Identify microprocessor from code.
PowerOne
I want to identify a microprocessor from the code because
I dont have the micro number. This micro uses an EPROM 27C4001.
These are the first part of code staring from line 500h:
01 00 6D F5 52 E5 6D 7D 6D F6 52 D6 09 65 01 00
6D 76 52 E6 09 5E 54 70 01 00 6D F5 0F E5 01 00
6D 76 55 5C 0F D6 54 70 01 00 6D F5 0F E5 01 00
6D 76 0F E6 4B 0C 0F D5 4A 10 17 B5 55 42 17 B6
54 70 17 B6 0F D5 4A F4 17 B5 40 34 01 00 6D F5
0F E5 01 00 6D 76 0F E6 4B 0C 0F D5 4A 02 17 B5
55 1E 0F D6 54 70 17 B6 0F D5 4A 02 17 B5 55 10
The micro has the part number B4F2398 but I can not find it
on the web.
I want to decompile the code.
Thank you.
mengx...@gmail.com
are you sue the date you listed is code ?
i do not think so,
i think storing the code in a eeprom is a bad design
if you want identity this microprocessor, maybe you should find some
hint from it's pins and the mark on it surface.
Simon
Neil
I am not sure how you can tell what the CPU is from a hex dump.
Mark McDougall
> These are the first part of code staring from line 500h:
> 01 00 6D F5 52 E5 6D 7D 6D F6 52 D6 09 65 01 00
> 6D 76 52 E6 09 5E 54 70 01 00 6D F5 0F E5 01 00
> 6D 76 55 5C 0F D6 54 70 01 00 6D F5 0F E5 01 00
> 6D 76 0F E6 4B 0C 0F D5 4A 10 17 B5 55 42 17 B6
> 54 70 17 B6 0F D5 4A F4 17 B5 40 34 01 00 6D F5
> 0F E5 01 00 6D 76 0F E6 4B 0C 0F D5 4A 02 17 B5
> 55 1E 0F D6 54 70 17 B6 0F D5 4A 02 17 B5 55 10
You have no way of identifying what is code, and what isn't. Also, do you
know if this EPROM was half of a 16-bit wide ROM image - 4Mb is a lot for
an 8-bit design)? And does the board use some sort of design protection,
eg. scrambling bit lines or decrypting EPROM data using a PAL? Do you have
schematics?
Also, some manufacturers supplied custom variations of micros with masked
bootstrap roms and even built-in encryption, most of which also had custom
part numbers.
For some common micros, an experienced disassembler with enough data can
recognise code areas of his/her favourite micro (eg. I could probably do
so with Z80 code), but with so little info and (I'm assuming) experience I
don't like your chances.
Regards,
--
Mark McDougall, Engineer
Virtual Logic Pty Ltd, <http://www.vl.com.au>
21-25 King St, Rockdale, 2216
Ph: +612-9599-3255 Fax: +612-9599-3266
Didi
>
> I am not sure how you can tell what the CPU is from a hex dump.
Oh one can if one speaks the language. Or has spoken it, that is...
I would have known instantly if it had been a 6800 or a 6809 -
although
I have not spoken much of these languages for well over a decade.
So it is not one of these (and not a HC11 either, which is an enhanced
6800).
Someone else might know what it is - unless it is some newer core
which noone has ever dealt with manually...
Didi
------------------------------------------------------
Dimiter Popoff Transgalactic Instruments
http://www.tgi-sci.com
------------------------------------------------------
http://www.flickr.com/photos/didi_tgi/sets/72157600228621276/
Original message: http://groups.google.com/group/comp.arch.embedded/msg/cad2e11aaab78ac6?dmode=source
Don McKenzie
Take a picture of the board, put it up on the web somewhere, and link to it.
The support chips, or board layout may give enough of a clue to someone
experienced with the board.
When the choice is minimal, some decent answers may fall out.
Don...
--
Don McKenzie
Site Map: http://www.dontronics.com/sitemap
E-Mail Contact Page: http://www.dontronics.com/email
Intelligent 2.83" AMOLED with touch screen for micros:
http://www.dontronics-shop.com/product.php?productid=16699
Lanarcam
http://www.bi.a.u-tokyo.ac.jp/~uaa/gomitext/2007/20071021/timer-h8300.txt
Stuart
news:f9b1c9eb-15fe-4a23...@79g2000hsk.googlegroups.com...
Looks a bit like Hitachi H8! (5470 == RTS, 6D7{0x} POP, 6DF{0x} PUSH. )
--
Stuart
Stef
Why would storing code in EEPROM be bad design?
Furthermore, this code is stored in EPROM (one 'E'). This used to be the
defacto standard for storing code until FLASH chips and controllers with
big internal FLASH became common.
Starting from 500h sound a bit funny though, most CPU's start executing
from zero or from their highest address.
If there was any deliberate attempt to hide the type of processor or
otherwise hinder reverse engineering, data- and addressbusses may have
been mixed up as well.
--
Stef (remove caps, dashes and .invalid from e-mail address to reply by mail)
PowerOne
I will try to get the picture.
The package type is TQFP (Thin Quad Flat Pack)
I don't have schematic.
Hitachi has a Mark but this one don't.
Mike Harrison
Why do you think that it is code, not just data in the eprom?
Could the micro have on-chip rom/flash?
CBFalconer
This makes no sense. If you want to post a followup via
groups.google.com, ensure you quote enough for the article to make
sense. Google is only an interface to Usenet; it's not Usenet
itself. Don't assume your readers can, or ever will, see any
previous articles.
More details at: <http://cfaj.freeshell.org/google/>
--
[mail]: Chuck F (cbfalconer at maineline dot net)
[page]: <http://cbfalconer.home.att.net>
Try the download section.
** Posted from http://www.teranews.com **
donald
>> I want to identify a microprocessor from the code because
>> I dont have the micro number. This micro uses an EPROM 27C4001.
>>
>>
>> on the web.
Ok, so whats on the outside of the box.
Did you just get a PCB without a box/case and power supply ??
donald
Robert Adsett
Stef says...
It would be reasonable for a 80C196 variant. The reset address IIRC was
2080H. Executable code could be place before or after that with some
memory reserved for the micro's internal memory. The amount reserved
varies with the variant.
Robert
PowerOne
cs_po...@hotmail.com
> For some common micros, an experienced disassembler with enough data can
> recognise code areas of his/her favourite micro (eg. I could probably do
> so with Z80 code), but with so little info and (I'm assuming) experience I
> don't like your chances.
I think it's kind of a fun question actually. Almost worth posting
some examples as intentional challenges to the group just for the fun
of it.
Sure, their are snippets that would be undecipherable, or very
difficult such as half of a 16 bit pair as mentioned, but I bet many
real world examples could be identified. At least by ancestry if not
by precise variant.
Mark McDougall
> The board is from an Archade machine made in Spain.
Do you mean "arcade"? Whay didn't you say it was so important earlier???
I'm assuming this particular machine isn't yet implemented in MAME?
A *lot* of arcade boards (depending on the era) used varying degrees of
design protection, ranging from simply switching address/data lines or a
simple xor-matrix PAL to custom encrypting processors with volatile key
storage. Cross your fingers it's not the latter! ;)
I'd run with the H8 suggestion first. Run it thru a disassembler and see
if there are any areas that look sane (start with the reset vector address
of course). However, I'm pretty sure that there were a number of machines
that used custom Hitachi processors for design protection. Is this the
main game processor? I don't recall any games using H8 off the top of my
head (I could be wrong), but rather using H8 parts as secondary processors
for I/O controllers...
Wayne Farmer
Here's another way of looking at the data given. Hope it helps.
Paul Urbanus
> I will try to get the picture.
> The package type is TQFP (Thin Quad Flat Pack)
> I don't have schematic.
Do you have an ohmmeter, pencil, paper, and time? If so, you can
generate a schematic. The old Tocom/General Instruments 5503 cable box
had a house numbered processor. I drew a schematic and then compared it
to all the standard micro pinouts I could find. Turned out it was a
Zilog Z8, and the address/data lines were scrambled.
Even a partial schematic showing the CPU to memory connections can be a
big help.