blob: 285d074e7c88a920c4536d4ae60bf4da99cc133f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
-------------------------------------------------------------------------------
Intel MCS-48 external memory access
-------------------------------------------------------------------------------
Example dump of external program memory access on an Intel 8039 (like the 8048,
part of the MCS-48 family) in an HP 3478A bench multimeter.
The 8039 has no internal ROM. The respective mcs48 PD was designed to
reconstruct a ROM dump without needing to desolder the ROM IC.
The HP3478A is special in that it needed to access 8kB of code -- the normal
MCS-48 address space is 4kB, so an extra address line was added (A12) under
software control. In other words, they have crafted their code to toggle a
pin to control A12 and thus switch memory "banks".
Details:
https://github.com/fenugrec/hp3478a_utils/blob/master/sigrok_PD/notes.txt
https://en.wikipedia.org/wiki/Intel_MCS-48
https://www.keysight.com/en/pd-3478A%3Aepsg%3Apro-pn-3478A/55-digit-dmm-with-hp-ib-interface
Logic analyzer setup
--------------------
The logic analyzer used was an Saleae Logic16 clone (at 8MHz).
Probe i8039
-----------------
0 A8
1 A9
2 A10
3 A11
4 A12
5 ALE
7 PSEN
8 D0
9 D1
10 D2
11 D3
12 D4
13 D5
14 D6
15 D7
A sampling rate of 8MHz was sufficient to validate transitions on ALE and PSEN.
Data
----
Example sigrok-cli invocation to dump the memory accesses:
$ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN
The text annotations are formated as "XXXX:YY" where XXXX is the address
and YY the byte at that address.
A more useful command:
$ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN -B mcs48 > rom_access.bin
This writes every access to a raw file, simply as 3-byte chunks [XX XX YY]
which may easily be post-processed to reconstruct the full ROM image.
|
