Previous Thread
Next Thread
Print Thread
Page 80 of 81 1 2 78 79 80 81
Darkstar #119304 06/01/21 06:36 AM
Joined: Jan 2012
Posts: 1,165
Likes: 10
Very Senior Member
Offline
Very Senior Member
Joined: Jan 2012
Posts: 1,165
Likes: 10
I've added an archive with the newly dumped ROMs of the Philips :YES from the vcfed forum thread to the FTP.


NCR DMV- DEC Rainbow- Siemens PCD- ITT 3030-Oly People- Acorn A5000- Olivetti M20
rfka01 #119869 10/19/21 11:27 PM
Joined: Jan 2021
Posts: 48
Likes: 28
R
Member
Offline
Member
R
Joined: Jan 2021
Posts: 48
Likes: 28
Casio CTK-2100 (2009) ROM dump: https://revenant1.net/ctk2100.zip

Service manual for CTK-2000 (same hardware): https://www.manualslib.com/manual/933451/Casio-Ctk-2000.html

Time to figure out yet another piece of custom hardware - the CPU this time is a glop-top, listed as "uPD800468P-012" in the schematic. All I've determined so far (after just dumping the ROM yesterday) is that it's little-endian, and not a H8 derivative/clone like the GT913 is. Sample compression seems (sounds) similar to the GT913 format, but the default voice/drum pad sounds are also present as uncompressed 16-bit PCM at the very end of the ROM.

Darkstar #119870 10/19/21 11:52 PM
Joined: Mar 2001
Posts: 16,960
Likes: 76
R
Very Senior Member
Online Content
Very Senior Member
R
Joined: Mar 2001
Posts: 16,960
Likes: 76
It looks like an ARM at first:

000000: e59ff060 LDR R15, [R15, #$60] (68)

R15 is the program counter on ARM, and you can directly load it to jump so an LDR like this at the boot location is normal.

But the code at 68 doesn't make sense.

000068: 18000004 STMNE [R0], { R2 }
00006c: 2a003e00 BCS $f874
000070: 18000080 STMNE [R0], { R7 }
000074: 00010000 ANDEQ R0, R1, R0
000078: 00020000 ANDEQ R0, R2, R0
00007c: 0000f000 ANDEQ R15, R0, R0
000080: eb000000 BL $88
000084: eb007e12 BL $1f8d4
000088: e28f002c ADD R0, R15, #$2c

Darkstar #119871 10/20/21 12:14 AM
Joined: May 2004
Posts: 1,740
Likes: 8
H
Very Senior Member
Offline
Very Senior Member
H
Joined: May 2004
Posts: 1,740
Likes: 8
can't ID it myself either, 2009 is quite late too, a lot of architectures had died out by that point unless they were still relying on something much older.

worth adding as a skeleton, although I guess we can't rule out there being an internal ROM in the glob too, although the start of the ROM here does look kinda like you'd expect for the start of a ROM.

Darkstar #119873 10/20/21 01:57 AM
Joined: Jan 2021
Posts: 48
Likes: 28
R
Member
Offline
Member
R
Joined: Jan 2021
Posts: 48
Likes: 28
I can see at least some reasonable-looking ARM stuff starting a bit further into the ROM:

Code
001358: e92d0003  STMPW   [R13], { R0-R1 }
00135c: e59f122c  LDR     R1, [R15, #$22c] (1590)
001360: e5910000  LDR     R0, [R1]
001364: e2800001  ADD     R0, R0, #$1
001368: e3500901  CMPS    R0, #$4000
00136c: e5810000  STR     R0, [R1]
001370: 9a000006  BLS     $1390
001374: e59f0218  LDR     R0, [R15, #$218] (1594)
001378: e3a01004  MOV     R1, #$4
00137c: e5801014  STR     R1, [R0, #$14]
001380: e59f0210  LDR     R0, [R15, #$210] (1598)
001384: e5901000  LDR     R1, [R0]
001388: e3811004  ORR     R1, R1, #$4
00138c: e5801000  STR     R1, [R0]
001390: e8bd0003  LDMUW   [R13], { R0-R1 }
(etc...)

Darkstar #119874 10/20/21 02:00 AM
Joined: May 2004
Posts: 1,740
Likes: 8
H
Very Senior Member
Offline
Very Senior Member
H
Joined: May 2004
Posts: 1,740
Likes: 8
might be an ARM with internal ROM to boot from then, see if you can figure out what address the valid code maps at?

should be possible to modify the external ROM to dump an internal ROM if the chip can be reprogrammed, although you need to understand how to output the data somehow.

Darkstar #119875 10/20/21 02:21 AM
Joined: Jan 2021
Posts: 48
Likes: 28
R
Member
Offline
Member
R
Joined: Jan 2021
Posts: 48
Likes: 28
There are pointers in ROM to stuff like the table of instrument names, etc, where the actual addresses are at 0x18000000+, so I'm assuming that's where the external ROM is supposed to be mapped.

It's probably also worth mentioning that the CPU does have all(?) of its pins broken out to visible test points on the board, and there are a decent number of unconnected pins on the schematic that may or may not be related to some kind of debug interface.

R. Belmont #119876 10/20/21 02:42 AM
Joined: Jan 2021
Posts: 48
Likes: 28
R
Member
Offline
Member
R
Joined: Jan 2021
Posts: 48
Likes: 28
Originally Posted by R. Belmont
It looks like an ARM at first:

000000: e59ff060 LDR R15, [R15, #$60] (68)

R15 is the program counter on ARM, and you can directly load it to jump so an LDR like this at the boot location is normal.

But the code at 68 doesn't make sense.

Actually, looking again, this should be an indirect jump - given the load address I mentioned above, this actually ends up jumping to the address stored at 0x68 in the ROM, which is 0x18000004, i.e. the very next instruction, which is valid code.

I wonder if you could get it partially booting by just mirroring the ROM appropriately. (I'm suddenly reminded of e.g. "FastROM" SNES games which boot up and then immediately jump to a ROM mirror with fewer wait states)

Last edited by Revenant; 10/20/21 02:44 AM.
Darkstar #119877 10/20/21 02:54 AM
Joined: Mar 2001
Posts: 16,960
Likes: 76
R
Very Senior Member
Online Content
Very Senior Member
R
Joined: Mar 2001
Posts: 16,960
Likes: 76
Yeah, good point. Execution does seem reasonable that way. There's likely a switchable mirror at 0 that turns into RAM later on, that was a common pattern on 680x0 systems.

Darkstar #119878 10/20/21 03:26 AM
Joined: Jan 2021
Posts: 48
Likes: 28
R
Member
Offline
Member
R
Joined: Jan 2021
Posts: 48
Likes: 28
Well, that looks like one mystery solved, at least. I'll probably start working on a preliminary driver sometime this week.

1 member likes this: R. Belmont
Page 80 of 81 1 2 78 79 80 81

Link Copied to Clipboard
Who's Online Now
1 members (Pernod), 23 guests, and 4 robots.
Key: Admin, Global Mod, Mod
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics9,158
Posts119,911
Members5,034
Most Online1,283
Dec 21st, 2022
Our Sponsor
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!

Superior Solitaire
Forum hosted by www.retrogamesformac.com