How to do machine ROM dumps?

Page 2/2
1 |

By RetroTechie

Paragon (1563)

RetroTechie's picture

07-05-2019, 08:19

That marking is clearly some custom jobbie not IC type (looks like a Nec chip to me but that's just a guess). Googling turns up nothing. But for the most part you can deduce what it is:

Model page on this site's Wiki has some photo's of the main board, where you can see it's the only ROM. So all firmware combined in that chip.

Memory map shows a variety of firmware blocks, adding up to (if I count correctly) 192 KB. So that will be a 2 Mbit (256k x 8 bit) ROM. With some duplication, 'empty' space, or (less likely) a ROM mapper we don't know about.

256k x 8 bit mask ROMs are normally 32 pins - check. Chances are pinout will match that of eg. an MB832000 (see sd_snatcher's link). Which is almost identical to that of a 27C020 in read mode. So if you ever have access to an EPROM reader, 27C020 would be a good setting to try. Chip is socketed - nice! Putting in place of the ROM in a 2 Mbit MegaROM cartridge & read out in other MSX, would be another option. Modifying connections to take a 2 Mbit flash or UV EPROM should also be easy (but you'd have to know how blocks are arranged in the ROM before programming that).

You could verify some connections to be sure. I'm going by this photo from an earlier thread.

  • Pin 16 is ground, pin 32 is Vcc (+5V). Curiously pin 31 appears grounded too, I'd more likely expect that to hang on +5V as well, or be left unconnected. Probably doesn't matter much.
  • Chances are you'll find data lines connected (directly?) to the Z80. And lower address lines too (up to A13 or so), those perhaps through some buffer like 74LS367, '244 or such.
  • Leaving you with a couple of highest address lines, and 1 or 2 chip selects. Those signals will come from that bit of logic on the daughter board, which will take A14/A15 (and perhaps A13) and some slot select signals from S1985 as input.

Looks a well designed machine. And easily hackable too! (change floppy drive, RAM to 256 or 512K, etc).

By ali6x944

Master (196)

ali6x944's picture

09-05-2019, 17:56

@RetroTechie, the socket was added later by me for the sole purpose of reading it, sadly the TL886CS does not seem to read it, probably because the ROM isn't 27C020 compatible, But a 27C040 compatible ROM -THAT IS A 4Mb ROM?!?- which is really confusing Question , why the hell would they use an excessively large ROM I just can't get it Question
man this is hella weird, I am lost...
maybe that's why we have the supporting circuitry on the ROM board, probably used constrain the address and/or to page the ROM, but even then they used an excessively massive ROM to do this maybe they did that to add more integrated software at some point.
I will upload a .HEX file with images of the board markings to the forum hopefully it will be uploaded tonight Smile

By RetroTechie

Paragon (1563)

RetroTechie's picture

09-05-2019, 19:31

Pin 31 might be an additional, active-low chip enable. Hence that pin being wired to ground? Pin 1 is probably not connected on the ROM.

When read out as a 27C020, this pin (/PGM) would be held high, meaning chip is disabled & you get 'empty'. When read as a 27C040, pin 31 carries highest address line (A18). Which for a ROM with extra chip enable on that pin, means chip is enabled for addresses where A18 is 0 (lower half), and chip is disabled where A18 is 1 (upper half).

In that case, check contents of the file you got. Chances are one half is filled with FF hex, and the other half data. Snip the empty half off, and remaining half is your 2 Mbit ROM. Smile2 Alternative: bend ROM pin 31 sideways & connect to ground before plugging into EPROM reader (and then read as a 27C020).

P.S. do not even attempt to use the self-ID function of EPROMs ("signature mode") when you have a ROM in your programmer! Although unlikely, this could potentially damage the chip.

By ali6x944

Master (196)

ali6x944's picture

11-05-2019, 11:07

@RetroTechie, the mode worked, and the ROM was read Smile
still, there was a rather substantial empty region in the ROM again starting at 030000 and ending at 03FFF0.
so can I use both a 27C040 or a 27C020 as a drop-in-replacement for the ROM?

By RetroTechie

Paragon (1563)

RetroTechie's picture

11-05-2019, 12:01

Can you please upload that ROM somewhere? Quite a few people might be interested in that. The empty half (when read as a 27C040) is of no interest as it isn't part of the original ROM. 'Empty' space (no matter what contents) inside the remaining 2 Mbit IS however, as it's part of the original ROM & may be of interest w/ regards to the decoding circuitry on the daughter board. So you'll want a file of exactly 262144 bytes for the archives. Smile

ali6x944 wrote:

so can I use both a 27C040 or a 27C020 as a drop-in-replacement for the ROM?

Don't bother with a 4 Mbit EPROM. The hassle of matching contents to wiring of the socket will get tiresome quickly.

Why not use a Flash EPROM? No need to bother with UV lamp for erasure. Just wire pin 31 (= /Write Enable on a 2 Mb flash chip) on the socket to +5V, and pop it in. With suitable wiring it might even be possible to rewrite the flash chip in-system (simply wire to Z80 /WR signal? Nah that would be too easy Tongue ).

By ali6x944

Master (196)

ali6x944's picture

18-05-2019, 15:44

this is AX-350II ROM dump.
sorry, the upload info has a couple of mistakes if anyone knows how to edit the info please notify me on how to do it.
@RetroTechie what chips would you recommend? also, can a modified version of the ROM enable a MSX2+ upgrade?

Page 2/2
1 |