So how would one go about doing this?
Read here:
https://forums.macrumors.com/thread...l-work-in-a-beige-power-macintosh-g3.2303689/
Search for "rom dump". Look at #137 and #682.
You'll need telnet to capture that info.
Read the "Connecting to Open Firmware" section at
#1. Summary:
Boot the Cube into Mac OS X and write down its IP address from the Network preferences panel or
ifconfig command. For example, 192.168.0.121
Boot the Cube into Open Firmware. Set
io in Open Firmware to telnet using that IP address like this:
" enet:telnet,192.168.0.121" io
Use telnet on another computer to connect to the Cube.
#54. For example, in Terminal.app:
telnet 192.168.0.121
You may need an older Mac that has telnet, or you can install telnet from homebrew or whatever.
Capture some info from Open Firmware:
dev / ls unselect-dev " devalias" evaluate " printenv" evaluate dump-device-tree words
In that output, look at the boot-rom properties:
Code:
name boot-rom
reg fff00000 00100000
write-characteristic flash
model Apple PowerMac1,1 1.1f4 BootROM built on 04/09/99 at 13:57:32
BootROM-version 663400
BootROM-build-date 30342f30 392f3939 20617420 31333a35 373a3332 00
result 00000000
info fff00000 00004000 000111f4 19990409 c1a05781
fff08000 00078001 000111f4 19990409 04f7f36d
fff80000 00080002 000111f4 19990409 a70af36d
The
boot-rom device's
reg property has a physical address
fff00000 and a size
00100000 = 1MB. This is probably the same on all New World Macs.
See "Dumping the New World Rom.txt" in the attachment at
#137 . Also see
#682 .
Check the list of memory translations.
For a 64-bit CPU (Power Mac G5):
Code:
dev /cpus/@0
cr " translations" active-package get-package-property 0= if bounds do i @ u. i 4+ @ u. i 8 + @ u. i c + @ u. i 10 + @ u. cr 14 +loop then
For a 32-bit CPU:
Code:
dev /cpus/@0
cr " translations" active-package get-package-property 0= if bounds do i @ u. i 4+ @ u. i 8 + @ u. i c + @ u. i cr 10 +loop then
Find a range that is not in the list of translations and map the physical address range of the boot-rom to that range. For example, 1MB at virtual address 40000000 is probably available, so we can use that for mapping the ROM:
fff00000 40000000 100000 28 do-map
28 is two flags: Cache-Inhibited & Guarded, whatever that means (check the PPC manual). It's the same flags used by most of the translations so we'll go with that.
Once the ROM is mapped into the virtual memory, you can dump the contents. First, create a word that can dump the contents.
: dumpbytes bounds ?do i 3f and 0= if cr then i c@ 2 u.r loop cr ;
The
dumpbytes word will be slightly faster than the built-in
dump word since it won't output address or text with the hex bytes.
Save everything to a text file, zip the txt file, and post it. I will then convert the hex to PPC assembly and fcode and Forth. Then we can see what it's doing or not doing for audio related devices.
