Hacking old HP spectrum Analyzers - Page 1
Forum section: electronics / testgear

author: alex.forencich
author_rank: Frequent Contributor
timestamp: April 08, 2014, 02:57:26 am
content: So this is something I did a little while ago, but I figured people here might find it useful, or at least interesting.The 859xE series analyzers made by HP/Agilent have a number of installable options. One of these options is Option 105, the gate option. For the A series analyzers, this is a card. However, for the E series analyzers, HP actually built the gate circuitry into the motherboard. Interestingly, they then provided two ways of adding option 105: one is to send the analyzer back to HP, where they will turn on the internal gate option. If this is too difficult, they can also send out a whole gate card that the customer can install. The internal option shows up as GATE rev B, while the card shows up as GATE rev A.I figured it would be interesting to figure out how to turn on the gate option in the analyzer as installing a whole option card is rather redundant.First, the recon: the internal gate module itself just appears as a pair of SMB connectors on the motherboard that must be connected to the back panel with SMB to BNC cables. Then, the module must be enabled in the firmware somehow. These analyzers have a small amount of battery-backed NVRAM, the perfect place to store calibration data and possibly this sort of a 'sofware switch.' The service manual also lists some procedures for when the internal memory is erased. For most analyzers, nothing special is required as the firmware can detect what analyzer it's running in. However, there are a couple of cases where this doesn't work and manual intervention is required. First, there is apparently no detectable difference between the 8595E and the 8596E, so the unit will pop up a box and ask. However, the procedure for an 8591C is different: it will initialize as an 8591E, and then the manual asks you to send the analyzer FACTSET 11023,1 to switch it to 8591C.That's a very pretty looking magic number, there. I wonder if there are any more of those?So, I bought an EPROM programmer, read out all four EPROMs, pieced them together into one, and opened the shebang up in a hex editor. I searched for FACTSET. I found exactly one hit at address 0007E3E0, in what appeared to be some sort of command data structure. That's not going to do me a whole lot of good, so I converted the magic number 11023 to hex (2B 0F) and searched for that. I got exactly one hit, at address 0001978E. This one appeared to be buried in some instructions as well - more interesting! Off to the disassembler....Right around that address, we find this very interesting piece of code:(please note that the comments and names have been added by me, they were not originally in the disassembly!)Code:ROM:0001974C ; =============== S U B R O U T I N E =======================================ROM:0001974CROM:0001974C ; Attributes: bp-based frameROM:0001974CROM:0001974C process_factset: ; CODE XREF: j_process_factsetjROM:0001974CROM:0001974C var_4 = -4ROM:0001974C arg_0 = 8ROM:0001974CROM:0001974C ; FUNCTION CHUNK AT ROM:0001977A SIZE 00000082 BYTESROM:0001974CROM:0001974C link a6,#-2ROM:00019750 move.w d0,(sp)ROM:00019752 bra.s loc_1977AROM:00019752 ; End of function process_factsetROM:00019752ROM:00019754ROM:00019754 ; =============== S U B R O U T I N E =======================================ROM:00019754ROM:00019754ROM:00019754 update_bff6: ; CODE XREF: process_factset+3CpROM:00019754 ; process_factset+4Cp ...ROM:00019754 btst #0,9(a6)ROM:0001975A beq.s loc_19768ROM:0001975C move.w ($FFFFBFF6).w,d6ROM:00019760 move.w -4(a6),d0ROM:00019764 bset d0,d6ROM:00019766 bra.s loc_19774ROM:00019768 ; ---------------------------------------------------------------------------ROM:00019768ROM:00019768 loc_19768: ; CODE XREF: update_bff6+6jROM:00019768 move.w ($FFFFBFF6).w,d0ROM:0001976C move.w -4(a6),d6ROM:00019770 bclr d6,d0ROM:00019772 move.w d0,d6ROM:00019774ROM:00019774 loc_19774: ; CODE XREF: update_bff6+12jROM:00019774 move.w d6,($FFFFBFF6).wROM:00019778 rtsROM:00019778 ; End of function update_bff6ROM:00019778ROM:0001977A ; ---------------------------------------------------------------------------ROM:0001977A ; START OF FUNCTION CHUNK FOR process_factsetROM:0001977AROM:0001977A loc_1977A: ; CODE XREF: process_factset+6jROM:0001977A subq.l #2,spROM:0001977C cmp.w #$3421,d0ROM:00019780 bne.s loc_1978CROM:00019782 move.w #$A,var_4(a6)ROM:00019788 bsr.s update_bff6ROM:0001978A bra.s loc_197F4ROM:0001978C ; ---------------------------------------------------------------------------ROM:0001978CROM:0001978C loc_1978C: ; CODE XREF: process_factset+34jROM:0001978C cmp.w #$2B0F,d0ROM:00019790 bne.s loc_1979CROM:00019792 move.w #9,var_4(a6)ROM:00019798 bsr.s update_bff6ROM:0001979A bra.s loc_197F4ROM:0001979C ; ---------------------------------------------------------------------------ROM:0001979CROM:0001979C loc_1979C: ; CODE XREF: process_factset+44jROM:0001979C cmp.w #$2B44,d0ROM:000197A0 bne.s loc_197ACROM:000197A2 move.w #$E,var_4(a6)ROM:000197A8 bsr.s update_bff6ROM:000197AA bra.s loc_197F4ROM:000197AC ; ---------------------------------------------------------------------------ROM:000197ACROM:000197AC loc_197AC: ; CODE XREF: process_factset+54jROM:000197AC cmp.w #$30E,d0ROM:000197B0 bne.s loc_197BAROM:000197B2 move.w arg_0(a6),($FFFF9FBC).wROM:000197B8 bra.s loc_197F4ROM:000197BA ; ---------------------------------------------------------------------------ROM:000197BAROM:000197BA loc_197BA: ; CODE XREF: process_factset+64jROM:000197BA cmp.w #$30F,d0ROM:000197BE bne.s loc_197C8ROM:000197C0 move.w arg_0(a6),($FFFF9FBE).wROM:000197C6 bra.s loc_197F4ROM:000197C8 ; ---------------------------------------------------------------------------ROM:000197C8ROM:000197C8 loc_197C8: ; CODE XREF: process_factset+72jROM:000197C8 cmp.w #$310,d0ROM:000197CC bne.s loc_197D6ROM:000197CE move.w arg_0(a6),($FFFF9FC0).wROM:000197D4 bra.s loc_197F4ROM:000197D6 ; ---------------------------------------------------------------------------ROM:000197D6ROM:000197D6 loc_197D6: ; CODE XREF: process_factset+80jROM:000197D6 cmp.w #$311,d0ROM:000197DA bne.s loc_197E4ROM:000197DC move.w arg_0(a6),($FFFF9FC2).wROM:000197E2 bra.s loc_197F4ROM:000197E4 ; ---------------------------------------------------------------------------ROM:000197E4ROM:000197E4 loc_197E4: ; CODE XREF: process_factset+8EjROM:000197E4 cmp.w #$44,d0 ; 'D'ROM:000197E8 bne.s loc_197F4ROM:000197EA move.w #6,var_4(a6)ROM:000197F0 bsr.w update_bff6ROM:000197F4ROM:000197F4 loc_197F4: ; CODE XREF: process_factset+3EjROM:000197F4 ; process_factset+4Ej ...ROM:000197F4 unlk a6ROM:000197F6 movea.l (sp)+,a0ROM:000197F8 addq.l #2,spROM:000197FA jmp (a0)ROM:000197FA ; END OF FUNCTION CHUNK FOR process_factsetThis code appears to take two arguments, where one is compared with several 'magic numbers' and the other is then either compared with zero to set/clear a bit or is directly written to a memory location. After some experimentation, it became clear that this code is definitely called by the factset command somehow. This is what these magic numbers do:FACTSET 13345,1 sets a bit in NVRAM with unknown effectFACTSET 11023,1 sets the analyzer to C seriesFACTSET 11076,1 sets the analyzer to L seriesFACTSET 782,n sets the FM demod zero to nFACTSET 783,n sets the FM demod slope to nFACTSET 784,n sets the FM demod narrow bw setting to nFACTSET 785,n sets the FM demod wide bw setting to nFACTSET 68,1 sets a bit in NVRAM with unknown effectThe memory addresses that 782-785 write to correspond with NVRAM registers for the FM demodulator. I do not know why FACTSET can access them, I presume it is for calibration or debugging, but these commands do not appear in the calibration guide. Searching on the addresses eventually yielded the corresponding strings where the values are displayed in the 'cal data' screens. Two of the bits that FACTSET can change in location FFFFBFF6 have unknown functions, while two of them change the analyzer to C or L series.None of this has anything to do with the gate module, though! Or does it? Hmm....Next step is to search for what is displayed when the gate is enabled - "GATE rev B". I found this in the middle of a string table:Code:ROM:0002B50A aHpib: dc.b 4,'HPIB' ; DATA XREF: ROM:00027A96oROM:0002B50F dc.b $20ROM:0002B510 aRs232: dc.b 5,'RS232' ; DATA XREF: ROM:00027A9AoROM:0002B516 aOven: dc.b 4,'OVEN' ; DATA XREF: ROM:off_27A9EoROM:0002B51B dc.b $20ROM:0002B51C aFadc: dc.b 4,'FADC' ; DATA XREF: ROM:off_27AA2oROM:0002B521 dc.b $20ROM:0002B522 aOcsl: dc.b 4,'OCSL' ; DATA XREF: ROM:00027AAAoROM:0002B527 dc.b $20ROM:0002B528 aDrts: dc.b 4,'DRTS' ; DATA XREF: ROM:00027AAEoROM:0002B52D dc.b $20ROM:0002B52E aFmd: dc.b 3,'FMD' ; DATA XREF: ROM:00027AB2oROM:0002B532 aIo: dc.b 2,'IO' ; DATA XREF: ROM:00027AB6oROM:0002B535 dc.b $20ROM:0002B536 aBands: dc.b 5,'BANDS' ; DATA XREF: ROM:00027ABAoROM:0002B53C aGate: dc.b 4,'GATE' ; DATA XREF: ROM:00027ABEoROM:0002B541 dc.b $20ROM:0002B542 aNbw: dc.b 3,'NBW' ; DATA XREF: ROM:off_27AC2oROM:0002B546 aNoise: dc.b 5,'NOISE' ; DATA XREF: ROM:off_27AC6oROM:0002B54C aRfps: dc.b 4,'RFPS' ; DATA XREF: ROM:00027ACAoROM:0002B551 dc.b $20ROM:0002B552 aDdfadc: dc.b 6,'DDFADC' ; DATA XREF: ROM:00027ACEoROM:0002B559 dc.b $20ROM:0002B55A aTgatten: dc.b 7,'TGATTEN' ; DATA XREF: ROM:00027AD2oROM:0002B562 aFast: dc.b 4,'FAST' ; DATA XREF: ROM:00027AD6oROM:0002B567 dc.b $20ROM:0002B568 aTvtun: dc.b 5,'TVTUN' ; DATA XREF: ROM:off_27ADAoROM:0002B56E aAtv: dc.b 3,'ATV' ; DATA XREF: ROM:00027ADEoROM:0002B572 aCage: dc.b 4,'CAGE' ; DATA XREF: ROM:00027AE2oROM:0002B577 dc.b $20ROM:0002B578 aFrqext: dc.b 6,'FRQEXT' ; DATA XREF: ROM:off_27AE6oROM:0002B57F dc.b $20ROM:0002B580 aLoOutput: dc.b 9,'LO OUTPUT' ; DATA XREF: ROM:off_27AEAoROM:0002B58A aComb_0: dc.b 4,'COMB' ; DATA XREF: ROM:00027AEEoROM:0002B58F dc.b $20ROM:0002B590 aGrdly: dc.b 5,'GRDLY' ; DATA XREF: ROM:off_27AF2oROM:0002B596 aGatea: dc.b 5,'GATEA' ; DATA XREF: ROM:off_27AF6oROM:0002B59C aGateb: dc.b 5,'GATEB' ; DATA XREF: ROM:off_27AFAoROM:0002B5A2 aNbwcount: dc.b 8,'NBWCOUNT' ; DATA XREF: ROM:00027AFEoROM:0002B5AB dc.b $20ROM:0002B5AC aProto: dc.b 5,'PROTO' ; DATA XREF: ROM:00027B02oROM:0002B5B2 aUfp: dc.b 3,'UFP' ; DATA XREF: ROM:off_27B06oROM:0002B5B2 ; ROM:000281A4oROM:0002B5B6 aDdfw: dc.b 4,'DDFW' ; DATA XREF: ROM:00027B0AoROM:0002B5BB dc.b $20ROM:0002B5BC aDdfwrev: dc.b 7,'DDFWREV' ; DATA XREF: ROM:00027B0EoROM:0002B5C4 aDect: dc.b 4,'DECT' ; DATA XREF: ROM:00027B12oROM:0002B5C9 dc.b $20ROM:0002B5CA aUfpa: dc.b 4,'UFPA' ; DATA XREF: ROM:off_27B16oROM:0002B5CF dc.b $20ROM:0002B5D0 aParallel: dc.b 8,'PARALLEL' ; DATA XREF: ROM:off_27B1AoROM:0002B5D9 dc.b $20ROM:0002B5DA aHpiba: dc.b 5,'HPIBA' ; DATA XREF: ROM:00027B1EoROM:0002B5E0 aHpibb: dc.b 5,'HPIBB' ; DATA XREF: ROM:00027B22oROM:0002B5E6 aRs232a: dc.b 6,'RS232A' ; DATA XREF: ROM:00027B26oROM:0002B5ED dc.b $20ROM:0002B5EE aRs232b: dc.b 6,'RS232B' ; DATA XREF: ROM:00027B2AoROM:0002B5F5 dc.b $20ROM:0002B5F6 aTvpict: dc.b 6,'TVPICT' ; DATA XREF: ROM:off_27B2EoROM:0002B5FD dc.b $20ROM:0002B5FE asc_2B5FE: dc.b 2,': ' ; DATA XREF: sub_27F62+4AoROM:0002B601 dc.b $20ROM:0002B602 aDemodTv: dc.b 8,'DEMOD/TV' ; DATA XREF: ROM:00028046oROM:0002B60B dc.b $20ROM:0002B60C aDemodQpd: dc.b 9,'DEMOD/QPD' ; DATA XREF: ROM:00028068oROM:0002B616 aGateRevA: dc.b $A ; DATA XREF: ROM:0002808AoROM:0002B616 dc.b 'GATE Rev A'ROM:0002B621 dc.b $20ROM:0002B622 aGateRevB: dc.b $A ; DATA XREF: ROM:000280ACoROM:0002B622 ; ROM:00028280oROM:0002B622 dc.b 'GATE Rev B'ROM:0002B62D dc.b $20ROM:0002B62E aGroupDelay: dc.b $B,'GROUP DELAY' ; DATA XREF: ROM:000280F6oROM:0002B63A aDdFadc: dc.b 7,'DD/FADC' ; DATA XREF: ROM:0002815AoROM:0002B642 aDdfwRev: dc.b 9,'DDFW rev ' ; DATA XREF: ROM:0002816AoROM:0002B64C aUfpA: dc.b 5,'UFP A' ; DATA XREF: ROM:000281CAoROM:0002B652 aTvPicture: dc.b $A ; DATA XREF: ROM:000281F0oROM:0002B652 dc.b 'TV Picture'ROM:0002B65D dc.b $20ROM:0002B65E aDeleteCnt: dc.b $A ; DATA XREF: ROM:0002825EoROM:0002B65E dc.b 'Delete CNT'ROM:0002B669 dc.b $20ROM:0002B66A unk_2B66A: dc.b 3 ; DATA XREF: ROM:00028298oROM:0002B66B dc.b $37 ; 7ROM:0002B66C dc.b $35 ; 5ROM:0002B66D dc.b $FA ;ROM:0002B66E aDectSource: dc.b $B,'DECT Source' ; DATA XREF: ROM:000282F0oROM:0002B67A aHpibParallel: dc.b $F,'HPIB + Parallel' ; DATA XREF: ROM:0002835EoROM:0002B68A aRs232Parallel: dc.b $10,'RS232 + Parallel' ; DATA XREF: ROM:00028374oROM:0002B69B dc.b $20(continued...)

author: alex.forencich
author_rank: Frequent Contributor
timestamp: April 08, 2014, 02:59:33 am
content: It turns out that a bunch of these are then referenced in a list of addresses in another part of the code, followed by a function which I will call check_installed_options. Interestingly, the number of items in the string table exactly match the number of entries in the jump table. Creepy. After figuring out how the jump_table_call routine works, and with the first few entries commented with the corresponding string table entry, the code looks like this:Code:ROM:00027A84 ; ---------------------------------------------------------------------------ROM:00027A86 off_27A86: dc.l aCnt ; DATA XREF: check_installed_options+14oROM:00027A86 ; ROM:00028244o ...ROM:00027A86 ; "\x03CNT"ROM:00027A8A off_27A8A: dc.l aTv ; DATA XREF: ROM:00028032rROM:00027A8A ; "\x02TV"ROM:00027A8E off_27A8E: dc.l aQpd ; DATA XREF: ROM:00028054rROM:00027A8E ; "\x03QPD"ROM:00027A92 off_27A92: dc.l aTg_0 ; DATA XREF: ROM:000282A6rROM:00027A92 ; ROM:000282C4r ...ROM:00027A92 ; "\x02TG"ROM:00027A96 dc.l aHpib ; "\x04HPIB"ROM:00027A9A dc.l aRs232 ; "\x05RS232"ROM:00027A9E off_27A9E: dc.l aOven ; DATA XREF: ROM:00027FEArROM:00027A9E ; ROM:00028002rROM:00027A9E ; "\x04OVEN"ROM:00027AA2 off_27AA2: dc.l aFadc ; DATA XREF: ROM:0002800ErROM:00027AA2 ; ROM:00028026rROM:00027AA2 ; "\x04FADC"ROM:00027AA6 off_27AA6: dc.l aCard_0 ; DATA XREF: ROM:00028202rROM:00027AA6 ; ROM:0002821ArROM:00027AA6 ; "\x04CARD"ROM:00027AAA dc.l aOcsl ; "\x04OCSL"ROM:00027AAE dc.l aDrts ; "\x04DRTS"ROM:00027AB2 dc.l aFmd ; "\x03FMD"ROM:00027AB6 dc.l aIo ; "\x02IO"ROM:00027ABA dc.l aBands ; "\x05BANDS"ROM:00027ABE dc.l aGate ; "\x04GATE"ROM:00027AC2 off_27AC2: dc.l aNbw ; DATA XREF: ROM:0002812CrROM:00027AC2 ; ROM:00028144rROM:00027AC2 ; "\x03NBW"ROM:00027AC6 off_27AC6: dc.l aNoise ; DATA XREF: ROM:00028104rROM:00027AC6 ; ROM:00028120rROM:00027AC6 ; "\x05NOISE"ROM:00027ACA dc.l aRfps ; "\x04RFPS"ROM:00027ACE dc.l aDdfadc ; "\x06DDFADC"ROM:00027AD2 dc.l aTgatten ; "\aTGATTEN"ROM:00027AD6 dc.l aFast ; "\x04FAST"ROM:00027ADA off_27ADA: dc.l aTvtun ; DATA XREF: ROM:000280BArROM:00027ADA ; ROM:000280D2rROM:00027ADA ; "\x05TVTUN"ROM:00027ADE dc.l aAtv ; "\x03ATV"ROM:00027AE2 dc.l aCage ; "\x04CAGE"ROM:00027AE6 off_27AE6: dc.l aFrqext ; DATA XREF: ROM:0002839ErROM:00027AE6 ; ROM:000283B6rROM:00027AE6 ; "\x06FRQEXT"ROM:00027AEA off_27AEA: dc.l aLoOutput ; DATA XREF: ROM:00028300rROM:00027AEA ; ROM:00028314rROM:00027AEA ; "\tLO OUTPUT"ROM:00027AEE dc.l aComb_0 ; "\x04COMB"ROM:00027AF2 off_27AF2: dc.l aGrdly ; DATA XREF: ROM:000280DErROM:00027AF2 ; "\x05GRDLY"ROM:00027AF6 off_27AF6: dc.l aGatea ; DATA XREF: ROM:00028076rROM:00027AF6 ; "\x05GATEA"ROM:00027AFA off_27AFA: dc.l aGateb ; DATA XREF: ROM:00028098rROM:00027AFA ; ROM:0002826CrROM:00027AFA ; "\x05GATEB"ROM:00027AFE dc.l aNbwcount ; "\bNBWCOUNT"ROM:00027B02 dc.l aProto ; "\x05PROTO"ROM:00027B06 off_27B06: dc.l aUfp ; DATA XREF: ROM:0002818CrROM:00027B06 ; "\x03UFP"ROM:00027B0A dc.l aDdfw ; "\x04DDFW"ROM:00027B0E dc.l aDdfwrev ; "\aDDFWREV"ROM:00027B12 dc.l aDect ; "\x04DECT"ROM:00027B16 off_27B16: dc.l aUfpa ; DATA XREF: ROM:000281B2rROM:00027B16 ; "\x04UFPA"ROM:00027B1A off_27B1A: dc.l aParallel ; DATA XREF: ROM:00028392rROM:00027B1A ; "\bPARALLEL"ROM:00027B1E dc.l aHpiba ; "\x05HPIBA"ROM:00027B22 dc.l aHpibb ; "\x05HPIBB"ROM:00027B26 dc.l aRs232a ; "\x06RS232A"ROM:00027B2A dc.l aRs232b ; "\x06RS232B"ROM:00027B2E off_27B2E: dc.l aTvpict ; DATA XREF: ROM:000281D8rROM:00027B2E ; "\x06TVPICT"ROM:00027B32 word_27B32: dc.w $D ; DATA XREF: ROM:0002823EoROM:00027B32 ; ROM:00028334oROM:00027B34 word_27B34: dc.w $66 ; DATA XREF: ROM:00028042rROM:00027B36 word_27B36: dc.w $67 ; DATA XREF: ROM:00028064rROM:00027B38 dc.w $AROM:00027B3A dc.w $15ROM:00027B3C dc.w $17ROM:00027B3E word_27B3E: dc.w 4 ; DATA XREF: ROM:00027FFArROM:00027B40 word_27B40: dc.w $65 ; DATA XREF: ROM:0002801ErROM:00027B42 word_27B42: dc.w 3 ; DATA XREF: ROM:00028212rROM:00027B44 dc.w 0ROM:00027B46 dc.w 0ROM:00027B48 dc.w 0ROM:00027B4A dc.w 0ROM:00027B4C dc.w 0ROM:00027B4E dc.w $69ROM:00027B50 word_27B50: dc.w $82 ; DATA XREF: ROM:0002813CrROM:00027B52 word_27B52: dc.w $77 ; DATA XREF: ROM:00028118rROM:00027B54 dc.w 0ROM:00027B56 dc.w 0ROM:00027B58 dc.w 0ROM:00027B5A dc.w 0ROM:00027B5C word_27B5C: dc.w $6B ; DATA XREF: ROM:000280CArROM:00027B5E dc.w 0ROM:00027B60 dc.w 0ROM:00027B62 word_27B62: dc.w $1A ; DATA XREF: ROM:000283AErROM:00027B64 dc.w 9ROM:00027B66 dc.w 0ROM:00027B68 word_27B68: dc.w $6F ; DATA XREF: ROM:000280F2rROM:00027B6A word_27B6A: dc.w $69 ; DATA XREF: ROM:00028086rROM:00027B6C word_27B6C: dc.w $69 ; DATA XREF: ROM:000280A8rROM:00027B6C ; ROM:0002827CrROM:00027B6E dc.w 0ROM:00027B70 dc.w 0ROM:00027B72 word_27B72: dc.w $3D ; DATA XREF: ROM:000281A0rROM:00027B72 ; ROM:000281C6rROM:00027B74 dc.w 0ROM:00027B76 dc.w 0ROM:00027B78 dc.w $3CROM:00027B7A dc.w $3DROM:00027B7C word_27B7C: dc.w $18 ; DATA XREF: ROM:0002838ArROM:00027B7E dc.w 0ROM:00027B80 dc.w $29ROM:00027B82 dc.w 0ROM:00027B84 dc.w $2BROM:00027B86 word_27B86: dc.w $B4 ; DATA XREF: ROM:000281ECr

author: alex.forencich
author_rank: Frequent Contributor
timestamp: April 08, 2014, 03:01:20 am
content: Half of the corresponding subroutine:Code:ROM:00027B88 ; =============== S U B R O U T I N E =======================================ROM:00027B88ROM:00027B88 ; Attributes: bp-based frameROM:00027B88ROM:00027B88 check_installed_options: ; CODE XREF: ROM:000014D4jROM:00027B88 ; ROM:00027FEEp ...ROM:00027B88ROM:00027B88 var_11 = -$11ROM:00027B88 var_6 = -6ROM:00027B88 var_4 = -4ROM:00027B88ROM:00027B88 link a6,#-4ROM:00027B8C move.l d0,(sp)ROM:00027B8E subq.l #2,spROM:00027B90 clr.l d0ROM:00027B92 move.l d0,-(sp)ROM:00027B94 move.w #$2B,-(sp) ; '+'ROM:00027B98 move.l var_4(a6),-(sp)ROM:00027B9C lea off_27A86,a0ROM:00027BA0 jsr sub_862ROM:00027BA4 move.w d0,var_6(a6)ROM:00027BA8 tst.w d0ROM:00027BAA blt.w loc_27F5CROM:00027BAE bra.w loc_27F58ROM:00027BB2 ; ---------------------------------------------------------------------------ROM:00027BB2 jsr sub_22668ROM:00027BB6 btst #0,d0ROM:00027BBA beq.s loc_27BD6ROM:00027BBC jsr sub_2267CROM:00027BC0 btst #0,d0ROM:00027BC4 beq.s loc_27BCEROM:00027BC6 move.l #3,(sp)ROM:00027BCC bra.s loc_27BD4ROM:00027BCE ; ---------------------------------------------------------------------------ROM:00027BCEROM:00027BCE loc_27BCE: ; CODE XREF: check_installed_options+3CjROM:00027BCE move.l #1,(sp)ROM:00027BD4ROM:00027BD4 loc_27BD4: ; CODE XREF: check_installed_options+44jROM:00027BD4 bra.s loc_27BD8ROM:00027BD6 ; ---------------------------------------------------------------------------ROM:00027BD6ROM:00027BD6 loc_27BD6: ; CODE XREF: check_installed_options+32jROM:00027BD6 clr.l (sp)ROM:00027BD8ROM:00027BD8 loc_27BD8: ; CODE XREF: check_installed_options:loc_27BD4jROM:00027BD8 bra.w loc_27F5CROM:00027BDC ; ---------------------------------------------------------------------------ROM:00027BDC jsr sub_98EROM:00027BE0 btst #0,d0ROM:00027BE4 beq.s loc_27C10ROM:00027BE6 btst #$B,($FFFFB072).wROM:00027BEC beq.s loc_27BFEROM:00027BEE btst #$D,($FFFFB072).wROM:00027BF4 beq.s loc_27BFEROM:00027BF6 move.w #3,var_6(a6)ROM:00027BFC bra.s loc_27C04ROM:00027BFE ; ---------------------------------------------------------------------------ROM:00027BFEROM:00027BFE loc_27BFE: ; CODE XREF: check_installed_options+64jROM:00027BFE ; check_installed_options+6CjROM:00027BFE move.w #1,var_6(a6)ROM:00027C04ROM:00027C04 loc_27C04: ; CODE XREF: check_installed_options+74jROM:00027C04 move.w ($FFFFB07C).w,d6ROM:00027C08 lsl.w #5,d6ROM:00027C0A or.w d6,var_6(a6)ROM:00027C0E bra.s loc_27C14ROM:00027C10 ; ---------------------------------------------------------------------------ROM:00027C10ROM:00027C10 loc_27C10: ; CODE XREF: check_installed_options+5CjROM:00027C10 clr.w var_6(a6)ROM:00027C14ROM:00027C14 loc_27C14: ; CODE XREF: check_installed_options+86jROM:00027C14 move.w var_6(a6),d0ROM:00027C18 ext.l d0ROM:00027C1A move.l d0,(sp)ROM:00027C1C bra.w loc_27F5CROM:00027C20 ; ---------------------------------------------------------------------------ROM:00027C20 jsr sub_958ROM:00027C24 ext.w d0ROM:00027C26 ext.l d0ROM:00027C28 move.l d0,(sp)ROM:00027C2A bra.w loc_27F5CROM:00027C2E ; ---------------------------------------------------------------------------ROM:00027C2E move.w ($FFFFAD4C).w,d6ROM:00027C32 ext.l d6ROM:00027C34 move.l d6,(sp)ROM:00027C36 bra.w loc_27F5CROM:00027C3A ; ---------------------------------------------------------------------------ROM:00027C3A tst.b ($FFFFBF09).wROM:00027C3E seq d0ROM:00027C40 cmpi.b #4,($FFFFBF09).wROM:00027C46 seq d6ROM:00027C48 or.b d0,d6ROM:00027C4A ext.w d6ROM:00027C4C ext.l d6ROM:00027C4E move.l d6,(sp)ROM:00027C50 bra.w loc_27F5CROM:00027C54 ; ---------------------------------------------------------------------------ROM:00027C54 cmpi.b #1,($FFFFBF09).wROM:00027C5A seq d0ROM:00027C5C cmpi.b #8,($FFFFBF09).wROM:00027C62 seq d6ROM:00027C64 or.b d0,d6ROM:00027C66 ext.w d6ROM:00027C68 ext.l d6ROM:00027C6A move.l d6,(sp)ROM:00027C6C bra.w loc_27F5CROM:00027C70 ; ---------------------------------------------------------------------------ROM:00027C70 jsr sub_227BAROM:00027C74 ext.l d0ROM:00027C76 move.l d0,(sp)ROM:00027C78 bra.w loc_27F5CROM:00027C7C ; ---------------------------------------------------------------------------ROM:00027C7C jsr sub_1EAROM:00027C80 ext.w d0ROM:00027C82 ext.l d0ROM:00027C84 move.l d0,(sp)ROM:00027C86 bra.w loc_27F5CROM:00027C8A ; ---------------------------------------------------------------------------ROM:00027C8A bsr.w sub_2689CROM:00027C8E andi.b #1,d0ROM:00027C92 move.w d0,-(sp)ROM:00027C94 bsr.w sub_268AAROM:00027C98 lsl.b #1,d0ROM:00027C9A add.b $12+var_11(sp),d0ROM:00027C9E addq.w #2,spROM:00027CA0 ext.w d0ROM:00027CA2 ext.l d0ROM:00027CA4 move.l d0,(sp)ROM:00027CA6 bra.w loc_27F5CROM:00027CAA ; ---------------------------------------------------------------------------ROM:00027CAA bsr.w sub_261FCROM:00027CAE ext.w d0ROM:00027CB0 ext.l d0ROM:00027CB2 move.l d0,(sp)ROM:00027CB4 bra.w loc_27F5CROM:00027CB8 ; ---------------------------------------------------------------------------ROM:00027CB8 jsr sub_976ROM:00027CBC ext.w d0ROM:00027CBE ext.l d0ROM:00027CC0 move.l d0,(sp)ROM:00027CC2 bra.w loc_27F5CROM:00027CC6 ; ---------------------------------------------------------------------------ROM:00027CC6 jsr sub_8F8ROM:00027CCA ext.w d0ROM:00027CCC ext.l d0ROM:00027CCE move.l d0,(sp)ROM:00027CD0 bra.w loc_27F5CROM:00027CD4 ; ---------------------------------------------------------------------------ROM:00027CD4 cmpi.b #$F,($FFFF9B20).wROM:00027CDA sne d6ROM:00027CDC ext.w d6ROM:00027CDE ext.l d6ROM:00027CE0 move.l d6,(sp)ROM:00027CE2 bra.w loc_27F5CROM:00027CE6 ; ---------------------------------------------------------------------------ROM:00027CE6 move.w ($FFFF9FB4).w,d0ROM:00027CEA ext.l d0ROM:00027CEC move.l d0,(sp)ROM:00027CEE bra.w loc_27F5CROM:00027CF2 ; ---------------------------------------------------------------------------ROM:00027CF2 jsr check_gate_optionROM:00027CF6 andi.b #1,d0ROM:00027CFA sne d6ROM:00027CFC ext.w d6ROM:00027CFE ext.l d6ROM:00027D00 move.l d6,(sp)ROM:00027D02 bra.w loc_27F5CROM:00027D06 ; ---------------------------------------------------------------------------ROM:00027D06 jsr sub_20DD6ROM:00027D0A ext.w d0ROM:00027D0C ext.l d0ROM:00027D0E move.l d0,(sp)ROM:00027D10 bra.w loc_27F5CROM:00027D14 ; ---------------------------------------------------------------------------ROM:00027D14 moveq #$FFFFFFFB,d0ROM:00027D16 bsr.w sub_28506ROM:00027D1A cmp.w #$FFFF,d0ROM:00027D1E sne d6ROM:00027D20 ext.w d6ROM:00027D22 ext.l d6ROM:00027D24 move.l d6,(sp)ROM:00027D26 bra.w loc_27F5CROM:00027D2A ; ---------------------------------------------------------------------------ROM:00027D2A clr.l (sp)ROM:00027D2C bra.w loc_27F5CROM:00027D30 ; ---------------------------------------------------------------------------ROM:00027D30 jsr sub_8F2ROM:00027D34 ext.l d0ROM:00027D36 move.l d0,(sp)ROM:00027D38 bra.w loc_27F5CROM:00027D3C ; ---------------------------------------------------------------------------ROM:00027D3C jsr sub_24B64ROM:00027D40 ext.w d0ROM:00027D42 ext.l d0ROM:00027D44 move.l d0,(sp)ROM:00027D46 bra.w loc_27F5CROM:00027D4A ; ---------------------------------------------------------------------------ROM:00027D4A jsr sub_15AROM:00027D4E move.w d0,-(sp)ROM:00027D50 jsr sub_1EAROM:00027D54 or.b $12+var_11(sp),d0ROM:00027D58 addq.w #2,spROM:00027D5A ext.w d0ROM:00027D5C ext.l d0ROM:00027D5E move.l d0,(sp)ROM:00027D60 bra.w loc_27F5CROM:00027D64 ; ---------------------------------------------------------------------------ROM:00027D64 jsr sub_93AROM:00027D68 ext.w d0ROM:00027D6A ext.l d0ROM:00027D6C move.l d0,(sp)ROM:00027D6E bra.w loc_27F5CROM:00027D72 ; ---------------------------------------------------------------------------ROM:00027D72 jsr sub_93AROM:00027D76 move.w d0,-(sp)ROM:00027D78 jsr sub_98EROM:00027D7C or.b $12+var_11(sp),d0ROM:00027D80 addq.w #2,spROM:00027D82 ext.w d0ROM:00027D84 ext.l d0ROM:00027D86 move.l d0,(sp)ROM:00027D88 bra.w loc_27F5CROM:00027D8C ; ---------------------------------------------------------------------------ROM:00027D8C move.w ($FFFFAFCE).w,d6ROM:00027D90 ext.l d6ROM:00027D92 move.l d6,(sp)ROM:00027D94 bra.w loc_27F5CROM:00027D98 ; ---------------------------------------------------------------------------ROM:00027D98 cmpi.w #$2190,($FFFFBFEE).wROM:00027D9E seq d0ROM:00027DA0 cmpi.w #$2191,($FFFFBFEE).wROM:00027DA6 seq d6ROM:00027DA8 or.b d0,d6ROM:00027DAA ext.w d6ROM:00027DAC and.w ($FFFFA2E2).w,d6ROM:00027DB0 ext.l d6ROM:00027DB2 move.l d6,(sp)ROM:00027DB4 bra.w loc_27F5CROM:00027DB8 ; ---------------------------------------------------------------------------ROM:00027DB8 btst #0,($FFFFAD4E).wROM:00027DBE sne d0ROM:00027DC0 ext.w d0ROM:00027DC2 ext.l d0ROM:00027DC4 move.l d0,(sp)ROM:00027DC6 bra.w loc_27F5CROM:00027DCA ; ---------------------------------------------------------------------------ROM:00027DCA move.w ($FFFFA2E4).w,d6ROM:00027DCE ext.l d6ROM:00027DD0 move.l d6,(sp)ROM:00027DD2 bra.w loc_27F5CROM:00027DD6 ; ---------------------------------------------------------------------------

author: alex.forencich
author_rank: Frequent Contributor
timestamp: April 08, 2014, 03:01:58 am
content: And the other half:Code:ROM:00027DD6 moveq #$FFFFFFFD,d0 ; aGrdly?ROM:00027DD8 bsr.w sub_28506ROM:00027DDC cmp.w #$FFFF,d0ROM:00027DE0 sne d6ROM:00027DE2 ext.w d6ROM:00027DE4 ext.l d6ROM:00027DE6 move.l d6,(sp)ROM:00027DE8 bra.w loc_27F5CROM:00027DEC ; ---------------------------------------------------------------------------ROM:00027DEC jsr check_gate_option ; aGateA?ROM:00027DF0 andi.b #2,d0 ; set Z of d0.1 is zeroROM:00027DF4 sne d6 ; set d6 if NE (Z = 0) (d0.1 set)ROM:00027DF6 ext.w d6ROM:00027DF8 ext.l d6ROM:00027DFA move.l d6,(sp)ROM:00027DFC bra.w loc_27F5CROM:00027E00 ; ---------------------------------------------------------------------------ROM:00027E00 jsr check_gate_option ; aGateB?ROM:00027E04 andi.b #4,d0 ; set Z if d0.2 is zeroROM:00027E08 sne d6 ; set d6 if NE (Z = 0) (d0.2 set)ROM:00027E0A ext.w d6ROM:00027E0C ext.l d6ROM:00027E0E move.l d6,(sp)ROM:00027E10 bra.w loc_27F5CROM:00027E14 ; ---------------------------------------------------------------------------ROM:00027E14 jsr sub_20DD6 ; aNbwCount?ROM:00027E18 btst #5,($FFFFBFF7).wROM:00027E1E sne d6ROM:00027E20 and.b d0,d6ROM:00027E22 ext.w d6ROM:00027E24 ext.l d6ROM:00027E26 move.l d6,(sp)ROM:00027E28 bra.w loc_27F5CROM:00027E2C ; ---------------------------------------------------------------------------ROM:00027E2C jsr sub_2B3A ; aProto?ROM:00027E30 tst.l d0ROM:00027E32 slt d6ROM:00027E34 ext.w d6ROM:00027E36 ext.l d6ROM:00027E38 move.l d6,(sp)ROM:00027E3A bra.w loc_27F5CROM:00027E3E ; ---------------------------------------------------------------------------ROM:00027E3E moveq #$FFFFFFF5,d0 ; aUfp?ROM:00027E40 bsr.w sub_28506ROM:00027E44 cmp.w #$FFFF,d0ROM:00027E48 sne d6ROM:00027E4A ext.w d6ROM:00027E4C ext.l d6ROM:00027E4E move.l d6,(sp)ROM:00027E50 bra.w loc_27F5CROM:00027E54 ; ---------------------------------------------------------------------------ROM:00027E54 jsr sub_940 ; aDdfw?ROM:00027E58 ext.l d0ROM:00027E5A move.l d0,(sp)ROM:00027E5C bra.w loc_27F5CROM:00027E60 ; ---------------------------------------------------------------------------ROM:00027E60 jsr sub_9A0 ; aDdfwrev?ROM:00027E64 move.l d0,(sp)ROM:00027E66 bra.w loc_27F5CROM:00027E6A ; ---------------------------------------------------------------------------ROM:00027E6A moveq #$FFFFFFEF,d0 ; aDect?ROM:00027E6C bsr.w sub_28506ROM:00027E70 cmp.w #$FFFF,d0ROM:00027E74 sne d6ROM:00027E76 ext.w d6ROM:00027E78 ext.l d6ROM:00027E7A move.l d6,(sp)ROM:00027E7C bra.w loc_27F5CROM:00027E80 ; ---------------------------------------------------------------------------ROM:00027E80 moveq #$FFFFFFF3,d0 ; aUfpa?ROM:00027E82 bsr.w sub_28506ROM:00027E86 cmp.w #$FFFF,d0ROM:00027E8A sne d6ROM:00027E8C ext.w d6ROM:00027E8E ext.l d6ROM:00027E90 move.l d6,(sp)ROM:00027E92 bra.w loc_27F5CROM:00027E96 ; ---------------------------------------------------------------------------ROM:00027E96 cmpi.b #2,($FFFF9B20).w ; aParallel?ROM:00027E9C seq d0ROM:00027E9E ext.w d0ROM:00027EA0 ext.l d0ROM:00027EA2 move.l d0,(sp)ROM:00027EA4 bra.w loc_27F5CROM:00027EA8 ; ---------------------------------------------------------------------------ROM:00027EA8 tst.b ($FFFFBF09).w ; aHpibA?ROM:00027EAC seq d6ROM:00027EAE ext.w d6ROM:00027EB0 ext.l d6ROM:00027EB2 move.l d6,(sp)ROM:00027EB4 bra.w loc_27F5CROM:00027EB8 ; ---------------------------------------------------------------------------ROM:00027EB8 cmpi.b #4,($FFFFBF09).w ; aHpibB?ROM:00027EBE seq d0ROM:00027EC0 ext.w d0ROM:00027EC2 ext.l d0ROM:00027EC4 move.l d0,(sp)ROM:00027EC6 bra.w loc_27F5CROM:00027ECA ; ---------------------------------------------------------------------------ROM:00027ECA cmpi.b #1,($FFFFBF09).w ; aRs232a?ROM:00027ED0 seq d6ROM:00027ED2 ext.w d6ROM:00027ED4 ext.l d6ROM:00027ED6 move.l d6,(sp)ROM:00027ED8 bra.w loc_27F5CROM:00027EDC ; ---------------------------------------------------------------------------ROM:00027EDC cmpi.b #8,($FFFFBF09).w ; aRs232b?ROM:00027EE2 seq d0ROM:00027EE4 ext.w d0ROM:00027EE6 ext.l d0ROM:00027EE8 move.l d0,(sp)ROM:00027EEA bra.s loc_27F5CROM:00027EEC ; ---------------------------------------------------------------------------ROM:00027EEC moveq #$FFFFFFDF,d0 ; aTvpict?ROM:00027EEE bsr.w sub_28506ROM:00027EF2 cmp.w #$FFFF,d0ROM:00027EF6 sne d6ROM:00027EF8 ext.w d6ROM:00027EFA ext.l d6ROM:00027EFC move.l d6,(sp)ROM:00027EFE bra.s loc_27F5CROM:00027EFE ; ---------------------------------------------------------------------------ROM:00027F00 dc.w $FF90ROM:00027F02 dc.w $FF80ROM:00027F04 dc.w $FF6EROM:00027F06 dc.w $FF5CROM:00027F08 dc.w $FF4CROM:00027F0A dc.w $FF3AROM:00027F0C dc.w $FF24ROM:00027F0E dc.w $FF0EROM:00027F10 dc.w $FF04ROM:00027F12 dc.w $FEF8ROM:00027F14 dc.w $FEE2ROM:00027F16 dc.w $FED0ROM:00027F18 dc.w $FEB8ROM:00027F1A dc.w $FEA4ROM:00027F1C dc.w $FE90ROM:00027F1E dc.w $FE7AROM:00027F20 dc.w $FE6EROM:00027F22 dc.w $FE5CROM:00027F24 dc.w $FE3CROM:00027F26 dc.w $FE30ROM:00027F28 dc.w $FE16ROM:00027F2A dc.w $FE08ROM:00027F2C dc.w $FDEEROM:00027F2E dc.w $FDE0ROM:00027F30 dc.w $FDD4ROM:00027F32 dc.w $FDCEROM:00027F34 dc.w $FDB8ROM:00027F36 dc.w $FDAAROM:00027F38 dc.w $FD96ROM:00027F3A dc.w $FD8AROM:00027F3C dc.w $FD78ROM:00027F3E dc.w $FD6AROM:00027F40 dc.w $FD5CROM:00027F42 dc.w $FD4EROM:00027F44 dc.w $FD2EROM:00027F46 dc.w $FD20ROM:00027F48 dc.w $FD14ROM:00027F4A dc.w $FCF8ROM:00027F4C dc.w $FCDEROM:00027F4E dc.w $FCD2ROM:00027F50 dc.w $FCC4ROM:00027F52 dc.w $FC80ROM:00027F54 dc.w $FC56ROM:00027F56 dc.w $2BROM:00027F58 ; ---------------------------------------------------------------------------ROM:00027F58ROM:00027F58 loc_27F58: ; CODE XREF: check_installed_options+26jROM:00027F58 jsr relative_jump_table_callROM:00027F5CROM:00027F5C loc_27F5C: ; CODE XREF: check_installed_options+22jROM:00027F5C ; check_installed_options:loc_27BD8j ...ROM:00027F5C move.l (sp)+,d0ROM:00027F5E unlk a6ROM:00027F60 rtsROM:00027F60 ; End of function check_installed_optionsAfter correcting a few off-by-one errors (sigh), it turns out that both gate options call the same function, which I will call check_gate_option. The Gate rev A call looks at bit 1 if the returned word, while gate rev B looks at bit 2. Very interesting. Now, let's have a look at this new function:Code:ROM:0002F498 check_gate_option: ; CODE XREF: j_check_gate_optionjROM:0002F498 ; check_installed_options+16Ap ...ROM:0002F498 link a6,#0ROM:0002F49C move.l ($FFFFBF2A).w,d6 ; read register $FFFFBF2A (32 bit) into d6ROM:0002F4A0 not.l d6 ; invert d6ROM:0002F4A2 btst #$19,d6 ; check if d6.25 is zero (Z=1 if addr.25 is 1)ROM:0002F4A6 sne d0 ; set d0 if not zero (d0 set if addr.25 = 0)ROM:0002F4A8 andi.b #3,d0 ; and with 3 so only lowest 2 bits set if setROM:0002F4AC btst #4,($FFFFBFF7).w ; check if $FFFFBFF7.4 is zero (Z = 0 if addr.4 is 1)ROM:0002F4B2 sne d1 ; set d1 if not zero (d1 set if addr.4 is 1)ROM:0002F4B4 andi.b #5,d1 ; and with 5 for set pattern of 101 in LSBsROM:0002F4B8 or.b d0,d1 ; OR and place in d0ROM:0002F4BA move.b d1,d0 ; d0.0 = GATE presentROM:0002F4BA ; d0.1 = GATEA presentROM:0002F4BA ; d0.2 = GATEB presentROM:0002F4BC unlk a6ROM:0002F4BE rtsROM:0002F4BE ; End of function check_gate_option

author: alex.forencich
author_rank: Frequent Contributor
timestamp: April 08, 2014, 03:02:24 am
content: This is what we call short and sweet. That FFFFBFF7 reference looks very similar - doesn't FACTSET modify FFFFBFF6? This part is 16 bit, so FFFFBFF7 is just the MSB of FFFFBFF6. The plot thickens. This routine checks bit 4 of FFFFBFF7, corresponding to bit 12 of FFFFBFF6. Let's see where that might take place. Interestingly, it's not far away. Literally, the next function down in the ROM.Code:ROM:0002F4C0 process_gatesel: ; CODE XREF: j_process_gateseljROM:0002F4C0 link a6,#-2ROM:0002F4C4 move.w d0,(sp) ; d0 contains first argument, save it on stackROM:0002F4C6 tst.w d0ROM:0002F4C8 bne.s loc_2F4DA ; skip if argument is nonzeroROM:0002F4CA btst #4,($FFFFBFF7).w ; Check Gate BROM:0002F4D0 beq.s loc_2F4D8ROM:0002F4D2 bset #$F,($FFFFB116).w ; Set bit if gate B presentROM:0002F4D8ROM:0002F4D8 loc_2F4D8: ; CODE XREF: process_gatesel+10jROM:0002F4D8 bra.s process_gatesel_retROM:0002F4DA ; ---------------------------------------------------------------------------ROM:0002F4DAROM:0002F4DA loc_2F4DA: ; CODE XREF: process_gatesel+8jROM:0002F4DA cmp.w #1,d0ROM:0002F4DE bne.s loc_2F4F0 ; continue only if arg = 1ROM:0002F4E0 bsr.s check_gate_optionROM:0002F4E2 btst #1,d0 ; check if any gate presentROM:0002F4E6 beq.s loc_2F4EE ; branch if no gate presentROM:0002F4E8 bclr #$F,($FFFFB116).w ; if some gate present, clear bitROM:0002F4EEROM:0002F4EE loc_2F4EE: ; CODE XREF: process_gatesel+26jROM:0002F4EE bra.s process_gatesel_retROM:0002F4F0 ; ---------------------------------------------------------------------------ROM:0002F4F0ROM:0002F4F0 loc_2F4F0: ; CODE XREF: process_gatesel+1EjROM:0002F4F0 cmp.w #2,d0ROM:0002F4F4 bne.s loc_2F51A ; continue only if arg = 2ROM:0002F4F6 movem.l dword_2FF9A,d0-d1 ; load d0 (0x00000000) and d1 (0x00002001)ROM:0002F4FC jsr negate_bcd_16dig ; negate 16 digit BCD number in d0 and d1ROM:0002F4FC ; d0:d1 = 0x0000000000002001 (2001)ROM:0002F4FC ; becomesROM:0002F4FC ; d0:d1 = 0x9999999999997999 (-2001)ROM:0002F500 jsr load_comp_swp_64bit_next_absROM:0002F500 ; ---------------------------------------------------------------------------ROM:0002F504 dc.w $B060 ; argument for previous functionROM:0002F504 ; reference to 0xFFFFB060 (center frequency)ROM:0002F506 ; ---------------------------------------------------------------------------ROM:0002F506 bne.s loc_2F518 ; skip if center frequency does not match -2001ROM:0002F508 bsr.w check_gate_b_presentROM:0002F50C btst #0,d0ROM:0002F510 beq.s loc_2F518ROM:0002F512 bset #4,($FFFFBFF7).w ; Enable Gate BROM:0002F518ROM:0002F518 loc_2F518: ; CODE XREF: process_gatesel+46jROM:0002F518 ; process_gatesel+50jROM:0002F518 bra.s process_gatesel_retROM:0002F51A ; ---------------------------------------------------------------------------ROM:0002F51AROM:0002F51A loc_2F51A: ; CODE XREF: process_gatesel+34jROM:0002F51A cmp.w #3,d0ROM:0002F51E bne.s process_gatesel_ret ; continue only if arg = 3ROM:0002F520 movem.l dword_2FF9A,d0-d1 ; load d0 (0x00000000) and d1 (0x00002001)ROM:0002F526 jsr negate_bcd_16dig ; negate 16 digit BCD number in d0 and d1ROM:0002F526 ; d0:d1 = 0x0000000000002001 (2001)ROM:0002F526 ; becomesROM:0002F526 ; d0:d1 = 0x9999999999997999 (-2001)ROM:0002F52A jsr load_comp_swp_64bit_next_absROM:0002F52A ; ---------------------------------------------------------------------------ROM:0002F52E dc.w $B060 ; argument for previous functionROM:0002F52E ; reference to 0xFFFFB060 (center frequency)ROM:0002F530 ; ---------------------------------------------------------------------------ROM:0002F530 bne.s process_gatesel_ret ; skip if center frequency does not match -2001ROM:0002F532 bclr #4,($FFFFBFF7).w ; Disable Gate BROM:0002F538ROM:0002F538 process_gatesel_ret: ; CODE XREF: process_gatesel:loc_2F4D8jROM:0002F538 ; process_gatesel:loc_2F4EEj ...ROM:0002F538 unlk a6 ; restore stack and returnROM:0002F53A rtsROM:0002F53A ; End of function process_gateselROM:0002F53AThis appears to be what we are looking for. The function takes one of several paths, depending on the value of the argument in d0. If it is zero, it checks bit 4 of FFFFBFF7 (gate B) sets bit 15 of FFFFB116 if gate B is present. It is unclear what bit 15 of FFFFB116 is responsible for.If d0 is 1, then it clears bit 15 of FFFFB116 if some gate is present. Odd.If d0 is 2, then it does some magic, and if all of that is correct, it enables gate B.If d0 is 3, then it does some magic, and if all of that is correct, it disables gate B.Now, all of this 'magic' is checking to see of the center frequency is -2001 Hz. This was not at all clear without going and looking at several of these methods. This was also not all that clear because it is using BCD arithmetic instead of regular binary (2001 in BCD is 0x2001).Now, this methid is definitely the ticket. However, how the heck is it called? Finding the code is all well and good, but if you can't call it, it might as well not be there. Well, let's compare the command list in memory with the manual. Under sweep, there is GATE, GATECTL, GC, GD, GL, GP, and a bunch thatstart with GDR. These are all in the ROM table. However, there is an interesting one in the ROM table: GATESEL. This does not appear in the manual. Could it really be this easy? Well, no harm in trying it out....aaand, it works.So after all of this BS, the result is very simple:to eanble Gate rev B, send the following commands:CF -2001 HzGATESEL 2And to disable Gate rev B, send the following commands:CF -2001 HzGATESEL 3Hopefully somebody finds this useful.Also, an alternative set of instructions from Agilent are also available publicly here:http://www.home.agilent.com/owc_discussions/thread.jspa?messageID=114410These involve pushing some unmarked softkeys to do the same thing, after properly setting the center frequency.

author: gaijin
author_rank: Contributor
timestamp: April 08, 2014, 03:03:24 am
content: Someone posted a ebay auction linking to the Agilent forums where the instructions were posted to enable opt 105warning not to buy the instructions off ebay as someone was trying to sell them for $1000http://www.home.agilent.com/owc_discussions/thread.jspa?threadID=33120&tstart=0