QUFB

[QUFB @qufbee]

@lauriewired 2 Hitachi ISAs were mostly figured out by Piotr Piatek and Martin Poupe, although both seem to have relied on hardware testing.

On early CPUs without pipelining, you can use a logic analyzer to infer instruction length + jumps from ROM accesses, along with R/W to RAM or I/O.

[QUFB @qufbee]

@netspooky @iximeow @phrack Nice writeup! I think there's a typo on one of the decodings: "e93cef ; r0<-[0xef3c]" should be r1?

[QUFB @qufbee]

@ByteOrderMarc @travisgoodspeed (typo: 8 x 64 bits)

[QUFB @qufbee]

@ByteOrderMarc @travisgoodspeed I was looking at your older thread with the decap, if I'm reading right, each internal ROM can hold 64 bits x 64 rows x 12 columns = 0xC000 bytes. The script only dumps segment 0, since I got mirrored bytes after 0xC000, I never found code references but should also do segment 1.

[QUFB @qufbee]

@ByteOrderMarc @travisgoodspeed Here's a script that outputs a dumping binary, it just writes to a RAM address to be sniffed with a logic analyzer. Would be less cumbersome if it used the data port, but haven't yet checked which instructions are doing that. https://t.co/gyY9ueFp5r

[QUFB @qufbee]

@ByteOrderMarc @travisgoodspeed Some of these have interesting routines which just cycle through instructions, probably for testing memory access patterns... I think they are probably enabled from test pins but haven't traced which. Some models have test points labelled on the PCB.

[QUFB @qufbee]

@ByteOrderMarc @travisgoodspeed Also, all these models have an internal CPU ROM which can be directly read-out by setting data segment 0.

[QUFB @qufbee]

@GMMan_BZFlag Yeah I agree, doing it via UI is just cumbersome. Not allowing to edit bytes at defined instructions seems like protecting the user from errors needlessly. but at least all those memory operations can be scripted.

[QUFB @qufbee]

@GMMan_BZFlag In that case it's creating new memory regions, but you can avoid splitting and reuse an existing region with something like: currentProgram.getMemory().setBytes(address, bytes, startOffset, bytes.length)

[QUFB @qufbee]

@GMMan_BZFlag On loaders I usually prompt for some BIOS to set along with the loaded ROM, here's an example: https://t.co/NFVUOqhi5k

[QUFB @qufbee]

@kasamikona Does the function table have a static address? You can try storing that mov in a context register and then computing the address to call in a context variable, as it avoids most of these indirection issues: https://t.co/l2Mh2XXTUx

[QUFB @qufbee]

There's a variety of tests for memory, screen, networking, etc... Only first ROM test is passing at the moment.

[QUFB @qufbee]

MAME emulation is still WIP, but you can already check out this unused debug screen in Casio Picky Talk Forest of Gurutan. On debugger run "bpset 20adb2,, { ip=20ad27; g; }", or if testing in hardware, apply patch "0xadb2 = 88 ad 27". It should show up after pen calibration.

[QUFB @qufbee]

@angealbertini Ghidra's patch instruction does it, maybe it can be exposed in a programmable manner?

[QUFB @qufbee]

While reversing Tomy Prin-C keyboard-only model, I found these hidden developer credits: after power on, hold down keys "T" and "M". A few seconds later, the credits blink for a moment before showing the title screen.

[QUFB @qufbee]

I've patched Sega Ferie to load its (AFAIK unused) test functions: https://t.co/tFHFhXqLlD

For example, here's the memory backup test with a hidden credits roll!

[QUFB @qufbee]

@biggestsonicfan Looks like it was the same pinout after all: https://t.co/HWvD7VROo2

[QUFB @qufbee]

@biggestsonicfan Nice, keep me updated. AFAIK there were 2 GG ROM variants, those less than 1Mb didn't use an external mapper, but maybe those dumpers support both variants.