
Very Senior Member
Haze  Offline
Very Senior Member

Joined: May 2004
Posts: 1,499
I think the 'vector' at FFFFE might just be some kind of checksum of the rest of the data, I likewise couldn't connect it with anywhere that looked like 'code' structures.

6502 is interesting, because none of the original games that run on it used a 6502, so I guess they're all rewrites then.

the blocks look game specific, so it might be you found the entry point to one of the games, not the menu

I couldn't see strings for several of the games in there (although it's possible they used gfx or a different encoding) but that did make me wonder if there was data missing.

Without a boot vector anywhere it does seem more likely it's booting from an internal rom, or some other device, or there is missing data.

#112120 - 01/10/18 01:10 AM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: Mar 2001
Posts: 15,954
R. Belmont Offline
R. Belmont  Offline

Very Senior Member

Joined: Mar 2001
Posts: 15,954
USA
Boot appears to be at F8000. It's slightly unconventional, but less than it first appears:

Code
loc_F8000:
		NOP
		NOP
		NOP
		NOP
		LDX	#0

loc_F8006:				; CODE XREF: ROM:F8007j
		DEX
		BPL	loc_F8006
		TXS
		CLD
		SEI
		LDA	#5
		STA	byte_500B
		LDX	#0

loc_F8013:				; CODE XREF: ROM:F8018j
		LDA	#$FE ; '�'
		STA	0,X
		INX
		BNE	loc_F8013
		LDA	#0
		STA	byte_0
		LDA	#1
		STA	byte_1
		LDY	#0

loc_F8024:				; CODE XREF: ROM:F8029j ROM:F8031j
		LDA	#$FE ; '�'
		STA	(0),Y
		INY
		BNE	loc_F8024
		INC	byte_1
		LDA	byte_1
		CMP	#$40 ; '@'
		BNE	loc_F8024
		LDA	#1
		STA	byte_201
		STA	byte_202
		LDA	#0
		STA	byte_F0
		STA	byte_F1
		STA	byte_F2
		STA	byte_203
		STA	byte_204
		STA	byte_205
		STA	byte_206
		STA	byte_207
		STA	byte_208
		STA	byte_209
		STA	byte_20A
		STA	byte_20B
		LDA	#$7F ; ''
		STA	byte_5040
		LDA	#$FE ; '�'
		STA	byte_5042
		LDA	#$56 ; 'V'
		STA	byte_5048
		STA	byte_5049
		LDA	#$FF
		STA	byte_5041
		LDA	#0
		STA	byte_5043
		STA	byte_5045
		LDX	#0

loc_F807F:				; CODE XREF: ROM:F8080j
		DEX
		BNE	loc_F807F
		LDA	byte_5041
		EOR	#$FF
		CMP	#$12
		BEQ	loc_F8090
		LDA	#0
		JMP	loc_E092
; ---------------------------------------------------------------------------

loc_F8090:				; CODE XREF: ROM:F8089j
		LDA	#1
		STA	byte_20C
		LDA	#0
		BIT	byte_500B
		BMI	loc_F809E
		LDA	#1

loc_F809E:				; CODE XREF: ROM:F809Aj
		STA	byte_F3
		CLD
		SEI
		LDA	#$7F ; ''
		STA	byte_500D
		LDA	#0
		STA	byte_500C
		LDX	#$FF
		TXS
		JMP	loc_8000

#112121 - 01/10/18 04:57 AM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2004
Posts: 1,499
Haze Offline
Very Senior Member
Haze  Offline
Very Senior Member

Joined: May 2004
Posts: 1,499
as discussed in the shoutbox, there's a chance that's just the code that an internal rom would jump to when you select a game

or it's a rather hacked up 6502 core they have in there..

not clear where this code would actually map, or what would map at 8000 to jump to either.

#112123 - 01/10/18 06:26 AM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2010
Posts: 1,041
seanriddle Offline
Very Senior Member
seanriddle  Offline
Very Senior Member

Joined: May 2010
Posts: 1,041
I wrote a graphics ripper for Williams games 20 years ago (on my Amiga!), and updated it 10 years ago for Windows: www.seanriddle.com/ripper.html It's specifically for that platform's 4-bit graphics, in either screen layout or blitter layout, but it will read any 64K file and try to display what it finds. I split out the Space Invaders 1M file into 16 64K files and ran it on those. There are sprites for all 5 of the games, as well as the Radica logo and the menu, and even a diagnostic mode with pass/fail graphics. So it really looks like all the data is in the ROM file, and I bet all the code is, too. Bank 0 has Colony 7 sprites, bank 1 has the Radica logo, bank 2 has the menu graphics, bank 3 has Space Invader sprites, bank 4 has Phoenix sprites, bank 5 includes what looks like a little Phoenix title screen, bank 8 has Lunar Rescue sprites, bank 9 has the Diagnostic Mode graphics, and bank 13 has Qix sprites.

I did a quick search for a "graphics explorer" type of program where you could define the width and height and bit depth, and scan through a binary file displaying each block of w*h*d/8 bytes, but didn't find anything. Anyone know of something like this?

The first time I dumped this Space Invaders Plug n Play ROM, I had a tiny solder bridge to one of the high address lines, and didn't notice it I soldered wires to 33 pads of a TSOP48!). So I wrote a little program to check a binary file to see if the data repeats at any interval that indicates that an address line is tied high or low. Is there any program that checks for common dumping issues? I was thinking about checking for address and data lines tied high or low or shorted to any other address or data lines. I usually check for data lines tied high/low by running a histogram on the hex file, but it would be nice to have one tool that checks several issues.

#112128 - 01/10/18 01:37 PM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2004
Posts: 1,499
Haze Offline
Very Senior Member
Haze  Offline
Very Senior Member

Joined: May 2004
Posts: 1,499
Ah right, non-tile based then I guess. I tried all the usual tile combinations and didn't find anything. That definitely rules out it being a NES-VT clone as RB speculated it might be, that's all strictly tile-based stuff.

Still the way the CPU runs is odd, so it's still possible there's an internal bootstrap of some kind, because there really are no boot vectors that a 6502 would need for booting / interrupts..

It's an odd one, we do know that 6502s did end up being heavily customized by this point, and we've even seen systems with brand new opcodes that aren't even part of the usual 6502 set, so working out what is actually going on could be tricky.

#112130 - 01/10/18 04:23 PM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: May 2004
Posts: 1,499
Haze Offline
Very Senior Member
Haze  Offline
Very Senior Member

Joined: May 2004
Posts: 1,499
fwiw that code maps at 0xe000

so 0xf8000 - 0xf9ffff is 0xe000 - 0xffff in 6502 memory map which DOES actually give the boot vectors

Code
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000F9FF0  00 00 00 00 00 00 00 00 00 00 3E E1 00 E0 3E E1  ..........>á.à>á


I'd overlooked them before because I was looking on 0x4000 block boundaries instead

#112134 - 01/10/18 08:33 PM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: Haze]  
Joined: Mar 2005
Posts: 499
incog Offline
Senior Member
incog  Offline
Senior Member

Joined: Mar 2005
Posts: 499
Bradford, UK
https://imgur.com/a/ptnMm - radica tetris, i sent one to sean in a package but i never marked them, it was mentioned in the shoutbox this system may share the same hw

#112137 - 01/10/18 09:12 PM Re: TMS-09xx/1xxx thread (was New Dumps) [Re: seanriddle]  
Joined: Mar 2002
Posts: 1,011
hap Offline
Very Senior Member
hap  Offline
Very Senior Member

Joined: Mar 2002
Posts: 1,011
Skeleton Warriors is added and working.
External artwork here: http://tsk-tsk.net/net/extart/tskelwarr.zip

[Linked Image]

Page 261 of 289 1 2 259 260 261 262 263 288 289

Who's Online Now
3 registered members (Sharkpuncher, mixmaster, Al Kossow), 20 guests, and 3 spiders.
Key: Admin, Global Mod, Mod
Shout Box
Forum Statistics
Forums9
Topics8,543
Posts111,673
Members4,795
Most Online225
May 26th, 2014
Powered by UBB.threads™ PHP Forum Software 7.6.0
Page Time: 0.095s Queries: 14 (0.053s) Memory: 5.0373 MB (Peak: 5.2623 MB) Zlib enabled. Server Time: 2018-06-19 02:29:13 UTC