Reverse-engineering a HD63B03RP-based AES Prodata bus ticket machine

[Rjevski]

Hello,

I'm trying to reverse-engineer a very obscure piece of equipment - an AES Prodata bus ticketing machine - it can read/write and print (thermal) paper tickets with a low-coercivity magstripe. The one I got is actually an Australian one as it had a sticker about "not for Opal cards" on the face of it. It's one of old green ones as in this picture.

(I've updated the post with my latest findings/understanding of the device - original post will be below for reference)


Update: I managed to make some progress with LLMs, will update the thread when I try the findings on the real device (which is currently in storage). I've pushed the LLM-assisted notes on Github: https://github.com/Rjevski/prodata-ticket-machine


The main CPU is a HD63B03RP, and there's an IO multiplexer chip HD63B21P. There's also a timer chip HD63B40. Board photos are available here (the forum doesn't allow me to upload the full resolution photos unfortunately).

The board has two ROMs (one EEPROM "P28F010-120" marked "BOOT DRIV" dumped as "ROM2.hex" and one EPROM "AM27C128-200DC" dumped as "ROM.hex") as well as an SRAM chip "HY62256ALP-10" powered by a backup battery which I've temporarily shorted to try and clear it thinking it would make it go into a factory/debug mode (it didn't) so let's assume the contents of that one are now lost/unreliable. There's also an FPGA "XC2064-50 PC68C" which I assume would be used for the magnetic card reading/writing, printing or motor control for the card transport mechanism.

At the moment the machine itself powers on and displays a fixed value on the LCD - something like "SBZ001" and stays stuck there, presumably it's waiting for the right sequence of bytes on the serial port to begin operating. I'd like to figure out what it wants so I can send it to it and make it boot properly. There's an RS485 transceiver on the board. The device spews out regular garbage on the serial port - I'm not sure what baud rate it is (is there even a concept of baud rate in RS485? My USB converter presents itself to the system as a standard serial port to the OS and I can set a baud rate) but I've tried them all and I get garbage in every case so I assume it's just outputting binary for now. I do not yet have a scope to probe further.

There are also 16 DIP switches on the board however no combination of them appears to have any visible results even after rebooting.

Power-wise it seems to be able to run on both 12 and 24 volts - there seems to be a huge block on the board around the power area and several connectors coming back to the board which can be configured in different ways - presumably you can either feed the right voltage directly to the board or change the connector to make the power go through the extra block which would step it down to a proper level. I've got the board powered up properly (I've fed in 19V from a laptop PSU both with and without the extra block and the board powers on and appears to be fine - going through the extra block makes it take longer to power on - I assume that one expects a higher voltage normally and the delay is just its caps charging up on a lower voltage than it expects).

What would be the next steps that you would suggest?

I will eventually get around to tracing the full board which would allow me to figure out the address space (my el-cheapo multimeter has a good 500ms delay on the continuity mode making this process extremely tedious, but I'm planning to get a better one), in the meantime I'd like to make as much progress as possible with what I've got at hand. At the moment the memory map is assumed to be like the following thanks to abyrvalg:

boot:
ROM2:0:4000 -> C000 - this is an FPGA loader (FPGA bitstream is at +0x40), it jumps to "main" ROM C022 after load. Looks like a standalone banked ROM.

main:
ROM1:0:4000 -> C000 - entry point at C022, vector table at end
ROM1:6000:8000 -> A000
ROM1:8000:C000 -> 6000 - entry point at 6022

0:6000 must be HY62256 RAM (overlaid by CPU’s SFRs 0:20 and IRAM 80:100)

Regarding disassembling, IDA is out of the question - I don't have a license and the Home one wouldn't be suitable as it doesn't support this architecture. I've reached out to them to see if they can sell me a "special" non-commercial license for that architecture at a more affordable price but no luck. Ghidra was recommended here, however I'm not sure which CPU architecture to pick. Here's a list of architectures it supports - which one should I pick? Alternatively, do you know any other GUI-based disassemblers (free or paid but reasonably priced) that would support it?

I've been thinking of getting a logic analyzer - I'd need 32 channels at a minimum for this and they are reasonably pricey - do you guys know if there's a way to combine multiple cheap 16-channel analyzers instead? There are cheap Chinese USB ones on Amazon and it would come out cheaper to buy 2 or 3 of these and somehow combine them than buy the "proper" one.

Also I'd like to figure out what I can use to substitute the "AM27C128-200DC" EPROM. I've searched around and most drop-in flash alternatives are no longer in production (though eBay is full of fakes) - would a modern microcontroller with the right pin count be fast enough to emulate one? Alternatively, are there commercially-available emulators that would take a ROM file from a computer and emulate it? I've seen such a product on an automotive tuning website but the price was in the 300 bucks range - does anyone know if others exist? I could see this being useful for cartridge-based consoles too so surely something like that must exist?

Thanks.


Hello,

I'm trying to reverse-engineer a very obscure piece of equipment - an AES Prodata bus ticketing machine. The one I got is actually an Australian one as it had a sticker about "not for Opal cards" on the face of it. It's one of old green ones as in this picture: https://railgallery.wongm.com/sydney-ticketing/E115_9101.jpg.html

The main CPU seems to be a HD63B03RP, which according to my understanding has 64K of internal ROM. The board does have an EEPROM which I have dumped and while it does contain some strings (that would be displayed on the LCD) my disassembly efforts have failed (all the free disassemblers out there only produce nonsensical assembly, although I haven't tried IDA yet as I can't justify the price of a license) so I'm assuming it must be just configuration data and the actual firmware is in the microcontroller itself. I've attached the ROM file as well in case someone is curious.

Assuming I am correct about the chip having internal firmware, does anyone have ideas about dumping it? I would like to do so to understand what it expects in the config ROM and what's the protocol on the serial port - so far all combinations of baud rates I have tried produce unintelligible text, so I'm assuming it's just speaking binary which isn't easy to make sense of.

At the moment the machine itself powers on and displays a fixed value on the LCD - something like "SBZ001" on the LCD and stays stuck there, presumably it's waiting for the right sequence of bytes on the serial port to begin operating. I'd like to figure out what it wants so I can send it to it and make it boot properly.

Regards.

[oPossum]

The HD63B03 has a 16 bit address bus so it can use up to 64 kB of memory. The only internal memory is 128 bytes of RAM. There is no internal ROM. It is the functional equivalent of a Motorola MC6803. Instruction set is the same as 6800/6801/6802/6803/6808.

[up8051]

You can try to use :
http://www.atastro.com/software/prog/dasmx.html

[PA0PBZ]

Can you check your EPROM dump again? It should at max be 64K, the top half of your file is empty and the first part 0000-3FFF should be at C000-FFFF. Maybe they tried to obfuscate stuff by swapping some high address lines or you used the wrong EPROM type to read it?

[Rjevski]

Thanks for getting back to me. There is another EEPROM on the board which at first I discarded because it had references to Xilinx in it (there is an FPGA on the board as well), but now reading it more closely it might actually contain the actual code (the sticker on the EEPROM says "BOOT DRIV"). I've attached it to this post.

[PA0PBZ]

Your first dump is the boot ROM, I can see the RESET, NMI and IRQ vectors in there, but the 'problem is that they are supposed to sit at FFF8-FFFF but in your dump file they are at 3FF8-3FFF. If I relocate the 0000-3FFF part to C000-FFFF it makes sense:

Code: [Select]

ROM:FFF8 IRQ:            fdb $E8E2
ROM:FFFA SOFTI:          fdb $D30B
ROM:FFFC NMI:            fdb $D89C
ROM:FFFE RESET:          fdb $C475
ROM:FFFE ; end of 'ROM'


Code: [Select]

ROM:C475 ; ---------------------------------------------------------------------------
ROM:C475                 sei                     ; RESET
ROM:C476                 ldaa    #6
ROM:C478                 bsr     sub_C480
ROM:C47A                 bra     loc_C4B9
ROM:C47A ; ---------------------------------------------------------------------------

So the question is what type of EPROM is it and what type did you use to make the dump?

[Rjevski]

The second dump in the post above is an EPROM and seems to be an "AM27C128-200DC", it's a ceramic package with the window for the UV lamp to erase it.

I've used a TL866II Plus with the "minipro" software to dump it, with the following command line:

Code: [Select]

minipro -p 'AM27C128@DIP28' -r ROM2.hex
Could it be that there's some circuitry in hardware that would relocate this ROM at a different address space?

The first dump in the initial post was from a Intel P28F010-120 dumped with "minipro -p 'P28F010@DIP32' -r ROM.hex".

[oPossum]

There is probably some sort of banking scheme that allows access to all off the Flash (128 kB) and EPROM (32 kB). That would also do mapping necessary to put the vectors at the right address.

[Rjevski]

Just wondering, how would I go about disassembling the first ROM with the understanding that the data should be relocated at C000? I've tried the Online Disassembler at https://onlinedisassembler.com and despite selecting m68k and setting the base address at 0xc000 I'm still getting what seems to be garbage.

[PA0PBZ]

Just wondering, how would I go about disassembling the first ROM with the understanding that the data should be relocated at C000? I've tried the Online Disassembler at https://onlinedisassembler.com and despite selecting m68k and setting the base address at 0xc000 I'm still getting what seems to be garbage.

M68K is a 68000 32-bit processor so that is why you get garbage. What I did is take the 0000-3FFF part of ROM.hex and saved it as a seperate file. Upload that file and pick 68HC11 for Arch and load address 0xC000. Press No when asked to start disassembly at the beginning of the file. Note that the last 2 bytes in the file are C475, that is the reset vector. Navigate to C475, press C and enjoy.



Your ROM2.hex is also a bootable 6800 file, maybe used to reprogram the xilinx? What is IC21 and what is the size of the IC16 RAM?

[Rjevski]

Thanks so much. I'm going to try the disassembly in a second.

IC16 is a HY62256ALP-10 SRAM chip powered by a lithium battery backup (there's a battery on the board and I measure 2.55V on the power pin of the chip even if the board is unpowered). Seems to be 32K in size.

IC21 is a XC2064-50 PC68C FPGA.

Here are the board photos: https://rjevski-my.sharepoint.com/:f:/g/personal/hi_rjevski_io/EtvU2rrlwRNOk5D7cHymoesB4Y3EBhf90xPPfwzkDdG_Yw?e=l0IfKJ

[abyrvalg]

The complete memory mapping looks like this:

boot:
ROM2:0:4000 -> C000 - this is an FPGA loader (FPGA bitstream is at +0x40), it jumps to "main" ROM C022 after load. Looks like a standalone banked ROM.

main:
ROM1:0:4000 -> C000 - entry point at C022, vector table at end
ROM1:6000:8000 -> A000
ROM1:8000:C000 -> 6000 - entry point at 6022

0:6000 must be HY62256 RAM (overlaid by CPU’s SFRs 0:20 and IRAM 80:100)

[Rjevski]

Thanks for the information.

I just got a 16-channel logic analyser (Kingst LA1010). It doesn't have enough channels to cover both the entire address bus and the data bus (in fact even for the address bus alone I'm missing an extra channel for the clock pin). I'm thinking to return this and get a bigger one (or get 2, have both share a pin and then sync the two captures in software based on that clock pin) but in the meantime does anyone know any tricks I could do with this logic analyser to get further?

The A0-A7 address lines from the MCU go into a latch (PC74HC573P) and the latch enable pin goes to the MCU's AS (address strobe) pin. Presumably this is to multiplex the address/data bus (the first A0-A7 pins are also marked D0-D7) of the MCU. At the moment I'm probing the outputs of the latch for A0-A7 and then the A8-A14 directly and using the last channel for the clock. My idea is to at least get a look at which addresses the MCU is looking at during powerup.

it jumps to "main" ROM C022 after load

In your post you say both ROMs are mapped to C000 - is this correct or is this a typo? And if it is correct, there must be a mechanism to switch the ROMs right before jumping to C022, correct?

[abyrvalg]

Yes, the two regions mapped to the same C000 address are switched somehow (and there are some PORT1 bits manipulations before jump). But the boot rom looks like a standalone component, there are no function calls between it and the main rom. No need to load them both into the same disassembly.
I can be wrong about jump to C022, it’s a calculated jump to something+22 and both C000 and 6000 parts have entry points at +22, so it can be 6022 actually. But the C022 entry leads to a jump to 6022 pretty quickly, so it is not much difference which one you’ll choose for the start.
I’m sure about rom1 mappings described above - all those 3 parts have absolute calls from one to other and the call targets look sane with that mapping (a call from one part leads to a code sequence looking like a function start in the other part).

[Rjevski]

Thanks for the info. May I ask which disassembler you're using and how you're loading the ROMs into it (at the proper addresses)? Do you manipulate the files beforehand to arrange the regions at the proper address or is your disassembler able to let you remap regions of the ROM?

Also there is a IO multiplexer chip HD63B21P which I'm assuming is connected to the main CPU and probably manages the ROM mapping.

[abyrvalg]

I use IDA, it allows to load the binary piece-by-piece at any desired addresses. But it is a bit too pricy for a one time project, I recommend to try Ghidra, it even has a decompiler (outputting C code) for 68xx.
HD63B21 is a memory-mapped parallel I/O port (so a few yet unknown addresses are directed to it) adding 16 gpio lines to the system.
Edit: HD63B40 (from your photo) is another memory-mapped I/O device (timer).

[Rjevski]

Bump (edited my first post with more details and questions).

[Rjevski]

Update:

So I have some time on my hands now and more money to throw at the problem. I got my hands on IDA Pro and am in the process of sourcing a scope (maybe not strictly needed right now, but can't hurt to have one anyway).

Could someone help me load the ROMs I dumped earlier into IDA? I've made some attempts yesterday and it seems OK-ish but I wanted to double-check:

Which architecture to use? I see many options:

- Hitachi HD63701/03
- Hitachi HD63703/01
- Motorola MC6301
- Motorola MC6303
- Motorola MC6800
- Motorola MC6801
- Motorola MC6803
- Motorola MC6805
- Motorola MC6808
- Motorola MC6809
- Motorola MC6811

When it comes to loading the first ROM (ROM.hex), how should I proceed given that I need to load parts of it at various addresses? Currently when I open the file I only load part of it (by varying the load address, file offset & length parameters) and then go "File -> Load -> Additional binary file" and repeat the process with the same file several times until I get all the parts in the right place. Am I doing this right or is there a better/easier way?

Is there a way to search for references to an address range? There are some strings in the ROM that would be displayed on the LCD - I can't get any hits on an exact address but was just wondering if I could do a search for references to the entire range containing all the strings?

Thanks.

[bingo600]

We mentioned a lot of free 68xx tools in this thread

https://www.eevblog.com/forum/fpga/replicating-a-custom-6800-in-fpga/?all

I chose this one
https://www.eevblog.com/forum/fpga/replicating-a-custom-6800-in-fpga/msg3714880/#msg3714880

https://github.com/Arakula/dasmfw

Ohh i missed you got the IDA Pro

Well for others that might need a free tool




/Bingo

[bingo600]

Just ran a simple :

$ strings -tx ROM.hex >ROM-strings.txt
$ strings -tx ROM2.hex >ROM2-strings.txt

Attached the string txt files  (the offset is in hex)

/Bingo

[nali]

Just noticed this thread... FWIW it looks like what you have is just the card reader / printer, not the ticketing machine itself which is the beige box above & next to the steering wheel.

Not familiar with that machine but have seen a few others of the same era. RS485 will probably be binary, try looking for 0x02 STX characters at the start of the packets (or 0xFD if you've got the RS485 lines swapped), suggest 9600 or 19200 baud for starters.

[Rjevski]

Yes - I have ran that back in the day and indeed there are strings. My question was more about how would I search for references to the address ranges the strings are located at in IDA? An exact match doesn't yield any results but I was wondering if there's a way to do a broader search for anything that references the general area of where the strings are located? No worries if not.

Just noticed this thread... FWIW it looks like what you have is just the card reader / printer, not the ticketing machine itself which is the beige box above & next to the steering wheel.

Not familiar with that machine but have seen a few others of the same era. RS485 will probably be binary, try looking for 0x02 STX characters at the start of the packets (or 0xFD if you've got the RS485 lines swapped), suggest 9600 or 19200 baud for starters.

I will have a look at the serial traffic again when I get the machine powered up and the entire development environment set up (everything has been packed and sitting in storage since I moved last year). I'll have a scope so the baud rate issue will be settled anyway.

Regarding the machine, indeed I don't have the driver's console. Just FYI I remember that these machines were also used in France with an ERG DF4000 driver's console (pictured here: https://www.flickr.com/photos/85000178@N05/20522269625).

[Rjevski]

I managed to get some action out of it.

I'm using a TTL USB to serial converter (an Arduino Uno with the micro itself held in reset, just using its serial converter part) and hooking up the RX line to the DS75176BTN (a RS422/485 transciever chip on the board)'s DI pin (4) (and obviously having grounds connected), just to rule out any RS485-related issues (I had no idea whether my converter worked, don't have anything else that can speak that protocol to test).

On 9600/8/N/1 I managed to get the board into a weird state where it would not boot, however on the serial port I saw this:

Code: [Select]

XILINX - IC
XILINX -ˇ
XIL
XILIN. - IC 21 - PR
XILINX - IC 21 -
XILINX - IC 21 ˇ
XILH
.ˇ.
XILI
XILINX - IC 21 - PRO
XILINX
XILIˇ
XILINX - IC 21 - P
XILINX - IC 21 - P
.I¸
XILINX ˝
XILINX % IC 21 - PROBLEM : PROGØ
XILINX - IC 21 - PROBLEM :
XIL.NX - IC ˙
XILINX - IC 20 - PROBL

ï1%9aÅ- IC 21 - PROBLE
XILINX - IC¯

XILINXˇ
˛
ÿ
XILINX )
 
XILILX - IC 21 -
XILINX - IC 21 - PROˇ
XILINX - I. 2
XILINX - KC 21 -ÇI=.1.5Å: PROG/
XILINX - IC 21 - ¸
XILINX - IC 21 - PROBLEM :ÇI=.ΩDOˇ
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PI˛
XILINX ˇ
XILIN
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15)
XILINX - IC 21 - PROBLEM : PROG/DON≈
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3.PIN15) STAYS†
ä
XILINX - IC 21 - PROBLEM :
˛
XILINX - IC 21 - PROBLEˇ

ÿ
XIL.NX - …
XILINÿ
XILINX
XILIN
XILINX - IC 21 -
X
XILINX -˛
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/
XILINX - IC 21
XILINÿ
XILILX
XILINX - IC 21 - PROBLEM : PRGG/DONE LINE (IC
XILINX - IC 21 - PROBL.M * PR
XILI
XILINX - ˇ

XÈ
XILINX - IC 21 - PROBLEM : PROG/DON≈
XILˇ
XILIN

XILIN˛
XIÃ
XILˇ
X
XILI
XILINX -
XILINX - IC 21 - PRO
XILINX % IC 21 - PROBLEM : PROG/DONE LIŒ
ÿ
XILINX - …
X.LINP - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15) S¸
XILIN.j.Jˇ
˙.
XILI
XILINX - IC 21 - PRO
XILINX - IC 21 - –
XILINX`- IC 21 - PROBLEM : P
XILINXj.J
Å21
.˘ˇ
XIÃ
·
XILINX ˝
XI
XILINX - IC 21 - PROBLEM
XILINX - IC 21 -ê%ı.1.5Å:
XILINX - IC 21 - PROBLEM :ˇ
XILINX - IC 21
XILINX - IC 21 - PROBLEM : PROG/DONE LI


XILINX - IC 21 KÇI=.1.5Å: –
XILINX - IC 2±Õ
XI
XILINX - IC 21 - PROBLEM : .R
!ï1%9aÅ-
XILI
ˇ
XILINX - IC˛
XILINX -
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (…Õ
XILINX -êR(í
XIHINX - IC 21 -
XILINX -†
XILINX - IC 21 - P.
XILINX - ˇ
XILINX ˝
Xˇ
˛
XIL.NX - IC 21 - P™J1ˇ
XILINX - IC 21 - PROBLEM : PRO
XILINX - IC 21 - PRJ1.5Å
XIDINX - IC 21 ˇ
XILINX - IC 21 - PROBLEL : PROG/DONQb%9.Å
XILINX - IC 21 - PROBLEM
XILINX - IC

!ï1%9aÅˇ
XIL…
XILINX - IC
XILINX ˝
XILINX - IC 21†
XILINX
XILˇ
XILIŒX - ˘
X.LINX - IC 21 - PROBLEM : PROG/DONE
XILINX - IC 21 % ¯
XIL˘
XILINX - IC 21 - PROBLEM : PROG/DONE LINˇ
XILINX - IC 21 - PROBLEM ˛
ï1%9aÅ- IC 01 - PROBLEM : PROG/DONQb%9.Å(IC3/PIN15) STAYS
XILINX
XILINX -
XILINX - IC 21 - PROBLEM :†
XILINX - IC 21 - P.OBLEM : PROCÔç
ÿ
XILINX -

XILIN
XILINX - I(íä.j.ÇI=˘
X˝
XILINX - IC 21 - PROBL≈
XILIFX
XILI
XILINX - IC 21 - PROBLEM : PRKG/DNNE
XILINX
XI¸

XILINX - IC 21 -

XILINX - IC 21 -
XILINX - IC 21 - @RO¬
XILINX -
˛
¯
XIÃ
XILINX - IC 21 - PROBLEM : P
XI
XIˇ
XILINX`-¯H
XILINX - IC 21 - PROBLEM : P˛

XILINX - IC 21 KÇI=.1.5Å: PROG/DONE LILE (IC3/PI
XILINX - IC 21 -

XILINX - IC 21 - PRKBLEM.: PROG/DO˛
XILINX - IC 21 - PROB
XILINX - IC 21
XI*
.j.J
Å

XILINX - IC 21
XILANX
XILINX - IC 21 - PROBLEM : PROG/DONE LINE
HILINX - IC 21 - PROBLEM.: PROG/DONE LINE (IC3/PIN1µ
XILINX - IC 21 - PROB™5Å: PROG/D
XILINX - ˇ
X.LINX - IC 21 - PRJ1.5 : P“
XILINX - IC 21 - PROBLEM : PROG/DONE L
XILINX - IC ˙

XILINX
XILINX - IC 21 - PROBLEM : PROG/DONE LINˇ
XILINX - IC 21 - PROBLE
 : PROG/DONE LINˇ
XILINX - IC 21 - PROBLEM : PROG/DONE LILE (IC3/PIN.5) STA
XILINX - I√
XILINX
 IC 21 - PROBLEM : PROG/DONE LINE (AC3/PIN15) STAYS AT ZER
ä
XILINX
XILIN˛
XILINX - I(íä.j.ÇI=.1.˘
¯
˝
XILINX -ˇ
XILINX - .C 21 - PROBˇ
XILINX - IC 2Lj.ÇI=.1.5Å: PROG/D
XILINX
XILIÓ
XILI
.j.J
Å21 - PROBLEM : PROG/DON
X
XILINX - IC 21 - PROBLEM : PRO./DONE LINE (IC3/PIN15) ˇ

X…
XILINX - IC 21 - PRˇ
 
XILINX - IC 21 -.
X
XILINX - I(íä.j.ÇI=.1.M
XILINX - IC 21 - .ROBLEM :‡
XILINX - IC 21¯
XILINX -
XILINX - IC 21¯
X
XILINX - IC 21 - PROBLQS“.ÇI=.ΩDONE LIŒ
XILINX - IC 21 - PROBLEM : –
XILINX KJ
Å
XI
XILINX - IC 21
XILINX - IC 21 , PROBLEM¯
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/PIN15) STAYS AT Z
˛
XILINX¯
XI˛

XILINX - IC 21 - PRO
XILINX - IC 21
XILINÿ
XILINX -
XILINX - I˚
XI˛
XILINX - IC 21 - PROBLEM
XILINX - IC 21 -
XILINX - IC 21 -
X.LÈ
X
XILI.X -ˇ
XILINX - IC 21 - PROBLQS“.ÇI˝
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/Pˇ
XILINX % ICˇ
XILINX - IC 21 ˝
XILINX - IC 21 KÇI=.1.5Å: PROE/DONE ˛

XR*
.j.J
Å21 - PROBLEM :¯
X…
XILINX - IC 21 - PRNBLEM :.PROG/DONE LINE (R®¶.ï9Ö5JöQ.eMÅAT
XI
X
HALINX - IC 21 Ì
X

XILINX - IC 21 - PROBLEM : PRˇ
XILINX - IC 2±
XILINX -ˇ
XILINX - IC 2
XILINX - .C 21 - PROBLEM : PROG/DONE LINE (IC3/PI˛ˇ
X
XILINX - IC 21
X…
XILINX - I
XILINX - IC 21 - PROBLE
 : PROG/DONE LINE (IC3
XILINX - IC 21 ) PROBLEM : PROG/D ™ÅLINE (KC3/PIN15) STAYS AT ZERG AFTER L
XI.INX - IC 21 - PRO(™5ˇ
XILIFX - IC 21 - PRO
XILINX - IC 21 - PRO@LEM : PR
XILINX - IC 21 - PROBLEM¯
XILINX - IC 21 - PROBLEM : PROG/DOFE LINE (IC3/PIŒ
XILINX - ˇ
XILINX - IC 21 - PROBLEM : –
XILINX - IC
XILINX - IC 21 - PROBLEM : PROG/DONE LINE (IC3/P
XILINX - IC 21 - PRO
XILINX - Iˇ
XILINX - IC¸
XILINX - IC 21 - PROBLEM : PRGG/DOND
XI.INX - IC 21 - PROBÃ
XILINX - IC 2!j.ÇI9.1.5Å
XILINX - IC 21 - P
XILINX - IC‡
.ILINX - I(Çä.j.Ç.=.1.5Å2 PROG/DONE LINE (IC3/PIN15) STA.S AT ˙
XILI˛.
X
XILINX - IC 21 - P˙
XILINX - IC 21
XI¸
XILINX - IC¸
XILINX -
XILINX - IC 21 - PROBLEM : P“
XILINX - IC 21 - PROBLEM : PROG/DON
XILINX - IC 2˝
XILINX - IC 21 - PRO
XILINX‡
.XILINX¸
XILINX - IC
XILINX - IC 21 -
.XILINX¸
XILINX - IC 21 - PRO...ˇ
XILINX - IC Õ
XILINX - IC 2˝ˇ
XILINX - IC
XKLI.X - IC 21 - PROBLQ”. ï1%NX - IC .1 - PROBLÂ
XILINX - IC 21 - PROBLEM : PROG/ˇ
XILINX ) IC 21 - PROBLÕ
XILINX¯
XIL…

XILINX - IC 21 - PROBLEˇ
XILINX -
XILINX - IC 21 -¸
X.LINX - IC 21 - PROBL.M : PRNG/DONE LINˇ
˛

XILINX - IC "1 - PROBLEM
X
XILINX - IC Ú
XILINX - ICˇ
XILIN
XILINX - IC 21 - P
XILINX - ˇ
˙
XILINX - IC 61 - PROBLEM†
X
XILˇ
XILINX - IC 21 - PROBLEM : PROG/DONE L
XILINX ˝
XI
X
XILINX - IA 2
XILI
XILˇ
X…
XIˇ
XILÈ
˛
X
ï1%9X¯
XILINX - IC 21 -
X.L
XILINX - IC 21 - PRO˙

XILINX - IC 21 - PROBLEM : PROG.DONE LINE
XILINX - IC 21 - PRœ
XILIJX - .C 21 - PROBLDM : PROG/DONE LINE (IC3/PIN15) STAYS AT
X…
XILINX - IC 21 - ˛
ˇ
XI
XILINX - IC 21 - .
XILINX - IC
XI*
.j.J
Å21 - P
˙
XILINP - IC 21 ) PROBL.I : PRO./DONE
XILINX % IC 21 .
XILINX - IC ˛
Xˇ
XILINX - IB 21 Kġ
XILINX‡ˇ
XI
XILINX - IC 21 - PRœ
XILINX - IC 21 -ÇI˝
XILIŒ
Í˝
XILINX`- IC 21 KÇI=.1.5Å: PR
XALINX - IC 21 - ˛
X˘
XILINH - IC 21 -
XILINXjÇ
Xˇ
XILINX - HC
HILINX - IC 21‡

XILINX - IC 21
X
 
XILINX
XILINX - IC 21 - P
XIL.NX - IC 21 - PRO˛
XI*
.j.J
Å2
ˇ
XILINXÕ˝.
PILIN¯˝

XILINX


XILINX - IC 21†Õ
XILINX -
¯
XILI˛
XILIN¯
XILINX ≠
XILH
XI¸
XILINX - IC 21 - Pˇˇˇ
.XILINX
X…
˙
XILINX - I√
ï1%9aÅ-‡

XILIN
XILI
XILINX - IC
XILINX - IC 21 - PROBLEM : PROGˇ
XILINX - IC 21 - PROBLEM 'ÇI=./DO.E¯
XILI˛
XILINX - IC 21 - PROBLı
XILINX - IC 21 - PROBLEÕ
XIˇ
Xˇ
XILINX - IC!ï1%9aÅ- IC 21

XILINX - IC 21 - PRO
XILI
˝ˇˇˇ.


Note the interruption in the middle (with dots) - on the hex view it was just zeroes. I believe the board might have a watchdog that resets everything in case of lockup and this happened there (I've noticed the watchdog-like behavior when I accidentally touched some pins on the board and upset it - the serial output would stop which I suspect means the board has frozen, then the entire thing reboots and starts over).

So at least it seems like my terrible attempt at getting serial output out of it is working.

Edit: so the board may have a bad contact which would get it into that error state where it can't load the FPGA bitstream. I've flexed the board a bit and pushed down on all the socketed chips and managed to make it boot like it was before (card mechanism moves briefly at startup, "S1.0Z181" displayed on LCD and repeating binary spam on the serial port).

Now that I got it booted and am confident that the serial setup is correct (at least hardware-wise), here's what I get on 9600/8N1:

Code: [Select]

$ xxd Documents/CoolTerm\ Capture\ 2022-03-07\ 00-37-07.txt
00000000: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff  ................
00000010: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04  ................
00000020: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca  ................
00000030: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd  ................
00000040: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105  ................
00000050: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff  ................
00000060: 04c5 c505 ff04 c6c6 05ff 04c7 c705 ff04  ................
00000070: c8c8 05ff 04c9 c905 ff04 caca 05ff 04cb  ................
00000080: cb05 ff04 cccc 05ff 04cd cd05 ff04 cece  ................
00000090: 05ff 04cf cf05 ff04 c1c1 05ff 04c2 c205  ................
000000a0: ff04 c3c3 05ff 04c4 c405 ff04 c5c5 05ff  ................
000000b0: 04c6 c605 ff04 c7c7 05ff 04c8 c805 ff04  ................
000000c0: c9c9 05ff 04ca ca05 ff04 cbcb 05ff 04cc  ................
000000d0: cc05 ff04 cdcd 05ff 04ce ce05 ff04 cfcf  ................
000000e0: 05ff 04c1 c105 ff04 c2c2 05ff 04c3 c305  ................
000000f0: ff04 c4c4 05ff 04c5 c505 ff04 c6c6 05ff  ................
00000100: 04c7 c705 ff04 c8c8 05ff 04c9 c905 ff04  ................
00000110: caca 05ff 04cb cb05 ff04 cccc 05ff 04cd  ................
00000120: cd05 ff04 cece 05ff 04cf cf05 ff04 c1c1  ................
00000130: 05ff 04c2 c205 ff04 c3c3 05ff 04c4 c405  ................
00000140: ff04 c5c5 05ff 04c6 c605 ff04 c7c7 05ff  ................
00000150: 04c8 c805 ff04 c9c9 05ff 04ca ca05 ff04  ................
00000160: cbcb 05ff 04cc cc05 ff04 cdcd 05ff 04ce  ................
00000170: ce05 ff04 cfcf 05ff 04c1 c105 ff04 c2c2  ................
00000180: 05ff 04c3 c305 ff04 c4c4 05ff 04c5 c505  ................
00000190: ff04 c6c6 05ff 04c7 c705 ff04 c8c8 05ff  ................
000001a0: 04c9 c905 ff04 caca 05ff 04cb cb05 ff04  ................
000001b0: cccc 05ff 04cd cd05 ff04 cece 05ff 04cf  ................
000001c0: cf05 ff04 c1c1 05ff 04c2 c205 ff04 c3c3  ................
000001d0: 05ff 04c4 c405 ff04 c5c5 05ff 04c6 c605  ................
000001e0: ff04 c7c7 05ff 04c8 c805 ff04 c9c9 05ff  ................
000001f0: 04ca ca05 ff04 cbcb 05ff 04cc cc05 ff04  ................
00000200: cdcd 05ff 04ce ce05 ff04 cfcf 05ff 04c1  ................
00000210: c105 ff04 c2c2 05ff 04c3 c305 ff04 c4c4  ................
00000220: 05ff 04c5 c505 ff04 c6c6 05ff 04c7 c705  ................
00000230: ff04 c8c8 05ff 04c9 c905 ff04 caca 05ff  ................
00000240: 04cb cb05 ff04 cccc 05ff 04cd cd05 ff04  ................
00000250: cece 05ff 04cf cf05 ff04 c1c1 05ff 04c2  ................
00000260: c205 ff04 c3c3 05ff 04c4 c405 ff04 c5c5  ................
00000270: 05ff 04c6 c605 ff04 c7c7 05ff 04c8 c805  ................
00000280: ff04 c9c9 05ff 04ca ca05 ff04 cbcb 05ff  ................
00000290: 04cc cc05 ff04 cdcd 05ff 04ce ce05 ff04  ................
000002a0: cfcf 05ff 04c1 c105 ff04 c2c2 05ff 04c3  ................
000002b0: c305 ff04 c4c4 05ff 04c5 c505 ff04 c6c6  ................
000002c0: 05ff 04c7 c705 ff04 c8c8 05ff 04c9 c905  ................
000002d0: ff04 caca 05ff 04cb cb05 ff04 cccc 05ff  ................
000002e0: 04cd cd05 ff04 cece 05ff 04cf cf05 ff04  ................
000002f0: c1c1 05ff 04c2 c205 ff04 c3c3 05ff 04c4  ................
00000300: c405 ff04 c5c5 05ff 04c6 c605 ff04 c7c7  ................
00000310: 05ff 04c8 c805 ff04 c9c9 05ff 04ca ca05  ................
00000320: ff04 cbcb 05ff 04cc cc05 ff04 cdcd 05ff  ................
00000330: 04ce ce05 ff04 cfcf 05ff 04c1 c105 ff04  ................
00000340: c2c2 05ff 04c3 c305 ff04 c4c4 05ff 04c5  ................
00000350: c505 ff04 c6c6 05ff 04c7 c705 ff04 c8c8  ................
00000360: 05ff 04c9 c905 ff04 caca 05ff 04cb cb05  ................
00000370: ff04 cccc 05ff 04cd cd05 ff04 cece 05ff  ................
00000380: 04cf cf05 ff04 c1c1 05ff 04c2 c205 ff04  ................
00000390: c3c3 05ff 04c4 c405 ff04 c5c5 05ff 04c6  ................
000003a0: c605 ff04 c7c7 05ff 04c8 c805 ff04 c9c9  ................
000003b0: 05ff 04ca ca05 ff04 cbcb 05ff 04cc cc05  ................
000003c0: ff04 cdcd 05ff 04ce ce05 ff04 cfcf 05ff  ................
000003d0: 04c1 c105 ff04 c2c2 05ff 04c3 c305 ff04  ................
000003e0: c4c4 05ff 04c5 c505 ff04 c6c6 05ff 04c7  ................
000003f0: c705 ff04 c8c8 05ff 04c9 c905 ff04 caca  ................
00000400: 05ff 04cb cb05 ff04 cccc 05ff 04cd cd05  ................
00000410: ff04 cece 05ff 04cf cf05 ff04 c1c1 05ff  ................
00000420: 04c2 c205 ff04 c3c3 05ff 04c4 c405 ff04  ................
00000430: c5c5 05ff 04c6 c605 ff04 c7c7 05ff 04c8  ................
00000440: c805 ff04 c9c9 05ff 04ca ca05 ff04 cbcb  ................
00000450: 05ff 04cc cc05 ff04 cdcd 05ff 04ce ce05  ................
00000460: ff04 cfcf 05ff 04c1 c105 ff04 c2c2 05ff  ................
00000470: 04c3 c305 ff04 c4c4 05ff 04c5 c505 ff04  ................
00000480: c6c6 05ff                                ....


Note that there's a jumper on the board near the RS485 transceiver IC that's been set by default. If I remove it, the serial output is much slower and as follows:

Code: [Select]

$ xxd Documents/CoolTerm\ Capture\ 2022-03-07\ 00-39-39.txt
00000000: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff  ................
00000010: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04  ................
00000020: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca  ................
00000030: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd  ................
00000040: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105  ................
00000050: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff  ................
00000060: 04c5 c505 ff04 c6c6 05ff 04c7 c705 ff04  ................
00000070: c8c8 05ff 04c9 c905 ff04 caca 05ff 04cb  ................
00000080: cb05 ff04 cccc 05ff 04cd cd05 ff04 cece  ................
00000090: 05ff 04cf cf05 ff04 c1c1 05ff 04c2 c205  ................
000000a0: ff04 c3c3 05ff 04c4 c405 ff04 c5c5 05ff  ................
000000b0: 04c6 c605 ff04 c7c7 05ff 04c8 c805 ff04  ................
000000c0: c9c9 05ff 04ca ca05 ff04 cbcb 05ff 04cc  ................
000000d0: cc05 ff04 cdcd 05ff 04ce ce05 ff04 cfcf  ................
000000e0: 05ff 04c1 c105 ff04 c2c2 05ff 04c3 c305  ................
000000f0: ff04 c4c4 05ff 04c5 c505 ff04 c6c6 05ff  ................
00000100: 04c7 c705 ff04 c8c8 05ff 04c9 c905 ff04  ................
00000110: caca 05ff 04cb cb05 ff04 cccc 05ff 04cd  ................
00000120: cd05 ff04 cece 05ff 04cf cf05 ff04 c1c1  ................
00000130: 05ff 04c2 c205 ff04 c3c3 05ff 04c4 c405  ................
00000140: ff04 c5c5 05ff 04c6 c605 ff04 c7c7 05ff  ................
00000150: 04c8 c805 ff04 c9c9 05ff 04ca ca05 ff04  ................
00000160: cbcb 05ff 04cc cc05 ff04 cdcd 05ff 04ce  ................
00000170: ce05 ff04 cfcf 05ff 04c1 c105 ff04 c2c2  ................
00000180: 05ff 04c3 c305 ff04 c4c4 05ff 04c5 c505  ................
00000190: ff04 c6c6 05ff 04c7 c705 ff04 c8c8 05ff  ................
000001a0: 04c9 c905 ff04 caca 05ff 04cb cb05 ff04  ................
000001b0: cccc 05ff 04cd cd05 ff04 cece 05ff 04cf  ................
000001c0: cf05 ff04 c1c1 05ff 04c2 c205 ff04 c3c3  ................
000001d0: 05ff 04c4 c405 ff04 c5c5 05ff 04c6 c605  ................
000001e0: ff04 c7c7 05ff 04c8 c805 ff04 c9c9 05ff  ................
000001f0: 04ca ca05 ff04 cbcb 05ff 04cc cc05 ff04  ................
00000200: cdcd 05ff 04ce ce05 ff04 cfcf 05ff 04c1  ................
00000210: c105 ff04 c2c2 05ff 04c3 c305 ff04 c4c4  ................
00000220: 05ff 04c5 c505 ff04 c6c6 05ff 04c7 c705  ................
00000230: ff04 c8c8 05ff 04c9 c905 ff04 caca 05ff  ................
00000240: 04cb cb05 ff04 cccc 05ff 04cd cd05 ff04  ................
00000250: cece 05ff 04cf cf05 ff04 c1c1 05ff 04c2  ................
00000260: c205 ff04 c3c3 05ff 04c4 c405 ff04 c5c5  ................
00000270: 05ff 04c6 c605 ff04 c7c7 05ff 04c8 c805  ................
00000280: ff04 c9c9 05ff 04ca ca05 ff04 cbcb 05ff  ................
00000290: 04cc cc05 ff04 cdcd 05ff 04ce ce05 ff04  ................
000002a0: cfcf 05ff 04c1 c105 ff04 c2c2 05ff 04c3  ................
000002b0: c305 ff04 c4c4 05ff 04c5 c505 ff04 c6c6  ................
000002c0: 05ff 04c7 c705 ff04 c8c8 05ff 04c9 c905  ................
000002d0: ff04 caca 05ff 04cb cb05 ff04 cccc 05ff  ................
000002e0: 04cd cd05 ff04 cece 05ff 04cf cf05 ff04  ................
000002f0: c1c1 05ff 04c2 c205 ff04 c3c3 05ff 04c4  ................
00000300: c405 ff04 c5c5 05ff 04c6 c605 ff04 c7c7  ................
00000310: 05ff 04c8 c805 ff04 c9c9 05ff 04ca ca05  ................
00000320: ff04 cbcb 05ff 04cc cc05 ff04 cdcd 05ff  ................
00000330: 04ce ce05 ff04 cfcf 05ff 04c1 c105 ff04  ................
00000340: c2c2 05ff 04c3 c305 ff04 c4c4 05ff 04c5  ................
00000350: c505 ff04 c6c6 05ff 04c7 c705 ff04 c8c8  ................
00000360: 05ff 04c9 c905 ff04 caca 05ff 04cb cb05  ................
00000370: ff04 cccc 05ff 04cd cd05 ff04 cece 05ff  ................
00000380: 04cf cf05 ff04 c1c1 05ff 04c2 c205 ff04  ................
00000390: c3c3 05ff 04c4 c405 ff04 c5c5 05ff 04c6  ................
000003a0: c605 ff04 c7c7 05ff 04c8 c805 ff04 c9c9  ................
000003b0: 05ff 04ca ca05 ff04 cbcb 05ff 04cc cc05  ................
000003c0: ff04 cdcd 05ff 04ce ce05 ff04 cfcf 05ff  ................
000003d0: 04c1 c105 ff04 c2c2 05ff 04c3 c305 ff04  ................
000003e0: c4c4 05ff 04c5 c505 ff04 c6c6 05ff 04c7  ................
000003f0: c705 ff04 c8c8 05ff 04c9 c905 ff04 caca  ................
00000400: 05ff 04cb cb05 ff04 cccc 05ff 04cd cd05  ................
00000410: ff04 cece 05ff 04cf cf05 ff04 c1c1 05ff  ................
00000420: 04c2 c205 ff04 c3c3 05ff 04c4 c405 ff04  ................
00000430: c5c5 05ff 04c6 c605 ff04 c7c7 05ff 04c8  ................
00000440: c805 ff04 c9c9 05ff 04ca ca05 ff04 cbcb  ................
00000450: 05ff 04cc cc05 ff04 cdcd 05ff 04ce ce05  ................
00000460: ff04 cfcf 05ff 04c1 c105 ff04 c2c2 05ff  ................
00000470: 04c3 c305 ff04 c4c4 05ff 04c5 c505 ff04  ................
00000480: c6c6 05ff 04c7 c705 ff04 c8c8 05ff 04c9  ................
00000490: c905 ff04 caca 05ff 04cb cb05 ff04 cccc  ................
000004a0: 05ff 04cd cd05 ff04 cece 05ff 04cf cf05  ................
000004b0: ff04 c1c1 05ff 04c2 c205 ff04 c3c3 05ff  ................
000004c0: 04c4 c405 ff04 c5c5 05ff 04c6 c605 ff04  ................
000004d0: c7c7 05ff 04c8 c805 ff04 c9c9 05ff 04ca  ................
000004e0: ca05 ff04 cbcb 05ff 04cc cc05 ff04 cdcd  ................
000004f0: 05ff 04ce ce05 ff04 cfcf 05ff 04c1 c105  ................
00000500: ff04 c2c2 05ff 04c3 c305 ff04 c4c4 05ff  ................
00000510: 04c5 c505 ff04 c6c6 05                   .........


(now that I look at it the outputs seem completely identical from a data point of view, just that removing the jumper seems to make it slower)

[ozcar]

I think ideally you would have to use a disassembler that understands 6303. I have an ancient 6803 disassembler, and that produces output like this (from a chunk of ROM.hex relocated as suggested by PA0PBZ):

Code: [Select]

D69A CC   6000             LDD    #$6000
D69D C3   0006             ADDD   #$0006
D6A0 18                    FCB    $18
D6A1 EC   00               LDD    0,X
D6A3 38                    PULX
D6A4 ED   04               STD    4,X
D6A6 3C                    PSHX

That is a step up from using a 6800 disassembler, because it knows of instructions LDD,  STD, ASLD, LSRD,  ADDD, SUBD, PSHX, PULX, ABX and MUL, which did not exist for 6800. However, note the FCB $18 in there, apparently that is an instruction that does not exist on 6803 either (XGDX). There seem to be other instructions that exist for 6303 but not 6803, including BCLR, BSET, BTGL, BTST, OIM, AIM, EIM and TIM and maybe more (that is just from a quick RTFM - I’m not really familiar with 6303).

As for finding references to the ASCII strings, you would probably have to relocate them for a start (maybe as abyrvalg suggested, I did not check if that makes sense).

[bingo600]

This one (handbook) could be handy
https://usermanual.wiki/Document/HD6301HD6303SeriesHandbook1989.865407655.pdf


Build 6801 Disassembler - My choice was dasmfw (Seems to be a newer version of f9dasm)
https://github.com/Arakula/dasmfw

Seems to handle 6803 instructions

Code: [Select]

$ ./dasmfw -dasm 6303    -cchar '*' -conv off -cref on  -out ROM.asm -offset C000 ROM.hex

Code: [Select]

        LDD     #M6000                  * D69A: CC 60 00       '.`.'
        ADDD    #M0006                  * D69D: C3 00 06       '...'
        XGDX                            * D6A0: 18             '.'
        LDD     ,X                      * D6A1: EC 00          '..'
        PULX                            * D6A3: 38             '8'
        STD     $04,X                   * D6A4: ED 04          '..'
        PSHX                            * D6A6: 3C             '<'

Mnemonic brief
https://www.jaapsch.net/psion/mcmnemal.htm