|
|
Joined: Jan 2012
Posts: 1,179 Likes: 17
Very Senior Member
|
Very Senior Member
Joined: Jan 2012
Posts: 1,179 Likes: 17 |
I've added an archive with the newly dumped ROMs of the Philips :YES from the vcfed forum thread to the FTP.
NCR DMV- DEC Rainbow- Siemens PCD- ITT 3030-Oly People- Acorn A5000- Olivetti M20
|
|
|
|
|
Joined: Jan 2021
Posts: 62 Likes: 56
Member
|
|
Member
Joined: Jan 2021
Posts: 62 Likes: 56 |
Casio CTK-2100 (2009) ROM dump: https://revenant1.net/ctk2100.zipService manual for CTK-2000 (same hardware): https://www.manualslib.com/manual/933451/Casio-Ctk-2000.htmlTime to figure out yet another piece of custom hardware - the CPU this time is a glop-top, listed as "uPD800468P-012" in the schematic. All I've determined so far (after just dumping the ROM yesterday) is that it's little-endian, and not a H8 derivative/clone like the GT913 is. Sample compression seems (sounds) similar to the GT913 format, but the default voice/drum pad sounds are also present as uncompressed 16-bit PCM at the very end of the ROM.
|
|
|
|
|
Joined: Mar 2001
Posts: 17,181 Likes: 211
Very Senior Member
|
Very Senior Member
Joined: Mar 2001
Posts: 17,181 Likes: 211 |
It looks like an ARM at first:
000000: e59ff060 LDR R15, [R15, #$60] (68)
R15 is the program counter on ARM, and you can directly load it to jump so an LDR like this at the boot location is normal.
But the code at 68 doesn't make sense.
000068: 18000004 STMNE [R0], { R2 }
00006c: 2a003e00 BCS $f874
000070: 18000080 STMNE [R0], { R7 }
000074: 00010000 ANDEQ R0, R1, R0
000078: 00020000 ANDEQ R0, R2, R0
00007c: 0000f000 ANDEQ R15, R0, R0
000080: eb000000 BL $88
000084: eb007e12 BL $1f8d4
000088: e28f002c ADD R0, R15, #$2c
|
|
|
|
|
Joined: May 2004
Posts: 1,767 Likes: 34
Very Senior Member
|
|
Very Senior Member
Joined: May 2004
Posts: 1,767 Likes: 34 |
can't ID it myself either, 2009 is quite late too, a lot of architectures had died out by that point unless they were still relying on something much older.
worth adding as a skeleton, although I guess we can't rule out there being an internal ROM in the glob too, although the start of the ROM here does look kinda like you'd expect for the start of a ROM.
|
|
|
|
|
Joined: Jan 2021
Posts: 62 Likes: 56
Member
|
|
Member
Joined: Jan 2021
Posts: 62 Likes: 56 |
I can see at least some reasonable-looking ARM stuff starting a bit further into the ROM:
001358: e92d0003 STMPW [R13], { R0-R1 }
00135c: e59f122c LDR R1, [R15, #$22c] (1590)
001360: e5910000 LDR R0, [R1]
001364: e2800001 ADD R0, R0, #$1
001368: e3500901 CMPS R0, #$4000
00136c: e5810000 STR R0, [R1]
001370: 9a000006 BLS $1390
001374: e59f0218 LDR R0, [R15, #$218] (1594)
001378: e3a01004 MOV R1, #$4
00137c: e5801014 STR R1, [R0, #$14]
001380: e59f0210 LDR R0, [R15, #$210] (1598)
001384: e5901000 LDR R1, [R0]
001388: e3811004 ORR R1, R1, #$4
00138c: e5801000 STR R1, [R0]
001390: e8bd0003 LDMUW [R13], { R0-R1 }
(etc...)
|
|
|
|
|
Joined: May 2004
Posts: 1,767 Likes: 34
Very Senior Member
|
|
Very Senior Member
Joined: May 2004
Posts: 1,767 Likes: 34 |
might be an ARM with internal ROM to boot from then, see if you can figure out what address the valid code maps at?
should be possible to modify the external ROM to dump an internal ROM if the chip can be reprogrammed, although you need to understand how to output the data somehow.
|
|
|
|
|
Joined: Jan 2021
Posts: 62 Likes: 56
Member
|
|
Member
Joined: Jan 2021
Posts: 62 Likes: 56 |
There are pointers in ROM to stuff like the table of instrument names, etc, where the actual addresses are at 0x18000000+, so I'm assuming that's where the external ROM is supposed to be mapped.
It's probably also worth mentioning that the CPU does have all(?) of its pins broken out to visible test points on the board, and there are a decent number of unconnected pins on the schematic that may or may not be related to some kind of debug interface.
|
|
|
|
|
Joined: Jan 2021
Posts: 62 Likes: 56
Member
|
|
Member
Joined: Jan 2021
Posts: 62 Likes: 56 |
It looks like an ARM at first:
000000: e59ff060 LDR R15, [R15, #$60] (68)
R15 is the program counter on ARM, and you can directly load it to jump so an LDR like this at the boot location is normal.
But the code at 68 doesn't make sense. Actually, looking again, this should be an indirect jump - given the load address I mentioned above, this actually ends up jumping to the address stored at 0x68 in the ROM, which is 0x18000004, i.e. the very next instruction, which is valid code. I wonder if you could get it partially booting by just mirroring the ROM appropriately. (I'm suddenly reminded of e.g. "FastROM" SNES games which boot up and then immediately jump to a ROM mirror with fewer wait states)
Last edited by Revenant; 10/20/21 02:44 AM.
|
|
|
|
|
Joined: Mar 2001
Posts: 17,181 Likes: 211
Very Senior Member
|
|
Very Senior Member
Joined: Mar 2001
Posts: 17,181 Likes: 211 |
Yeah, good point. Execution does seem reasonable that way. There's likely a switchable mirror at 0 that turns into RAM later on, that was a common pattern on 680x0 systems.
|
|
|
|
|
Joined: Jan 2021
Posts: 62 Likes: 56
Member
|
|
Member
Joined: Jan 2021
Posts: 62 Likes: 56 |
Well, that looks like one mystery solved, at least. I'll probably start working on a preliminary driver sometime this week.
|
|
1 member likes this:
R. Belmont |
|
|
|
1 members (Dorando),
87
guests, and
3
robots. |
|
Key:
Admin,
Global Mod,
Mod
|
|
|
Forums9
Topics9,310
Posts121,714
Members5,070
| |
Most Online1,283
Dec 21st, 2022
|
|
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!
|
|
|
|
