Subject: Q: CC-40 bank switching ROM

From: Jon Guidry <[email-masked]>
Date: Wed, 27 Jan 2010 20:14:38 -0600

I'm trying to get a little creative about dumping the CC-40's HN61256 ROM, since all other attempts have failed..

From the manual, the ROM plops itself in 8K segments from >D000 to >EFFF (8K).  From the TI-74 Manual, I see that the processor ROM has the bank switching routines in it.  (>F800 to >F8FF.)  

Now, a couple of questions...

1) Does anyone think it would be feasible to write the 8K contents to the RS232 device, switch it three times, and the dump the other 8K banks?
2) If not, any way of getting that 32K out of the system without trying to physically read the chip?

Here's the memory map, BTW...

>0000->007F = Registers (128 bytes)
>0080->00FF = Unused (128 bytes)
>0100->01FF = Peripheral File [I/O] (256 bytes)
>0200->07FF = Unused (1.5K bytes)
>0800->4FFF = System RAM (18K)
>5000->CFFF = Cartridge Port (32K) (wow...)
>D000->EFFF = System ROM (8K, paged)
>F000->F7FF = Unused (2K)
>F800->FFFF = Processor ROM (2K)

I think it would be relatively easy to dump the cartridges via the RS232 port (raw mode) via a simple BASIC program.  Just use Procomm Plus in RAW capture mode and I would be set (and then hexedit any extraneous stuff from the top/bottom).  The same for the Processor ROM.  However, the System ROM is the current challenge.

Thoughts, discussions?

BTW, the TI-74's memory map is close to the CC-40... (from http://www.classiccmp.org/dunfield/ti/ti74tdm.pdf)

>0000->007F = Processor Registers (128 bytes)
>0080->00FF = Reserved 
>0100->017F = Processor I/O (128 bytes)
>0180->0FFF = Unused (4K)
>1000->1FFF = System I/O
>2000->3FFF = System RAM (8K)
>4000->BFFF = Cartridge Port (32K)
>C000->DFFF = System ROM (8K, paged)
>E000->EFFF = Unused (4K)
>F000->FFFF = Processor ROM (4K)

Anyone know the developer of the CC-40?  Maybe they still have some of their code (including the glue logic in the control chip) somewhere.

Jon

---

From: "hexbus" <[email-masked]>
Date: Thu, 28 Jan 2010 02:50:58 -0000

BTW, also the CC-40 has a nice debugger/monitor built into it.

However, the ROM paging function doesn't seem to work.  The "R" function is supposed to be used to page the ROM.  "When the space bar is pressed, the monitor responds by displaying SYSTEM PAGE=n where n is the current ROM page that is selected while the machine language program is running.  The new system ROM page can then be entered."  No matter if I enter a 0, 1, 2, or 3 here, I still get the same set of bits at >D000.

Copying works great though from >D000->EFFF to >5000->6FFF though for the currently selected 8K... (with my 32K RAM cartridge installed, and not being used as RAM.)

Jon