Leibniz icon indicating copy to clipboard operation
Leibniz copied to clipboard

Extracting other potential ROM images

Open splorp opened this issue 9 years ago • 64 comments

The ROM images from the following devices still need to be extracted for use with Leibniz:

  • Japanese Bunn Warmer Prototype (J-1b1.00)

splorp avatar Apr 17 '16 19:04 splorp

I've created a fork of NewTen which is able to download ROMs from 1.x devices using the "serial debugger easter egg", and 2.x devices using Hammer's "Debugger Connection" package.

https://github.com/pablomarx/NewTen

I've provided @splorp with a precompiled binary of this.

pablomarx avatar Apr 17 '16 20:04 pablomarx

I'd also like to see:

  • Siemens NotePhone
  • MP120 v2.0 (I've dumped v1.3)
  • Cadillac ROM card (e.g. Russ Uzes' "EVTIC Diags 3/26/93 3:05pm", which I believe @splorp possesses).
  • Does anything exist for the Bic? I know Jim Abeles' BIC came with a ROMulator, which probably connected to the red universal Newton NuBus boards. Were there standalone ROM cards for it?
  • Andrei Chichak's collection of Egger ROMs :)

pablomarx avatar Apr 17 '16 20:04 pablomarx

And RE: Cadillac dumping, I realize it's a bit tricky. I see a few options (ranked from easiest to hardest):

  1. If it has a "memory dump and edit" screen, ala the OMP Diagnostics, I could possibly pull off a stunt similar to how I dumped the OMPs initially.
  2. If one were willing to open the case of the card, then we could hopefully identify the ROM chips and trace them to the card connector edge. With that identified, we could then wire up an edge connector into a Teensy/whatever, plug the card in, and dump the ROM.
  3. Make a long PCB that plugs into the Newton, the card plugs into the PCB. Then sniff all of the pins and try to identify them (address, data, vss, vdd, etc).

pablomarx avatar Apr 17 '16 20:04 pablomarx

Besides the Japanese Bunn Warmer, I also have the following devices:

splorp avatar Apr 17 '16 20:04 splorp

@splorp Is your Bic from the Huston brothers? I think Jim Abeles got his (for a song) from a gent in Atlanta, whom I got my ARMistice and ARMageddon from.

pablomarx avatar Apr 17 '16 21:04 pablomarx

@splorp Don't you have a Batman OMP? Does it boot? Oddball OS version?

pablomarx avatar Apr 17 '16 21:04 pablomarx

@pablomarx Yes, the Bic is from the Hustons. The Cadillac is from Russ Uzes. I haven’t tried booting the Batmobile in some time … I can’t recall if it worked or what the OS version was. I’m putting a bunch of new items on my to-do list.

splorp avatar Apr 17 '16 23:04 splorp

Nudging @splorp on this. The 9 ROM images I've dumped are now running well. Need more ROMs for testing (and obviously archiving) :)

pablomarx avatar Feb 14 '17 04:02 pablomarx

Oh, thanks for the reminder.

splorp avatar Feb 14 '17 07:02 splorp

Probably should add the Digital Ocean and Harris ROMs to the list – I think these were all Lindy devices, no?

pablomarx avatar Feb 14 '17 07:02 pablomarx

Yes, the Digital Ocean Tarpon was an updated version of the Harris SuperTech 2000. Both were based on the MessagePad 130. The earlier Digital Ocean Seahorse was based on what I believe was the MP110.

splorp avatar Feb 15 '17 00:02 splorp

Sorry for the delay, Steve … I’ve been away on vacation for the past week.

Following up on the ROM dumping process, is the easiest way to do this to connect via serial using your hacked version of NewTen?

splorp avatar Feb 26 '17 21:02 splorp

@splorp No worries. For ROM dumping on 1.x devices, my fork of NewTen is the only method available (that I'm aware of). It's a little on the "glacially slow" side. IIRC, it took ~ 40 minutes to dump a ROM.

It may not work with the NotePad. If not, let me know and I'll see if I can cook something up. (It won't work on mine, the OS build is too early and doesn't have "Serial Debugger" code).

I realize that'll take something like 72 years to dump all of your Newtons, so if I had to help narrow that down, perhaps the rare ones first? e.g. Japanese prototype, NotePad, etc.

Unless the Bic/Cadillac run a proper NewtonOS, this method won't work for them. I am in the process of making a PCMCIA card snooper for this exact reason (e.g. to dump the diagnostics ROM card for the Cadillac)

Perhaps others can help out with the less rare (NotePhone, Digital Ocean, etc). Or I can add them to my collection the next time one becomes available.

pablomarx avatar Feb 26 '17 21:02 pablomarx

@splorp Is your Bic operational? I was always under the impression that it'd need either a ROM card (ala the Cadillac), or a ROMulator + Universal Newton Adapter NuBus card (small ones, often red) + Egger + appropriate ROM images on the Mac.

(IIRC, the Huston auction was for just the Bic itself, no other accessories...)

pablomarx avatar Feb 26 '17 22:02 pablomarx

@splorp I should add that the NewTen fork uses the built in "Serial Debugging" stuff in the Newton ROMs. All it does is send a "read memory X" request, gets back a 32-bit value, adds 4 to X, and loops until X is 4,194,304 (e.g. 4MB). This should be completely benign, and it was fine on the 7 devices I ran it on.

However I just added a "integrity check" to NewTen, and updated the download link.

Before it starts the ROM dumping, it reads 3 memory locations to determine the manufacturer, hardware type, OS version. With the integrity check, If the "gROMManufacturer" bit or "gHardwareType" bits return something unexpected, it'll stop, present you with a dialog alerting you to this. You can chose to continue dumping, or to stop at this point.

This is to deal with a hypothetical that I sincerely doubt will happen, but better to be safe than sorry...

Imagine some prototype has the serial debugger with a bad bug, that ends up treating a read memory request as a erase memory request, and this prototype also has EEPROM. Prior to the introduction of the integrity check, NewTen would've erased a significant amount of the EEPROM contents.

With the integrity check, it would at most erase two words of ROM (Manufacturer and Hardware Type), neither of which are necessary for the Newton to boot. And both of which could easily be repaired.

So if you're using NewTen on a rare prototype and get the dialog, I'd hit the Stop button and let me know.

pablomarx avatar Feb 26 '17 23:02 pablomarx

@pablomarx Re: the Bic … to be honest, I don‘t know if it is functional. I’m had my Cadillac powered up, but I’ll have to dig the Bic out of the basement and take a look.

What exactly does the ROMulator do? Is it just a card containing the updatable ROMs which sits between the prototype hardware and the NuBus controller?

splorp avatar Feb 28 '17 23:02 splorp

@splorp The ROMulator picture I sent on the NewtonTalk isn't high resolution so it's difficult to say exactly. As an aside, I know Jim Abeles won the auction for that Bic (for a song, $1100... I didn't know about the auction until it was over for ~ 30 minutes. Yes, I'm sure I've mentioned this before, and yes, I'm still bitter about it). He's taken high resolution photos of the Bic, but not of the card. Perhaps I can nudge him for higher resolution pics of the board.

ROMulator is a generic term, nothing specific to Newton. Normally it'd be a circuit used in the place of ROM chips – generally a gob of RAM chips, and some other circuitry to allow an uplink to a computer, so that code can be downloaded onto the RAM. Then the device would execute the code as if it were burned into ROM chips. As an example, tether the device, upload the code from your computer, hit the reset button on the device, and it starts executing that newly uploaded code.

I think it is a fair assumption that this ROMulator does the same via the 50-pin ribbon cable interface back to the NuBus board.

It probably does a little bit more though, given it's taking up two card slots and they're clearly labelled "RAM" and "ROM". Above each slot there are 4 chips that certainly look like RAM chips. So presumably one group of 4 is the fake ROM card, the other group of 4 is the fake RAM card.

Then where things get interesting – there are two larger chips above them that look like Texas Instruments NuBus chips. And then there's another FPGA beneath the ribbon cable connector.

The BunWarmer I opened did definitively have TI NuBus chips on it (and additional FPGAs), which can be seen here: https://www.flickr.com/photos/pablo_marx/353001521

The BunWarmer evidence makes me reasonably confident in thinking the two chips on the ROMulator are TI NuBus chips. And this would imply the Universal Newton Adapter is pretty much just sharing a fair amount of the NuBus bus over the 50-pin connector. And that means the ROMulator may be doing even more than just emulating RAM+ROM cards – it may also serve as the debugger connection, etc.

pablomarx avatar Mar 01 '17 00:03 pablomarx

I found another image of that ROMulator board on this French site.

splorp avatar Mar 01 '17 22:03 splorp

By the way, where would I find a copy of Hammer?

splorp avatar Mar 01 '17 23:03 splorp

It's in the C++ tools and the Lantern DDK. I have attached a zip (of 4 StuffIts) to this reply containing Hammer from those two packages, Newtsbug from the C++ tools, and Egger from the floppy disks I managed to track down.

Per the NewtonTalk reply, the copyright date on Hammer is 1991-1996. For NewtsBug it's 1991-96. For Egger it's 1991-1993.

Obviously it could be that they both share code from some ancestor app that was created in 1991. Or my theory may be correct that they're all the same, just with different features compiled in.

screen shot 2017-03-01 at 15 17 44

The version strings are intriguing. Egger from 1993 shows "1.1d45exp", while Hammer from 1996 shows "1.1d95exp". Possibly just very small changes over the years to learn about newer hardware?

Newton Debuggers.zip

pablomarx avatar Mar 01 '17 23:03 pablomarx

I have another copy of NewtsBug with the version "1.0f4". I can upload that too if you'd like. It's in my C++ tools folder, but that seems wrong – why would it ship with two copies? I might've accidentally placed it there some time ago, and have forgotten where it came from.

pablomarx avatar Mar 01 '17 23:03 pablomarx

Just to turn this issue into a stream of consciousness. 1991 is the same year as the ARMageddon board. And the year ARM600 became available. Perhaps this is when the Newton team first switched to ARM? Did they ever use the ARM2 / ARM3? And seeing that Hammer would carry on with puns – Arm and Hammer – perhaps the Hobbit Newton's had a tool with a Tolkienesque name?

If I drove, I'd try to go to every Silicon Valley yard sale and buy any SyQuest cartridges I saw...

pablomarx avatar Mar 01 '17 23:03 pablomarx

Also the photo of the photo of the Bic + ROMulator you found is from the Computer History Museum. It's one of many Newton items Steve Capps donated:

http://www.computerhistory.org/collections/catalog/102633650

(Mislabelled as a Cadillac)

His Bunwarmer:

http://www.computerhistory.org/collections/catalog/102667152

(Google for site:computerhistory.org "steve capps" inurl:collections )

pablomarx avatar Mar 02 '17 00:03 pablomarx

If I drove, I'd try to go to every Silicon Valley yard sale and buy any SyQuest cartridges I saw...

Thanks, Steve.

I just wanted to extract those code strings for myself. For some reason, I couldn’t locate either Egger or Hammer in any of the development stuff I’ve collected over the years. Newtsbug? No problem. Lots of those kicking around.

If I drove, I'd try to go to every Silicon Valley yard sale and buy any SyQuest cartridges I saw...

You and me, both …

splorp avatar Mar 02 '17 04:03 splorp

Aha! I wondered where those photos came from. (I really wish CHM would post better quality images … yeesh.)

I didn’t realize that Capps had donated one of the “plexiglas sandwich” prototypes too.

http://www.computerhistory.org/collections/catalog/102667182

splorp avatar Mar 02 '17 04:03 splorp

That one is interesting and may explain where the Bunwarmer confusion comes from.

It looks like yours, complete with the dozens of header pins on the left side of the (green) board. But then there is another circuit board (blueish tint), presumably attached to those rows of header pins.

And that board appears to have an FPGA complete with the taped on paper label, and then suspiciously two chips that look like the NuBus chips, and a cable connector that appears to be wide enough to contain 50 pins... Lots of smaller chips that could be RAM.

Admittedly I'm at CSI levels of zoom here, but I suspect it could be another ROMulator.

This might explain why your plexiglas is so much larger than it's contents. Perhaps originally they all used the ROMulator, so it was still tethered like a Bunwarmer. Hence people still calling them Bunwarmers. And later on when yours was made, they had shifted to using the ROM cards and dropped the large ROMulator board.

pablomarx avatar Mar 02 '17 04:03 pablomarx

Also could be that the ROM card slots existed on all of these mystery devices. And then perhaps engineers would have the ROMulator add-on for quicker turn around time, and QA folk wouldn't as they just test blessed builds delivered to them on a ROM card.

folklore.org came out ~ 20 years after the original Mac. I was always optimistic we'd be treated to a similar site 20 years after the Newton, but I reckon we're a few years overdue for that. (I realize there are a couple of Newton stories on folklore, but...)

pablomarx avatar Mar 02 '17 04:03 pablomarx

And per the Clank sound in Hammer/Egger, it would happen when dialogs appeared – I mentioned DebugStr as being a source. Here are a couple of examples of those from Leibniz – some NewtonOS assertions failing while debugging serial emulation. I can likely trigger some in Egger in the next few days if you'd like a more authentic example (they should look the same, just proper Platinum instead of flat-aqua)

screen shot 2017-02-28 at 23 02 32 screen shot 2017-03-01 at 13 39 12

pablomarx avatar Mar 02 '17 05:03 pablomarx

That plexiglas prototype from Capps is almost exactly like my other unit with the broken screen. It has the same circuit boards and ROM slots and multiple toggle switches. I’ll take some close up photos tomorrow to share with you.

By the way, I fired up the Japanese prototype again tonight … it still works (almost) perfectly.

splorp avatar Mar 02 '17 06:03 splorp

I have a spare working OMP LCD. The logic board gave it's life for science (or emulation, take your pick)... If it looks like an easy replacement on this son-of-bunwarmer you have (e.g. the existing LCD isn't superglued down), I'm happy to ship it out to you.

If this other device has ROM card slots, and you don't have the ROM cards for them.... I'm confident I could make replacements. Then you could have two functional son-of-bunwarmers. And as it is difficult to order just one custom PCB (minimum order quantities), you could have several reproduction ROM cards, with differing OS versions, to show off the wonders of the ROM card technology. Could burn my Notepad ROM on one, etc.

For the ROM Card, it'd honestly be easiest if one could be opened up and photographed. But I realize you may be hesitant to do that, so the previously mentioned PCMCIA connector snooper I'm designing for the Cadillac would work here. I just need to expedite that design process.

(What can I say, I like it when things are functional....)

pablomarx avatar Mar 02 '17 07:03 pablomarx