Hi all,

I’m trying to access the Furby’s 80 K ROM onboard the SPC81A. I’m utilizing an Arduino Nano in this process. A rough pinout of the Furby’s SPC81A daughter board can be found here. Note the memory map on page 5.

As stated elsewhere, the SPC81A is a RISC 6502. It contains a little less than half of the opcodes found on an actual 6502, although I am unsure which ones are omitted. The datasheet for the SPC81A can be found here.

The SPC81A daughter board has 25 pins. My implementation uses pins 14 (Serial Data In), 17 (Serial Data Out), and 18 (Serial Clock). I’m assuming I can send commands to the processor through these ports, but I really have no idea of knowing.

Here is an outline of how I’d like to retrieve the contents of the 80k ROM:

1) Send command $4C (JMP) to set the address to $00000
2) Load contents of address to the accumulator using $A9 (LDA)
3) Send contents of the accumulator to the serial line
4) Output to Arduino serial monitor
5) Increment address by 1
6) Repeat until address $17FFF is reached

Note that between each bit, the clock will go high or low. (bit 1, send clock high, bit 2, send clock low, bit 3, send clock high, etc)

I’ve never messed with a 6502 before, so any advice here would be welcome.

Welcome!



Hmm, well it's just possible the Furby firmware accepts commands over serial, but I don't think it would be likely. The 6502 inside will, I would think, boot from a ROM image that's on chip. If that code reads from the serial port, it would probably be reading data, not code. Possible there's a debug interface and there are commands it will accept.

But, dig in and see what you can find out! You might want to start by seeing if there's any activity on the serial out and the clock line.

Edit: oops, I completely missed that there are more pages to the schematics. So, we have two complex chips, both describes as CPUs, connected by a synchronous serial link. Also on that link is a 128 byte EEPROM. It must be worthwhile to capture some traffic from that link. But I'm still not sure I'd expect any code to be going across there.

I did that not long ago. I desoldered an EEPROM chip from the main board and dumped its contents. Not much to see since the Furby had been reset and lost its state. I think the EEPROM is where the Furby's various states are kept, and it is what tells the other parts of the Furby to start using less Furbish.

Another option might be to attach wires to the Furby's serial connections and watch activity on the Arduino's serial monitor.

I suppose if I could find the code for the SPC81A's test program, I could confirm whether or not any ROM I read from the Furby would be correct. Or if I could match anything with a data capture from serial monitor, that would work.

My end goal is kinda open at this point, but one thing I'd like to do is create a custom processor board that serves the same purpose, but with my own code in the ROM. I suppose I could use a microcontroller for that, but doing so would take out the fun of using a 6502 or similar.

I think what I really would like to know is what opcodes to call for what I outlined in my first post. Assuming I can actually get what I want through the serial lines, how should it be done?

See if the links in the topic "Furby 1998 source code" help. It looks like a good possibility. The first I heard about Furby was in a video of a presentation given by a young woman at a conference after she had figured out what the processor was, and I think she managed to download and examine the code as well. Unfortunately I can't find that video right now. [Edit: Never mind. That was Tamagochi, not Furby.]

kubba, what instructions to use to read the code out will depend on several things like what instructions are available (since we already know many of the normal 6502 instructions were not included but we don't know which ones yet), and whether there's some kind of monitor already. You suggested JMP 0000; but JMP is to pick up execution at that address, not read it like data. Assuming the processor uses zero page (ie, addresses 0000-00FF) the same way a 6502 does, there will be data there but probably no executable instructions, unless there is a way to put a routine there and then run it.

_________________
http://WilsonMinesCo.com/ lots of 6502 resources
The "second front page" is http://wilsonminesco.com/links.html .
What's an additional VIA among friends, anyhow?

You know, I have the source code pdf bookmarked and still never thought to use it for this project. That might be the best place to start. That way, I can see what opcodes are available by simply checking which ones are used.