Reverse-engineering a HD63B03RP-based AES Prodata bus ticket machine - Page 1
Forum section: electronics / general

author: Rjevski
author_rank: Unknown
timestamp: April 12, 2020, 01:35:19 am
content: Hello,I'm trying to reverse-engineer a very obscure piece of equipment - an AES Prodata bus ticketing machine - it can read/write and print (thermal) paper tickets with a low-coercivity magstripe. The one I got is actually an Australian one as it had a sticker about "not for Opal cards" on the face of it. It's one of old green ones as inthis picture.(I've updated the post with my latest findings/understanding of the device - original post will be below for reference)The main CPU is a HD63B03RP, and there's an IO multiplexer chip HD63B21P. There's also a timer chip HD63B40. Board photos are availablehere(the forum doesn't allow me to upload the full resolution photos unfortunately).The board has two ROMs (one EEPROM "P28F010-120" marked "BOOT DRIV" dumped as "ROM2.hex" and one EPROM "AM27C128-200DC" dumped as "ROM.hex") as well as an SRAM chip "HY62256ALP-10" powered by a backup battery which I've temporarily shorted to try and clear it thinking it would make it go into a factory/debug mode (it didn't) so let's assume the contents of that one are now lost/unreliable. There's also an FPGA "XC2064-50 PC68C" which I assume would be used for the magnetic card reading/writing, printing or motor control for the card transport mechanism.At the moment the machine itself powers on and displays a fixed value on the LCD - something like "SBZ001" and stays stuck there, presumably it's waiting for the right sequence of bytes on the serial port to begin operating. I'd like to figure out what it wants so I can send it to it and make it boot properly. There's an RS485 transceiver on the board. The device spews out regular garbage on the serial port - I'm not sure what baud rate it is (is there even a concept of baud rate in RS485? My USB converter presents itself to the system as a standard serial port to the OS and I can set a baud rate) but I've tried them all and I get garbage in every case so I assume it's just outputting binary for now. I do not yet have a scope to probe further.There are also 16 DIP switches on the board however no combination of them appears to have any visible results even after rebooting.Power-wise it seems to be able to run on both 12 and 24 volts - there seems to be a huge block on the board around the power area and several connectors coming back to the board which can be configured in different ways - presumably you can either feed the right voltage directly to the board or change the connector to make the power go through the extra block which would step it down to a proper level. I've got the board powered up properly (I've fed in 19V from a laptop PSU both with and without the extra block and the board powers on and appears to be fine - going through the extra block makes it take longer to power on - I assume that one expects a higher voltage normally and the delay is just its caps charging up on a lower voltage than it expects).What would be the next steps that you would suggest?I will eventually get around to tracing the full board which would allow me to figure out the address space (my el-cheapo multimeter has a good 500ms delay on the continuity mode making this process extremely tedious, but I'm planning to get a better one), in the meantime I'd like to make as much progress as possible with what I've got at hand. At the moment the memory map is assumed to be like the following thanks toabyrvalg:QuoteRegarding disassembling, IDA is out of the question - I don't have a license and the Home one wouldn't be suitable as it doesn't support this architecture. I've reached out to them to see if they can sell me a "special" non-commercial license for that architecture at a more affordable price but no luck. Ghidra was recommended here, however I'm not sure which CPU architecture to pick.Here's a list of architectures it supports- which one should I pick? Alternatively, do you know any other GUI-based disassemblers (free or paid but reasonably priced) that would support it?I've been thinking of getting a logic analyzer - I'd need 32 channels at a minimum for this and they are reasonably pricey - do you guys know if there's a way to combine multiple cheap 16-channel analyzers instead? There are cheap Chinese USB ones on Amazon and it would come out cheaper to buy 2 or 3 of these and somehow combine them than buy the "proper" one.Also I'd like to figure out what I can use to substitute the "AM27C128-200DC" EPROM. I've searched around and most drop-in flash alternatives are no longer in production (though eBay is full of fakes) - would a modern microcontroller with the right pin count be fast enough to emulate one? Alternatively, are there commercially-available emulators that would take a ROM file from a computer and emulate it? I've seen such a product on an automotive tuning website but the price was in the 300 bucks range - does anyone know if others exist? I could see this being useful for cartridge-based consoles too so surely something like that must exist?Thanks.Hello,I'm trying to reverse-engineer a very obscure piece of equipment - an AES Prodata bus ticketing machine. The one I got is actually an Australian one as it had a sticker about "not for Opal cards" on the face of it. It's one of old green ones as in this picture:https://railgallery.wongm.com/sydney-ticketing/E115_9101.jpg.htmlThe main CPU seems to be a HD63B03RP, which according to my understanding has 64K of internal ROM. The board does have an EEPROM which I have dumped and while it does contain some strings (that would be displayed on the LCD) my disassembly efforts have failed (all the free disassemblers out there only produce nonsensical assembly, although I haven't tried IDA yet as I can't justify the price of a license) so I'm assuming it must be just configuration data and the actual firmware is in the microcontroller itself. I've attached the ROM file as well in case someone is curious.Assuming I am correct about the chip having internal firmware, does anyone have ideas about dumping it? I would like to do so to understand what it expects in the config ROM and what's the protocol on the serial port - so far all combinations of baud rates I have tried produce unintelligible text, so I'm assuming it's just speaking binary which isn't easy to make sense of.At the moment the machine itself powers on and displays a fixed value on the LCD - something like "SBZ001" on the LCD and stays stuck there, presumably it's waiting for the right sequence of bytes on the serial port to begin operating. I'd like to figure out what it wants so I can send it to it and make it boot properly.Regards.

author: oPossum
author_rank: Super Contributor
timestamp: April 12, 2020, 02:24:22 am
content: The HD63B03 has a 16 bit address bus so it can use up to 64 kB of memory. The only internal memory is 128 bytes of RAM. There is no internal ROM. It is the functional equivalent of a Motorola MC6803. Instruction set is the same as 6800/6801/6802/6803/6808.

author: up8051
author_rank: Frequent Contributor
timestamp: April 12, 2020, 09:18:20 am
content: You can try to use :http://www.atastro.com/software/prog/dasmx.html

author: PA0PBZ
author_rank: Super Contributor
timestamp: April 12, 2020, 10:38:47 am
content: Can you check your EPROM dump again? It should at max be 64K, the top half of your file is empty and the first part 0000-3FFF should be at C000-FFFF. Maybe they tried to obfuscate stuff by swapping some high address lines or you used the wrong EPROM type to read it?

author: Rjevski
author_rank: Unknown
timestamp: April 12, 2020, 03:32:35 pm
content: Thanks for getting back to me. There is another EEPROM on the board which at first I discarded because it had references to Xilinx in it (there is an FPGA on the board as well), but now reading it more closely it might actually contain the actual code (the sticker on the EEPROM says "BOOT DRIV"). I've attached it to this post.

author: PA0PBZ
author_rank: Super Contributor
timestamp: April 12, 2020, 03:55:46 pm
content: Your first dump is the boot ROM, I can see the RESET, NMI and IRQ vectors in there, but the 'problem is that they are supposed to sit at FFF8-FFFF but in your dump file they are at 3FF8-3FFF. If I relocate the 0000-3FFF part to C000-FFFF it makes sense:Code:ROM:FFF8 IRQ: fdb $E8E2ROM:FFFA SOFTI: fdb $D30BROM:FFFC NMI: fdb $D89CROM:FFFE RESET: fdb $C475ROM:FFFE ; end of 'ROM'Code:ROM:C475 ; ---------------------------------------------------------------------------ROM:C475 sei ; RESETROM:C476 ldaa #6ROM:C478 bsr sub_C480ROM:C47A bra loc_C4B9ROM:C47A ; ---------------------------------------------------------------------------So the question is what type of EPROM is it and what type did you use to make the dump?

author: Rjevski
author_rank: Unknown
timestamp: April 12, 2020, 04:04:12 pm
content: The second dump in the post above is an EPROM and seems to be an "AM27C128-200DC", it's a ceramic package with the window for the UV lamp to erase it.I've used a TL866II Plus with the "minipro" software to dump it, with the following command line:Code:minipro -p 'AM27C128@DIP28' -r ROM2.hexCould it be that there's some circuitry in hardware that would relocate this ROM at a different address space?The first dump in the initial post was from a Intel P28F010-120 dumped with "minipro -p 'P28F010@DIP32' -r ROM.hex".

author: oPossum
author_rank: Super Contributor
timestamp: April 12, 2020, 05:08:37 pm
content: There is probably some sort of banking scheme that allows access to all off the Flash (128 kB) and EPROM (32 kB). That would also do mapping necessary to put the vectors at the right address.

author: Rjevski
author_rank: Unknown
timestamp: April 12, 2020, 06:49:26 pm
content: Just wondering, how would I go about disassembling the first ROM with the understanding that the data should be relocated at C000? I've tried the Online Disassembler athttps://onlinedisassembler.comand despite selecting m68k and setting the base address at 0xc000 I'm still getting what seems to be garbage.

author: PA0PBZ
author_rank: Super Contributor
timestamp: April 12, 2020, 07:09:36 pm
content: Quote from: Rjevski on April 12, 2020, 06:49:26 pmM68K is a 68000 32-bit processor so that is why you get garbage. What I did is take the 0000-3FFF part of ROM.hex and saved it as a seperate file. Upload that file and pick 68HC11 for Arch and load address 0xC000. Press No when asked to start disassembly at the beginning of the file. Note that the last 2 bytes in the file are C475, that is the reset vector. Navigate to C475, press C and enjoy.Your ROM2.hex is also a bootable 6800 file, maybe used to reprogram the xilinx? What is IC21 and what is the size of the IC16 RAM?

author: Rjevski
author_rank: Unknown
timestamp: April 12, 2020, 07:56:00 pm
content: Thanks so much. I'm going to try the disassembly in a second.IC16 is a HY62256ALP-10 SRAM chip powered by a lithium battery backup (there's a battery on the board and I measure 2.55V on the power pin of the chip even if the board is unpowered). Seems to be 32K in size.IC21 is a XC2064-50 PC68C FPGA.Here are the board photos:https://rjevski-my.sharepoint.com/:f:/g/personal/hi_rjevski_io/EtvU2rrlwRNOk5D7cHymoesB4Y3EBhf90xPPfwzkDdG_Yw?e=l0IfKJ

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 18, 2020, 01:49:11 pm
content: The complete memory mapping looks like this:boot:ROM2:0:4000 -> C000 - this is an FPGA loader (FPGA bitstream is at +0x40), it jumps to "main" ROM C022 after load. Looks like a standalone banked ROM.main:ROM1:0:4000 -> C000 - entry point at C022, vector table at endROM1:6000:8000 -> A000ROM1:8000:C000 -> 6000 - entry point at 60220:6000 must be HY62256 RAM (overlaid by CPU’s SFRs 0:20 and IRAM 80:100)

author: Rjevski
author_rank: Unknown
timestamp: April 18, 2020, 05:30:04 pm
content: Thanks for the information.I just got a 16-channel logic analyser (Kingst LA1010). It doesn't have enough channels to cover both the entire address bus and the data bus (in fact even for the address bus alone I'm missing an extra channel for the clock pin). I'm thinking to return this and get a bigger one (or get 2, have both share a pin and then sync the two captures in software based on that clock pin) but in the meantime does anyone know any tricks I could do with this logic analyser to get further?The A0-A7 address lines from the MCU go into a latch (PC74HC573P) and the latch enable pin goes to the MCU's AS (address strobe) pin. Presumably this is to multiplex the address/data bus (the first A0-A7 pins are also marked D0-D7) of the MCU. At the moment I'm probing the outputs of the latch for A0-A7 and then the A8-A14 directly and using the last channel for the clock. My idea is to at least get a look at which addresses the MCU is looking at during powerup.QuoteIn your post you say both ROMs are mapped to C000 - is this correct or is this a typo? And if it is correct, there must be a mechanism to switch the ROMs right before jumping to C022, correct?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 19, 2020, 04:16:45 pm
content: Yes, the two regions mapped to the same C000 address are switched somehow (and there are some PORT1 bits manipulations before jump). But the boot rom looks like a standalone component, there are no function calls between it and the main rom. No need to load them both into the same disassembly.I can be wrong about jump to C022, it’s a calculated jump to something+22 and both C000 and 6000 parts have entry points at +22, so it can be 6022 actually. But the C022 entry leads to a jump to 6022 pretty quickly, so it is not much difference which one you’ll choose for the start.I’m sure about rom1 mappings described above - all those 3 parts have absolute calls from one to other and the call targets look sane with that mapping (a call from one part leads to a code sequence looking like a function start in the other part).

author: Rjevski
author_rank: Unknown
timestamp: April 19, 2020, 08:25:03 pm
content: Thanks for the info. May I ask which disassembler you're using and how you're loading the ROMs into it (at the proper addresses)? Do you manipulate the files beforehand to arrange the regions at the proper address or is your disassembler able to let you remap regions of the ROM?Also there is a IO multiplexer chip HD63B21P which I'm assuming is connected to the main CPU and probably manages the ROM mapping.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: April 20, 2020, 09:17:57 pm
content: I use IDA, it allows to load the binary piece-by-piece at any desired addresses. But it is a bit too pricy for a one time project, I recommend to try Ghidra, it even has a decompiler (outputting C code) for 68xx.HD63B21 is a memory-mapped parallel I/O port (so a few yet unknown addresses are directed to it) adding 16 gpio lines to the system.Edit: HD63B40 (from your photo) is another memory-mapped I/O device (timer).

author: Rjevski
author_rank: Unknown
timestamp: May 03, 2021, 01:32:44 pm
content: Bump (edited my first post with more details and questions).

author: Rjevski
author_rank: Unknown
timestamp: March 06, 2022, 06:26:05 pm
content: Update:So I have some time on my hands now and more money to throw at the problem. I got my hands on IDA Pro and am in the process of sourcing a scope (maybe not strictly needed right now, but can't hurt to have one anyway).Could someone help me load the ROMs I dumped earlier into IDA? I've made some attempts yesterday and it seems OK-ish but I wanted to double-check:Which architecture to use? I see many options:- Hitachi HD63701/03- Hitachi HD63703/01- Motorola MC6301- Motorola MC6303- Motorola MC6800- Motorola MC6801- Motorola MC6803- Motorola MC6805- Motorola MC6808- Motorola MC6809- Motorola MC6811When it comes to loading the first ROM (ROM.hex), how should I proceed given that I need to load parts of it at various addresses? Currently when I open the file I only load part of it (by varying the load address, file offset & length parameters) and then go "File -> Load -> Additional binary file" and repeat the process with the same file several times until I get all the parts in the right place. Am I doing this right or is there a better/easier way?Is there a way to search for references to an address range? There are some strings in the ROM that would be displayed on the LCD - I can't get any hits on an exact address but was just wondering if I could do a search for references to the entire range containing all the strings?Thanks.

author: bingo600
author_rank: Super Contributor
timestamp: March 06, 2022, 07:06:41 pm
content: We mentioned a lot of free 68xx tools in this threadhttps://www.eevblog.com/forum/fpga/replicating-a-custom-6800-in-fpga/?allI chose this onehttps://www.eevblog.com/forum/fpga/replicating-a-custom-6800-in-fpga/msg3714880/#msg3714880https://github.com/Arakula/dasmfwOhh i missed you got the IDA ProWell for others that might need a free tool/Bingo

author: bingo600
author_rank: Super Contributor
timestamp: March 06, 2022, 07:31:02 pm
content: Just ran a simple :$ strings -tx ROM.hex >ROM-strings.txt$ strings -tx ROM2.hex >ROM2-strings.txtAttached the string txt files (the offset is in hex)/Bingo

author: nali
author_rank: Frequent Contributor
timestamp: March 06, 2022, 08:06:33 pm
content: Just noticed this thread... FWIW it looks like what you have is just the card reader / printer, not the ticketing machine itself which is the beige box above & next to the steering wheel.Not familiar with that machine but have seen a few others of the same era. RS485 will probably be binary, try looking for 0x02 STX characters at the start of the packets (or 0xFD if you've got the RS485 lines swapped), suggest 9600 or 19200 baud for starters.

author: Rjevski
author_rank: Unknown
timestamp: March 06, 2022, 09:06:21 pm
content: Yes - I have ran that back in the day and indeed there are strings. My question was more about how would I search for references to the address ranges the strings are located at in IDA? An exact match doesn't yield any results but I was wondering if there's a way to do a broader search for anything that references the general area of where the strings are located? No worries if not.Quote from: nali on March 06, 2022, 08:06:33 pmI will have a look at the serial traffic again when I get the machine powered up and the entire development environment set up (everything has been packed and sitting in storage since I moved last year). I'll have a scope so the baud rate issue will be settled anyway.Regarding the machine, indeed I don't have the driver's console. Just FYI I remember that these machines were also used in France with an ERG DF4000 driver's console (pictured here:https://www.flickr.com/photos/85000178@N05/20522269625).

author: Rjevski
author_rank: Unknown
timestamp: March 07, 2022, 12:24:38 am
content: I managed to get some action out of it.I'm using a TTL USB to serial converter (an Arduino Uno with the micro itself held in reset, just using its serial converter part) and hooking up the RX line to the DS75176BTN (a RS422/485 transciever chip on the board)'s DI pin (4) (and obviously having grounds connected), just to rule out any RS485-related issues (I had no idea whether my converter worked, don't have anything else that can speak that protocol to test).On 9600/8/N/1 I managed to get the board into a weird state where it would not boot, however on the serial port I saw this:Code:XILINX - ICXILINX -ˇXILXILIN. - IC 21 - PRXILINX - IC 21 -XILINX - IC 21 ˇXILH.ˇ.XILIXILINX - IC 21 - PROXILINXXILIˇXILINX - IC 21 - PXILINX - IC 21 - P.I¸XILINX ˝XILINX % IC 21 - PROBLEM : PROGØXILINX - IC 21 - PROBLEM :XIL.NX - IC ˙XILINX - IC 20 - PROBLï1%9aÅ- IC 21 - PROBLEXILINX - IC¯XILINXˇ˛ÿXILINX )XILILX - IC 21 -XILINX - IC 21 - PROˇXILINX - I. 2XILINX - KC 21 -ÇI=.1.5Å: PROG/XILINX - IC 21 - ¸XILINX - IC 21 - PROBLEM :ÇI=.ΩDOˇXILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PI˛XILINX ˇXILINXILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15)XILINX - IC 21 - PROBLEM : PROG/DON≈XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3.PIN15) STAYS†äXILINX - IC 21 - PROBLEM :˛XILINX - IC 21 - PROBLEˇÿXIL.NX - …XILINÿXILINXXILINXILINX - IC 21 -XXILINX -˛XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/XILINX - IC 21XILINÿXILILXXILINX - IC 21 - PROBLEM : PRGG/DONE LINE (ICXILINX - IC 21 - PROBL.M * PRXILIXILINX - ˇXÈXILINX - IC 21 - PROBLEM : PROG/DON≈XILˇXILINXILIN˛XIÃXILˇXXILIXILINX -XILINX - IC 21 - PROXILINX % IC 21 - PROBLEM : PROG/DONE LIŒÿXILINX - …X.LINP - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15) S¸XILIN.j.Jˇ˙.XILIXILINX - IC 21 - PROXILINX - IC 21 - –XILINX`- IC 21 - PROBLEM : PXILINXj.JÅ21.˘ˇXIÃ·XILINX ˝XIXILINX - IC 21 - PROBLEMXILINX - IC 21 -ê%ı.1.5Å:XILINX - IC 21 - PROBLEM :ˇXILINX - IC 21XILINX - IC 21 - PROBLEM : PROG/DONE LIXILINX - IC 21 KÇI=.1.5Å: –XILINX - IC 2±ÕXIXILINX - IC 21 - PROBLEM : .R!ï1%9aÅ-XILIˇXILINX - IC˛XILINX -XILINX - IC 21 - PROBLEM : PROG/DONE LINE (…ÕXILINX -êR(íXIHINX - IC 21 -XILINX -†XILINX - IC 21 - P.XILINX - ˇXILINX ˝Xˇ˛XIL.NX - IC 21 - P™J1ˇXILINX - IC 21 - PROBLEM : PROXILINX - IC 21 - PRJ1.5ÅXIDINX - IC 21 ˇXILINX - IC 21 - PROBLEL : PROG/DONQb%9.ÅXILINX - IC 21 - PROBLEMXILINX - IC!ï1%9aÅˇXIL…XILINX - ICXILINX ˝XILINX - IC 21†XILINXXILˇXILIŒX - ˘X.LINX - IC 21 - PROBLEM : PROG/DONEXILINX - IC 21 % ¯XIL˘XILINX - IC 21 - PROBLEM : PROG/DONE LINˇXILINX - IC 21 - PROBLEM ˛ï1%9aÅ- IC 01 - PROBLEM : PROG/DONQb%9.Å(IC3/PIN15) STAYSXILINXXILINX -XILINX - IC 21 - PROBLEM :†XILINX - IC 21 - P.OBLEM : PROCÔçÿXILINX -XILINXILINX - I(íä.j.ÇI=˘X˝XILINX - IC 21 - PROBL≈XILIFXXILIXILINX - IC 21 - PROBLEM : PRKG/DNNEXILINXXI¸XILINX - IC 21 -XILINX - IC 21 -XILINX - IC 21 - @RO¬XILINX -˛¯XIÃXILINX - IC 21 - PROBLEM : PXIXIˇXILINX`-¯HXILINX - IC 21 - PROBLEM : P˛XILINX - IC 21 KÇI=.1.5Å: PROG/DONE LILE (IC3/PIXILINX - IC 21 -XILINX - IC 21 - PRKBLEM.: PROG/DO˛XILINX - IC 21 - PROBXILINX - IC 21XI*.j.JÅXILINX - IC 21XILANXXILINX - IC 21 - PROBLEM : PROG/DONE LINEHILINX - IC 21 - PROBLEM.: PROG/DONE LINE (IC3/PIN1µXILINX - IC 21 - PROB™5Å: PROG/DXILINX - ˇX.LINX - IC 21 - PRJ1.5 : P“XILINX - IC 21 - PROBLEM : PROG/DONE LXILINX - IC ˙XILINXXILINX - IC 21 - PROBLEM : PROG/DONE LINˇXILINX - IC 21 - PROBLE: PROG/DONE LINˇXILINX - IC 21 - PROBLEM : PROG/DONE LILE (IC3/PIN.5) STAXILINX - I√XILINXIC 21 - PROBLEM : PROG/DONE LINE (AC3/PIN15) STAYS AT ZERäXILINXXILIN˛XILINX - I(íä.j.ÇI=.1.˘¯˝XILINX -ˇXILINX - .C 21 - PROBˇXILINX - IC 2Lj.ÇI=.1.5Å: PROG/DXILINXXILIÓXILI.j.JÅ21 - PROBLEM : PROG/DONXXILINX - IC 21 - PROBLEM : PRO./DONE LINE (IC3/PIN15) ˇX…XILINX - IC 21 - PRˇXILINX - IC 21 -.XXILINX - I(íä.j.ÇI=.1.MXILINX - IC 21 - .ROBLEM :‡XILINX - IC 21¯XILINX -XILINX - IC 21¯XXILINX - IC 21 - PROBLQS“.ÇI=.ΩDONE LIŒXILINX - IC 21 - PROBLEM : –XILINX KJÅXIXILINX - IC 21XILINX - IC 21 , PROBLEM¯XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15) STAYS AT Z˛XILINX¯XI˛XILINX - IC 21 - PROXILINX - IC 21XILINÿXILINX -XILINX - I˚XI˛XILINX - IC 21 - PROBLEMXILINX - IC 21 -XILINX - IC 21 -X.LÈXXILI.X -ˇXILINX - IC 21 - PROBLQS“.ÇI˝XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PˇXILINX % ICˇXILINX - IC 21 ˝XILINX - IC 21 KÇI=.1.5Å: PROE/DONE ˛XR*.j.JÅ21 - PROBLEM :¯X…XILINX - IC 21 - PRNBLEM :.PROG/DONE LINE (R®¶.ï9Ö5JöQ.eMÅATXIXHALINX - IC 21 ÌXXILINX - IC 21 - PROBLEM : PRˇXILINX - IC 2±XILINX -ˇXILINX - IC 2XILINX - .C 21 - PROBLEM : PROG/DONE LINE (IC3/PI˛ˇXXILINX - IC 21X…XILINX - IXILINX - IC 21 - PROBLE: PROG/DONE LINE (IC3XILINX - IC 21 ) PROBLEM : PROG/D ™ÅLINE (KC3/PIN15) STAYS AT ZERG AFTER LXI.INX - IC 21 - PRO(™5ˇXILIFX - IC 21 - PROXILINX - IC 21 - PRO@LEM : PRXILINX - IC 21 - PROBLEM¯XILINX - IC 21 - PROBLEM : PROG/DOFE LINE (IC3/PIŒXILINX - ˇXILINX - IC 21 - PROBLEM : –XILINX - ICXILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PXILINX - IC 21 - PROXILINX - IˇXILINX - IC¸XILINX - IC 21 - PROBLEM : PRGG/DONDXI.INX - IC 21 - PROBÃXILINX - IC 2!j.ÇI9.1.5ÅXILINX - IC 21 - PXILINX - IC‡.ILINX - I(Çä.j.Ç.=.1.5Å2 PROG/DONE LINE (IC3/PIN15) STA.S AT ˙XILI˛.XXILINX - IC 21 - P˙XILINX - IC 21XI¸XILINX - IC¸XILINX -XILINX - IC 21 - PROBLEM : P“XILINX - IC 21 - PROBLEM : PROG/DONXILINX - IC 2˝XILINX - IC 21 - PROXILINX‡.XILINX¸XILINX - ICXILINX - IC 21 -.XILINX¸XILINX - IC 21 - PRO...ˇXILINX - IC ÕXILINX - IC 2˝ˇXILINX - ICXKLI.X - IC 21 - PROBLQ”. ï1%NX - IC .1 - PROBLÂXILINX - IC 21 - PROBLEM : PROG/ˇXILINX ) IC 21 - PROBLÕXILINX¯XIL…XILINX - IC 21 - PROBLEˇXILINX -XILINX - IC 21 -¸X.LINX - IC 21 - PROBL.M : PRNG/DONE LINˇ˛XILINX - IC "1 - PROBLEMXXILINX - IC ÚXILINX - ICˇXILINXILINX - IC 21 - PXILINX - ˇ˙XILINX - IC 61 - PROBLEM†XXILˇXILINX - IC 21 - PROBLEM : PROG/DONE LXILINX ˝XIXXILINX - IA 2XILIXILˇX…XIˇXILÈ˛Xï1%9X¯XILINX - IC 21 -X.LXILINX - IC 21 - PRO˙XILINX - IC 21 - PROBLEM : PROG.DONE LINEXILINX - IC 21 - PRœXILIJX - .C 21 - PROBLDM : PROG/DONE LINE (IC3/PIN15) STAYS ATX…XILINX - IC 21 - ˛ˇXIXILINX - IC 21 - .XILINX - ICXI*.j.JÅ21 - P˙XILINP - IC 21 ) PROBL.I : PRO./DONEXILINX % IC 21 .XILINX - IC ˛XˇXILINX - IB 21 KÄˇXILINX‡ˇXIXILINX - IC 21 - PRœXILINX - IC 21 -ÇI˝XILIŒÍ˝XILINX`- IC 21 KÇI=.1.5Å: PRXALINX - IC 21 - ˛X˘XILINH - IC 21 -XILINXjÇXˇXILINX - HCHILINX - IC 21‡XILINX - IC 21XXILINXXILINX - IC 21 - PXIL.NX - IC 21 - PRO˛XI*.j.JÅ2ˇXILINXÕ˝.PILIN¯˝XILINXXILINX - IC 21†ÕXILINX -¯XILI˛XILIN¯XILINX ≠XILHXI¸XILINX - IC 21 - Pˇˇˇ.XILINXX…˙XILINX - I√ï1%9aÅ-‡XILINXILIXILINX - ICXILINX - IC 21 - PROBLEM : PROGˇXILINX - IC 21 - PROBLEM 'ÇI=./DO.E¯XILI˛XILINX - IC 21 - PROBLıXILINX - IC 21 - PROBLEÕXIˇXˇXILINX - IC!ï1%9aÅ- IC 21XILINX - IC 21 - PROXILI˝ˇˇˇ.Note the interruption in the middle (with dots) - on the hex view it was just zeroes. I believe the board might have a watchdog that resets everything in case of lockup and this happened there (I've noticed the watchdog-like behavior when I accidentally touched some pins on the board and upset it - the serial output would stop which I suspect means the board has frozen, then the entire thing reboots and starts over).So at least it seems like my terrible attempt at getting serial output out of it is working.Edit: so the board may have a bad contact which would get it into that error state where it can't load the FPGA bitstream. I've flexed the board a bit and pushed down on all the socketed chips and managed to make it boot like it was before (card mechanism moves briefly at startup, "S1.0Z181" displayed on LCD and repeating binary spam on the serial port).Now that I got it booted and am confident that the serial setup is correct (at least hardware-wise), here's what I get on 9600/8N1:Code:$ xxd Documents/CoolTerm\ Capture\ 2022-03-07\ 00-37-07.txt00000000: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff ................00000010: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04 ................00000020: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca ................00000030: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd ................00000040: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105 ................00000050: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff ................00000060: 04c5 c505 ff04 c6c6 05ff 04c7 c705 ff04 ................00000070: c8c8 05ff 04c9 c905 ff04 caca 05ff 04cb ................00000080: cb05 ff04 cccc 05ff 04cd cd05 ff04 cece ................00000090: 05ff 04cf cf05 ff04 c1c1 05ff 04c2 c205 ................000000a0: ff04 c3c3 05ff 04c4 c405 ff04 c5c5 05ff ................000000b0: 04c6 c605 ff04 c7c7 05ff 04c8 c805 ff04 ................000000c0: c9c9 05ff 04ca ca05 ff04 cbcb 05ff 04cc ................000000d0: cc05 ff04 cdcd 05ff 04ce ce05 ff04 cfcf ................000000e0: 05ff 04c1 c105 ff04 c2c2 05ff 04c3 c305 ................000000f0: ff04 c4c4 05ff 04c5 c505 ff04 c6c6 05ff ................00000100: 04c7 c705 ff04 c8c8 05ff 04c9 c905 ff04 ................00000110: caca 05ff 04cb cb05 ff04 cccc 05ff 04cd ................00000120: cd05 ff04 cece 05ff 04cf cf05 ff04 c1c1 ................00000130: 05ff 04c2 c205 ff04 c3c3 05ff 04c4 c405 ................00000140: ff04 c5c5 05ff 04c6 c605 ff04 c7c7 05ff ................00000150: 04c8 c805 ff04 c9c9 05ff 04ca ca05 ff04 ................00000160: cbcb 05ff 04cc cc05 ff04 cdcd 05ff 04ce ................00000170: ce05 ff04 cfcf 05ff 04c1 c105 ff04 c2c2 ................00000180: 05ff 04c3 c305 ff04 c4c4 05ff 04c5 c505 ................00000190: ff04 c6c6 05ff 04c7 c705 ff04 c8c8 05ff ................000001a0: 04c9 c905 ff04 caca 05ff 04cb cb05 ff04 ................000001b0: cccc 05ff 04cd cd05 ff04 cece 05ff 04cf ................000001c0: cf05 ff04 c1c1 05ff 04c2 c205 ff04 c3c3 ................000001d0: 05ff 04c4 c405 ff04 c5c5 05ff 04c6 c605 ................000001e0: ff04 c7c7 05ff 04c8 c805 ff04 c9c9 05ff ................000001f0: 04ca ca05 ff04 cbcb 05ff 04cc cc05 ff04 ................00000200: cdcd 05ff 04ce ce05 ff04 cfcf 05ff 04c1 ................00000210: c105 ff04 c2c2 05ff 04c3 c305 ff04 c4c4 ................00000220: 05ff 04c5 c505 ff04 c6c6 05ff 04c7 c705 ................00000230: ff04 c8c8 05ff 04c9 c905 ff04 caca 05ff ................00000240: 04cb cb05 ff04 cccc 05ff 04cd cd05 ff04 ................00000250: cece 05ff 04cf cf05 ff04 c1c1 05ff 04c2 ................00000260: c205 ff04 c3c3 05ff 04c4 c405 ff04 c5c5 ................00000270: 05ff 04c6 c605 ff04 c7c7 05ff 04c8 c805 ................00000280: ff04 c9c9 05ff 04ca ca05 ff04 cbcb 05ff ................00000290: 04cc cc05 ff04 cdcd 05ff 04ce ce05 ff04 ................000002a0: cfcf 05ff 04c1 c105 ff04 c2c2 05ff 04c3 ................000002b0: c305 ff04 c4c4 05ff 04c5 c505 ff04 c6c6 ................000002c0: 05ff 04c7 c705 ff04 c8c8 05ff 04c9 c905 ................000002d0: ff04 caca 05ff 04cb cb05 ff04 cccc 05ff ................000002e0: 04cd cd05 ff04 cece 05ff 04cf cf05 ff04 ................000002f0: c1c1 05ff 04c2 c205 ff04 c3c3 05ff 04c4 ................00000300: c405 ff04 c5c5 05ff 04c6 c605 ff04 c7c7 ................00000310: 05ff 04c8 c805 ff04 c9c9 05ff 04ca ca05 ................00000320: ff04 cbcb 05ff 04cc cc05 ff04 cdcd 05ff ................00000330: 04ce ce05 ff04 cfcf 05ff 04c1 c105 ff04 ................00000340: c2c2 05ff 04c3 c305 ff04 c4c4 05ff 04c5 ................00000350: c505 ff04 c6c6 05ff 04c7 c705 ff04 c8c8 ................00000360: 05ff 04c9 c905 ff04 caca 05ff 04cb cb05 ................00000370: ff04 cccc 05ff 04cd cd05 ff04 cece 05ff ................00000380: 04cf cf05 ff04 c1c1 05ff 04c2 c205 ff04 ................00000390: c3c3 05ff 04c4 c405 ff04 c5c5 05ff 04c6 ................000003a0: c605 ff04 c7c7 05ff 04c8 c805 ff04 c9c9 ................000003b0: 05ff 04ca ca05 ff04 cbcb 05ff 04cc cc05 ................000003c0: ff04 cdcd 05ff 04ce ce05 ff04 cfcf 05ff ................000003d0: 04c1 c105 ff04 c2c2 05ff 04c3 c305 ff04 ................000003e0: c4c4 05ff 04c5 c505 ff04 c6c6 05ff 04c7 ................000003f0: c705 ff04 c8c8 05ff 04c9 c905 ff04 caca ................00000400: 05ff 04cb cb05 ff04 cccc 05ff 04cd cd05 ................00000410: ff04 cece 05ff 04cf cf05 ff04 c1c1 05ff ................00000420: 04c2 c205 ff04 c3c3 05ff 04c4 c405 ff04 ................00000430: c5c5 05ff 04c6 c605 ff04 c7c7 05ff 04c8 ................00000440: c805 ff04 c9c9 05ff 04ca ca05 ff04 cbcb ................00000450: 05ff 04cc cc05 ff04 cdcd 05ff 04ce ce05 ................00000460: ff04 cfcf 05ff 04c1 c105 ff04 c2c2 05ff ................00000470: 04c3 c305 ff04 c4c4 05ff 04c5 c505 ff04 ................00000480: c6c6 05ff ....Note that there's a jumper on the board near the RS485 transceiver IC that's been set by default. If I remove it, the serial output is much slower and as follows:Code:$ xxd Documents/CoolTerm\ Capture\ 2022-03-07\ 00-39-39.txt00000000: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff ................00000010: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04 ................00000020: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca ................00000030: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd ................00000040: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105 ................00000050: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff ................00000060: 04c5 c505 ff04 c6c6 05ff 04c7 c705 ff04 ................00000070: c8c8 05ff 04c9 c905 ff04 caca 05ff 04cb ................00000080: cb05 ff04 cccc 05ff 04cd cd05 ff04 cece ................00000090: 05ff 04cf cf05 ff04 c1c1 05ff 04c2 c205 ................000000a0: ff04 c3c3 05ff 04c4 c405 ff04 c5c5 05ff ................000000b0: 04c6 c605 ff04 c7c7 05ff 04c8 c805 ff04 ................000000c0: c9c9 05ff 04ca ca05 ff04 cbcb 05ff 04cc ................000000d0: cc05 ff04 cdcd 05ff 04ce ce05 ff04 cfcf ................000000e0: 05ff 04c1 c105 ff04 c2c2 05ff 04c3 c305 ................000000f0: ff04 c4c4 05ff 04c5 c505 ff04 c6c6 05ff ................00000100: 04c7 c705 ff04 c8c8 05ff 04c9 c905 ff04 ................00000110: caca 05ff 04cb cb05 ff04 cccc 05ff 04cd ................00000120: cd05 ff04 cece 05ff 04cf cf05 ff04 c1c1 ................00000130: 05ff 04c2 c205 ff04 c3c3 05ff 04c4 c405 ................00000140: ff04 c5c5 05ff 04c6 c605 ff04 c7c7 05ff ................00000150: 04c8 c805 ff04 c9c9 05ff 04ca ca05 ff04 ................00000160: cbcb 05ff 04cc cc05 ff04 cdcd 05ff 04ce ................00000170: ce05 ff04 cfcf 05ff 04c1 c105 ff04 c2c2 ................00000180: 05ff 04c3 c305 ff04 c4c4 05ff 04c5 c505 ................00000190: ff04 c6c6 05ff 04c7 c705 ff04 c8c8 05ff ................000001a0: 04c9 c905 ff04 caca 05ff 04cb cb05 ff04 ................000001b0: cccc 05ff 04cd cd05 ff04 cece 05ff 04cf ................000001c0: cf05 ff04 c1c1 05ff 04c2 c205 ff04 c3c3 ................000001d0: 05ff 04c4 c405 ff04 c5c5 05ff 04c6 c605 ................000001e0: ff04 c7c7 05ff 04c8 c805 ff04 c9c9 05ff ................000001f0: 04ca ca05 ff04 cbcb 05ff 04cc cc05 ff04 ................00000200: cdcd 05ff 04ce ce05 ff04 cfcf 05ff 04c1 ................00000210: c105 ff04 c2c2 05ff 04c3 c305 ff04 c4c4 ................00000220: 05ff 04c5 c505 ff04 c6c6 05ff 04c7 c705 ................00000230: ff04 c8c8 05ff 04c9 c905 ff04 caca 05ff ................00000240: 04cb cb05 ff04 cccc 05ff 04cd cd05 ff04 ................00000250: cece 05ff 04cf cf05 ff04 c1c1 05ff 04c2 ................00000260: c205 ff04 c3c3 05ff 04c4 c405 ff04 c5c5 ................00000270: 05ff 04c6 c605 ff04 c7c7 05ff 04c8 c805 ................00000280: ff04 c9c9 05ff 04ca ca05 ff04 cbcb 05ff ................00000290: 04cc cc05 ff04 cdcd 05ff 04ce ce05 ff04 ................000002a0: cfcf 05ff 04c1 c105 ff04 c2c2 05ff 04c3 ................000002b0: c305 ff04 c4c4 05ff 04c5 c505 ff04 c6c6 ................000002c0: 05ff 04c7 c705 ff04 c8c8 05ff 04c9 c905 ................000002d0: ff04 caca 05ff 04cb cb05 ff04 cccc 05ff ................000002e0: 04cd cd05 ff04 cece 05ff 04cf cf05 ff04 ................000002f0: c1c1 05ff 04c2 c205 ff04 c3c3 05ff 04c4 ................00000300: c405 ff04 c5c5 05ff 04c6 c605 ff04 c7c7 ................00000310: 05ff 04c8 c805 ff04 c9c9 05ff 04ca ca05 ................00000320: ff04 cbcb 05ff 04cc cc05 ff04 cdcd 05ff ................00000330: 04ce ce05 ff04 cfcf 05ff 04c1 c105 ff04 ................00000340: c2c2 05ff 04c3 c305 ff04 c4c4 05ff 04c5 ................00000350: c505 ff04 c6c6 05ff 04c7 c705 ff04 c8c8 ................00000360: 05ff 04c9 c905 ff04 caca 05ff 04cb cb05 ................00000370: ff04 cccc 05ff 04cd cd05 ff04 cece 05ff ................00000380: 04cf cf05 ff04 c1c1 05ff 04c2 c205 ff04 ................00000390: c3c3 05ff 04c4 c405 ff04 c5c5 05ff 04c6 ................000003a0: c605 ff04 c7c7 05ff 04c8 c805 ff04 c9c9 ................000003b0: 05ff 04ca ca05 ff04 cbcb 05ff 04cc cc05 ................000003c0: ff04 cdcd 05ff 04ce ce05 ff04 cfcf 05ff ................000003d0: 04c1 c105 ff04 c2c2 05ff 04c3 c305 ff04 ................000003e0: c4c4 05ff 04c5 c505 ff04 c6c6 05ff 04c7 ................000003f0: c705 ff04 c8c8 05ff 04c9 c905 ff04 caca ................00000400: 05ff 04cb cb05 ff04 cccc 05ff 04cd cd05 ................00000410: ff04 cece 05ff 04cf cf05 ff04 c1c1 05ff ................00000420: 04c2 c205 ff04 c3c3 05ff 04c4 c405 ff04 ................00000430: c5c5 05ff 04c6 c605 ff04 c7c7 05ff 04c8 ................00000440: c805 ff04 c9c9 05ff 04ca ca05 ff04 cbcb ................00000450: 05ff 04cc cc05 ff04 cdcd 05ff 04ce ce05 ................00000460: ff04 cfcf 05ff 04c1 c105 ff04 c2c2 05ff ................00000470: 04c3 c305 ff04 c4c4 05ff 04c5 c505 ff04 ................00000480: c6c6 05ff 04c7 c705 ff04 c8c8 05ff 04c9 ................00000490: c905 ff04 caca 05ff 04cb cb05 ff04 cccc ................000004a0: 05ff 04cd cd05 ff04 cece 05ff 04cf cf05 ................000004b0: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff ................000004c0: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04 ................000004d0: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca ................000004e0: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd ................000004f0: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105 ................00000500: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff ................00000510: 04c5 c505 ff04 c6c6 05 .........(now that I look at it the outputs seem completely identical from a data point of view, just that removing the jumper seems to make it slower)

author: ozcar
author_rank: Frequent Contributor
timestamp: March 07, 2022, 03:46:29 am
content: I think ideally you would have to use a disassembler that understands 6303. I have an ancient 6803 disassembler, and that produces output like this (from a chunk of ROM.hex relocated as suggested by PA0PBZ):Code:D69A CC 6000 LDD #$6000D69D C3 0006 ADDD #$0006D6A0 18 FCB $18D6A1 EC 00 LDD 0,XD6A3 38 PULXD6A4 ED 04 STD 4,XD6A6 3C PSHXThat is a step up from using a 6800 disassembler, because it knows of instructions LDD, STD, ASLD, LSRD, ADDD, SUBD, PSHX, PULX, ABX and MUL, which did not exist for 6800. However, note the FCB $18 in there, apparently that is an instruction that does not exist on 6803 either (XGDX). There seem to be other instructions that exist for 6303 but not 6803, including BCLR, BSET, BTGL, BTST, OIM, AIM, EIM and TIM and maybe more (that is just from a quick RTFM - I’m not really familiar with 6303).As for finding references to the ASCII strings, you would probably have to relocate them for a start (maybe as abyrvalg suggested, I did not check if that makes sense).

author: bingo600
author_rank: Super Contributor
timestamp: March 07, 2022, 05:22:47 pm
content: This one (handbook) could be handyhttps://usermanual.wiki/Document/HD6301HD6303SeriesHandbook1989.865407655.pdfBuild 6801 Disassembler - My choice was dasmfw (Seems to be a newer version of f9dasm)https://github.com/Arakula/dasmfwSeems to handle 6803 instructionsCode:$ ./dasmfw -dasm 6303 -cchar '*' -conv off -cref on -out ROM.asm -offset C000 ROM.hexCode:LDD #M6000 * D69A: CC 60 00 '.`.'ADDD #M0006 * D69D: C3 00 06 '...'XGDX * D6A0: 18 '.'LDD ,X * D6A1: EC 00 '..'PULX * D6A3: 38 '8'STD $04,X * D6A4: ED 04 '..'PSHX * D6A6: 3C '<'Mnemonic briefhttps://www.jaapsch.net/psion/mcmnemal.htm

author: bingo600
author_rank: Super Contributor
timestamp: March 07, 2022, 06:53:49 pm
content: IMHOThe MCU must POR on ROM2This PROM sets up the stack (to 0xff , end of internal ram) , before the firstBSR/JSR- In ROM we have aBSRwo. a SP setup, that wouldRTSto random land".ROM2 VectorsCode:FDB vec_IRQ_SCI * FFF0: F7 75 '.u'FDB vec_IRQ_T0F * FFF2: F7 9F '..'FDB vec_IRQ_ICF * FFF4: FD 87 '..'FDB vec_IRQ_ICF * FFF6: FD 87 '..'FDB vec_IRQ_EXT * FFF8: FA 13 '..'FDB vec_SWI * FFFA: F7 2E '.."R* Xref: $C0C3ZFFFC FDB vec_NMI * FFFC: FD 33 '.3'* Xref: $C0BA, $C15F, $C19B, $C230, $C3A9, $E723MFFFE FDB vec_IRQ_ICF * FFFE: FD 87 '..'ROM2 RESET RoutineCode:* Xref: $FFF4, $FFF6, MFFFEvec_IRQ_ICFLDAA #$01 * FD87: 86 01 '..'BRA ZFDA1 * FD89: 20 16 ' .'* Xref: $FD57ZFD8B LDAA #$02 * FD8B: 86 02 '..'BRA ZFDA1 * FD8D: 20 12 ' .'LDAA #$03 * FD8F: 86 03 '..'BRA ZFDA1 * FD91: 20 0E ' .'LDAA #$04 * FD93: 86 04 '..'BRA ZFDA1 * FD95: 20 0A ' .'LDAA #$05 * FD97: 86 05 '..'BRA ZFDA1 * FD99: 20 06 ' .'* Xref: $E305ZFD9B LDAA #$06 * FD9B: 86 06 '..'BRA ZFDA1 * FD9D: 20 02 ' .'* Xref: $F7DAZFD9F LDAA #$07 * FD9F: 86 07 '..'* Xref: $FD89, $FD8D, $FD91, $FD95, $FD99, $FD9DZFDA1 SEI * FDA1: 0F '.'STAA M0080 * FDA2: 97 80 '..'* Xref: $FD84, $FDC4, $FDD0ZFDA4 LDS #M00FF * FDA4: 8E 00 FF '...'JSR ZF063 * FDA7: BD F0 63 '..c'JSR ZEF7B * FDAA: BD EF 7B '..{'TSTB * FDAD: 5D ']'BEQ ZFDC6 * FDAE: 27 16 ''.'DECB * FDB0: 5A 'Z'LDX #MFE4E * FDB1: CE FE 4E '..N'ASLB * FDB4: 58 'X'ABX * FDB5: 3A ':'LDX ,X * FDB6: EE 00 '..'JSR ZFFAF * FDB8: BD FF AF '...'AIM #$DF,M0000 * FDBB: 71 DF 00 'q..'LDX #MFFFF * FDBE: CE FF FF '...'* Xref: $FDC2ZFDC1 DEX * FDC1: 09 '.'BNE ZFDC1 * FDC2: 26 FD '&.'BRA ZFDA4 * FDC4: 20 DE ' .'

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 07, 2022, 08:30:10 pm
content: As I've told earlier, the smaller 16K ROM is a standalone FPGA loader. Don't waste time on it, there are no communications, it just loads an embedded FPGA image, test the RAM, does some hw init and switches to the main 128K ROM that contains "main" code.With 128K ROM mapped per my description above finding string refs is trivial. An example:- "BAD CARD" message is at 0x8A44- Press Alt-B (search for binary data)- Enter 8a44- ref is found at 88AB: ldd #8A44 - that's it, press O there to convert it to offset- the message pointer is passed to a function at 0x794A (by 88B3: jsr 794A) - that's some kind of OutTextAt(row, msg), check other refs to it to find more message output.FF 04 xx xx 05 packets seen in your txt dumps are sent by a func at 0xD417. D310 is TxByte(val), check other refs to it to find more packet types. D340 is RxByte(), several comms processing funcs call it. E862 is UpdateCRC(val), updating wCrc at 0xC7 (in IRAM), used by comms.

author: nali
author_rank: Frequent Contributor
timestamp: March 07, 2022, 09:12:52 pm
content: Quote from: Rjevski on March 07, 2022, 12:24:38 amIt's a bit of a long shot but as it's European it may be using VDV300 - in which case try 9600/E/7/1 or maybe even 1200/E/7/1. You'll see ASCII strings if it is.

author: Rjevski
author_rank: Unknown
timestamp: March 07, 2022, 10:18:00 pm
content: Not sure when that standard was released - this is a pretty old machine & system and while it's been inspected relatively recently (2015) according to a sticker inside I would expect that the actual software & protocols were designed in the late 90s/very early 00s. But I've tried anyway, nothing conclusive - see the two kinds of output (the change in the middle is me swapping between the first setting you suggested and the second one).

author: Rjevski
author_rank: Unknown
timestamp: March 07, 2022, 11:53:03 pm
content: It seems like some parts of the main firmware has some sort of checksum on it. Attempting to do a benign modification (in this case, swapping a character in the string "CARD") makes the machine not boot and not produce any serial output. However, changing a byte in a different region worked fine (as in it prevented it from displaying anything on the screen, but I was still getting serial output at least).

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 08, 2022, 12:45:46 pm
content: Each flash bank has CRC16. Bank header:Code:+0 dw crc16 //lsb first+2 dw magic == 0x87CD+4 dw start+6 dw endExample: 16K ROM header: { .crc16=0xDE33, .magic=0x87CD, .start=0xC002 - skip crc16 itself, .end=0xFFFF }. CRC16 calculation in my 010Editor (initial value=0, polynomial=0xA001) produces 0x33DE.Python crcmod has a builtin implementation with these params, example:Code:#!/usr/bin/python3import crcmodcrc16func = crcmod.predefined.mkCrcFun('crc-16')data = open('boot.bin', 'rb').read()print(hex(crc16func(data[2:])))Another finding: 16K bootloader ROM can reflash the 128K part.

author: Rjevski
author_rank: Unknown
timestamp: March 08, 2022, 06:03:50 pm
content: Thanks for looking into this, I'll keep this in mind in my next attempt and will write a script to regenerate the CRCs.I guess the bootloader reflashing the flash might be for some remote firmware update mechanism? Either it waits for a magic packet at boot over serial or alternatively, the 128k part can be sent a command to pass control back to the bootloader (by simply rebooting?) once it receives a firmware update command. This would allow firmware updates without having to physically open the machine and swap chips.Also, another bit of trivia from yesterday - I managed to make the machine reboot by sending it garbage over serial at 9600/8N1 by mashing the keyboard. The machine rebooted and I got 1.0Z183 on the screen. Sadly, I couldn't reproduce it. I tried just sending /dev/urandom to it for a few minutes and nothing happened so I don't think it was a crash - rather I must've accidentally sent a valid command manually.

author: bingo600
author_rank: Super Contributor
timestamp: March 08, 2022, 07:06:04 pm
content: QuoteStrange they did it that way around ...The BootEEPROMcan reprogram theEPROM, that requires UV light to erase (AM27C128-200DC)Well ... There are some blocks of 0xFFFF they can patch some stuff into./Bingo

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 08, 2022, 08:02:40 pm
content: Bingo, no, the opposite - the bootloader in 16K 27C128 writes the main app to 128K 28F010.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 08, 2022, 09:37:32 pm
content: 04 Cx Cx 05 packets are some pings - the machine, acting as a master, is looking for some slave device, Cx values are slave addresses. Depending on some unclear condition (DIP switch?) the machine can also act as a slave and wait for 04 Cx Cx 05 packet (x is set somehow, another DIP sw?). Expected replies are single bytes 04, 05, 10 and some complex packet starting with 02, ending with 03, having control bytes (like 02, 03) escaped as 10 xx and containing a crc16.

author: Rjevski
author_rank: Unknown
timestamp: March 08, 2022, 10:53:41 pm
content: There are indeed 2x8 DIP switches - pretty sure all were off when I got the machine. I've cycled through them all one by one and didn't notice any change in behavior - bruteforcing all the potential combinations is going to be very time-consuming (given it takes ~8 seconds to boot). Haven't had time to play with it today but will try throwing some serial traffic at it tomorrow.

author: Rjevski
author_rank: Unknown
timestamp: March 12, 2022, 03:56:14 am
content: Got some progress.I managed to put the device into slave mode - the 7th switch of the topmost DIP switch bank seems to control the master/slave mode. At least some of the remaining switches also control the address of the device.Sending a 04 xx xx 05 (xx varies depending on the address set on the DIP switches) - I've had C7, C3, etc appears to make the machine boot - it displays "CLOSED" on the screen and returns some data on the serial port:Code:00000000: 1002 4c00 0001 0ffe de33 9b0e bdce 5632 ..L......3....V200000010: 2e30 2f30 2030 312e 3037 2e39 3156 372e .0/0 01.07.91V7.00000020: 3020 2020 3033 2f30 332f 3938 5331 2e30 0 03/03/98S1.000000030: 5a20 2020 2020 2020 2020 2000 0546 5210 Z ..FR.00000040: 038d 5a05 0505 0505 ..Z.....5A seems to be the terminator of the frame - the "05" bytes after arrive at about 1/second, suggesting some kind of keep alive or something. Sending more data during the "05" period returns FF. The byte before the terminator must be the CRC.This response seems to be an example of the complex format Abyrvalg mentioned - I'm going to write some Python scripts to send them and do escaping/CRC properly.Also, besides its "primary" address, it seems like the machine also responds on other addresses. I've made myself a quick bruteforcer to iterate through all the 255 possible addresses, seems like address 131 (0x83) also responds (as usual, I am sending the same command type, so here it would be 04 83 83 05) - I get "10 30" back immediately with 4 further "15" responses every ~10 seconds - seems like it's waiting for more data. If sent first after powerup, this will also set the machine in the "CLOSED" state.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 12, 2022, 07:37:40 am
content: Yes, in slave mode the incoming address is masked with 0xBF before comparison and bit 6 is used later for some other purpose - two completely separate code paths depending on it, something like control/data bit??

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 12, 2022, 03:14:34 pm
content: Slave response to 04 xx xx 05 with addr.6 bit set:10 02 - DLE STXvariable-length payload with every 10 symbol (DLE) replaced by 10 10 - from some buf filled by other funcs not related to comms10 03 - DLE ETXcrc16l crc16h - crc of payload (before10 -> 10 10 stuffing !) and final 03 byte (w/o 10 !)after that the machine waits for 10 31 acknowledge, sending a 05 (ENQ) after each rx timeout, trying 5 times (those 05 05 05 05 05 in your dump)finally it sends a 04

author: Rjevski
author_rank: Unknown
timestamp: March 12, 2022, 03:42:42 pm
content: Just wondering, is this all from disassembly or did you somehow manage to run parts of the code in an emulator?I've tried again - seems like the machine's response to 04xxxx05 is inconsistent.After initial powerup, the first response will be a single 04 (and it changing to its "CLOSED" state). Further commands like it will produce the responses described previously with the stream of 05 05 05...If I send a 10 31 in response to those 05 05 05 (gotta be quick - seems like it's buffered, by the time I see the second "05" it's too late and the microcontroller has already timed out the conversation) results with a 04 response - after which the 04xxxx05 command only ever elicits that response and nothing more. Seems like it establishes some kind of "conversation" context where it expects different commands from now on, and presumably there's a way to exit this context as well?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 12, 2022, 06:06:52 pm
content: Yes, disasm.I see now, doing that full addr.6=1 exchange clears some flag and disables further 10 02 ... 10 03 crc packet sending until that flag is set again (by some code not related to comms - card scan?).But there is another path available:send 04 xx xx 05 with addr.6=0the machine either responds with NAK (15) and continues the comms loopor does this:send 10 30 (or 10 31, the LSB toggles from iteration to iteration)receive 10 02 ... 10 03 crcl crch packetsend 10 3xcontinue the comms loopthis also sets a flag signaling to non-comms code to process the rx buf contentRx buf content (10 02 ... 10 03 packet payload):buf==4D -> do nothing (ping?)buf==E3 -> show "CMD MODE" on LCD and jump to some other ROM bank (back to 16K boot ROM ?)other values - ??

author: Rjevski
author_rank: Unknown
timestamp: March 12, 2022, 10:31:07 pm
content: > doing that full addr.6=1 exchange clears some flag and disables further 10 02 ... 10 03 crc packet sending until that flag is set again (by some code not related to comms - card scan?).> card scan?Does it first do something to put the machine in a state to accept cards? There's a solenoid on the card slot that is closed by default (no power = card slot closed), so the machine has to explicitly "want" a card for a card to end up in the card slot. Simply doing the first handshake as described in my previous post (which puts it in a "CLOSED" state) isn't enough to unlock the card slot.> show "CMD MODE" on LCD and jump to some other ROM bank (back to 16K boot ROM ?)This could be interesting. Looking at the strings in the ROM I don't see anything for "day to day" operations such as validating tickets and confirming to the user that their ticket has been validated (or denied), so I suspect the machine is just a very dumb peripheral that relies on the serial bus for every operation, including the card validation and display of messages (it'll presumably send a packet when it reads a card, expect in the reply what to write on the magstripe, print on the ticket and display on the screen). In this case, the next question would be whether it's supposed to receive commands or raw code to execute.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 13, 2022, 11:55:19 am
content: It’s quite hard to move further from this point, I’ve consumed all easily visible "entry points" (refs to text messages, UART registers, flash IDs array, CRC poly). A code controlling the solenoid would be indistinguishable from any other GPIO access. Perhaps you could trace some important hw control paths to CPU/PPI pins to get an idea what reg.bit corresponds to them in code?