All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 232 posts ]  Go to page Previous  1 ... 8, 9, 10, 11, 12
Author Message
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 2nd, 2024, 12:55 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
HaQue wrote:
adapter working? Translatable to English: https://www.phantom.sannata.org/viewtopic.php?t=40212&start=165

Quote:
Hello everyone, I'm fine, the development of the device has not been abandoned, but has been paused.
I don’t want to open source it yet, maybe later.
I didn’t unsubscribe to the topic because I didn’t see the notifications... Such a monstrous coincidence. ;)

The latest available firmware has added:
* advanced multi-level CLI
* ATA bus debugging mode: the device is connected third to a standard cable, captures messages on the bus, caches them in the controller memory and displays them in the CLI.
* ZIP support improvements: soft-eject support, compatibility with music equipment, successfully tested on Boss BR8, Roland SP808, Roland SP808ex, Roland VS840vx.
* error correction.


Yes this works very well, i worked with user Sintechi to get the emulator working perfectly with the SP808. Due to the sanctions placed on Russia and because of the political unease, he is taking a break from the project, but he has re-spun a new version of the board.

The emulator has a bus sniff function, which allows all data on the IDE bus to be captured. This allowed us to see the interaction between the SP808 and the ZIP drive. I have put logs here: https://github.com/hsiboy/Roland_SP-808_Reverse_Engineering/blob/default/Roland_SP-808_to_ZIP_Drive_sniff.md


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 2nd, 2024, 12:56 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
HaQue wrote:
Anyone know anything about these expansion boards for the SP?

https://reverb.com/au/item/56525330-rare-roland-sp808-op2-scsi-digital-i-o-expansion-board-for-sp-808-sp-808ex-worldwide-shipping
Quote:
Very Rare Roland SP808-OP2 expansion card for SP-808, SP-808EX.
Adds SCSI, Digital In/Out, and balanced stereo input / output with XLR Mic input.

Quote:
Two XLR Inputs with Line/Mic switch - Two XLR Outputs - Digital SP/DIF In/Out - SCSI port for adding an extra Zip drive.


I wonder if this port is useful in any way?

Attachment:
expansion.jpg


Hey @HaQue - I have one of these interfaces, unfortunately it only works as a backup device. So you can save a copy of your ZIP to the backup device or restore from a backup, but you can not play from it.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 2nd, 2024, 13:06 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
HaQue wrote:
Wondering if it is possible to use the technique in this post to somehow access other parts of the system. Namely put CPU in a different mode that ignores onboard OTPROM and boot from flash with some code.

https://hackaday.io/project/188508-repu ... 039-h8300h

Also wondering about how the buttons tell the OS what to do. Looking to see if a button press is sent via an ascii code or some protocol, what happens if we send something unexpected?

I edited together some images of the test mode. The RAM looks interesting. Not sure what PRAM0, PRAM1, IRAM0, IRAM1, GRAM and ERAM are. I have seen reference to IRAM being CPU Instruction RAM, but not so sure that is what it is here.

Attachment:
TestMode.jpg


@HaQue did you see the "special" mode?

Code:
Status + FX A --> MIDI Update
Status + FX B --> Zip Update
Status + FX C --> Develop Monitor
Status + FX D --> Diagnostic Mode


Midi update is interesting to me, i think this is using Hitachi UART, look at the PCB ;-)

If you damage IC9 (flash IC), you get this message:

Code:
<< EMERGENCY >>
SYSTEM is BROKEN !
Please consult quali -
fied Roland Service.


Those string do not exist in the firmware file!


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 23rd, 2024, 9:24 
Offline

Joined: September 6th, 2023, 7:16
Posts: 6
Location: United Kingdom
Don’t know if this is relevant but in case you guys have not seen it.

https://superuser.com/questions/1429096 ... -hangs-fir

It talks about pins 21 and 29 in IDE interface not being connected on SP-808, I wonder if the same is true of the A6 - presumably not since it is factory fitted with a HD, can’t seem to find the A6 service manual. Might be worth asking Roland for it?

I’m still very much interested in a solution even though currently my SP-808 is working happily with the Akai card reader.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 23rd, 2024, 15:37 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
Yeah, that is a factor, but, the Iomega zip drive sends a specific response to a given ATAPI command that is an extension to the ATPI specification. Its vendor specific, and other devices don't know how to respond.

Also, the zip drive returns data in a specific way, and the SP-808 expects to get the data in those specific sized chunks, and if it doesn't, it sends a reset to the drive and starts again.

All this is documented on my GitHub repo.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 27th, 2024, 1:53 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
I will be struggling for time next 4 weeks or so, due to work. My main laptop becoming unbootable is a P.I.T.A. as well.

@Hsiboy I need to go back and check out the special mode in more detail, as really I have only been documenting what I am finding, without going into too much research mode on the individual interesting parts. The CPU certainly has firmware. I am not sure it is updateable/dumpable though. to use any CPU I/O I would assume you would need to write code and get it to execute to setup the serial comms, and I am sure there would be vectors to do that, I don't know how yet.

Where did you see this? :
Status + FX A --> MIDI Update
Status + FX B --> Zip Update
Status + FX C --> Develop Monitor
Status + FX D --> Diagnostic Mode

my mind is a bit foggy on what I've been doing, but I can't remember seeing this anywhere.

as for disassembly, specify Hitachi H8S advanced, and H8S/2215R. Closest I go to the actual CPU.
the following seemed to work for a dodgy memory map. not sure how accurate it is because this is from my work PC, and I may have worked on it more on my laptop that is currently only got a new install of win11, with the SSD out of it hoping I can recover it. My fault for getting a new laptop and simply swapping SSDs, installing new drivers and hoping it would carry on. didn't expect blue screen and all methods of recovery not working. dammnit!

I started adding the memory map from the CPU docs, but to be honest, wasn't making a whole lot of sense to me!

Attachment:
segments.JPG
segments.JPG [ 76.15 KiB | Viewed 68339 times ]


@Buzunki, the service notes can be found in these places:
https://www.synthxl.com/wp-content/uploads/2020/01/Roland-A-6-Service-Manual.pdf

https://www.manualslib.com/manual/1829457/Roland-A-6.html


The more I look at this project, the more I feel I need to know!


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 28th, 2024, 7:27 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
this looks very interesting ;-)

http://forums.openecu.org/viewtopic.php?f=15&t=394


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 29th, 2024, 12:16 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
@HaQue

Power off the SP-808
Hold down the STATUS & EFFECTS buttons for Track A and then power on the SP-808
The display reads "MIDI UPDATE - Waiting MIDI . . ."

Status + FX A --> MIDI Update
Status + FX B --> Zip Update
Status + FX C --> Develop Monitor
Status + FX D --> Diagnostic Mode

This code is from the mask ROM 8)

I've tried sniffing the midi interface when in Develop Mode, but there's no traffic i can see, so i'm hoping the UART that's brought out to unpopulated CN7 on the PCB has something.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 29th, 2024, 12:24 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
From my notes on. github...


Looking at the PCB
Pin 83 STBY is held high.

Pin 82 NMI (Non Maskable Interrupt) is held high, which means NMI is not being used.
MIDI is communicated via pin 61 (P30 / RXD0) and pin 59 (P32 / TXD0).

Pin 60 is TXD1 and pin 62 is RXD1, this serial interface is brought out on pin 33 as TX1 and pin 32 as RX1 on unpopulated connecter CN7. Pin 31 of CN7 carries XRST, while neighbouring pins 34-37 are GND and pins 38-40 are VCC.

On the PCB, the pins (MD2 to MD0) that control the MCU Operating Mode are set as follows:

Pin 123 - MD0 = Low
Pin 124 - MD1 = High
Pin 125 - MD2 = High

Which means the CPU is running in Mode 6 - "On-chip ROM enabled, expansion mode".

This means the MCU is running in Advanced mode!

The address space is 16 Mbytes in modes 4 to 7 (advanced modes). The on-chip ROM of H8S/2655 contains 128 kbytes, but only 56 kbytes are available in modes 2 and 3 (normal modes). The address space is divided into eight areas for modes 4 to 7.

In Advanced mode, Linear access is provided to a 16-Mbyte maximum address space (architecturally a maximum 16-Mbyte program area and a maximum 4-Gbyte data area, with a maximum of 4 Gbytes for program and data areas combined).

Note - While the CPU’s architecture allows for 4 Gbytes of address space, the H8S/2655 Group can actually accesses a maximum of 16 Mbytes.

Modes 1, 2, and 4 to 6 are externally expanded modes that allow access to external memory and peripheral devices.

The external expansion modes allow switching between 8-bit and 16-bit bus modes. After program execution starts, an 8-bit or 16-bit address space can be set for each area, depending on the bus controller setting. If 16-bit access is selected for any one area, 16-bit bus mode is set; if 8-bit access is selected for all areas, 8-bit bus mode is set.


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: February 29th, 2024, 12:28 
Offline

Joined: January 7th, 2022, 6:43
Posts: 20
Location: United Kingdom
HaQue wrote:

as for disassembly, specify Hitachi H8S advanced, and H8S/2215R. Closest I go to the actual CPU.
the following seemed to work for a dodgy memory map.


Smashing, let me see what i used :good:


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: March 15th, 2024, 3:31 
Offline

Joined: August 9th, 2023, 11:40
Posts: 3
Location: Barcelona
Hi,
Glad to see some forward movement is happen.

Sadly on my side after contact MidiManiac over wallapop and sent him a whatsapp messaging the conversation didn’t flow (he made an appointment and never return)
Maybe he moved on this topic since I found him selling his sp808 with MCD drive…


Top
 Profile  
 
 Post subject: Re: Sniffing control flow between legacy devices over PATA/A
PostPosted: March 31st, 2024, 16:24 
Offline

Joined: January 10th, 2022, 13:36
Posts: 4
From the creators of SCSI2SD and ZuluSCSI, looks like there 'may' finally be and alternative to the ZIP in the SP-808:

JUST RELEASED...

https://www.zuluide.com
https://github.com/rabbitholecomputing/ZuluIDE-firmware

ZuluIDE™ is a IDE computer storage emulation platform, where CD-ROM drive images are stored on a standard FAT32 or exFAT-formatted SD card. SDXC cards of up to 512GB are supported.

Features
Emulates IDE/ATAPI CD-ROM drives of any size.
Emulates ZIP100 ATAPI removable media.
Open-source firmware, licensed under the GPLv3


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 232 posts ]  Go to page Previous  1 ... 8, 9, 10, 11, 12

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 36 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group