This is bank 3, it resides on the flash from 18000 to 1ffff
This is bank 3, it resides on the flash from 18000 to 1ffff
By the way, these are some of the numbers on the IC's on the board just in case it helps:
185
16196452
e87j (this is the 68hc11F1)
18391m64
66285
delco 466
a8372y25
39194
delco 466
a8393p53
51862
delco 466
16132083
a 9832 736 (date code?)
m832316apa
flash
AN28f010 (the flash rom)
185
16185984
2e79n (68hc56fn, the dlc I/O device)
16132083
a 9833 736 (date code?)
m83309apa
18412r31
66285
delco 466
a8403m42
51862
delco
05799
t8383655
466
Well my agilent logicwave logic analyzers will hopefully show up tomorrow. Probably will take a bit to work the bugs out since they do not have cables (what can you expect for cheap ) but hopefully I can have them hooked up and reading by the end of the month. Then I should be able to start making heads and tails of the code. I think the biggest questionmark is really what do the tables mean (scaling etc) and what ends up in any given memory address. At some point I will have to figure out how to get the stuff out of the eeprom on the CPU as well.
Acquiring the Agilent is cool...
I acquired an old HP (before Agilent) and an old Tektronix (I asked my work if I could have them since they were being thrown out, and my work said yes)...
so now I need (for LS1):
- to get the card out of a spare PCM,
- a way to read the raw bin from it,
- a 68332 disassembler (preferably free).
Took a quick run arround the net and did not pull up a free dissasembler, IDA is supposed to be good for many processors, but it isn't free.
BTW I do think I have a way of getting the stuff off of the eeprom, once I have the logicwave's hooked up, I just write a small section of code that will set the appropriate register bits then pick a spot and read and write them on the databus, the logic analyzer will pick up the code just fine. Eventually I should be able to do it with just mode $27 stuff I would think, but my early attempts to make that work have been less than fruitfull. At least I have made it past getting the seed/key pair though.
Well I officially have the logic analyers up and working. Just need to make the connections and away I go.
Well for those of you playing the home game I have some info from logic analyzer world. The major enhanced mode entry points. This is all in the 3rd upper memory block.
10 $8F26
12 $8FE8
13 $9103
14 $91e2
17 $91F9
18 $946d
19 $964e
20 $98Ac
22 $98Dd
23 $991c
25 $9963
27 $9971
28 $99Fa
29 $9A44
2a $9A42
2b $9C28
2c $9C7c
31 $9DF6
32 $9DF6
33 $9DF6
34 $9E44
35 $9EA6
3b $A4B6
3c $A4B6
3f $A8Cd
The jump table that access these actually shows 4 digits lower, but when the indirect call is made it adds 4 to the address.
Have you gotten any further with this?
I have been off on honeydo projects for awhile. If things go relatively well this winter I am hoping to have a chance to go at it some more.
Any chance the honeydo projects have subsided?
I owned a Ford once, ONCE.......