Author Topic: Quantel Ramcorder - Digital Video RAM Store  (Read 21548 times)

0 Members and 1 Guest are viewing this topic.

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #50 on: April 13, 2018, 06:54:10 am »
I've done the GUI, I'll finish the actual code tonight.

wow! thank you  :-+

should be a useful tool, not just for this


Offline nali

  • Frequent Contributor
  • **
  • Posts: 656
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #51 on: April 13, 2018, 07:03:03 am »
There are tools around that already do this. I used to do exactly that but can't remember the name of the program I used and the laptop I used is long dead now.

I couldn't find it after a quick Google trying to refresh my memory, but it did bring up a couple of things which might be of use

http://nicecircuits.com/dual-port-serial-terminal/
https://docs.microsoft.com/en-us/sysinternals/downloads/portmon
 

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #52 on: April 13, 2018, 12:48:38 pm »

OzOnE is a bit busy working on his own project at the moment, so he can't look at the EPROM code in the Ramcorder right now, i don't suppose anyone else here is versed in 6809 disassembly are they?

i have included all the details below if anyone feels inclined to take a look, this is really all we know at the moment:

CPU: 6809
SRAM: 0x0000 to 0x1FFF
EPROM: 0x8000 to 0xFFFF
Dual UART: SCN2681 mapped to 0x5000

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #53 on: April 13, 2018, 07:15:16 pm »
Attached is my Visual Basic 2010 program called Q_Capture.
You can use 1 or 2 serial ports.
You can name each port so the report shows that name on each line.
The program looks for the F nibble to find the start and uses the count in the lower nibble so it can buffer the input until the end and then display it when the command is complete, so that if commands happen on both ports at the same time it will still print a full line that makes sense, and also to avoid confusion if the data also contains an F in the upper nibble.

I have only given it a quick test and it seems OK, but there still maybe bugs in it.
Please give it a try and let me know.

I can provide source if you want too.
« Last Edit: April 13, 2018, 07:20:33 pm by Willyarma »
 

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #54 on: April 14, 2018, 08:20:41 am »
wow, what a great little tool!

ok, i just tried it and it's say data error for most of the time, i doubt it's your app... it'll be my setup for sure.

Code: [Select]
Data error, expected high nibble to be F 05
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 02
Data error, expected high nibble to be F C2
RC 08:40:45.0254 F2 41 01 00 F6
Data error, expected high nibble to be F 05
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 0A
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 05
Data error, expected high nibble to be F 00
Data error, expected high nibble to be F 04
PB 08:40:45.1190 FF 05 0A 00 05 00 04 FF F2 41 01 00 F6 05 0A 00 05 00
Data error, expected high nibble to be F 06

It makes me wonder if my hantek captures that showed the high nibble of the first byte to always be F might be in error, could you disable that data check so i can do some checking as to why this new method shows different data?

whatever i do i am getting erratic data even using terminal emulators, turning on even parity seems to help though if i use my other terminal emulator but doesn't in the q_capture app, does your app override the default settings for stuff like parity  that i set in device mangler?

« Last Edit: April 14, 2018, 08:52:30 am by dexters_lab »
 

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #55 on: April 14, 2018, 09:14:49 am »
I have added the ability to change baud, data bits, stop bits and parity.
I've not disabled the F check yet as that needs more thought as I'm relying on it to know where to insert the timestamp and start a new line etc..

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #56 on: April 14, 2018, 09:30:13 am »
wow, that was quick!

looks much better now, though i don't get anything from port 2... there is definitely data coming in on com4 though i can see it if i open it in my terminal emulator


Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #57 on: April 14, 2018, 09:37:07 am »
Sorry, I made a typo, the serial port 2 handler was reading port 1!

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #58 on: April 14, 2018, 09:41:39 am »
awesome, thanks!

i am out for the remainder of today so i'll take a look at it tomorrow.


Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #59 on: April 14, 2018, 10:55:48 am »
Looks like there is some kind of diagnostics in there:
Code: [Select]

ROM:A1A0 0000001A C CAROUSEL Diagnostics Menu                                                     
ROM:A1BA 00000027 C Uxx        Bidi Bus Read Of Address xx                                         
ROM:A1E1 00000028 C /yy        Bidi Bus Write yy To Last xx                                       
ROM:A209 00000032 C T          Toggle Test Probes or Store Difference                             
ROM:A23B 00000022 C NN         Show Input Source List                                             
ROM:A25D 00000033 C Nx,NLx,NCx Select Input Source on Both/Luma/Chroma                             
ROM:A290 0000002B C G          Toggle Parallel (GPI) Port Test                                     
ROM:A2BB 0000001F C Y          Toggle Store Bypass                                                 
ROM:A2DA 00000050 C Zx         Zit Test 0=(All)/1st/2nd Half Store; 1,2 Skip Mid Fld and Transients
ROM:A32A 00000035 C ZY         Zit Test All Store, Loop, counting errors                           
ROM:A35F 0000003D C ZZ         Zit Test All Store, Loop, stopping at first error                   
ROM:A39C 0000001D C J          Toggle Paint Task                                                   
ROM:A3B9 00000020 C K          Toggle Parallel Task                                               
ROM:A3D9 0000001F C I          Toggle Test Display                                                 
ROM:A3F8 00000018 C ?          This Message                                                       
ROM:A410 0000001A C X          Reset Software                                                     
ROM:A42A 0000001E C P          Play Forward Frame                                                 
ROM:A448 00000031 C S          Stop Play/Record; Cancel Position (H)                               
ROM:A479 00000018 C V          Play Reverse                                                       
ROM:A491 00000020 C Q          Record Forward Frame                                               
ROM:A4B1 0000003A C <or>       Step Forward or Backward (outputs field count)                     
ROM:A4EB 0000002C C Hxxx       Pos to Field xxx and Simul Rd/Wr                                   
ROM:A517 0000001E C Lxxx       Look at Field xxx                                                   
ROM:A535 00000021 C O          Play This Half (Loop)                                               
Keyboard error: Press F1 to continue.
 

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #60 on: April 14, 2018, 12:42:55 pm »
I've found a 6809 emulator written in C on github, I've altered it to print reads and writes to non memory areas....

It does this:

Read from 5100 write 0 to 500d write 0 to 5004 write 0 to 5005 write 0 to 5414 Read from 500f write ff to 5006 write ff to 5007 write 30 to 5004 write 0 to 5005 Read from 500e Read from 500d write 2 to 5005 write 0 to 5005 write 20 to 5005 write 0 to 5005 write 0 to 5409 write 0 to 5408 write 0 to 5407 write 0 to 5406 write 0 to 5405 write 0 to 5404 write 0 to 5403 write 0 to 5402 write 0 to 5400 write 80 to 5401 write c8 to 5411 write 0 to 5412 write 0 to 5413 write c8 to 5411 write 31 to 5004 write 80 to 5005 Read from 5410 write f to 5414 Read from 5100 Read from 5006 Read from 5007 Read from 5006 write 1a to 5002 write 2a to 5002 write 3a to 5002 write 4a to 5002 write 5a to 5002 write 0 to 500d write 65 to 500f write 80 to 5005 Read from 5100 Read from 5006 Read from 5007 Read from 5006 write 1a to 500a write 2a to 500a write 3a to 500a write 4a to 500a write 5a to 500a write 0 to 500d write 96 to 500f write 80 to 5005 Read from 5100 Read from 5006 Read from 5007 Read from 5006 Read from 5100 Read from 5006 Read from 5007 Read from 5006 Read from 5100 Read from 5006 Read from 5007 Read from 5006 Read from 5100 Read from 5006 Read from 5007 Read from 5006 Read from 5100.....

All values are in hex.

Not much use yet i guess
« Last Edit: April 14, 2018, 12:55:37 pm by Willyarma »
 

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #61 on: April 14, 2018, 03:24:51 pm »
Attached is a dissasembly.
Code starts at 0x8000
Interrupt routine starts at 0x866F, looks like it might handle received RS232

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #62 on: April 14, 2018, 08:48:07 pm »
Looks like there is some kind of diagnostics in there:
Code: [Select]

ROM:A1A0 0000001A C CAROUSEL Diagnostics Menu                                                     
ROM:A1BA 00000027 C Uxx        Bidi Bus Read Of Address xx                                         
ROM:A1E1 00000028 C /yy        Bidi Bus Write yy To Last xx                                       
ROM:A209 00000032 C T          Toggle Test Probes or Store Difference                             
ROM:A23B 00000022 C NN         Show Input Source List                                             
ROM:A25D 00000033 C Nx,NLx,NCx Select Input Source on Both/Luma/Chroma                             
ROM:A290 0000002B C G          Toggle Parallel (GPI) Port Test                                     
ROM:A2BB 0000001F C Y          Toggle Store Bypass                                                 
ROM:A2DA 00000050 C Zx         Zit Test 0=(All)/1st/2nd Half Store; 1,2 Skip Mid Fld and Transients
ROM:A32A 00000035 C ZY         Zit Test All Store, Loop, counting errors                           
ROM:A35F 0000003D C ZZ         Zit Test All Store, Loop, stopping at first error                   
ROM:A39C 0000001D C J          Toggle Paint Task                                                   
ROM:A3B9 00000020 C K          Toggle Parallel Task                                               
ROM:A3D9 0000001F C I          Toggle Test Display                                                 
ROM:A3F8 00000018 C ?          This Message                                                       
ROM:A410 0000001A C X          Reset Software                                                     
ROM:A42A 0000001E C P          Play Forward Frame                                                 
ROM:A448 00000031 C S          Stop Play/Record; Cancel Position (H)                               
ROM:A479 00000018 C V          Play Reverse                                                       
ROM:A491 00000020 C Q          Record Forward Frame                                               
ROM:A4B1 0000003A C <or>       Step Forward or Backward (outputs field count)                     
ROM:A4EB 0000002C C Hxxx       Pos to Field xxx and Simul Rd/Wr                                   
ROM:A517 0000001E C Lxxx       Look at Field xxx                                                   
ROM:A535 00000021 C O          Play This Half (Loop)                                               

thanks, we had spotted it before... we're just not sure how to access it!

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #63 on: April 15, 2018, 12:45:21 am »
Somethings bugging me, if the UART starts at 0x5000, then I would expect the UART data holding registers to be at 0x5003 or 0x500B but theres nothing in disassembly that reads or writes there!
Have you any details on how the address bus is wired between the 6809 and UART?
« Last Edit: April 15, 2018, 12:47:19 am by Willyarma »
 

Offline james_s

  • Super Contributor
  • ***
  • Posts: 21611
  • Country: us
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #64 on: April 15, 2018, 01:15:43 am »
I wouldn't be surprised if the addresses are not fully decoded, causing some peripherals to appear at multiple memory locations. I've seen that with some 80s arcade game hardware.
 

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #65 on: April 15, 2018, 07:21:59 am »
The memory locations directly accessed are:
M5000
M5001
M5002

M5004
M5005
M5006
M5007
M5008
M5009
M500A

M500D
M500E
M500F

I've not looked for any indirect access.
Why are the 2 ones that (ought to) actually receive and transmit characters missing!
Are there any swappages on the 4 address lines between the 6809 and UART?

Also there is another interrupt handler at 0x8234 in addition to the 0x886F that I mentioned before.
I could do with knowing which interrupt pin the UART is connected to.

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #66 on: April 15, 2018, 08:05:54 am »
Sorry, I made a typo, the serial port 2 handler was reading port 1!


app looks to be working great

this is a grab of me enabling the ramcorder, then buying / selling some frames, making a few settings changes etc

i was just testing the app works ok, next time i'll make a video of what i am doing

there's a couple of little tweaks to the app i might suggest...
the new log appears at the bottom of the list of captured commands, but whenever it's updated it scrolls to the top meaning i have to keep scrolling to the bottom to see the latest data

anyway, more to come and i'll try and get ash to post about the uart mapping

Code: [Select]
PB 08:39:50.6756 F7 53 09 50 08 12 00 00 00 43
RC 08:39:50.6996 FC 41 01 00 08 12 00 00 00 04 01 43 09 4A 0D
PB 08:39:50.7056 F2 4B 0A 00 B9
RC 08:39:50.7206 F2 41 01 04 C8
PB 08:39:50.7326 F7 53 09 50 08 12 00 00 00 43
RC 08:39:50.7586 FC 41 01 00 08 12 00 00 00 04 01 43 09 4A 0D
PB 08:39:50.7626 F0 73 9D
RC 08:39:50.7756 F5 41 01 00 05 00 34 90
PB 08:39:57.6180 F8 50 02 00 00 07 00 32 00 33 4A
RC 08:39:57.6280 F2 41 01 00 CC
PB 08:39:57.7470 F8 50 02 00 00 07 00 32 00 33 4A
RC 08:39:57.7610 F2 41 01 00 CC
PB 08:39:57.8170 F0 73 9D
RC 08:39:57.8320 F5 41 01 00 05 00 33 91
PB 08:40:10.2697 FA 73 09 50 02 01 00 07 00 32 00 33 CB
RC 08:40:10.2877 F5 41 01 00 05 00 30 94
PB 08:40:10.2917 F0 52 BE
RC 08:40:10.2997 F2 41 01 00 CC
PB 08:40:10.3577 F0 73 9D
RC 08:40:10.3698 F5 41 01 00 05 00 32 92
PB 08:40:10.3828 F8 50 02 00 00 07 00 34 00 35 46
RC 08:40:10.3938 F2 41 01 00 CC
PB 08:40:10.4378 F0 73 9D
RC 08:40:10.4528 F5 41 01 00 05 00 34 90
PB 08:40:10.4988 F0 73 9D
RC 08:40:10.5128 F5 41 01 00 05 00 35 8F
PB 08:40:12.2499 FA 73 09 50 02 01 00 07 00 34 00 35 C7
RC 08:40:12.2679 F5 41 01 00 05 00 33 91
PB 08:40:12.2749 F0 52 BE
RC 08:40:12.2809 F2 41 01 00 CC
PB 08:40:12.3379 F0 73 9D
RC 08:40:12.3499 F5 41 01 00 05 00 35 8F
PB 08:40:12.3629 F8 50 02 00 00 07 00 36 00 37 42
RC 08:40:12.3739 F2 41 01 00 CC
PB 08:40:12.4179 F0 73 9D
RC 08:40:12.4329 F5 41 01 00 05 00 37 8D
PB 08:40:12.4789 F0 73 9D
RC 08:40:12.4929 F5 41 01 00 05 00 36 8E
PB 08:40:14.3900 FA 73 09 50 02 01 00 07 00 36 00 37 C3
RC 08:40:14.4080 F5 41 01 00 05 00 34 90
PB 08:40:14.4160 F0 52 BE
RC 08:40:14.4230 F2 41 01 00 CC
PB 08:40:14.4780 F0 73 9D
RC 08:40:14.4930 F5 41 01 00 05 00 36 8E
PB 08:40:14.5060 F8 50 02 00 00 07 00 38 00 39 3E
RC 08:40:14.5180 F2 41 01 00 CC
PB 08:40:14.5780 F0 73 9D
RC 08:40:14.5930 F5 41 01 00 05 00 39 8B
PB 08:40:14.6390 F0 73 9D
RC 08:40:14.6530 F5 41 01 00 05 00 38 8C
PB 08:40:16.4301 FA 73 09 50 02 01 00 07 00 38 00 39 BF
RC 08:40:16.4481 F5 41 01 00 05 00 36 8E
PB 08:40:16.4521 F0 52 BE
RC 08:40:16.4601 F2 41 01 00 CC
PB 08:40:16.5181 F0 73 9D
RC 08:40:16.5331 F5 41 01 00 05 00 38 8C
PB 08:40:16.5461 F8 50 02 00 00 07 00 3A 00 3B 3A
RC 08:40:16.5571 F2 41 01 00 CC
PB 08:40:16.6181 F0 73 9D
RC 08:40:16.6331 F5 41 01 00 05 00 3B 89
PB 08:40:16.6791 F0 73 9D
RC 08:40:16.6931 F5 41 01 00 05 00 3A 8A
PB 08:40:18.2902 FA 73 09 50 02 01 00 07 00 3A 00 3B BB
RC 08:40:18.3082 F5 41 01 00 05 00 39 8B
PB 08:40:18.3132 F0 52 BE
RC 08:40:18.3222 F2 41 01 00 CC
PB 08:40:18.3782 F0 73 9D
RC 08:40:18.3932 F5 41 01 00 05 00 3B 89
PB 08:40:18.4062 F8 50 02 00 00 07 00 3C 00 3D 36
RC 08:40:18.4172 F2 41 01 00 CC
PB 08:40:18.4782 F0 73 9D
RC 08:40:18.4932 F5 41 01 00 05 00 3C 88
PB 08:40:18.5392 F0 73 9D
RC 08:40:18.5532 F5 41 01 00 05 00 3D 87
PB 08:40:20.3903 FA 73 09 50 02 01 00 07 00 3C 00 3D B7
RC 08:40:20.4083 F5 41 01 00 05 00 3A 8A
PB 08:40:20.4133 F0 52 BE
RC 08:40:20.4233 F2 41 01 00 CC
PB 08:40:20.4783 F0 73 9D
RC 08:40:20.4933 F5 41 01 00 05 00 3C 88
PB 08:40:20.5063 F8 50 02 00 00 07 00 3E 00 3F 32
RC 08:40:20.5173 F2 41 01 00 CC
PB 08:40:20.5783 F0 73 9D
RC 08:40:20.5933 F5 41 01 00 05 00 3F 85
PB 08:40:20.6393 F0 73 9D
RC 08:40:20.6533 F5 41 01 00 05 00 3E 86
PB 08:40:23.6905 FA 73 09 50 02 01 00 07 00 3E 00 3F B3
RC 08:40:23.7085 F5 41 01 00 05 00 3D 87
PB 08:40:23.7145 F0 52 BE
RC 08:40:23.7245 F2 41 01 00 CC
PB 08:40:23.7785 F0 73 9D
RC 08:40:23.7905 F5 41 01 00 05 00 3F 85
PB 08:40:23.8035 F8 50 02 00 00 07 00 40 00 41 2E
RC 08:40:23.8145 F2 41 01 00 CC
PB 08:40:23.8585 F0 73 9D
RC 08:40:23.8725 F5 41 01 00 05 00 41 83
PB 08:40:23.9195 F0 73 9D
RC 08:40:23.9325 F5 41 01 00 05 00 40 84
PB 08:40:25.6506 FA 73 09 50 02 01 00 07 00 40 00 41 AF
RC 08:40:25.6686 F5 41 01 00 05 00 3F 85
PB 08:40:25.6756 F0 52 BE
RC 08:40:25.6816 F2 41 01 00 CC
PB 08:40:25.7386 F0 73 9D
RC 08:40:25.7506 F5 41 01 00 05 00 41 83
RC 08:40:25.7746 F2 41 01 00 CC
PB 08:40:25.8186 F0 73 9D
RC 08:40:25.8326 F5 41 01 00 05 00 43 81
PB 08:40:25.8796 F0 73 9D
RC 08:40:25.8936 F5 41 01 00 05 00 42 82
PB 08:40:29.0708 FA 73 09 50 02 01 00 07 00 42 00 43 AB
RC 08:40:29.0888 F5 41 01 00 05 00 40 84
PB 08:40:29.0958 F0 52 BE
RC 08:40:29.1038 F2 41 01 00 CC
PB 08:40:29.1588 F0 73 9D
RC 08:40:29.1738 F5 41 01 00 05 00 42 82
PB 08:40:29.1868 F8 50 02 00 00 07 00 44 00 45 26
RC 08:40:29.1988 F2 41 01 00 CC
PB 08:40:29.2588 F0 73 9D
RC 08:40:29.2728 F5 41 01 00 05 00 45 7F
PB 08:40:29.3198 F0 73 9D
RC 08:40:29.3328 F5 41 01 00 05 00 44 80
PB 08:40:31.9820 F0 73 9D
RC 08:40:31.9960 F5 41 01 00 05 00 45 7F
PB 08:40:40.0955 F8 50 02 00 00 07 00 00 00 01 AE
RC 08:40:40.1085 F2 41 01 00 CC
PB 08:40:40.2295 F8 50 02 00 00 07 00 00 00 01 AE
RC 08:40:40.2425 F2 41 01 00 CC
PB 08:40:40.2995 F0 73 9D
RC 08:40:40.3135 F5 41 01 00 05 00 01 C3
PB 08:40:44.7177 F0 73 9D
RC 08:40:44.7317 F5 41 01 00 05 00 00 C4
PB 08:40:44.7397 F0 73 9D
RC 08:40:44.7537 F5 41 01 00 05 00 01 C3
PB 08:40:48.3359 F0 73 9D
RC 08:40:48.3499 F5 41 01 00 05 00 01 C3
PB 08:40:50.3070 F8 50 02 00 00 07 00 00 00 01 AE
RC 08:40:50.3210 F2 41 01 00 CC
PB 08:40:50.3800 F0 73 9D
RC 08:40:50.3940 F5 41 01 00 05 00 01 C3
PB 08:40:50.4400 F0 73 9D
RC 08:40:50.4550 F5 41 01 00 05 00 00 C4
PB 08:40:51.7591 FA 73 09 50 02 00 00 07 00 00 00 31 00
RC 08:40:51.7741 F5 41 01 00 05 00 00 C4
PB 08:40:51.7831 F0 56 BA
RC 08:40:51.7931 F2 41 01 00 CC
PB 08:40:51.8801 F0 73 9D
RC 08:40:51.8941 F5 41 01 00 05 00 02 C2
PB 08:40:51.9401 F0 73 9D
RC 08:40:51.9541 F5 41 01 00 05 00 05 BF
PB 08:40:52.0001 F0 73 9D
RC 08:40:52.0141 F5 41 01 00 05 00 08 BC
PB 08:40:52.0601 F0 73 9D
RC 08:40:52.0741 F5 41 01 00 05 00 0B B9
PB 08:40:52.1201 F0 73 9D
RC 08:40:52.1341 F5 41 01 00 05 00 0E B6
PB 08:40:52.1801 F0 73 9D
RC 08:40:52.1941 F5 41 01 00 05 00 11 B3
PB 08:40:52.2401 F0 73 9D
RC 08:40:52.2551 F5 41 01 00 05 00 14 B0
PB 08:40:52.3001 F0 73 9D
RC 08:40:52.3151 F5 41 01 00 05 00 17 AD
PB 08:40:52.3602 F0 73 9D
RC 08:40:52.3752 F5 41 01 00 05 00 1A AA
PB 08:40:52.4202 F0 73 9D
RC 08:40:52.4352 F5 41 01 00 05 00 1D A7
PB 08:40:52.4802 F0 73 9D
RC 08:40:52.4962 F5 41 01 00 05 00 20 A4
PB 08:40:52.5402 F0 73 9D
RC 08:40:52.5552 F5 41 01 00 05 00 23 A1
PB 08:40:52.6002 F0 73 9D
RC 08:40:52.6162 F5 41 01 00 05 00 26 9E
PB 08:40:52.6602 F0 73 9D
RC 08:40:52.6752 F5 41 01 00 05 00 29 9B
PB 08:40:52.7202 F0 73 9D
RC 08:40:52.7362 F5 41 01 00 05 00 2C 98
PB 08:40:52.7802 F0 73 9D
RC 08:40:52.7962 F5 41 01 00 05 00 2F 95
PB 08:40:52.8402 F0 73 9D
RC 08:40:52.8562 F5 41 01 00 05 00 30 94

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #67 on: April 15, 2018, 08:40:26 am »
Glad it's working  :-+  :)

I have changed the textbox code to append rather than replace and it scrolls nicely now.


Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #68 on: April 15, 2018, 09:44:37 am »
Somethings bugging me, if the UART starts at 0x5000, then I would expect the UART data holding registers to be at 0x5003 or 0x500B but theres nothing in disassembly that reads or writes there!

I thought it was me seeing the same thing, no references to TX or RX FIFO for channel A or B:

Code: [Select]
UART:5000                          ; segment UART
UART:5000                          org $5000
UART:5000 ??       MODE_A:         rmb 1                   ; DATA XREF: ROM:B2ECw
UART:5000                                                  ; ROM:B2F1w ...
UART:5000                                                  ; mc2681 Dual UART
UART:5001 ??       SRA_CSRA:       rmb 1                   ; DATA XREF: ROM:B2F6w
UART:5001                                                  ; ROM:C893w ...
UART:5002 ??       BRG_CMD_A:      rmb 1                   ; DATA XREF: ROM:8F62w
UART:5002                                                  ; ROM:8F67w ...
UART:5003 ??       RHRA_THRA:      rmb 1
UART:5004 ??       IPCR_ACR:       rmb 1                   ; DATA XREF: sub_8052+Aw
UART:5004                                                  ; sub_81BE+33w ...
UART:5005 ??       ISR_IMR:        rmb 1                   ; DATA XREF: sub_8052+10w
UART:5005                                                  ; sub_81BE+3Ew ...
UART:5006 ??       CTU_CTUR:       rmb 1                   ; DATA XREF: sub_81BE+1Dw
UART:5006                                                  ; sub_866F+6r ...
UART:5007 ??       CTL_CTLR:       rmb 1                   ; DATA XREF: sub_81BE+20w
UART:5007                                                  ; sub_866F+9r ...
UART:5008 ??       MODE_B:         rmb 1                   ; DATA XREF: ROM:B3BEw
UART:5008                                                  ; ROM:B3C3w ...
UART:5009 ??       SRB_CSRB:       rmb 1                   ; DATA XREF: ROM:B3C8w
UART:5009                                                  ; ROM:C95Aw ...
UART:500A ??       X1_X16_CRB:     rmb 1                   ; DATA XREF: ROM:8FEFw
UART:500A                                                  ; ROM:8FF4w ...
UART:500B ??       RHRB_THRB:      rmb 1
UART:500C ??       RESERVED:       rmb 1
UART:500D ??       INP_OPCF:       rmb 1                   ; DATA XREF: sub_8052+4w
UART:500D                                                  ; ROM:8F85w ...
UART:500E ??       STARTC:         rmb 1                   ; DATA XREF: sub_81BE+41r
UART:500E                                                  ; ROM:loc_9C80w ...
UART:500F ??       STOPC:          rmb 1                   ; DATA XREF: sub_81BE+18r
UART:500F                                                  ; ROM:8F8Cw ...
UART:500F          ; end of 'UART'
Keyboard error: Press F1 to continue.
 

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #69 on: April 15, 2018, 09:54:12 am »
What tool are you using? looks quite handy :)

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #70 on: April 15, 2018, 11:48:01 am »
Not totally sure but I think UART RX/TX register is accessed indirectly, looks like base address of UART is put in memory at 0x0016.
Look at code at 0xBF88 for transmitting.

Also not sure why but it looks like some of the code repeats itself about 4 times, but its not simple repitition, it dosent line up with reading a 4K ROM as a 16K ROM for example.

« Last Edit: April 15, 2018, 12:02:30 pm by Willyarma »
 

Offline PA0PBZ

  • Super Contributor
  • ***
  • Posts: 5121
  • Country: nl
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #71 on: April 15, 2018, 12:16:52 pm »
What tool are you using? looks quite handy :)

This is IDA, the only tool :)

I found the same 0x16 address, but the problem is that it not always contains 0x5000 and I cant' understand why they would do that while all other registers in the UART are addressed directly.
If out are looking for transmit have a look at 0x9D79, here they transmit CR/LF using sub 0x844E, which I of course called S_BYTE_OUT:

Code: [Select]
ROM:9D79 86 0D                    lda     #$D
ROM:9D7B 36 02                    pshu    a
ROM:9D7D BD 84 4E                 jsr     S_BYTE_OUT
ROM:9D80 86 0A                    lda     #$A
ROM:9D82 36 02                    pshu    a
ROM:9D84 BD 84 4E                 jsr     S_BYTE_OUT
ROM:9D87 39                       rts

Code: [Select]
ROM:844E          S_BYTE_OUT:
ROM:844E 8E 08 C7                 ldx     #$8C7
ROM:8451 10 8E 0C+                ldy     #$CC7
ROM:8455 1F B9                    tfr     dp, b
ROM:8457 C1 02                    cmpb    #2
ROM:8459 26 07                    bne     loc_8462
ROM:845B 8E 0C C8                 ldx     #$CC8
ROM:845E 10 8E 10+                ldy     #$10C8
ROM:8462
ROM:8462          loc_8462:
ROM:8462 34 01                    pshs    cc
ROM:8464 1A 10                    orcc    #$10
ROM:8466 DC 0A                    ldd     byte_A
ROM:8468 83 00 01                 subd    #1
ROM:846B 9C 0A                    cmpx    byte_A
ROM:846D 2D 02                    blt     loc_8471
ROM:846F 1F 20                    tfr     y, d
ROM:8471          loc_8471:
ROM:8471 10 93 08                 cmpd    byte_8
ROM:8474 27 25                    beq     loc_849B
ROM:8476 DD 0A                    std     byte_A
ROM:8478 34 20                    pshs    y
ROM:847A 1F 02                    tfr     d, y
ROM:847C 37 02                    pulu    a
ROM:847E A7 A4                    sta     ,y
ROM:8480 1F 20                    tfr     y, d
ROM:8482 35 20                    puls    y
ROM:8484 83 00 01                 subd    #1
ROM:8487 9C 0A                    cmpx    byte_A
ROM:8489 26 02                    bne     loc_848D
ROM:848B 1F 20                    tfr     y, d
ROM:848D          loc_848D
ROM:848D 10 93 08                 cmpd    byte_8
ROM:8490 27 04                    beq     loc_8496
ROM:8492 5F                       clrb
ROM:8493 35 01                    puls    cc
ROM:8495 39                       rts
ROM:8496          loc_8496:
ROM:8496 C6 01                    ldb     #1
ROM:8498 35 01                    puls    cc
ROM:849A 39                       rts
ROM:849B          loc_849B:
ROM:849B 37 02                    pulu    a
ROM:849D C6 FF                    ldb     #$FF
ROM:849F 35 01                    puls    cc
ROM:84A1 39                       rts
ROM:84A1          ; End of function S_BYTE_OUT

I'm having a hard time to follow the BYTE_OUT, mostly because I'm not used to 6809 at all.
It looks like the byte is placed in another buffer and I guess this buffer is then read by the transmit buffer empty interrupt, but it is well hidden for now...


Keyboard error: Press F1 to continue.
 

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #72 on: April 15, 2018, 02:11:35 pm »
video of capturing the serial data, the data is attached as a text file

« Last Edit: April 16, 2018, 07:51:21 am by dexters_lab »
 
The following users thanked this post: Willyarma

Offline Willyarma

  • Contributor
  • Posts: 27
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #73 on: April 15, 2018, 04:37:03 pm »
Right at the start of the video, you pressed buy and the paintbox only sent the F0 73 9D command, and nothing else.
The ramcorder answered with F5 41 01 00 05 00 00 C4 which looks like it saying its on frame 0

Then when you changed buy to 2, the paintbox just sent the F0 73 9D command again.
The ramcorder answered with F5 41 01 00 05 00 01 C3 which is different to before, frame 1

Its interesting how the 73 command with no parameters could make the ramcorders response change.

What happens if you just keep dong that repeatedly?
Also would be interesting to see what happens if you manually send F0 73 9D a few times, does it toggle, count up or what?

Offline dexters_labTopic starter

  • Supporter
  • ****
  • Posts: 1890
  • Country: gb
Re: Quantel Ramcorder - Digital Video RAM Store
« Reply #74 on: April 15, 2018, 04:42:58 pm »
Right at the start of the video, you pressed buy and the paintbox only sent the F0 73 9D command, and nothing else.
The ramcorder answered with F5 41 01 00 05 00 00 C4 which looks like it saying its on frame 0

Then when you changed buy to 2, the paintbox just sent the F0 73 9D command again.
The ramcorder answered with F5 41 01 00 05 00 01 C3 which is different to before, frame 1

Its interesting how the 73 command with no parameters could make the ramcorders response change.

What happens if you just keep dong that repeatedly?
Also would be interesting to see what happens if you manually send F0 73 9D a few times, does it toggle, count up or what?

yes i noticed that before, i think i know what it is...

i mentioned previously how those counters are probably fields so 0x0 would be frame 0 field 1

i think these types of reply 'F5 41 01 00 05 00 01 C3' are more like a current status response from the ramcorder where it reports it's current frame...

i think what's happening is as the ramcorder is always outputting video depending on when it sends the status it could be outputting field 1 or field 2, which makes the reply change

i did try keep generating that response and it's pretty much 50/50 which response you get


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf