Mitsubishi MELPS 7700 Reverse Engineering

[needinput]

Hi all, this is my first post; figured I'd post in the Newbie part of the forum

I am working on reverse engineering an early 90s automotive application where it featured a Mitsubishi/Renesas M37700 series MCU.
This falls formally under their MELPS 7700 product line (16-bit). I believe the M377XX utilizes a WDC 65C816 hard core with some minor adaptations to the ISA.

Has anyone here worked with these or have knowledge they can forward? I was able to find the software programming guide from bitsavers for the 7700 series.
Part of the struggle is finding the C compiler, assembler, and compatible disassembler etc. Renesas no longer houses these technical resources for the 7700 or 740 series on their website.

I would like to get to a point where I can begin disassembling and reverse engineering the firmware within the mask ROM of the MCU.

From what I understand the microcontroller has four modes of operations. Single-chip mode, expanded memory mode, microprocessor mode, and evaluation mode. The modes can be set via a software register and/or physically externally upon reset. From what I understand some group from Japan was able to dump the internal ROM memory of a mask rom variant by engaging these modes, so at least I know it can be done. Unfortunately when reaching out to the group, they were unable to recall and the work was long gone.

[cjs]

needinput wrote:

From what I understand the microcontroller has four modes of operations. Single-chip mode, expanded memory mode, microprocessor mode, and evaluation mode. The modes can be set via a software register and/or physically externally upon reset.

Unfortunately I don't have any pointers to docs for this particular chip, but I would not be surprised if they'd followed the lead taken by Motorola in their "single-chip microcomputer" or "MCU" (their term for what we now call "microcontrollers") implementations of their 6800 architecture. The MC6801/6803 datasheet, starting at page 3-48 (physical page 106 in the PDF download), describes the operating modes. Essentially, the various modes allocate different numbers of the IO pins for address and data bus purposes to allow varying amounts of external memory, different mappings of internal vs. external memory, and whether the reset vector comes from an internal or external source. If you're not already aware of this, it will probably be useful background information, and perhaps help with reverse-engineering the way this was implemented in the M37700.

In particular, Figure 16 from that document gives a schematic for a typical external mode selection circuit, so you could look for something like this on your board. If you find something similar, you might try tweaking the pull-ups/downs while monitoring the initial startup cycles with a logic analyzer to work out the startup modes. If you can get a few cycles of NOP executing from external data bus pull-ups/downs, you're probably well on your way to hacking the chip.

If you come across Japanese documentation that you want help with, feel free to post links to it here. I am in no way, shape or form fluent in Japanese, but I have plenty of experience struggling through Japanese documentation for 8-bit computers with the help of dictionaries and my little vocabulary list.

(In fact, posting here links to any existing documentation you know of, whether in Japanese or not, will help people help you.)

[BigEd]

Welcome, needinput!

Is this previous thread any use to you?