I've just dumped the ROM of a Vtech toy laptop, the Ordi Genius Kid. The machine itself has a variety of semi-educational games and a little dot-matrix LCD screen, with lots of sampled sound, speech, and polyphonic music. The ROM is a 2MB serial flash job.

After much work with cpu_rec I have discovered that the ROM seems to contain 6502 code! Sort of. Here's a fragment:



It's probably one of the GeneralPlus 6502-based LCD controller parts, but the ones I've found datasheets for don't describe all those extended instructions. $0c looks like a prefix byte, maybe to do with overriding the current memory bank, but the strings starting with $80 could be anything. Has anyone seen anything like this? Running my own code on it would be fascinating, if completely pointless!

I haven't seen this before - I too would guess a SunPlus/GeneralPlus product but only as a guess.

That tax tay sequence shows, I think, that the $80 $03 are to be followed by a pair of bytes. That is, it's not a TAX but an $AA.

It would be interesting to try to figure out these special cases by understanding the whole thing.

It would also be interesting to see a transcript of your cpu_rec session, I think. Especially in verbose mode. (A tool I haven't come across before.)

Have you seen py8dis? That might be helpful, in a modified form.

An enjoyable and engaging puzzle!

How confident are you that you've parsed the bytes correctly (in order to determine where the instruction boundaries lie)? I'm not challenging you; just pointing out that it would be easy to go awry, based on the fact that you have some unknown instructions. The length of such an instruction is also unknown, which means you can't reliably disassemble the bytes that follow it -- or at least that's my initial take on the situation.

Starting from the reset vector I'd say you *can* reliably disassemble, but only up to the point where the first unknown instruction occurs -- then everything after that forces you to rely on your assumptions. Let me know if I'm missing something.

I suppose it could be a prefix, but I have doubts about it overriding the current memory bank. Didn't you say the ROM was serial? That's a whole different addressing regimen, and it seems to me the need for banking would be absent.

-- Jeff

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

All I know is that the disassembly produces sensible-looking code. You can see from the fragment I posted that it's divided fairly neatly into routines. I haven't figured out the load address yet --- I have found two different string tables which are consistent with themselves (tables of pointers pointing at strings) but not with each other, which suggests two different load addresses?

Regarding serial flash: some microcontrollers will map SPI serial flash to address space. It's slow, but if you run the flash at 100MHz and the CPU at 8MHz or so it's manageable and drastically reduces the footprint --- you only need four lines to the CPU instead of 25 or so, which simplifies the board design. I doubt this device is loading chunks of SPI flash into RAM as RAM is expensive, but I've met GeneralPlus 8051 controllers which appear to do exactly that, so I'm not ruling anything out yet.

Regarding cpu_rec: I actually used the binwalk plugin for this, as raw cpu_rec got rather confused, presumably by the large amounts of encoded audio in the ROM image. It said this. The block quoted above is from the beginning of the block at 0x2800.

Maybe try running it through a 'c02 disassembler? It looks a lot like 65c02 machine language to me. The $80 $03 is BRA *+3, the $0C $D9 $06 $60 is TSB $06D9 : RTS, and the $7C $7F $A8 is JMP ($A87F,X) ... maybe ...

_________________
Got a kilobyte lying fallow in your 65xx's memory map? Sprinkle some VTL02C on it and see how it grows on you!

Mike B. (about me) (learning how to github)

facepalm

Yes, it definitely looks like a 65c02. Here's the disassembly (different disassembler, different base address). It looks like it makes sense; I fed it all to ghidra, managed to identify a load address, and it looks like this. There's a weird JSR/BRA/JMP(abs),X construct which looks like a subroutine call to a code offset in X. Maybe a system call handler of some kind?

Oh, nice!

That's a work-around to cover the 65c02's lack of a JSR (abs,X) instruction. Old-school '02 coders typically utilize a different route entirely, but it's an effective kludge.

_________________
Got a kilobyte lying fallow in your 65xx's memory map? Sprinkle some VTL02C on it and see how it grows on you!

Mike B. (about me) (learning how to github)

Quick update! I've discovered several interesting things.

(a) I've managed to positively identify the address of a few routines, based on references to tables. That JSR/BRA/JMP sequence is really handy, too, as the JSR $+2 is very easy to identify.
(b) I discovered that my ROM dump was missing bytes every so often, which was incredibly confusing. I repeated it until I got a consistent result and now it makes more sense.
(c) Hooking up a signal analyser and watching how the device accesses the SPI flash shows that it reads one byte at a time, following the execution path. When it hits a BEQ it reads one byte after the branch and then starts reading bytes from the address jumped to. This is excellent news, as it means that it's mapped the SPI flash into the 6502's address space and is making SPI reads for every memory access.
(d) The very first thing it does is to read the address 0xc951 from the flash. Then it starts execution of code at what I determined to be address 0xc951. This is in the flash at offset 0x14951. This suggests a simple mapping of flash offset to address. Lots of code starts happening in the ROM at 0x12000, which would correspond to 0xa000... and yup, that all works perfectly!

So I'm going to guess that this device has a SPI flash bridge (I've seen references to a SPI SRAM bridge in some GeneralPlus devices, and flash is the same protocol). That means that it's capable of memory mapping the 2MB SPI flash. It has to be banked. There's also going to be a mask ROM internal to the blob on the PCB, and that'll be banked somewhere else. The next obvious chunk of ROM is at 0x18000, which suggests a 24kB window. I can see subroutine calls to routines from 0x2000-0x7000ish so I reckon that's where the mask ROM window is. RAM is below that. I would actually have expected the ROM to be mapped up high where the exception vectors are, but whatever.

This means that it's wide open for exploiting! All I need to do is write code to the flash in the right place, and the mask ROM will happily run it. Of course, until I can identify a way to get data out there's not a lot I can do with that, but this machine has loads of GPIOs for running the keyboard.

The ROM is full of jump tables, which ghidra hates.

...I've figured out why it's going to 0xc951 on startup --- there's a system call table at the bottom of the flash with addresses and memory banks in it, so system call 12 pages in bank 0x82 and jumps to 0xc951. That let me fabricate my own flash image which on startup jumps to 0xa000 and just spins in an infinite loop; the device actually runs this, at least until the watchdog timer kills it, and I can see it happen with the logic analyser. The screen seems to have startup up, too. Tomorrow's job is to write to video memory and see what comes out.

Sounds like you're having fun!

Care to share a photo or two of this toy laptop?

-- Jeff

_________________
In 1988 my 65C02 got six new registers and 44 new full-speed instructions!
https://laughtonelectronics.com/Arcana/ ... mmary.html

Currently it's in pieces and probably can't be reassembled again due to having had to solder a socket onto where the eight-pin flash chip was, but it's one of these:



Yes, that's an ortho alphabetic keyboard. It's about as bad as you'd expect. Shockingly the dpad is surprisingly decent. I managed to damage the paper LCD ribbon cable so one column of pixels doesn't work any more, but it's not like this thing is worth anything. I think the English equivalent is the My Zone.

There are some similar toy laptops with full qwerty keyboards; I'll see if I can get my hands on one...