All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 207 posts ]  Go to page Previous  1 ... 7, 8, 9, 10, 11
Author Message
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: May 10th, 2023, 13:28 
Offline

Joined: January 7th, 2022, 6:43
Posts: 10
Location: United Kingdom
Just a quick update.

There is something off with the firmware that was unpacked from the midi files earlier in this thread.

Decompilation was very scrappy and needed lots of manual intervention when it should not have required it.

As a test, I ran the firmware from a Nissan ECU (it uses the same CPU) through the decompilation and boom, a screen full of sub routines and jumps to them.

I don't get that with either the SP808 firmware or the A6 firmware.

Next, I'm seeing patterns in the firmware I wouldn't expect.
I'm seeing

Code:
7F 00 00 00 00
repeated every 14 bytes. And other anomalies that repeat through the code, suggesting it's an artifact of the midi extraction.

The other thing that makes no sense, the A6 firmware is bigger than the SP808 firmware??

I'd expect the SP808 firmware to be bigger because it has all of the effects and Synthesis that the A6 doesn't.

Very odd.

Current plan is to dump firmware to disk and examine that. However, I have just ordered a chip programmer that can handle the 56 pin flash chip, and that will be my next port.

Finally, I'm going to see if the UART on CN7 yields anything useful, as there are some strings in the firmware that are never shown on screen or stored on disk.

HSIBOY


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: May 11th, 2023, 4:31 
Offline

Joined: January 7th, 2022, 6:43
Posts: 10
Location: United Kingdom
Small correction to the above, it's
Code:
7A 00 00 00
,
And here's the odd thing. If I diff the Sp808 firmware and the A6 firmware, these patterns occur in the same place in both files. In fact, there are so many null bytes
Code:
00
that occurs in exactly the same place in the two files, it has to be an artifact from the midi update.
Question is, has it been extracted incorrectly, or, is it a further later of transport packing, because the firmware was being streamed in over a uart.

Also, there are strings that appear on the screen of both devices, that are not present in the firmware.
So, either the firmware does not update everything, or there is further compression.

The entropy of the two files is below 1, so I don't think it is compressed, but either way, the firmware that was extracted earlier in this thread, is currently a dead end, because it can't currently be compiled.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: June 18th, 2023, 13:42 
Offline

Joined: January 7th, 2022, 6:43
Posts: 10
Location: United Kingdom
Ok, so, a couple of things.

1. The firmware isn't H8 code. There maybe some H8 code in there,but it's not straight up H8 code.
2. The MCU used in the SP808 has a 64KB ROM, that was burnt at the factory (mask ROM).

I haven't been able to put the MCU into prom mode yet and I haven't been able to dump the flash ram either.

Slow going.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: August 9th, 2023, 12:53 
Offline

Joined: August 9th, 2023, 11:40
Posts: 2
Location: Barcelona
Hi,
I want to contribute to this cause. Short history… I waiting for Midimaniac to chat about it since I found him selling his sp808 with working cf reader (the bluempc model) and I wrote a comment a year ago in this video but he never answered…

https://youtu.be/3n7enH5vOyU

My comment (a year ago…):
Quote:
My brother is onto msx (and older computing) homebrew things and I wonder time to time to maybe research a bit to maybe try tomfind a solution but everytime I start to dig I can’t just avoid ending at “why not just bypass the whole memory system and attach an iPhone with koala sampler (or even a raspi which supports koala btw) and get the best of two worlds” so keeping the ADCDAC side, fx, even synth but just use the midi side and then some hardware hacking about in and outs (so output of mic/line + fx into usb soundcard in plug to koala and the out plug into sp where the signal was hijacked so it goes to the master and sp outputs again…?)
Maybe it could be possible understand the whole hot swappable Atapi drive but for 4 stereo polyphony? About the 4 track recorder maybe it could be possible add some vstudio parts… I will love to see a solution but with propietary file compression without sources it requires a bit (too much) working for so little reward (imo) and in the end these are nutty expensive due the madness about lofi (we called noise back in the day…) and all the sp series… now revamped by roland themselves with 404mk2. I dunno… maybe just try to ask at retrobrew computers club groups so maybe one of these genius gets it as a challenge and crack the weird firmware inside these or just replace the cpu by raspi and emulation of that part at the brain surgery I’m pointing. It should not be impossible but worthy? I should look again into schematic to see how hard it will be but it’s like dejavu… I feel I done it but what I found made me brainwhased just to avoid the pain over and over… #FuckURolandcorporates I hate them as time goes more and more!


So I started reading the topic but jump into last page to see latest news… also my brother came a moment (I’m soldering some floppy interfaces for msx at the moment) and I tried to explain the problem and ask his (nerd) opinion. He told me more or less what Midimaniac tried himself here:
https://www.themidimaniac.com/archives/1076

Scroll down and use “show reader” if you get annoyning scrambled ads on top like me with the iPad (or maybe switching to desktop web version…)

There’s a log of the project “recreate that mpc blue reader” and he even tried a kickstarter but not enough backers…

So I will come back after chatting with him to see what’s in his mind and search for a collab if possible or ditch it definetly but almost sharing the possible.

I will appreciate your opinion. I will try to find time to read the whole topic meanwhile…

Cheers!


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: August 9th, 2023, 17:48 
Offline

Joined: August 9th, 2023, 11:40
Posts: 2
Location: Barcelona
Update: I read the whole topic so I have better idea how is going.

Thanks everyone involved for all the contributions.

I’ll be back!


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: September 6th, 2023, 7:33 
Offline

Joined: September 6th, 2023, 7:16
Posts: 2
Location: United Kingdom
Hi all,

I joined up because I am also interested in finding a solution to the SP-808 zip replacement.

A couple of things:

The Startech CF drive seems readily available, it has a metal housing so will fit quite nicely, but obviously it seems to be a “dumb” IDE not ATAPI device.

Maybe a possible solution would be to have an inline pass through device which has a microcontroller that sends the appropriate commands to the SP-808, which connects between the Startech drive and the 808 drive cable. I don’t know enough about this to be sure it could work, hence my joining up here.

I have seen a FPGA based emulator for zip and other drives here https://3do.dev/products/copy-of-ide-emulator-batch2 but it seems quite expensive for this application and does a lot more than needed anyway.

I tried a few generic CF/IDE adaptors, some of them looked like they were going to work and gave me the option to format, and showed up recording time, but hung on trying to record, presumably because the 808 was waiting for some ATAPI response.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: September 15th, 2023, 12:33 
Offline

Joined: September 6th, 2023, 7:16
Posts: 2
Location: United Kingdom
I tried a PATA to SATA converter, with a SATA CF card reader, but did not work either, despite both devices supposedly supporting ATAPI.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 207 posts ]  Go to page Previous  1 ... 7, 8, 9, 10, 11

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group