|
Post by NetSamurai on Dec 14, 2004 23:34:18 GMT -5
It was suggested that I bring my efforts here. I have been discussing building a flash drive in comp.sys.cbm and in the process I have been reverse engineering the DTV. Here's what I have so far: home.comcast.net/~netsamurai/cpu_pins.jpgThe pin order of the DTV core (labeled) home.comcast.net/~netsamurai/cpu_pins.txtPin out listing of the DTV core home.comcast.net/~netsamurai/rom_pins_enhanced.jpgWIP, I have been find all the via locations on the board, this has been helpful home.comcast.net/~netsamurai/rom_pins_labeled.jpgSimilar to the above, but without the blue traces home.comcast.net/~netsamurai/hook_ups.jpgA full board view with locations for the common hacks (includes joystick and reset lines) That's it for now. I have just spent about 5 hours grinding down the CPU, going over it with a microscope, photographing it, and then labeling the pins. I determined the pin numbers by routing them out to components and checking with the schematic. I have not triple-checked my work yet, so please do so before attempting to use the information. If you find any errors, please let me know. Now, I am going to see if I can finish the labeled photo with the rest of the address lines and control lines. I hope I find Vias for everything! Scott McDonnell
|
|
|
Post by NetSamurai on Dec 15, 2004 15:15:59 GMT -5
Update: home.comcast.net/~netsamurai/rom_pins_enhanced.jpgThis photo now includes the locations of all ROM vias: A0-A20 D0-D7 ROMCS (chip select) ROM OE (Output enable) All pins are accessable with vias except for A18, which runs directly from the CPU to the ROM. I have included an inset photo of the component side which shows where that line is. 30AWG wire wrap wire fits very snugly into the vias, so it should be fairly easy to tap into these buses and add our own hardware. I have been studying the schematic provided by Jim Brain and am somewhat confused about the purpose of the 74HC74 (flip flop.) It appear that it is just making sure that the ROM outputs are disconnected when RAM is being accessed. Sound right? And finally, once I firgure out how to access the ROM with software, I want to find out if the /LOWR signal is available on accesses to it. If it is, it could be mapped in to allow flash ROM to be accessed for writing. Enjoy, and if anyone can think of any traces that they would like me to locate from the CPU, let me know. Since I already have one disassembled, it would be easier for me to trace them out. Scott
|
|
|
Post by RetroHacker on Dec 16, 2004 9:07:31 GMT -5
WOW. Amazing work. I'd never have gotten that far. I've been tracing things around the board until my eyes hurt, and I'd been able to find a couple things, like the chroma an luma signals, but this is amazing. Grinding down the blob must have been a fun project...
One of the things that I've been wanting to do is find a way to connect the other joystick port up - it's a real pain since some software only works with the other port... Unfortunately, it looks like some of the critical signals are missing, most notably /JoyB_0 (pin 47 on the CPU) which , from your photo, looks like it doesn't exist outside the blob. (No wonder I couldn't find it <grin>). Also, from studying the schematic, it looks like getting a serial port on this thing is going to be a pain too, since most of the signals you'd need for the user port aren't even on pins on the rom, and you can't get to things like the chip select line for the SID chip, or the R/W line on the CPU.
It's been a while since I did much hacking on the C64 itself, but I do remember the three ways (there are probably more though) to get RS-232 on the machine - the simple, kludgey, 7404 on the user port, adding 1488/1489 driver pairs to the user port, and building a UART daughter board off ths SID socket. But, since it looks like we don't have the necessary lines for any of those (or at least, I don't think so), something else will need to be designed. It may not even be possible, since getting whatever hack patched into the processor's I/O space is going to be fun, getting it to be compatible with all the existing software is going to be even more of a mess.
Man, I just wish I had enough time to dedicate to the DTV. Great job on your reverse engineering - this really helps a LOT. Hopefully I'll have some time soon to do something with this new information <grin>.
-Ian
|
|
|
Post by NetSamurai on Dec 16, 2004 10:12:16 GMT -5
On top of the lack of Joystick pins, it looks like the joystick is scanned in an unusual way. Perhaps once we get into the ROM, a patch might be possible to allow switching the joystick port between sticks (which would be MY preference.) Notice there are also paddle and lightpen lines. These would've been awesome to have routed out.
Well, the fact that the address bus (A0-A15 are very easy to connect to), data bus, and a few control lines are available, you could theoretically memory map just about any hardware you want. You might even use A16 to A20 to map to registers to reduce the extra address decoding hardware. Of course, you would have to DMA to those registers, but that's doesn't look like a huge deal.
What we need now is a complete memory map (all 128K RAM and 2MB ROM.) This is my next project.
Scott McDonnell
|
|