Vetronix Tech 1

[zhivat]

Hello,

Is anybody here have experience with Tech 1 Mass Storage Cartridge?

Is it possible to copy software inside MSC to put in another MSC, I think need to erase MSC before put in the software?

Thanks

[The1]

just pull it apart, standard eprom inside.

[zhivat]

But I have opened the MSC and the inside not use single EPROM like specific cartridge (i.e ABS,RWAL cartridge)

[The1]

no idea just assumed it would be a 4Mbit eprom, i havn't seen inside of one, only standard cartridges.

[zhivat]

Here pic inside MSC (both side), any idea???

[The1]

yeh good luck with that

[antus]

It looks like flash memory wired in parallel prolly using the ce line to select which one. But yeah will be proprietry.

[zhivat]

It looks like flash memory wired in parallel prolly using the ce line to select which one. But yeah will be proprietry.

Any info to extract the software inside flash memory and burn to new memory like standard EPROM/EEPROM?
I'm really new with flash memory...

[antus]

You'll have to come up with something custom. I dont think there is any information about how the data is mapped on there and thats after you buy sockets for those chips to suit your programmer and then successfully desolder them without causing any damage.

[danrmp]

Hey guys, pretty old thread but I had a similar question.

In Brazil GM had its specific Tech1 software. The individual cartridges are long gone, and the very few Tech1's that show up are equipped with a MSC. TIS2000 Brazil packages are know, but no one can put the hands on it.

So I came with the idea of dumping an MSC and programming into another one or a regular type (EPROM-based), which would be desirable since it is much cheaper.

So I fired up a TIS2000 programing on a spare MSC with a serial monitor running and got plenty of information.

The computer send the following data to check if a Tech1 is connected:

Code: Select all

ef 58 50 11 00 58 

and the Tech1 echo back the reply.

there is another set of data, but I think that the most interesting one is this:

Code: Select all

ef 5a 01 90 84 41 0e 53 

and the reply is:

Code: Select all

    ef 97 01 4f 50 38 37 2d 39 34 20 47 42 20 20 20   Ôó.OP87-94 GB   	
    4f 50 45 4c 2f 56 41 55 58 48 41 4c 4c 20 38 37   OPEL/VAUXHALL 87	
    2d 39 34 20 45 43 55 20 28 56 33 2e 32 29 20 20   -94 ECU (V3.2)  	
    20 20 20 20 20 20 20 20 a0 17 f2 00 76 02 02 26           †.Ú.v..&	
    96 60 ff 7f 87                                                       

When writing to a MSC, the computer send a lot of blocks like these:

Code: Select all

    ef da 02 87 80 80 05 65 20 52 50 4d 40 20 20 54   Ô⁄.áÄÄ.e RPM@  T	
    65 73 74 20 61 62 6f 72 74 65 64 2c 20 20 56 65   est aborted,  Ve	
    68 69 63 6c 65 20 6e 6f 74 20 69 6e 20 20 20 50   hicle not in   P	
    61 72 6b 2f 4e 65 75 74 72 61 6c 2e 40 20 20 54   ark/Neutral.@  T	
    65 73 74 20 61 62 6f 72 74 65 64 2c 20 20 20 43   est aborted,   C	
    6c 75 74 63 68 20 50 65 64 61 6c 20 20 20 20 20   lutch Pedal     	
    64 65 70 72 65 73 73 65 64 2e 40 00 20 3d 20 49   depressed.@. = I	
    6e 63 72 65 61 73 65 20 45 47 52 20 20 53 6f 6c   ncrease EGR  Sol	
    2e 20 70 6f 73 69 74 e7                                        . positÁ        	

After a few educated guesses, I came up what seems to be the comunication protocol. Taking ef 5a 01 9e 00 80 0f 89 as an example:

Code: Select all

EF 5A 01 = Read Memory
9E 00 = Base address
80 = number of bytes to be read (128 maximum)
0f = Memory bank? yet to be confirmed
89 = 2's complement checksum

sending the data above throug the serial port returns the following:

Code: Select all

    ef d6 01 52 20 20 20 20 46 31 3a 52 45 4f 52 47   Ô÷.R    F1:REORG	
    2e 20 4d 45 4d 4f 52 59 46 32 3a 45 4e 41 42 4c   . MEMORYF2:ENABL	
    45 20 55 50 44 41 54 45 46 33 3a 44 49 53 41 42   E UPDATEF3:DISAB	
    4c 45 20 55 50 44 41 54 40 52 45 53 49 44 45 4e   LE UPDAT@RESIDEN	
    54 20 55 50 44 41 54 45 40 20 44 49 53 41 42 4c   T UPDATE@ DISABL	
    45 44 40 20 45 4e 41 42 4c 45 44 20 40 20 20 20   ED@ ENABLED @   	
    52 45 4f 52 47 41 4e 49 5a 45 20 20 20 20 20 4e   REORGANIZE     N	
    4f 54 20 50 4f 53 53 49 42 4c 45 40 20 2a 2a 2a   OT POSSIBLE@ ***	
    20 45 52 cf                                                            ERœ            	

Which matches the resident part of the MSC cartridge.

Observing the data written to it, seems like the writable data sits between 0x8000 and 0x9FFF, in pages from 0x01 to 0xff (in case of NAO package, about 1.1MB in size according to TIS). Seems plausible, since we'll have 255 pages of 8kB data for a total of 2MB addressable. The picture posted shows 6x F28F020 Intel flash chips, 256kB each, 1.2MB total

Page 0x0E looks like the directory index and page 0x0F seem to return any address in the 64kB space of Tech1's memory map. I was able to dump the internal RAM (used as a buffer for the diplay) and the higher parts of the internal ROM (0xFF80-0xFFFF), with the reset and interrupt vectors.

My guess is that Master Cartridge sits between 0x8000 ans 0xBFFF

I think that the challenge from now on is:
-Know the exact memory location that a Master Cartridge lives;
-Know how the memory banks are switched;
-Have a reliable MSC Resident dump or build a custom one;
-Extract only the relevant part of the software, or develop a hardware to do the flash-eeprom bank switching (CPLD will do the job)
OR
-Dump the entire MSC and replace the commands from "Read" to "Write" and send to another MSC, after sending the commands to erase all and write enable.

Regards,

Danniel