• Updated 2023-07-12: Hello, Guest! Welcome back, and be sure to check out this follow-up post about our outage a week or so ago.

PEx ROM Project

bbraun

Well-known member
I've fixed the permissions, sorry about that.

I've also included a 32bit Ubuntu binary and a 64bit SnowLeopard (OSX 10.6) binary of the program. If you've got another system, you'll need gcc or some other compiler to build the binary, but once built you won't need gcc to run it. If you're on a unix-like system, that should be pretty easy although the process varies by system. If you're on Windows, I can't really help you much.

 

dougg3

Well-known member
Nevermind my question earlier. I did some Googling and I think I'm caught up now. This is exciting, and I hope it works!

Edit (response to jt below): yep, found them all!

 
Last edited by a moderator:

trag

Well-known member
Thank you, again, bbraun. I really appreciate it.

I'll need to look into installing gcc on a local machine. I do not have any machines that can run 10.6 -- no Intel Macs yet. And my partner's MDD (Tiger) is down at the moment. It's hard drive gave its final gasp last week. Would you be willing to run the software for me two more times? I think two more de-interleavings and this project will be all but finished.

I didn't have any time this weekend to work on it, unfortunately.

Anyway, here's my plan based on what we learned last week:

1) I'll upload the files for the Beige G3, just like for the 9600. So I'll upload the four files for the ROM chips I've read from the Beige G3. And I'll make a CopyROM dump of the Beige G3 and upload that. Then compare the files and, I hope, find that they have the same relationship to each other found for the 9600.

2) If the Beige G3 follows the same pattern, then it would be very strange if the PEx does not as well. So, deinterleave the PEx extraction(s) that we have, and burn the resulting files to chips and mount them on a ROM module.

 

trag

Well-known member
Last night I uploaded the Beige ROM chip contents to:

http://www.prismnet.com/~trag/Firmware/Beige/

The files Beige_C_U1.bin, Beige_C_U2.bin, Beige_C_U3.bin, and Beige_C_U4.bin are the files for the chips.

I also made four dumps of my Beige G3 and put them in that folder, but none of them match each other, and for reasons explained below, I believe that all four of them are garbage.

I pulled some code out of the chip files at address (you need a hex editor to see what I'm discussing here) 0x0000 0310:

U1:

..OY. . P"uN.d.ker..mHp.. C./

U3:

sn./@ .gR ......ne.. . Q .../

U2:

dr . ) . oSDECB....n U$ A #./

U4:

.f."" . .NnusicS....mHjH. #

Interleaving it by taking two bytes at a time from each chip, and reversing the order of those two bytes (characters), yields the following:

..nsrdf.YO/. ". . @ . . .g. ) ."P R .N.Nu..Sound...EDisk...BCScreen............Hm nHm.p .$UHj . QA .C ..# # /./././<

Which is not to be found anywhere in the extracts I made, but it is found starting at address 0x0C40 (0x0310 X 4) in the extract at the Mac ROM archive.

There's another big useful chunk of text at 0x1ACB in the Beige extract and it corresponds with text found in the chip files a little before 0x06B0, although I haven't done a full decode to be absolutely certain.

So, this suggests that the interleave/deinterleave method is the same for the Beige G3 as for the 9600, which is promising when it comes to deinterleaving the PEx extract.

Now, on to the PEx extracts. I have various ones on hand. I'll try to get those uploaded soon. The question will be how do they differ, and which one do I use? There are 3 MB and 4 MB versions, and I hope that all the 3 MB versions are identical to each other and all the 4 MB versions are identical to each other. That would simplify matters to choosing between those two, or using them both and seeing which one works.

 

bbraun

Well-known member
FWIW, I ran the deinterleaver on the Beige_from_archive.ROM and this is what I got, for comparison. Looks the same as the 9600.

Code:
6dda0485f44f7f6f95359c8f9589a498  Beige_C_U1.bin
3ace31899d7eda8dc8db8d22630384ec  Beige_C_U2.bin
7d98cb7730188ccb1950f2b0ac0ddf7a  Beige_C_U3.bin
41f300d0f7c7ac6b635eb68e55835c37  Beige_C_U4.bin
6dda0485f44f7f6f95359c8f9589a498  beige_deinterleaved_U1.bin
7d98cb7730188ccb1950f2b0ac0ddf7a  beige_deinterleaved_U2.bin
3ace31899d7eda8dc8db8d22630384ec  beige_deinterleaved_U3.bin
41f300d0f7c7ac6b635eb68e55835c37  beige_deinterleaved_U4.bin
 

trag

Well-known member
Okay, I put a bunch of PEx extractions into:

http://www.prismnet.com/~trag/Firmware/PEx/

I ran a Hex Compare of the files and all the 3MB files are identical, including the one from the ROM archive which they called a bad dump.

The 4MB files are identical to each other, and they are identical to the 3MB files through the first 3MB. In other words, the 4MB files have extra stuff at the end.

The 4MB files are the ROM_grabber... files. Everything else is 3MB.

So, which do I use?

If I make a ROM with the 3MB files, the upper 1MB is going to be blank, or unprogrammed. I may as well use the 4MB files. I can't see where loading that upper 1MB with garbage would be worse than leaving it blank.

 

Trash80toHP_Mini

NIGHT STALKER
As my Pex Board lacks the Video Subsystem, that PLCC ROM pair in it probably matches up with the smaller of the ROM SIMM versions . . .

. . . in the case that it matches either of the two versions. :-/

Does James have a fully populated revision of the PEx ProtoBoard?

Where, oh where, are you Captain Z? :?:

trag, do you know how hawaaiicruiser's 'fritter PEx Boot Campaign turned out?

 

trag

Well-known member
FWIW, I ran the deinterleaver on the Beige_from_archive.ROM and this is what I got, for comparison. Looks the same as the 9600.
Excellent. Thank you! That was fast work. I was going to PM you, but no need.

Would you please run it one more time, on one of the get_ROM_pex_0[n] files located here:

http://www.prismnet.com/~trag/Firmware/PEx/

And would you please put the resulting files where I can download them? That should complete the decoding portion of this project and all that will remain is to put the code onto modules and see if it works.

I also ran a hex compare of the PEx and Beige files, but the utility I used is pretty bad (and they want $15 for it in 29 days). The code is very similar up to a point and then one gets offset from the other by about ten bytes (or maybe 26) and then the compare utility claims that they're different, but eyeballing it, it's still mostly the same code, just offset by a some bytes.

 

trag

Well-known member
JT are you saying you're lacking the two PLCC flash chips as well as the firmware/ROM module?

James sent me copies of the PLCC chip contents, so I could probably whip up a pair of those. He's labeled them odd and even, so we'll need to figure out which goes in what socket. If he doesn't comment here, I'll email him.

James has a board with the PLCC sockets filled, but lacking the ROM module. He was able to borrow a ROM module long enough to make the PEx extractions which I've put up.

I think I read the Fritter thread(s) but it was so long ago I don't remember any details.

 

Trash80toHP_Mini

NIGHT STALKER
NoPro, James an I are in the same boat. I HAVE the PLCC Flash ROMs, my PEx makes the startup chime and then does nothing every time I try it. Every year or so I power it up and listen to the startup chime a few times just to remind myself that I have a "RARE!!!!!!!!!!" Apple Prototype. [;)] ]'>

I do the same kind of thing with my Paladin Keyboard/TrackBall Prototype too . . . but it works! :lol:

It's my Video Chipset pads that are unpopulated, have you got a pic of James' MoBo?

 

trag

Well-known member
It's my Video Chipset pads that are unpopulated, have you got a pic of James' MoBo?
I don't think so. Do you want me to email him and ask about it? If Apple used custom chips for the video, you're probably out of luck. If they did something like they did on the Beige and just put a Rage mumble hooked up directly to the PCI bus, then you may be able to steal the needed chips from a video card.

 

Trash80toHP_Mini

NIGHT STALKER
PCI is plenty good enough for me, though completing the board and having it functional would be an uber :cool: achievement!

If it's as simple as that, one wonders if there's a pad compatible VidChipSet upgrade available? [}:)] ]'>

email away, thx! [:D] ]'>

 

trag

Well-known member
I just finished a big verification project at work and was taking a few minutes break and I found this line at address 0x002A C9c0 in the PEx ROM file:

002a:c9c0 vent Match - Native..Edisk.secret ROM image.The Teamkckckckckckc

Makes me wonder if there's one of those hidden photos of the PEx team in there.

I was actually searching on "875" at the time. The SCSI chip on the PEx is the 53C875. I think that's also the one use in the ANS, although I need to double check that.

It stands to reason that the PEx has a Mac OS driver for the 53C875 embedded in its ROM. If we could extract that and add it to the 9600 ROM, and fix the interrupt arrangement, then the ANS could run Mac OS and have support for its built-in ROM chips.

 

Dennis Nedry

Well-known member
I just finished a big verification project at work and was taking a few minutes break and I found this line at address 0x002A C9c0 in the PEx ROM file:
002a:c9c0 vent Match - Native..Edisk.secret ROM image.The Teamkckckckckckc

Makes me wonder if there's one of those hidden photos of the PEx team in there.
I found a JPEG header at address 0x2D14E0 by searching for "JFIF". I don't know much about JPEG so I used a program that finds and extracts JPEG images. The bottom half of the image is missing, maybe someone can tweak it and get the rest.

output00000.jpg

 

Trash80toHP_Mini

NIGHT STALKER
Very cool, Dennis.

Methinks it's time to fire up my board just to listen to the startup chimes for last year, missed it, already played with the Paladin KBD this spring. [:eek:)] ]'>

 

Dennis Nedry

Well-known member
I figured it out! I didn't know where to find the end of the image data before, but after a little googling, I realized that they end with 0xFFD9. There happens to be an extra 0xFFD9 in the image data before the end and I think that could be what caught up the JPEG extraction program.

image.jpg

 

Dennis Nedry

Well-known member
How did PEX machines make it out of Apple? There seems to be a fair number of them out there. Were they actually released or given permission in some way or were they potentially stolen/leaked? Or something in between? It's one thing to poke around at things actually released form Apple but I would not want to continue to have anything to do with items or data that we're not supposed to have, especially in a public fashion here at 68kmla.

If we aren't sure, we should consider removing the images I posted here ASAP.

 

Trash80toHP_Mini

NIGHT STALKER
The PEx systems that made it out of the Insidious Loop were probably seed units for developers or units that snuck home under The Man's nose after he canned the program (whoever The Man was at the time) in employees' car trunks, briefcases, etc.

I can't imagine the images and sounds garnered from ancient crown jewels should be a big deal . . .

. . . if it is we can always put the thread in the tank.

Great job!

 
Top