Saturn CD Block ROM dumped

Discussion in 'Sega Saturn Programming and Development' started by jhl, Jun 30, 2014.

  1. jhl

    jhl Spirited Member

    Joined:
    Jul 29, 2013
    Messages:
    102
    Likes Received:
    108
    Hello again!

    I'm pleased to report that I've successfully dumped the SH-1 ROM from a CDB105 Saturn CD block. This involved removing the SH-1 from a CD block board, and attaching it to a Gameboy cartridge to provide ROM and NVRAM. A custom ROM loaded via the cartridge allowed dumping the ROM via the NVRAM and thence via USB; I'm very pleased by the fact that I didn't have to write a single assembler instruction in the whole thing (it's all linker scripts and C).

    Here's the dumping rig, all cardboard and Drag'n'Derp:
    [​IMG]
    [​IMG] [​IMG]

    The USB power is jumpered over the cart Schottkys to drive the rig, and a Nintendo logo header is located at the appropriate place in the ROM to trick the cart into thinking it's a Gameboy ROM and permit drag and drop operation to work. I messed up the breakout board on the way to fabrication, so there was no copper where the pin pads were supposed to be - so the soldermask was scraped off and pins soldered straight to the tracks.

    After an extensive analysis of the ROM, I was able to divine the mechanism by which SH-1 code is loaded from the MPEG card, and so was able to build a USB interface to dump the ROM of a YGR022 unit as well (via the MPEG card slot). I don't have any pictures of this at the moment, as I'm currently some 17186km from my house.

    I'm aiming to provide a fuller release later on. In the mean time, I'm happy to provide any information I can to emulator authors and other people working in this domain.

    I am also developing an add-on card for the MPEG slot. I anticipate providing a USB interface to allow emulating a drive using a PC, Raspberry Pi, or whatever. This would include audio. It's not yet clear whether an SD card or host-type USB interface may be of use. The former would be limited in space (though 32GB represents quite a few games), while the latter wouldn't be able to power hard drives (as the Saturn's power supply is also limited). Either of the latter options may also require crowdsourcing some funding for development, while a pure USB interface should be relatively straightforward. I would be interested to hear everyone's thoughts.

    I originally started playing with the Saturn because I wanted to write a tracker for the SCSP. I wasn't anticipating finding so many interesting other things to play with. Hopefully the board will be the development tool I need to get me back on track for the original task...

    Finally, I'd like to express my gratitude to Druid II (aka zyrobs), who generously provided the original CDB105 board. (I think I may have horrified zyrobs by then desoldering the SH-1; conservationists will be pleased to learn that the chip was restored to its original board, and returned to its owner.)

    Cheerio,
    jhl / abrasive

    MD5 sums:
    21cc63ac18d7a85420c24de5c7d51321 cdb105.bin
    1f4ccf420e2189207bf018f2f5369c44 ygr022.bin

    edit: fixed image URLs (2016)
     
    Last edited: Jul 11, 2016
    DSwizzy145, seal1, almmiron and 3 others like this.
  2. TriMesh

    TriMesh Site Supporter 2013-2017

    Joined:
    Jul 3, 2008
    Messages:
    2,074
    Likes Received:
    582
    Impressive piece of work - did Hitachi actually design the chip so that even the masked parts could run external code, or did you find some way to trick it?
     
  3. jhl

    jhl Spirited Member

    Joined:
    Jul 29, 2013
    Messages:
    102
    Likes Received:
    108
    They can still run external code - but doing so unmaps the internal ROM. The mode pins aren't latched, though, so my dumper loads itself into RAM and toggles the relevant boot mode pin using one of the GPIOs. Swapping out the tablecloth from under the dinner...

    I wasn't sure about the boot mode latching until the dump came out; a bit of a gamble. Not that there aren't other ways to get the data out - but they would have been much more difficult.

    I also tried the PROM readback mode first - unsurprisingly, the PROM logic isn't attached to the mask array, but it would've been trivial if it had worked.
     
    Last edited: Jun 30, 2014
  4. Bad_Ad84

    Bad_Ad84 The Tick

    Joined:
    May 26, 2011
    Messages:
    8,236
    Likes Received:
    1,052
    Seconded, good stuff.
     
  5. TriMesh

    TriMesh Site Supporter 2013-2017

    Joined:
    Jul 3, 2008
    Messages:
    2,074
    Likes Received:
    582
    That's an interesting design decision on their part, although thinking back I seem to remember that some of the H8s did the same thing. And it always makes sense to try the easy methods first :)
     
  6. -=FamilyGuy=-

    -=FamilyGuy=- Site Supporter 2049

    Joined:
    Mar 3, 2007
    Messages:
    2,814
    Likes Received:
    655
    Congrats! Really nice procedure! Sometime the road as interesting as the destination!
     
  7. Helder

    Helder Site Supporter 2014,2015

    Joined:
    Apr 6, 2013
    Messages:
    981
    Likes Received:
    54
    So you plan to use the MPEG Card slot in the back of the system to attach a drive emulator?
     
  8. derekb

    derekb Well Known Member

    Joined:
    Jan 7, 2009
    Messages:
    1,940
    Likes Received:
    31
    same question, thats what it sonds like tho
     
  9. Druidic teacher

    Druidic teacher Officer at Arms

    Joined:
    Jun 6, 2006
    Messages:
    3,643
    Likes Received:
    129
    x
     
    Last edited: Jun 22, 2017
  10. keropi

    keropi Familiar Face

    Joined:
    Feb 2, 2011
    Messages:
    1,056
    Likes Received:
    60
    really amazing work and concept, kudos!
     
  11. fluxcore

    fluxcore Spirited Member

    Joined:
    Nov 5, 2013
    Messages:
    126
    Likes Received:
    4
    Wow, sounds like some really neat stuff could come from this! Great work!
     
  12. jhl

    jhl Spirited Member

    Joined:
    Jul 29, 2013
    Messages:
    102
    Likes Received:
    108
    Yes. Exactly. Also would function as a modchip, just for good measure.
     
  13. jhl

    jhl Spirited Member

    Joined:
    Jul 29, 2013
    Messages:
    102
    Likes Received:
    108
    2.5" HDDs will easily chew 1A at 5V while starting, and the whole Saturn only draws 2A normally. Not a good recipe. Also, the card contacts probably won't do it.

    Thanks for posting the MPEG/USB bridge - I couldn't find the photo I'd sent you. The next version will have the USB port in a more reasonable spot ;)
     
  14. Bad_Ad84

    Bad_Ad84 The Tick

    Joined:
    May 26, 2011
    Messages:
    8,236
    Likes Received:
    1,052
    Did that cypress board actually function as the interface to upload code?

    I figured you were using it as a logic analyzer, but your comments make it sound not.
     
  15. DSwizzy145

    DSwizzy145 Well Known Member

    Joined:
    Aug 6, 2011
    Messages:
    1,630
    Likes Received:
    40
    Is this a new way to play our backups soon?
     
  16. Bad_Ad84

    Bad_Ad84 The Tick

    Joined:
    May 26, 2011
    Messages:
    8,236
    Likes Received:
    1,052
    I dont understand how you even need to ask that question.
     
    OzOnE likes this.
  17. jhl

    jhl Spirited Member

    Joined:
    Jul 29, 2013
    Messages:
    102
    Likes Received:
    108
    Yes. Using a 74LS138 for glue and some kludgy software hacks, was able to emulate the boot ROM as well as provide an output interface for dumping the ROM. The older FX2s are really picky about WR timing with respect to the FIFOADR lines, that took ages to work out.

    It's not able to emulate the MPEG chip itself, which it turns out is verified before even trying to load the ROM. Some more glue would do it, but I decided to go ahead with a more capable design rather than continuing down the FX2 path.
     
  18. MaxWar

    MaxWar <B>Site Supporter 2013</B>

    Joined:
    Aug 13, 2012
    Messages:
    1,486
    Likes Received:
    28
    Props, you guys who do stuff like that are wizards to me.
     
    Keiji Dragon likes this.
  19. APE

    APE Site Supporter 2015

    Joined:
    Dec 5, 2005
    Messages:
    6,398
    Likes Received:
    128
    Impressive as fuck.
     
  20. Nemesis

    Nemesis Robust Member

    Joined:
    Mar 22, 2007
    Messages:
    231
    Likes Received:
    29
    Absolutely amazing work! This was priority number 1 on my list if I ever turned my sights on the Saturn. Dumping that code was a critical step for emulation, congrats!

    I've got a number of different Saturn models for hardware reference. Once you publish your method, I'd be interested in dumping the code from my systems too to check for revisions to this code.
     

Share This Page