Rom Hunter mkII

Pagina 6/11
1 | 2 | 3 | 4 | 5 | | 7 | 8 | 9 | 10 | 11

Van rderooy

Hero (568)

afbeelding van rderooy

04-07-2019, 12:40

gdx: Nice find on the original ROM Hunter. But are you sure about that 1984 date? It says MSX/2 on the front which seems to imply a later date. Also I don't see any mention of disk support, only tape. For the mk2 release you need that separate disk which does not seem to be included with the original release.

Van Takamichi

Master (209)

afbeelding van Takamichi

04-07-2019, 13:22

I downloaded SHEM, peeked at the document. Slot switching feature? I will try later.
Meanwhile I peeled the historic label and found not the screws but just the holes! I frantically wriggled the casing then suddenly it came off. The PCB was stuck hard too; after several tries it seemed the PCB comes off only when the force is applied from one specific direction. Right now I am keeping the PCB bare to save difficulty of removing again. Photos 1 2 3 4 I took a diagonal photo to show the capacitors. edit: Where is the info on Rom Hunter mkI?

Van gdx

Prophet (2927)

afbeelding van gdx

04-07-2019, 13:45

rderooy,
I'm not sure. It's probably between '85 and '86.

Takamichi,
Thank you for the pictures. Info comes from the box.

Van gdx

Prophet (2927)

afbeelding van gdx

04-07-2019, 14:28

rderooy wrote:

I don't see any mention of disk support, only tape.

It's writen on the back of box : "Can copy cartridges up to 32kB on tape or disk".

"32kバイト大容量カートリッジも、テープ又はディスクにコピーOK"

Van Takamichi

Master (209)

afbeelding van Takamichi

04-07-2019, 15:26

Translations for the earlier "mkI":
---
* Can copy even the protected ROM cartridge and 32 KB large capacity cartridge to tape or disk (rom hunter disk required)
* Absolutely does not require modifying the MSX itself
* Supports all MSX and MSX2 having 2 throttles or more, insensitive to the memory of the MSX
* Can be also used as a 16K expansion RAM cartridge
---
2 "throttles" typo again ;) Anyway what I've done so far;
Testing environment: A1GT, Sony HBD-F1 FDD in slot 1, Rom Hunter in slot 2. The A1GT's FDD is broken...
A diskette with MSX-DOS2 files and SHEM.COM
1. MSX power on. Rom Hunter tape menu boots. Choose [6} SKIP CARTRIDGE. MSX-DOS2 boots. Run SHEM.
2. Push CTRL+Y to enter "virtual slot change". Change three of the figures after "Target:" to 02. 4th figure (page 03) can't be changed; manual says it's to prevent crashing. Each figure represents a page. In this mode the page contents displayed is that of the assigned slot.
3. Rom Hunter system starts from 4000. I see character string DAITO MICO M starting from 44FE. This probably coincides with Manuel's analization. The system continues to 5021 and after that, full of FFs until 50FF with exception of 03 at 5080.
4. Something looks like code starts from 5100. 1E 00 CD 3C 52 1E 00 CD 5E 52 CD C2 51 38 55 06... until 5268 then full of FFs until 5FFF.
5. From 6000, contents exactly same as those from 4000 are located. I noticed this double existence when I dumped Rom Hunter as a 16KB rom.
6. From 7100, same as 4. except the address is +2000.
7. From 8000, full of 00s until BFFF. I seem to be able to rewrite the contents, which probably means it's RAM not ROM. A few bytes are not 00;
DD in 9102
73 in A5D2
80 in A756
I can rewrite these bytes.
8. I wanted to know the contents from C000 so I pushed CTRL+T and changed page 3 (4th figure after "Slot :") from 03 to 02. MSX froze instantly as warned in the manual.

What else should I try? Edit: I forgot to say between 2. and 3. that 0 to 3FFF are all FFs. Edit 2: Strange, now area from around 9000 contain not 0s but something complex. Was it rewritten by SHEM? I cannot reproduce the 00s... I almost thought so, but after shutting down the MSX for a while then rebooting, the area became all the 00s, and those irregular bits like DD in 9102 became 00s too.

Van gdx

Prophet (2927)

afbeelding van gdx

04-07-2019, 15:19

You can find info about ASCII mapper here:
https://www.msx.org/wiki/ROM_mappers#ASC8_.28ASCII.29

The unused bits (bit 7 to 4) may be used on the RH mkII to switch the ROM and the RAM or/and an eventual write protection, if this the case I think It will not be difficult to deduce the functioning, but not if it is another method it will not be easy without disassemble the software.

SHEM must not be able to change slots on page 3 (C000h~FFFFh).

Van Takamichi

Master (209)

afbeelding van Takamichi

04-07-2019, 15:54

Seeing is believing, here's 0000-BFFF of the Rom Hunter cart I've saved using SHEM. PIN is imbiggerthanyouthink Edit: this is all I could do today

Van Manuel

Ascended (15620)

afbeelding van Manuel

04-07-2019, 16:19

What can our hardware experts derive from the PCB pictures?

Van RetroTechie

Paragon (1563)

afbeelding van RetroTechie

04-07-2019, 19:37

(EP)ROM is 64 Kbit (8 Kbyte). DRAMs are 256K*1 bit type (although "4256" suggests otherwise Wink ), so in total 2 Mbit / 256 Kbyte. Guess you already knew this.

There's a set of 4 mapper registers of (in total) 8 bits wide (the 2x LS670). How many of those are used? You'd have to check how many of the data input & outputs are wired up. But anyway that would be maximum 256 blocks, in 4 memory ranges. Potentially mirrored elsewhere - switch blok in a range, block in another range switches as well. But 4 registers to set in any case. Or in theory, perhaps 8 registers, 4 bit wide... Nah, with 256KB RAM & 8 KB blocks, don't think so.

And there's a separate 4 bit register (the LS175). How many of those are used? Again: check how many of the D & Q pins are wired up. Rest of the IC's are simple logic like (N)AND/OR gates, multiplexers and such. Keep in mind it's possible to eg. wire up some NAND gates into a flip-flip (1 bit register).

100% certain: no slot expansion here. My guess: probably there's some address range or I/O port, which can be written to page out the ROM & page a RAM mapper in. Or some (hardware) flag gets set then, and the next memory access pages the ROM out? Debugging the ROM on an emulator leads to a crash because the 'ROM out, RAM mapper in' doesn't happen in that environment. On the real hw: perhaps some helper routine in say, C000-FFFFh area that does this final bit, and jumps to the cartridge that was loaded into the RAM mapper beforehand?

If someone would map out (all) connections between the IC's, it would be easy to produce a schematic & figure out how it works. Checking all connections would be a tedious job though... not to mention error-prone. Tongue As a shortcut: see how that '175 is clocked, what goes in as data, and how its Q (or /Q) outputs are used.

This extra IC + wires, anyone know whether that's from factory, or user mod? Or what's underneath the piggyback IC?

Pagina 6/11
1 | 2 | 3 | 4 | 5 | | 7 | 8 | 9 | 10 | 11