MCS-48 disassemble 8049 dump - Page 1
Forum section: electronics / general

author: Wiljan
author_rank: Regular Contributor
timestamp: July 05, 2020, 06:30:50 pm
content: HiI'm trying to help a friend with a faulty AutoHelm 3000 navigation unit.It does contain Phillips MAB8049H MPU unit with a MASK Rom program, we had some doubt if the MPU are faulty or not and my friend did try to buy another 8049 from Ebay but it's does act different so obvious different code.Anyway back to some research it's actually possible to read out a 8049 even if it's mask programmedhttps://www.sbprojects.net/projects/8049spy/index.phpI made a similar setup with an Arduino and have dumped both 8049 twice and I get same result when reading several times so I believe I might have some valid code and that the MPU actually does work correct.So my question are if some one here does have a MSC-48 disassembler already installed and if you could try to dissemble the attache 2k hex dump to see if the code actually give any meaning or I just have garbageThank you

author: pigrew
author_rank: Frequent Contributor
timestamp: July 05, 2020, 07:17:37 pm
content: I've usedDASMxin the past with a Sencore LCR meter. It's fairly dumb (isn't able to follow jump tables well), but is pretty good if you spend enough time giving it hints. It's closed source, but runs well on Windows 10.I didn't analyze the code so much, but it looks plausible. Attached is rough disassembly based on the following simple configuration. There's one data block left, that looks mostly like unused memory.cpu 8048org 0x0000numformat Ccode 0x0000 resetcode 0x0003 INTcode 0x0007 timer; Jump tablecode 0x003E code_003Ecode 0x0040 code_0040code 0x0042 code_0042code 0x0044 code_0044code 0x0046 code_0046code 0x0048 code_0048code 0x004A code_004Acode 0x004C code_004Ccode 0x004E code_004E

author: Wiljan
author_rank: Regular Contributor
timestamp: July 05, 2020, 09:03:23 pm
content: pigrew, thank you. I will continue looking fora faults as if the 8049 does work correctly and if not there might be a chance to program a 8749

author: pigrew
author_rank: Frequent Contributor
timestamp: July 05, 2020, 09:22:31 pm
content: Quote from: Wiljan on July 05, 2020, 09:03:23 pmIt looks like Ghidra can disassemble/decompile 8048, too. I barely have a clue about how to use the software.... It reported that there was an "bad instruction" in the bitstream at 0x02e5. I think it's an issue with my Ghidra setup (and not a ROM error).NEC (and Toshiba?) also manufactured these micros (perhaps with slightly different performance than Intel). For example, the NEC D8749HD.

author: Wiljan
author_rank: Regular Contributor
timestamp: July 06, 2020, 09:09:33 am
content: Thank for the dasmx link works fine here as well ( doubt any error on the 0x02E5)I added in checksum calculation and it fits fineI have attached the modified schematic and my Arduino code if anyone would need itCode:int Addr = 0;byte Data = 255;int Checksum =0;void setup() {Serial.begin(115200);Serial.println("");pinMode(0, OUTPUT);pinMode(1, OUTPUT);pinMode(2, OUTPUT);pinMode(3, OUTPUT);pinMode(4, OUTPUT);pinMode(5, OUTPUT);pinMode(6, OUTPUT);pinMode(7, OUTPUT);pinMode(8, OUTPUT);pinMode(9, OUTPUT);pinMode(10, OUTPUT);pinMode(11, OUTPUT);pinMode(12, OUTPUT);pinMode(13, OUTPUT);pinMode(A0, OUTPUT);pinMode(A1, OUTPUT);pinMode(A2, OUTPUT);pinMode(A3, OUTPUT);pinMode(A4, OUTPUT);pinMode(A5, INPUT);}void loop() {Serial.print("Loop");delay(1000);while (digitalRead(A5)){delay(1000);Serial.println("GND A5 to start! ");}//--------------Reset------Addr = 0;Checksum = 0;Serial.println("Start dump 8049 ");while (Addr < 2048){digitalWrite(A0, LOW);delay(10);pinMode(2, OUTPUT);pinMode(3, OUTPUT);pinMode(4, OUTPUT);pinMode(5, OUTPUT);pinMode(6, OUTPUT);pinMode(7, OUTPUT);pinMode(8, OUTPUT);pinMode(9, OUTPUT);pinMode(10,OUTPUT);pinMode(11,OUTPUT);pinMode(12,OUTPUT);pinMode(13,OUTPUT);digitalWrite(2, (Addr >> 0 &1));digitalWrite(3, (Addr >> 1 &1));digitalWrite(4, (Addr >> 2 &1));digitalWrite(5, (Addr >> 3 &1));;digitalWrite(6, (Addr >> 4 &1));digitalWrite(7, (Addr >> 5 &1));digitalWrite(8, (Addr >> 6 &1));digitalWrite(9, (Addr >> 7 &1));digitalWrite(10,(Addr >> 8 &1));digitalWrite(11,(Addr >> 9 &1));digitalWrite(12,(Addr >> 10 &1));digitalWrite(13,(Addr >> 11 &1));;delay(10);digitalWrite(A0, HIGH);//---------------------------Set Address-----------pinMode(2, INPUT);pinMode(3, INPUT);pinMode(4, INPUT);pinMode(5, INPUT);pinMode(6, INPUT);pinMode(7, INPUT);pinMode(8, INPUT);pinMode(9, INPUT);Data = 0;Data |= digitalRead(2)<<0 ;Data |= digitalRead(3)<<1 ;Data |= digitalRead(4)<<2 ;Data |= digitalRead(5)<<3 ;Data |= digitalRead(6)<<4 ;Data |= digitalRead(7)<<5 ;Data |= digitalRead(8)<<6 ;Data |= digitalRead(9)<<7 ;Checksum = Checksum + Data;if (Data < 16) {Serial.print("0");}Serial.print(Data,HEX);Serial.println("");Addr = Addr+1;}Serial.print("Checksum: ");Serial.print(Checksum & 0xFFFF,HEX);Serial.println("");}I made my setup on a breadboard and jump wires directly to the ArduinoI took the 5v from the Arduino and even had a pair of jump wire connected to the board where a 11Mhz Xtal already was in placeand feed the 12 v from a external psuOpen the Serial monitor 115200 and when finished dumping, copy / paste to a hex editor, pretty simple

author: jemp
author_rank: Contributor
timestamp: October 09, 2021, 08:52:12 am
content: Sublime Idea !Do you think its possible, to read Mask Roms..I have a 8048 from old Kenwood VFO for transceiverI'd like to read thisTnx for infoJP, ON7MA

author: Wiljan
author_rank: Regular Contributor
timestamp: October 09, 2021, 09:57:54 am
content: Quote from: jemp on October 09, 2021, 08:52:12 amYes, I believe you can dump a 8048, with the trick where it thinks it has an external EPROM and start dumping and switch to the internal ROM continue dumping

author: intabits
author_rank: Frequent Contributor
timestamp: November 05, 2021, 12:22:08 am
content: Quote from: Wiljan on July 05, 2020, 06:30:50 pmHuh?! I'm confused.Your attachment is a JPG image, Not an Intel hex file.Quote from: pigrew on July 05, 2020, 07:17:37 pmSo how did you disassemble it?I've written an MCS-48 disassembler, (which is much smarter than DASM, though still in development), and I wanted to see what it made of your firmware. Can you post it again in either Intel Hex or Raw Binary?

author: Wiljan
author_rank: Regular Contributor
timestamp: November 05, 2021, 12:22:29 pm
content: Quote from: intabits on November 05, 2021, 12:22:08 amHi .. good spottedYeah it't the jpg of the pinout connection to dump it... weird I cant see how that happened back thenAnyway I have replaced it with the "AutoHelm_30000_05_22CA.hex" size 2kI don't have the unit anymore it was not mine, so I can't test anything anymore

author: intabits
author_rank: Frequent Contributor
timestamp: November 05, 2021, 07:05:17 pm
content: Quote from: Wiljan on November 05, 2021, 12:22:29 pmOK, that's better! (but should be named ".bin" or ".rom", because it's the raw binary, not Intel hex format)For interest, below is what my disassembler came up with upon loading your file. To take it any further, requires interactive work such as assigning meaningful labels, marking and splitting data areas, adding comments, and clarifying data references (all can be done using the disassembler).But that also requires knowledge of the application, so I haven't tried to take it any further. (and it's no longer needed)Looks like the forum software truncates long posts, screwing up the "code" formatting. (but works in preview!?)Below is some of the output, I've put the full output on pastebin:-https://pastebin.com/R5EQP8dkCode:;********************************************************************************; Disassembly of MCS-48 binary file: AutoHelm_30000_05_22CA.BIN;********************************************************************************0000 27 VResetL CLR A0001 04 09 JMP Jmp00090003 94 B0 VIRQL CALL Sub04B00005 84 59 JMP Jmp04590007 04 1B VTimerL JMP Jmp001B0009 37 Jmp0009 CPL A000A 02 OUTL BUS,A000B 98 7F ANL BUS,#$7F000D 27 CLR A000E B8 7F MOV R0,#Mem7F0010 B0 2B MOV @R0,#$2B0012 C8 DEC R00013 B0 8C MOV @R0,#$8C0015 C8 DEC R00016 A0 Bra0016 MOV @R0,A0017 E8 16 DJNZ R0,Bra00160019 14 75 CALL Sub0075001B 23 68 Jmp001B MOV A,#$68001D 62 MOV T,A001E 35 DIS TCNTI001F 55 STRT T0020 B9 09 MOV R1,#$090022 27 CLR A0023 A1 MOV @R1,A0024 C9 DEC R10025 17 INC A0026 D7 MOV PSW,A0027 B8 23 MOV R0,#$230029 23 3E MOV A,#$3E002B 60 ADD A,@R0002C 60 ADD A,@R0002D A1 MOV @R1,A002E 10 INC @R0002F F0 MOV A,@R00030 D3 09 XRL A,#$090032 96 35 JNZ Bra00350034 A0 MOV @R0,A0035 B8 4D Bra0035 MOV R0,#$4D0037 B9 24 MOV R1,#$240039 F4 E0 CALL Sub07E0003B 14 50 CALL Sub0050003D 93 RETR003E C4 9F JMP Jmp069F0040 E4 A6 D0040 DB $E4,$A6,$E4,$BA,$E4,$C0,$E4,$A6 ;........0048 E4 A6 .... DB $E4,$BA,$24,$31,$84,$B5,$44,$87 ;..$1..D.0050 B8 44 Sub0050 MOV R0,#Mem440052 F0 MOV A,@R00053 C6 8F JZ Bra008F0055 12 A5 JB0 Bra00A50057 04 E3 JMP Jmp00E30059 B8 65 Jmp0059 MOV R0,#Mem65005B F0 MOV A,@R0005C 96 68 JNZ Bra0068005E B9 7E MOV R1,#Mem7E0060 F1 MOV A,@R10061 53 7F ANL A,#$7F0063 21 XCH A,@R10064 37 CPL A0065 F2 75 JB7 Sub00750067 10 INC @R00068 B9 64 Bra0068 MOV R1,#$64006A F0 MOV A,@R0006B 12 7B JB0 Bra007B006D 98 7F ANL BUS,#$7F006F F4 22 CALL Sub07220071 96 7A JNZ Jmp007A0073 B0 00 MOV @R0,#$000075 23 F2 Sub0075 MOV A,#$F20077 B9 64 Jmp0077 MOV R1,#Mem640079 A1 MOV @R1,A007A 83 Jmp007A RET007B F4 22 Bra007B CALL Sub0722007D C6 83 JZ Bra0083007F 88 80 ORL BUS,#$800081 04 7A JMP Jmp007A0083 10 Bra0083 INC @R00084 23 F6 MOV A,#$F60086 04 77 JMP Jmp00770088 B9 7E Sub0088 MOV R1,#Mem7E008A F1 MOV A,@R1008B 43 80 ORL A,#$80008D A1 MOV @R1,A008E 83 RET008F B8 66 Bra008F MOV R0,#Mem660091 B0 00 MOV @R0,#$000093 B4 34 CALL Sub05340095 96 A3 JNZ Bra00A30097 FE MOV A,R60098 C6 A3 JZ Bra00A3009A F4 22 CALL Sub0722009C 96 A3 JNZ Bra00A3009E B1 FD Bra009E MOV @R1,#$FD00A0 19 INC R100A1 B1 01 MOV @R1,#$0100A3 04 59 Bra00A3 JMP Jmp005900A5 B4 34 Bra00A5 CALL Sub053400A7 C6 9E JZ Bra009E00A9 F4 22 CALL Sub072200AB 96 C7 JNZ Bra00C700AD B9 45 MOV R1,#$4500AF FA MOV A,R200B0 A1 MOV @R1,A00B1 74 73 CALL Sub037300B3 C6 C9 JZ Bra00C900B5 74 77 CALL Sub037700B7 BB 40 MOV R3,#$4000B9 C6 CB JZ Bra00CB00BB 14 88 Bra00BB CALL Sub008800BD B9 66 MOV R1,#Mem6600BF B1 01 MOV @R1,#$0100C1 B9 43 Jmp00C1 MOV R1,#Mem4300C3 B1 B5 MOV @R1,#$B500C5 19 INC R100C6 11 INC @R100C7 04 59 Bra00C7 JMP Jmp005900C9 BB 20 Bra00C9 MOV R3,#$2000CB FA Bra00CB MOV A,R200CC DB XRL A,R300CD 96 BB JNZ Bra00BB00CF B8 7E MOV R0,#Mem7E00D1 F0 MOV A,@R000D2 D2 BB JB6 Bra00BB00D4 04 C1 JMP Jmp00C100D6 74 77 Bra00D6 CALL Sub037700D8 96 E1 JNZ Bra00E100DA B9 7E MOV R1,#Mem7E00DC F1 MOV A,@R100DD D2 E1 JB6 Bra00E100DF 24 05 Bra00DF JMP Jmp010500E1 04 FA Bra00E1 JMP Jmp00FA00E3 B4 34 Jmp00E3 CALL Sub053400E5 C6 DF JZ Bra00DF00E7 F4 22 CALL Sub072200E9 C6 DF JZ Bra00DF00EB FA MOV A,R200EC D3 40 XRL A,#$4000EE C6 D6 JZ Bra00D600F0 FA MOV A,R200F1 D3 80 XRL A,#$8000F3 00 NOP00F4 00 NOP00F5 00 NOP00F6 C6 FA JZ Jmp00FA00F8 24 11 JMP Jmp011100FA B8 45 Jmp00FA MOV R0,#$4500FC FA MOV A,R200FD A0 MOV @R0,A00FE B8 66 MOV R0,#Mem660100 F0 MOV A,@R00101 96 05 JNZ Jmp01050103 14 88 CALL Sub00880105 B8 45 Jmp0105 MOV R0,#Mem450107 F0 MOV A,@R00108 18 INC R00109 A0 MOV @R0,A010A B8 43 MOV R0,#Mem43010C B0 FD MOV @R0,#$FD010E 18 INC R0010F B0 00 MOV @R0,#$000111 B8 46 Jmp0111 MOV R0,#$460113 74 7B CALL Sub037B0115 C6 2A JZ Bra012A0117 74 73 CALL Sub03730119 BB 40 MOV R3,#$40011B 96 1F JNZ Bra011F011D BB 20 MOV R3,#$20011F F0 Bra011F MOV A,@R00120 DB XRL A,R30121 96 28 JNZ Bra01280123 F1 MOV A,@R10124 D2 28 JB6 Bra01280126 B0 00 Jmp0126 MOV @R0,#$000128 04 59 Bra0128 JMP Jmp0059012A F0 Bra012A MOV A,@R0012B 53 80 ANL A,#$80012D C6 28 JZ Bra0128012F 24 26 JMP Jmp01260131 B9 47 D0131 DB $B9,$47,$B8,$7B,$B4,$77,$C8,$F0 ;.G.{.w..0139 B9 47 .... DB $17,$53,$03,$A0,$B9,$2B,$B4,$A6 ;WSC..+..0141 B9 47 .... DB $BC,$38,$BD,$FF,$B4,$70,$D4,$29 ;.8...p.)0149 B9 47 .... DB $23,$E2,$94,$3F,$F6,$51,$24,$68 ;#..?.Q$h0151 B9 47 .... DB $B8,$7F,$FE,$F7,$23,$02,$E6,$5B ;...#B.[0159 B9 47 .... DB $23,$FE,$60,$AE,$03,$FB,$F2,$68 ;#.`.C..h0161 B9 47 .... DB $03,$D6,$F7,$E6,$68,$FE,$A0,$B8 ;C...h...0169 B9 47 .... DB $47,$B9,$2B,$D4,$50,$B8,$49,$B9 ;G.+.P.I.0171 B9 47 .... DB $5C,$D4,$50,$E4,$27 ;\.P.'0176 B9 7E Jmp0176 MOV R1,#$7E0178 B8 46 MOV R0,#$46017A 27 CLR A017B 20 XCH A,@R0017C AD MOV R5,A017D F1 MOV A,@R1017E 37 CPL A017F 72 84 JB3 Bra01840181 FD MOV A,R50182 C6 8B JZ Bra018B0184 B8 4D Bra0184 MOV R0,#Mem4D0186 B0 39 MOV @R0,#$390188 18 INC R00189 B0 FC MOV @R0,#$FC018B B8 4D Bra018B MOV R0,#$4D018D F4 16 CALL Sub0716018F FD MOV A,R50190 12 B4 JB0 Bra01B40192 B2 B2 JB5 Bra01B20194 D2 AE JB6 Bra01AE0196 F2 D3 JB7 Bra01D30198 BA FD MOV R2,#$FD019A BD FE MOV R5,#$FE019C 32 B0 JB1 Bra01B0019E BD 02 MOV R5,#$0201A0 52 B0 JB2 Bra01B001A2 BA E0 MOV R2,#$E001A4 BD EC MOV R5,#$EC01A6 72 B0 JB3 Bra01B001A8 BD 14 MOV R5,#$1401AA 92 B0 JB4 Bra01B001AC 44 6D JMP Bra026D01AE 44 1A Bra01AE JMP Jmp021A01B0 44 08 Bra01B0 JMP Jmp020801B2 44 02 Bra01B2 JMP Jmp020201B4 F1 Bra01B4 MOV A,@R101B5 72 C4 JB3 Bra01C401B7 43 6C ORL A,#$6C01B9 A1 MOV @R1,A01BA B8 42 MOV R0,#Mem4201BC B0 00 MOV @R0,#$0001BE B9 4B MOV R1,#$4B01C0 B8 37 MOV R0,#$3701C2 B4 77 CALL Sub057701C4 B8 4B Bra01C4 MOV R0,#$4B01C6 94 AB CALL Sub04AB01C8 B9 08 Jmp01C8 MOV R1,#$0801CA B8 18 MOV R0,#R001CC B0 00 Bra01CC MOV @R0,#$0001CE 18 INC R001CF E9 CC DJNZ R1,Bra01CC01D1 44 69 JMP Jmp026901D3 F1 Bra01D3 MOV A,@R101D4 12 DB JB0 Bra01DB01D6 D3 20 XRL A,#$2001D8 A1 MOV @R1,A01D9 44 69 Bra01D9 JMP Jmp026901DB B8 4B Bra01DB MOV R0,#Mem4B01DD F0 MOV A,@R001DE 18 INC R001DF 96 F7 JNZ Bra01F701E1 F0 MOV A,@R001E2 03 6A ADD A,#$6A01E4 F6 D9 JC Bra01D901E6 C8 Bra01E6 DEC R001E7 B8 4B MOV R0,#Mem4B01E9 F0 MOV A,@R001EA 37 CPL A01EB 53 03 ANL A,#$0301ED A0 MOV @R0,A01EE 18 INC R001EF F0 MOV A,@R001F0 37 CPL A01F1 17 INC A01F2 03 B4 ADD A,#$B401F4 A0 MOV @R0,A01F5 44 69 JMP Jmp026901F7 D3 03 Bra01F7 XRL A,#$0301F9 96 D9 JNZ Bra01D901FB F0 MOV A,@R001FC 03 E2 ADD A,#$E201FE F6 E6 JC Bra01E60200 44 69 JMP Jmp02690202 BB 04 Jmp0202 MOV R3,#$040204 B9 47 MOV R1,#$470206 44 36 JMP Jmp02360208 B8 1E Jmp0208 MOV R0,#$1E020A BB FF MOV R3,#$FF020C 94 10 CALL Sub0410020E 94 22 CALL Sub04220210 B8 39 MOV R0,#Mem390212 B0 FE MOV @R0,#$FE0214 B8 4B MOV R0,#$4B0216 B4 7E CALL Sub057E0218 44 69 JMP Jmp0269021A B8 5C Jmp021A MOV R0,#$5C021C 94 00 CALL Sub0400021E D4 29 CALL Sub06290220 94 30 CALL Sub04300222 B8 5F MOV R0,#$5F0224 94 00 CALL Sub04000226 D4 29 CALL Sub06290228 B4 70 CALL Sub0570022A BC CD MOV R4,#$CD022C BD FF MOV R5,#$FF022E B4 70 CALL Sub05700230 F2 6D JB7 Bra026D0232 BB 05 MOV R3,#$050234 B9 49 MOV R1,#$490236 B8 7E Jmp0236 MOV R0,#Mem7E0238 F0 MOV A,@R00239 AA MOV R2,A023A 72 3E JB3 Bra023E023C 44 58 JMP Jmp0258023E DB Bra023E XRL A,R3023F 12 52 JB0 Bra02520241 B8 42 MOV R0,#Mem420243 B0 B4 MOV @R0,#$B40245 B8 4B Jmp0245 MOV R0,#$4B0247 B4 77 CALL Sub05770249 B9 7E MOV R1,#$7E024B FA MOV A,R2024C 53 C6 ANL A,#$C6024E 4B ORL A,R3024F A1 MOV @R1,A0250 24 C8 JMP Jmp01C80252 FA Bra0252 MOV A,R20253 53 BF ANL A,#$BF0255 AA MOV R2,A0256 44 45 JMP Jmp02450258 DB Jmp0258 XRL A,R30259 12 52 JB0 Bra0252025B FA MOV A,R2025C 37 CPL A025D D2 6D JB6 Bra026D025F B8 42 MOV R0,#Mem420261 B0 FF MOV @R0,#$FF0263 B9 37 MOV R1,#$370265 B8 4B MOV R0,#$4B0267 B4 77 CALL Sub05770269 B8 27 Jmp0269 MOV R0,#Mem27026B B0 00 MOV @R0,#$00026D B9 42 Bra026D MOV R1,#Mem42026F F1 MOV A,@R10270 C6 7C JZ Bra027C0272 11 INC @R10273 F1 MOV A,@R10274 96 7C JNZ Bra027C0276 B8 7E MOV R0,#Mem7E0278 F0 MOV A,@R00279 53 BF ANL A,#$BF027B A0 MOV @R0,A027C 64 5C Bra027C JMP Jmp035C027E 09 Sub027E IN A,P1027F B2 86 JB5 Bra02860281 D4 19 CALL Sub06190283 FE MOV A,R60284 37 CPL A0285 AE MOV R6,A0286 83 Bra0286 RET0287 9A 00 ANL P2,#$000289 BA 05 MOV R2,#$05028B B9 E0 Bra028B MOV R1,#$E0028D 94 6C CALL Sub046C028F EA 8B DJNZ R2,Bra028B0291 74 65 CALL Sub03650293 B8 54 MOV R0,#$540295 94 10 CALL Sub04100297 54 7E CALL Sub027E0299 B9 70 MOV R1,#$70029B 94 29 CALL Sub0429029D B8 1C MOV R0,#$1C029F 94 10 CALL Sub041002A1 B9 06 MOV R1,#$0602A3 D4 6D CALL Sub066D02A5 B9 04 MOV R1,#$0402A7 B4 77 CALL Sub057702A9 B8 18 MOV R0,#$1802AB 94 10 CALL Sub041002AD 94 22 CALL Sub042202AF B8 1E MOV R0,#$1E02B1 F4 16 CALL Sub071602B3 96 CF JNZ Bra02CF02B5 74 7B CALL Sub037B02B7 C6 CF JZ Bra02CF02B9 B8 18 MOV R0,#$1802BB B9 1A MOV R1,#$1A02BD D4 24 CALL Sub062402BF B9 09 MOV R1,#$0902C1 D4 6D CALL Sub066D02C3 D4 19 CALL Sub061902C5 94 10 CALL Sub041002C7 94 22 CALL Sub042202C9 B8 1A MOV R0,#$1A02CB B9 04 MOV R1,#$0402CD B4 77 CALL Sub057702CF B8 18 Bra02CF MOV R0,#$1802D1 94 00 CALL Sub040002D3 94 30 CALL Sub043002D5 B9 52 MOV R1,#Mem5202D7 F1 MOV A,@R102D8 A9 MOV R1,A02D9 94 B0 CALL Sub04B002DB B4 70 Bra02DB CALL Sub057002DD E9 DB DJNZ R1,Bra02DB02DF B9 06 MOV R1,#$0602E1 D4 6D CALL Sub066D02E3 B8 20 MOV R0,#$2002E5 94 22 CALL Sub042202E7 B9 7E MOV R1,#$7E02E9 B8 5A MOV R0,#$5A02EB 94 AB CALL Sub04AB02ED 18 INC R002EE F1 MOV A,@R102EF 72 F7 JB3 Bra02F702F1 B8 4A MOV R0,#$4A02F3 12 F7 JB0 Bra02F702F5 B8 48 MOV R0,#$4802F7 F4 83 Bra02F7 CALL Sub078302F9 B8 40 MOV R0,#$4002FB D4 2B CALL Sub062B02FD D4 29 CALL Sub062902FF FB MOV A,R30300 4A ORL A,R20301 C6 07 JZ Bra03070303 23 01 MOV A,#$010305 94 3F CALL Sub043F0307 D4 2B Bra0307 CALL Sub062B0309 94 22 CALL Sub0422030B B8 20 MOV R0,#$20030D 94 10 CALL Sub0410030F 94 22 CALL Sub04220311 D4 29 CALL Sub06290313 B8 39 MOV R0,#$390315 94 3E CALL Sub043E0317 F6 1F JC Bra031F0319 B8 25 Bra0319 MOV R0,#Mem25031B B0 C0 MOV @R0,#$C0031D 64 51 JMP Jmp0351031F 4A Bra031F ORL A,R20320 C6 19 JZ Bra03190322 54 7E CALL Sub027E0324 B8 25 MOV R0,#Mem250326 B0 40 MOV @R0,#$400328 FE MOV A,R60329 F2 2D JB7 Bra032D032B B0 80 MOV @R0,#$80032D B8 70 Bra032D MOV R0,#$70032F 94 00 CALL Sub04000331 D4 29 CALL Sub06290333 23 C4 MOV A,#$C40335 94 3F CALL Sub043F0337 F6 51 JC Jmp03510339 B8 24 MOV R0,#Mem24033B B0 FD MOV @R0,#$FD033D B8 6B MOV R0,#$6B033F F4 16 CALL Sub07160341 96 5C JNZ Jmp035C0343 B8 26 MOV R0,#Mem260345 B0 00 MOV @R0,#$000347 88 C0 ORL BUS,#$C00349 B4 34 Bra0349 CALL Sub0534034B D3 01 XRL A,#$01034D 96 49 JNZ Bra0349034F 04 00 JMP VResetL0351 B8 24 Jmp0351 MOV R0,#Mem240353 B0 00 MOV @R0,#$000355 B8 6B MOV R0,#Mem6B0357 B0 C8 MOV @R0,#$C80359 18 INC R0035A B0 FB MOV @R0,#$FB035C 42 Jmp035C MOV A,T035D F2 5C JB7 Jmp035C035F 23 FE MOV A,#$FE0361 62 MOV T,A0362 25 EN TCNTI0363 64 63 Jmp0363 JMP Jmp03630365 8A 03 Sub0365 ORL P2,#$030367 B9 11 Sub0367 MOV R1,#$110369 23 30 MOV A,#$30036B 39 OUTL P1,A036C 94 6C CALL Sub046C036E 99 EF ANL P1,#$EF0370 94 6F CALL Jmp046F0372 83 RET0373 23 04 Sub0373 MOV A,#$040375 64 82 JMP Jmp03820377 23 05 Sub0377 MOV A,#$050379 64 82 JMP Jmp0382037B 23 0C Sub037B MOV A,#$0C037D 74 82 CALL Jmp0382037F 53 FE ANL A,#$FE0381 83 RET0382 B9 7E Jmp0382 MOV R1,#Mem7E0384 D1 XRL A,@R10385 53 0D ANL A,#$0D0387 83 RET0388 00 00 D0388 DB $00,$00,$00,$00,$00,$00,$00,$00 ;........0390 00 00 .... DB $00,$00,$00,$00,$00,$01,$02,$04 ;.....ABD0398 00 00 .... DB $08,$10,$20,$21,$06,$38,$28 ;HP !F8(039F 1C D039F DB $1C ;\03A0 14 0E D03A0 DB $14,$0E,$0A,$07,$00,$04,$09,$0D ;TNJG.DIM03A8 14 0E .... DB $12,$16 ;RV03AA 1B 1F D03AA DB $1B,$1F,$23,$28,$2C,$31,$35,$39 ;[_#(,15903B2 1B 1F .... DB $3E,$42,$46,$4B,$4F,$53,$57,$5B ;>BFKOSW[03BA 1B 1F .... DB $60,$61,$68,$6C,$70,$74,$78,$7C ;`ahlptx|03C2 1B 1F .... DB $80,$83,$87,$8B,$8F,$92,$96,$99 ;........03CA 1B 1F .... DB $9D,$A0,$A4,$A7,$AB,$AE,$B1,$B4 ;........03D2 1B 1F .... DB $B7,$BA,$BE,$C0,$C3,$C6,$C9,$CC ;........03DA 1B 1F .... DB $CE,$D1,$D3,$D6,$D8,$DB,$DD,$DF ;........03E2 1B 1F .... DB $E1,$E3,$E5,$E7,$E9,$EB,$EC,$EE ;........03EA 1B 1F .... DB $F0,$F1,$F3,$F4,$F5,$F6,$F7,$F8 ;........03F2 1B 1F .... DB $F9,$FA,$FB,$FC,$FD,$FD,$FE,$FE ;........03FA 1B 1F .... DB $FE,$FF,$FF,$FF,$FF,$40 ;.....@0400 F0 Sub0400 MOV A,@R00401 AA MOV R2,A0402 18 INC R00403 F0 MOV A,@R00404 AB MOV R3,A0405 4A ORL A,R20406 C8 DEC R00407 83 RET0408 FA Sub0408 MOV A,R20409 03 01 ADD A,#$01040B AA MOV R2,A040C E6 0F JNC Bra040F040E 1B INC R3040F 83 Bra040F RET

author: Wiljan
author_rank: Regular Contributor
timestamp: November 07, 2021, 10:51:48 am
content: Quote from: intabits on November 05, 2021, 07:05:17 pmThank you a lot, sure it should be named .bin... recall it came back when I dumped with the Arduino I just grabbed the IDE terminal dump save it as . hex (indicating to me it was the hex dump) and then later edited it (search replace) to some C formatting and then paste into a hex editor HxD and save .... here it should have been binWhen looking on your disassemble on pastebin.... it for me sure look's like valid code / dumpBut as mentioned I don't have the unit anymore so no more work needed.But a great job you did

author: jemp
author_rank: Contributor
timestamp: December 05, 2021, 04:50:20 pm
content: OK, tnxStarted this project over again... could you explain this last.. anything change to code ?? for reading the maskROM ?JP

author: Wiljan
author_rank: Regular Contributor
timestamp: December 05, 2021, 06:55:39 pm
content: Hi JPNot sure exactly what you ask for, but guess it when I talk about switching between internal / external ROM to do a dumphttps://www.sbprojects.net/projects/8049spy/index.phpThe original page does not respond but the wayback machine does have a copyhttps://web.archive.org/web/20210819052545/https://www.sbprojects.net/projects/8049spy/index.phpSo basically the 8048 can run with external EPROM so if you have the code in external EPROM and control the pin which tells if it's external or internal (the code then change that pin right after the first lines ask it to dump the EPROM over serial ... so instead of dumping the external the pin flip and you now get the internal send out over serialHope it makes senseJust found a link to same topic but with 8051http://www.verycomputer.com/31_807f66c8f7d78471_1.htmQuote