Another IIci ROM hack

[Trash80toHP_Mini]

WOOHOO! NINE pages and counting for your first post, dougg3!

How does the Macintosh Family Hardware Reference differ from the earlier Inside Macintosh volumes?

MFHR and GttMFH2E are Hardware Reference Materials printed on wood pulp based storage media which would the Paleolithic era distribution model for the Neolithic Developer CDs, both predecessors of the more current PDF based DeveloperNote model.

All of which refer to the Macintosh Hardware: I/O subsystems, memory management and physical layout of the case and design guidelines for those systems & subsystems.

Inside Macintosh is for software only developers right alongside hardware/software developers.

For the most part, the Hardware References give a vague description of the way a Mac is supposed to work and spend a LOT of ink/bits making it VERY CLEAR that the Mac Hardware should ONLY be addressed via the ToolBox routines found in: Inside Macintosh

[olePigeon]

My Inside Macintosh volumes are wood pulp in a 3-ring binder.

[Trash80toHP_Mini]

Here's the RoadMap:


. . . with a couple of other Titles I'd like to nab!

Here's the .TXT info:

There wasn't much need for Macintosh Hardware Reference Material until the release of the SE and the Macintosh II.
Before then, the Classic Macintosh was SJ's dream of the perfect "monolithic" AIO computing appliance . . .
. . . just add the "optional" second FDD, Double the RAM and add a SCSI port to the Box . . .
. . . then a killer app like PageMaker can save the poor little critter from oblivion!

[Trash80toHP_Mini]

I just ordered TIttMF in collectable condition from amazon.com for $35, shipped 2-Day, so I should have it Saturday.


Technical Introduction to the Macintosh Family the root level of the Macintosh Family TechInfo Tree!

[jongleur]

I just ordered TIttMF in collectable condition from amazon.com for $35

I bought my copy from AbeBooks, where if you want something that is in good condition, the price is very "affordable" (cheap as) and some copies for more, that are described as "as new".

http://www.abebooks.co.uk/servlet/Searc ... osh+Family

I always check for availability of old books/manuals at AbeBooks as shipping to the land down under is quite reasonable.

[Trash80toHP_Mini]

I got my copy of MFHR from abebooks and was very satisfied. I saw several copies of TIttMF for less . . .
. . . but the price was right for a "collectable" Reader that I don't expect to be scanning from cover to cover!

Designing Cards and Drivers for the Macintosh II and Macintosh SE is next on my list and abebooks has some great prices!
DCaDftMIIaMSE is beginning to get just a tad cryptic!

[dougg3]

LOL...I thought GttMFH2E was cryptic enough, but DCaDftMIIaSE is just insane!

Between all of the posters here, we could open a freakin' library with how many books we have!

[Bunsen]

Hey Trash80 - that family tree is invaluable! Thankyou for posting that.

[Trash80toHP_Mini]

De nada, compadre!

My "Collectable, Like New" copy of TIttMF arrived today and I could swear it's in better shape than my brand new, special ordered, GTttMFH2E was when it arrived at B&N back in the day! It's certainly in much better shape than the "in stock/on the shelf" copies had been at Barnes & Noble . . .
. . . before they'd discontinued stocking them.
More info after I take a gander at this new research toy!

[techknight]

ya i have the designing cards and devices book as well. I also have inside macintosh vol2 i think? but thats all i have.

Vol 1 through III is downloadable on the web. I have vol 2 in book form.

[Trash80toHP_Mini]

BUMP!!!!!!!!!!!!!

I can't believe this thread dropped all the way down to page 2 of "Active" Topics!

Meanwhile, back at the banana ranch . . . yo!!! dougg3!!!!!!

Have you considered a side by side comparison of ROM Dumps of the SE/30 <-> IIci <-> IIfx <-> IIsi in order to simplify your search methodology by eliminating repetitive/identical instruction sets and repetitive data sets?

With a comparative parser (?), you could identify blocks of instructions that are identical, even when stored at different address spaces on the four ROM samples.

Using a more complicated parser, you could identify blocks of instructions with a variable scale of change differential in similar blocks of instructions.
Kinda like running a PhotoShop Filter on sets/subsets of ROM instructions?

If this is a standard feature of de-compiling (?) software a/o S.O.P. for such processes, forgive my ignorance, but I just HAD to ask!

[dougg3]

Oh hi! I'm still here I just haven't had any reason to update while waiting for the PCBs to arrive.

Have you considered a side by side comparison of ROM Dumps of the SE/30 <-> IIci <-> IIfx <-> IIsi in order to simplify your search methodology by eliminating repetitive/identical instruction sets and repetitive data sets?

It really depends on what I'm looking for. If all I'm looking for is the startup chime, I already have ROM maps from Apple of several of the various II series (but not all! -- II, IIfx, IIci, IIsi, and IIvi) which will directly show me where the code is. But if we're looking to see just how similar two ROMs are, it would probably be awesome to have some kind of app that figured out the differences.

With a comparative parser (?), you could identify blocks of instructions that are identical, even when stored at different address spaces on the four ROM samples.

Using a more complicated parser, you could identify blocks of instructions with a variable scale of change differential in similar blocks of instructions.
Kinda like running a PhotoShop Filter on sets/subsets of ROM instructions?

If this is a standard feature of de-compiling (?) software a/o S.O.P. for such processes, forgive my ignorance, but I just HAD to ask!

I actually have no idea if this is a standard thing that reverse engineering types do. I would imagine it would be a very useful tool to have. To be completely useful, I'm thinking it would need to be integrated into a disassembler to help determine what's code and what's data -- this would probably help some kind of algorithm to know what chunks to compare between the two files. Also it would need to know to ignore jump/branch targets when comparing two chunks of code because as code is rearranged in the ROM the offsets to jump to would change. This is true even though the ROM is position-independent because the relative jump offset would still be different as code was moved around/inserted/deleted in ROM. Who knows--maybe IDA Pro already has something like that?

The most basic example would be a binary diff tool, but that would be very, very simple and probably wouldn't give much useful information -- for instance it doesn't know how to ignore jump targets. It would take quite a bit of effort, I'm guessing, to make a "ROM diff" utility as described above. It would probably be quicker just to manually inspect the ROMs but I do have to say it would still be useful, especially if you could just use it to play around and see how different the LC 520 ROM is from the LC III ROM for example. It's probably not something I have any time to work on though.

Anyway, it's great that you posted this "bump" today because...

The boards have arrived!

Top side

Bottom side

Unfortunately I have been battling a stomach bug of some kind all week (I won't go into any detail! haha) and it's still attacking me, so I'm not sure when I'll get around to assembling one to make sure they work. But at first glance, they look very nice! They also fit into the IIci's ROM SIMM slot great as far as I can tell.

Excellent turnaround time. Order was placed the night of 9/5/2011, I got the shipping notice 9/13/2011, and the package arrived 9/23/2011. Like most others whose reviews I read, I got 12 boards instead of 10 and they added a few numbers of their own to the silkscreen (I added my order number to the silkscreen too, because their instructions said to do that). They are actually about 50 mils thick instead of 47, but that's still perfect. I have to say I'm pretty darn impressed with Seeed Studio! Thanks again for letting me know about them, bigmessowires. Definitely awesome!

Anyway, once I'm feeling better I will start doing the fun stuff with these PCBs!

And then once it's all good, I'll get some skull versions of the board made! Haven't had any time to look at the LED stuff yet, but that can wait until I know that this board works.

[bigmessowires]

Woohoo!

[Trash80toHP_Mini]

Get well soon, feel better and then get to solderin' those beautiful lil' boards, comrade!

[dougg3]

Well, I've started feeling a lot better today, so naturally this afternoon I sat down and put one of them together. I ended up destroying the center plastic plate on the sockets so I could reach the pins. I also ended up having to cut off the alignment pegs from the bottom of the sockets because I accidentally ordered sockets that had alignment pegs!

Haven't tested it yet because I rinsed it off with water to clean off the flux and I'm going to let it dry for a while. I have done some continuity checking and everything seems to be connected right. Here's what it looks like (don't laugh too much at my surface mount soldering , especially on the back side...even those "big" 1206 capacitors are TINY!):

Top assembled

Bottom assembled

[bigmessowires]

I see solder bridges along the top row of pins on both IC2 and IC3. Should be easy to fix with some solder wick.

I'm looking forward to seeing this in action!

[dougg3]

Hey, thanks for pointing those out--I noticed those when I soldered, but those pins are connected together on the board anyway in order to pull the write enable pin high (the other pin is VCC), so I just left the bridges there. I forgot to mention that I think the solder bridged because there is a via between the pins.

[Trash80toHP_Mini]

Way cool!

Will these boards work as IIfx ROM SIMMs?

[bigmessowires]

Ah, that makes sense. Then you're almost ready to go!

Drumroll:

TATATATATATATATATATATATATATATATATATATATATATATATATA

TATATATATATATATATATATATATATATATATATATATATATATATATA

(waits expectantly)

[dougg3]

It should work in a IIfx as well as all the other II series that have a ROM SIMM socket, as well as the SE/30. The IIsi may have a slightly different pinout that I'll have to change in my future revision -- one of the address lines is marked as VCC in GTTMFH2E, but the IIsi devnote calls it another address line. I hooked it up as VCC on my pinout, but I should probably just leave it not connected instead.

I just tried my SIMM in my other IIci (which boots fine from the onboard ROM), and...nothing happened other than the fan spinning up.

The ROM SIMM jumper is removed, so that's not the problem. This is gonna be a very tough one to troubleshoot...I also removed all four of the chips and reseated them (eeek, those PLCC sockets are annoying, on-chip programming would be much nicer). It could be that I have them reversed, so I'll keep playing around with it.

Edit: Nope, not reversed either -- well, it doesn't work either way. So I guess the next step is to check the continuity of EVERY SINGLE PIN...gahhhhh

Edit2: I've checked the continuity of each pin to its corresponding SIMM contact, although I did not check for shorts on each pin. I also tried it in my hacked IIci with the same bad results. The possibilities I can think of:

• One or more of the chip contacts is not making contact with the socket properly (very likely, PLCC sockets are pretty flaky)
• Intermittent solder joint on one of the PLCC sockets' contacts
• I got one of the pins wrong on my layout so it's connected to the wrong pin on the chip
• Two of my pins are shorted together
• The IIci's pinout does not match what GttMFH2E says

[dougg3]

IT WORKS!!!!

I accidentally had D23 shorted to chip select (you can kind of see it in my picture on IC3, right side, two bottom pins). I cut the short out of there with an X-Acto knife, and shazam! It worked! (I also had the chips backwards )

I haven't yet had a chance to test the larger ROM capacity, but I was able to get my other IIci to boot with the custom chime.

The reasoning for the chips being backwards is that since the 680x0 is big-endian, the most significant byte out of each 4-byte word is the FIRST byte. This means that the very first byte in ROM is the most significant byte of the first 4-byte word, so it should be on D24 through D31. Seems kind of bass-ackwards, but it makes complete sense now that I think about it. So IC4 contains bytes 0, 4, 8, etc., IC3 contains bytes 1, 5, 9, etc., IC2 contains bytes 2, 6, 10, etc., and IC1 contains bytes 3, 7, 11, etc.

[olePigeon]

Woohoo!

[bigmessowires]

NICE!!! Congratulations!

How did you figure out the chips were byte-reversed? Just staring at the schematics again while looking for explanations? That could have taken a long time to realize, but you found it quickly.

Let the crazy ROM hacking begin!

[olePigeon]

Will the revision have the pirate?

[dougg3]

Thanks! I already had the hacking going before by socketing the DIPs, but now the REAL hacking can begin since it'll be WAY easier to change the ROMs without yanking out the hard drive and floppy drive, and it'll be way easier for everyone else to play around with the hacking too.

Speaking of others, I have 11 more boards here (with no jolly roger yet). Who all is interested in one? You'll still need an EEPROM burner to put programs on the chips until I can figure out how to make it fully programmable over USB or whatever -- or even a programmer board with a 64-pin SIMM socket would be great, but I can't find 64-pin SIMM sockets anywhere (plus I'd have to bring out the write enable line somehow). Once I get the jolly roger stuff finished I'll do a bigger order from Seeed (50 boards perhaps?).

But until then, is anybody interested in boards? I'd be happy to send out bare boards to anyone for $2.90 (1/12 of my PCB order cost) plus the cost of shipping Like I said, the SIMM should work in any of the II series Macs that have a ROM SIMM socket with the exception of the IIsi but that can be fixed by cutting a trace, and also the SE/30. That cost will go down once I order a bigger quantity. You can provide your own sockets, capacitors, EEPROMs, and soldering in that case.

For an assembled one, I'd be happy to solder sockets and capacitors onto the boards but I'll have to charge a small amount more than just the parts cost because my time is worth *something* You'll still need an EEPROM burner to flash the chips though. The sockets and capacitors cost about $4 in total to put on the board, the board is about $3, and I think it's fair to charge about $8 for my time, so I'm looking at $15 plus shipping for an assembled SIMM. Any objections? That doesn't count the EEPROMs which you can get yourself from Mouser or another distributor like that for about $2 a pop. You'll probably want a PLCC extractor tool too. Anyway, I will reserve a board for tt just in case because I know he was interested way back when...let me know for sure tt.

How did you figure out the chips were byte-reversed? Just staring at the schematics again while looking for explanations? That could have taken a long time to realize, but you found it quickly.

Well I knew it was either going to be 1-2-3-4 or 4-3-2-1, so I just tried both combinations after I fixed the short. I had already known about the interleaving going on when I was hacking with the DIPs, but I never paid attention to which data lines each chip was connected to. Then I wanted an explanation for why it was the way it was, so that's when I sat down and thought about it

Will the revision have the pirate?

The 12 boards I have now do not have the pirate, but the next PCBs I order from Seeed will. I'll probably go for the red silkscreen again too And those will also have the fix so they will work unmodified in the IIsi.