Dumping special format rom

Page 4/5
1 | 2 | 3 | | 5

By Takamichi

Champion (316)

Takamichi's picture

06-07-2020, 19:17

This contains three archives;
1. Page 2 and 3 dumps after typing PO7,0AAH and PO7,0FFH respectively
2. Videos showing me trying to rewrite the addresses after PO7,081H and PO4,0 . 0000H-7FFFH are originally 32 00s and 32 FFs repeated, and can be rewritten = RAM. 8000H-BF30H are codes and unrewritable. BF31H-FFFFH are all FFs and unrewritable. The result same regardless the memory card is inserted or not so the RAM is not the SRAM contents though both are 32 KB. Note TESTRAM did not indicate any existence of mapper RAM.
3. Various closeups of IC7 vicinity. Many pins are unused but it's difficult to tell which, some patterns are running BETWEEN pins instead of from them. I hope these help.

By NYYRIKKI

Enlighted (5556)

NYYRIKKI's picture

06-07-2020, 21:34

Indeed... It seems that there are lots of wires traveling below the chip. How ever looking the pics carefully I would feel reasonably confortable to say that:

I/O port 4 = PPI port A (output): bits 6 and 7 don't have a purpose... but rest is still quite a mystery, summary below.

I/O port 5 = PPI port B (output): This is not connected anywhere.

I/O port 6 = PPI port C (input & output): Output is not connected, but input in bits 0 and 1 seem to have some some purpose... If I would need to guess one of them is propably status if the card is inserted or not and other one is the battery status of the card... Here I'm yet again making just wild quesses... If you like, you may try to read this port with "PI6"-command and see if the value changes depending of if the card is in place or not... I think you should see values between #FC and #FF

I/O port 7 = PPI control (Standard PPI feature)

Ok, so let's look more closely the I/O port 4:
bit 6-7 = N/C
bit 4-5 = Bank number (0-3) for 16kB memory area #8000-#BFFF

bits 0-3 affect the 32kB memory area #0000-#7FFF
Table of tested bit 0-3 values:
0000 (#0) = RAM
0101 (#5) = SR-ROM
1010 (#A) = SR-ROM
1100 (#C) = Boot logo ROM
1111 (#F) = Disconnected

This table does not make a whole lot sense to me... but as this I/O port seems to be only way of accessing the hardware resources there must be external memory card (min 1 page) + 64kB of ROM (2 pages) + 128kB of RAM (4 pages) = at least 7 out of 15 possible combinations in use.

I think best way to continue from here is just to output all values between #0-#F to this port 4 and each time test few first bytes if they are RAM or not... and if they are then write a little ID there (like "12 34 xx" where xx is the page number tried), so that the page can be recognized if it repeats again. Other possible first (address 0) values should be #DD #DD for Boot logo, #53, #52 for "SR-ROM" or #FF, #FF for "Disconnected"

When you get this kind of table collected, I think we will find the final logic... and who knows, maybe OpenMSX team like to support the cartridge.

By NYYRIKKI

Enlighted (5556)

NYYRIKKI's picture

06-07-2020, 21:31

Ok, I managed to follow the lines from the pics and I can see that these bits 0-3 are indeed divided in to 0-1 and 2-3 in nearby 74LS139 as I originally thought... but what happens then is something I just can't see from the pics. Why we get "SR-ROM" selected with two totally different bit patterns seems a bit weird.

By Manuel

Ascended (16689)

Manuel's picture

06-07-2020, 21:34

Sure, if you fully find out how it works and have the ROM fully dumped, I'll write support for it in openMSX Smile

By Takamichi

Champion (316)

Takamichi's picture

07-07-2020, 17:33

Result of executing PI6 command:
With memory card
HEX:02 BIN:00000010
DEC(+)2 DEC(+-):2

Without memory card
HEX:03 BIN:00000011
DEC(+):3 DEC(+-):3

What else should I do? Note Knit Designer detects not only absence/presence of the card but also if its battery is low.
Beside, since this software doesn't seem to use MSX2+ features I tried it on Daewoo CPC-400 MSX2. The KD2 booted at first but stopped here without displaying the picture above the message. Whether it simply isn't progressing or is really hanged is undetectable because CPC-400 doesn't have any PAUSE button to test.

One problem about emulating Knit Designer is there is no interface to transfer data from the platform to the memory card. The official website doesn't mention any, nor about the Knit Designer. There may had been one for PC/MAC/PC9801/... but no information at all. I might ask Silver Reed.

By NYYRIKKI

Enlighted (5556)

NYYRIKKI's picture

07-07-2020, 19:40

Takamichi wrote:

What else should I do?

Ok, I'll dismantle the instructions to a "program" you can execute... It includes few extra steps this way, but we should get a perfect result. Although we already have all ROM data already, I added save commands so that if there is some data still alive on the card, we don't permanently destroy it in the process.

Load Super-X & init PPI:

BLOAD"SUPER-X.LDR",R
_@
PO 7,81h

Repeat these steps with following XX= values: 00,01,02,03,04,05,06,07,08,09,10,11,12,13,14,15
Loop:
- Write:

PO4,XX
S#PAGEXX.ROM,0#1,7FFF
D0#1

- Take fresh line on notepad and write XX
- Look if the first bytes contain "12 34", if they do, write to notepad "=" and two numbers following the "12 34"
- Write "1234" and XX
- write to notepad 3 first bytes from screen (=6 numbers)
- Press ESC
- Take next XX number from the list and jump to Loop.

- Post the results from notepad to here.

Quote:

Note Knit Designer detects not only absence/presence of the card but also if its battery is low.

Using simple exclusion logic, if presence is bit 0 then battery status must be bit 1...

Quote:

Beside, since this software doesn't seem to use MSX2+ features I tried it on Daewoo CPC-400 MSX2. The KD2 booted at first but stopped here without displaying the picture above the message.

Yes, it seems to do this on emulator as well... I eat my hat if it not related to the fact that main RAM is in slot 0-2... This is poison to countless of other software as well.

Quote:

One problem about emulating Knit Designer is there is no interface to transfer data from the platform to the memory card. The official website doesn't mention any, nor about the Knit Designer. There may had been one for PC/MAC/PC9801/... but no information at all. I might ask Silver Reed.

As they were in business of selling those cards, I doubt they had any backup software... but you newer know... If you followed the instructions carefully, I think you should now have backup of the card as well... I just don't know the correct file yet. :)

By Manuel

Ascended (16689)

Manuel's picture

07-07-2020, 22:12

For posting images, consider using msx.pics! Then they'll stay online for a longer time than WeTransfer.

By Takamichi

Champion (316)

Takamichi's picture

08-07-2020, 05:57

Oh yes I forgot I had msx.pics account. I'll upload later. Edit: Done.
Silver Reed answered me. Surprisingly many of their knitting tools were developed by Soft Byte the UK company. Silver Link 3 is the PC interface for the memory card. Designaknit is the PC software with not so cheap price.
PC10 (manual) (video) is a standalone designing device (not from Soft Byte) using the memory card. New price was 120k (!) yen, about half at yahoo auction and ebay. Whatever, we can ask Soft Byte for the data structure if necessary.

By Takamichi

Champion (316)

Takamichi's picture

08-07-2020, 17:23

I repeated the instruction 16 times. D0#1 (D, zero, #, one... right?) never showed "1234", though PAGE13 was a little close. page(trial number)+1234+page+initial three bytes were;
00123400AA0000
01123401000000
02123402000000
03123403000000
0412340453521F
0512340553521F
0612340653521F
0712340753521F
0812340853521F
0912340953521F
1012341053521F
1112341153521F
12123412DDDDDD
13123413200010
14123414FFFFFF
15123415FFFFFF
The screenshots of the dumps are here and the dumped roms are here (wetrasnsfer).
I executed "PO 7,81h" only before page00 try, but skipped before page01 and later. Was it necessary every time?

One more clue: The memory card isn't empty but contains various patterns. Most are monochrome but some are colored. This is the first saved pattern.

By NYYRIKKI

Enlighted (5556)

NYYRIKKI's picture

08-07-2020, 19:53

Oh, seems that I gave you bad instructions again... With this:

Quote:

- Write "1234" and XX

I meant MSX, not notepad... The idea was to test what addresses are writeable and if there is some repetion of pages.
Anyway the excercise was not useless at all... We got loads of good data that should now explain how these bits 0-3 work. As it seems the RAM does not repeat, we don't need to repeat this test.

After I saw your screenshots of the patterns, I realized I mixed what is memory card data and what is button graphics for the software. The thing that I earlier called "SR-ROM" seems to be the memory card and the "SR" is propably "Silver Reed" that is used to verify that the card is ok and formatted.

The buttons are saved to ROM in same format as BASIC COPY-command uses while writing SCREEN 5 graphics to disk... this made it very easy to see that I'm looking buttons instead by trying:

SCREEN5:COPY "ROMSAMPL.DAT" to (0,0):A$=INPUT$(1)

The logo ROM is just RAW VRAM dump, so it is easy to convert it to .SC5 by adding #FE,#00,#00,#FF,#7F,#00,#00 in front.

Ok, back to the point... In the end the bits 0-3 in I/O port 4 seem to go like this:

values 0-3 seems to be the 128kB of RAM
values 4-11 seem to activate the memory card
value 12 seems to activate the Logo ROM
value 13 seems to activate the Button ROM
and values 14-15 are unused...

Putting this in to other words:
bit 2-3, Device select (0-3):
0 = RAM
1 = Memory card
2 = Memory card
3 = ROM
bit 0-1, Bank select (0-3)

I just wonder how big memory card this system supports... Does the manual say anything about that? In theory there would be enough space to support up to 256kB.

To verify our findings one last test round is needed (In case you can verify that all my findings are now correct)

- Remove memory card from cartridge and put the cartridge to slot 1
- Type:

BLOAD"SUPER-X.LDR",R
_@
PO 7,81H
PO 4,0
D0#1
50 (ESC)
PO 4,1
D0
51 (ESC)
PO 4,2
D0
52 (ESC)
PO 4,3
D0
53 (ESC)
PO 4,0
D0

You should now see that first byte is 50, correct?
-type

(ESC)
PO 0,1
D0

You should now see that first byte is 51, correct?
-type

(ESC)
PO 0,2
D0

You should now see that first byte is 52, correct?
-type

(ESC)
PO 0,3
D0

You should now see that first byte is 53, correct?
-type

(ESC)
PO 0,4
D0

You should see that all bytes on screen are #FF, correct?

Quote:

I executed "PO 7,81h" only before page00 try, but skipped before page01 and later. Was it necessary every time?

No, you only need to execute this again if you power down the computer.

Page 4/5
1 | 2 | 3 | | 5