Gordon JC Pearce
gordonjcp at gjcp.net
Sun Feb 10 16:08:07 CST 2008
On Sun, 2008-02-10 at 18:51 +0000, Tony Duell wrote:
> > Basically I'm trying to reverse-engineer the firmware of a couple of
> > late-80s Alesis HR-16 and HR-16B drum machines. They use a 32kx8 EPROM
> > for the firmware, a pair of 512kx8 ROMs for the sampled sounds, a big
> > custom ASIC for the sample playback and an 80C31 for the clever stuff.
> I assume the ROM address latch is hidden in that ASIC, and isn't a
> seprate '373 or '572 chip If it was, it would be trivial to trace out the
No, the ASIC is *only* for playing back samples. The address latch is a
> address bit order, of course. Do the ROM data pins connect straight to
> the 8031 (without going through the ASIC). At least you could make sure
> the data bits are in the expected order.
The OS ROM connects up as you'd expect. AD0-AD7 through the latch,
> What aobut using a logic analyser, connected to the EPROM? You could
> capture the first few instructions and the addresses _at the ROM pins_.
> You can spot jumps, etc and thus work out what the addresses _should_ be
> and thus work out which bit ends up on which EPROM pin.
Actually, just looking at the PDFs of the datasheets and the physical
layout on the board provided the clue I needed. I didn't even need to
put the new battery I just bought in the meter ;-)
I've sussed out what's going on, and written a wee proggy to unscramble
the ROM images. Took about five minutes once I'd figured out how it was
More information about the cctech