Index wersja polskawersja polska

Internal ROM of the HD61700 processor

A part of the Casio PB-1000 firmware is hidden in the processor's internal 16-bit ROM of size 3072 words. It can be used only as program memory, data access isn't possible (except of constants encoded as a part of immediate addressing mode instructions). Therefore, all constant tables used by the procedures in this ROM have to be placed in external memory space (for example CORDIC tables, floating point constants, keyboard data, fonts...).

Due to this limitation the internal ROM cannot be directly read out. However, I managed to extract the ROM contents by single-stepping the code (by applying an IRQ2 interrupt pulse during execution of each instruction).

For this purpose all bus signals have been lead out to a connector inserted into a test socket of an universal device programmer TopMax controlled by a PC. With this equipment I can execute any single instruction, modify and examine the register and memory contents, log all bus activities, count cycles. The instructions can then be attempted to be identified.

The archive contains the partially commented ROM disassembly reconstructed using this method.

PB-1000 in a test socked


Some instructions cannot be distinctly identified, as the same result can be obtained in various manner. Examples:

Instructions encoding

In some cases not only the instruction could be identified, but also the actual memory contents. It is possible by executing the code starting from a second word of a 2-word instruction. Examples: