Quadra 950 ROM Hack

[BadGoldEagle]

Hi there,

Inspired by aapl2c's mishaps with their Quadra 700, I decided to check out which modifications bbraun made to the Q700/900+PB140/170 ROM. He wrote a great article about his IIsi ROM Hack and I wanted to do the same to the 950 ROM. He already made the necessary changes to the 900 ROM (available here), but the 950 uses a different one, and there seems to be a lot of differences between the two. Although the ROM changes weren't documented in the 950 Developer note, I guess this has to do with the Gestalt-ID and the better onboard video, among other things.

I'm having trouble identifying the memory test functions. In the IIsi ROM they're located at 0x467E0 and 0x468F8. I've got hexfiend loaded up but how does one decode the hex values in instructions. Which manual do I need?

Also 0x467E0 and 0x468F8 seem to point to 4CFA 003F, but there are more than two instances of 4CFA 003F in the file...

Files:
- IIsi Stock: 36B7FB6C - Mac IIsi.ROM
- IIsi No RAM check: iisi+nomem1.bin and iisi+nomem2.bin
- 900 Stock: 420DBFF3 - Quadra 700&900 & PB140&170.ROM
- 900 No RAM check: Quadra-900-mod.rom
- 950 Stock: 3DC27823 - Quadra 950.ROM

Any help appreciated!

 

[cy384]

You need a disassembler to turn the hex into instructions, but the problem is that the hex may be either data or instruction, so it needs a lot of manual work to disassemble a whole ROM into something fully useful.

based on this, one can search for "7000 72FF 2448" and replace the "7000" with "4ED6" for the first memory test

Then you also need to edit the checksum or remove the ROM check. I've been messing with the Wombat ROMs, so I have a script that can calculate and update checksums. Doing the one change described above and making a new checksum results in the file I've attached. Will this actually work or even boot? No idea!

 

[BadGoldEagle]

Awesome, great work! Can't tell if the RAM check is still there or not but the ROM works with Basilisk II at least. I need to test on the real thing once I get it up and running again and also get myself one of these: https://www.ebay.com/itm/401442364985?hash=item5d77d45e39:g:k8AAAOSw9OFZGMNg

Thanks!!

 

[cy384]

Awesome, great work! Can't tell if the RAM check is still there or not but the ROM works with Basilisk II at least. I need to test on the real thing once I get it up and running again and also get myself one of these: https://www.ebay.com/itm/401442364985?hash=item5d77d45e39:g:k8AAAOSw9OFZGMNg

Thanks!!

do you have a programmer? I've been trying to figure out the most convenient setup for experimenting, but I haven't seen anything great yet.

 

[trag]

do you have a programmer? I've been trying to figure out the most convenient setup for experimenting, but I haven't seen anything great yet.

Not the person you were asking, but thought I'd chime in on the TL866II+

Once one has the software installed, operation is pretty simple. It has nice illustrations that show which adapters to use after you tell it which chip you're going to program, but....

When you choose your device (pick a chip) it doesn't give you the socket configuration information. One must choose an operation, such as Read Device, before it will actually show you the socket illustration. Perhaps a minor thing, but it annoyed me.

Also, the software has no built-in provision to deinterleave programming files. It is not uncommon to have a complete ROM/firmware/bin file which is meant to be 32 bits or 64 bits wide and needs to be spread (deinterleaved) over multiple Flash chips.

The software for my 20+ year-old EMP-30 has an option to load a file to the buffer and then tell the programmer, okay, a word is this many bits (typically 8 or 16) so take the first word and every fourth one thereafter and put it on this chip. Or take the third word and every fourth one counting from there and put it on this other chip. Etc.

One can write a fairly simple routine to deinterleave one's ROM files into multiple .bin files to be programmed, but it's additional steps. I liked having a programmer that handled it for me. I wish the TL866II+ did. It seems like it would be a fairly simple feature to implement.

 

[BadGoldEagle]

Alternatively, if you can find a 64 pin socket, you should be able to build your own SIMM-Programmer: https://code.google.com/archive/p/mac-rom-simm-programmer/

 

[trag]

Thousands of 64 pin SIMM sockets available at The Connector People.

https://www.connectorpeople.com/Connector/TYCO-AMP-TE_CONNECTIVITY/8/822019-2