TI-99/2 - General / System Rom Dump

[kl99]

Hi,

I got a TI-99/2 machine donated by Mike Wright.

This is the Website Information I have setup so far

 

Rom Dumping:

http://www.ti99.eu/?page_id=3376&lang=en

 

General Overview (see below for 99/2 subpages)

http://www.ti99.eu/?page_id=3091&lang=en

 

The Rom Dumping Page links to 3 youtube videos from yesterday/today.

As soon as I get home again, I can transfer the disk over to my laptop to release the Rom.

 

I would be happy on any 99/2 related talk

[+Schmitzi]

Great fun and work, Klaus.

 

So here is my related talk: I WANT ONE OF THIS MACHINES ! :)

[Sinphaltimus]

Maybe an update to classic99.

[kl99]

Hm. I might have only dumped a part of the System Rom.
During development they decided to upgrade to 32KByte ROM.

Anyway, will release what I have tonight.

[speccery]

Klaus, I just watched some of your videos and that little machine looks great!

 

It will be very interesting to see the results of your ROM dumping project. Thanks for working on the dumps and good luck with that!

 

I also checked at some of the material on your site, and to my surprise you had links to some pretty in-depth documentation of the machine, especially the video chip and I/O chips. This seems like an obvious candidate for an upcoming FPGA project! I glanced over the video chip document, that is a simple device and could easily be done.

 

Erik

Edited October 25, 2016 by speccery

[kl99]

 

 

Files Description:

A.....0 to 2047 0000-07FF
A1....2048 to 4095 0800-0FFF
A2....4096 to 6143 1000-17FF
A3....6144 to 8191 6144-1FFF
B0....8192 to 10239 2000-27FF
B1....10240 to 12287 2800-2FFF
C0....12288 to 16383 3000-3FFF
D0....16384 to 20479 4000-4FFF
D1....20480 to 24575 5000-5FFF

 

I figured out that the Rom Size was upgraded to 32K somewhere during the development phase, so therefore I dumped some more than only the lower 12K.

However I don't know yet what is stored there. Could be Ram as well. We will see....

 

Filetype is DIS/FIX 32

 

because of the record length of 32 every 32th byte is an additional "32". i can fix that....

ti-99-2-rom-dumps-files.zip

99-2-DUMPS.dsk

Edited October 25, 2016 by kl99

[kl99]

Okay. Fixed Files are in this post. Can't update the former post for some reason.

 

Files:

ROM0 = 8KByte, 0000-1FFF

ROM1 = 8KByte, 2000-3FFF

ROM2 = 8KByte, 4000-5FFF

 

Disk Image with the 3 Files in correct TI format, Program, 33 Sectors:

99-2-DUMPS.dsk

 

Binary Files for the Pc:

ti-99-2-rom-dumps-files.zip

 

It seems there is one Eprom not dumped yet. I need to enable some bank switching for that.

Have fun.

 

P.S: You can use the disassembler function (right click) of TiImageTool to disassemble any Assembler in those to the 9900 Source Code.

[+acadiel]

Are the ROMS socketed, or are they semi-socketed and semi-soldered?

[kl99]

Are the ROMS socketed, or are they semi-socketed and semi-soldered?

 

http://www.ti99.eu/?page_id=3353&lang=en

[RickyDean]

 

http://www.ti99.eu/?page_id=3353&lang=en

Reminds me of a Sinclair 1000--- the innards ya know!!!

[+acadiel]

 

http://www.ti99.eu/?page_id=3353&lang=en

Oh boy, those are gonna be fun.

 

Sent from my Nexus 5X using Tapatalk

[+jedimatt42]

What would be the best tool for disassembling the roms?

 

-M@

[+acadiel]

What would be the best tool for disassembling the roms?

 

-M@

Well, since we really don't have GPL supposedly, are these things straight 9995 assembly?

[kl99]

What would be the best tool for disassembling the roms?

 

-M@

 

You can use the disassembler function (right click) of TiImageTool to disassemble any Assembler in those to the 9900 Source Code.

A Hex Editor shows raw Text (Ascii Values) to identify Data parts.

There might be some Basic Offset of >60 for more 'hidden' Text like in the 99/4a roms. This was done to not leave empty memory spots in VDP memory.

 

Is there any tool, that "draws" a Binary to the screen? like what CALL CHAR is doing with a hex-input. we could detect pattern definitions with this.

[+jedimatt42]

Well, since we really don't have GPL supposedly, are these things straight 9995 assembly?

 

I we have dissemblers for 9900, but I was thinking there must be extended instructions in the 9995... but maybe not... I've been reading about the later models too much.

 

-M@

[kl99]

Character Definitions start at >1C00 and go up to >1FFF.

It includes small caps letters as the 99/4a.

The very last character "1C3E6B7F633E1436" is some leavebehind message of the engineers it seems.

 

You can see that the characters before Ascii 32 (space) are used for Block Art Drawings.

[kl99]

here are my disassembly specs/hints that you can paste when opening the disassembler in TiImageTool

data(1C00,1FFF),data(1A34,1BFF),text(046A,0481),text(0483,0494),text(0497,04AC),text(04B0,04CB),text(04D1,04E9),text(04EB,04EF),text(04F2,050A),text(00D6,00EF),text(03A8,03B9),data(0AE6,0AE6),text(0AE7,0AF6),data(1826,1827),text(1828,1837),text(03BA,03C9),text(0DAA,0DB3),text(0DB8,0DBE)

 

use FileOffset: 0000

StartAddress: 0000

Length:1fff

 

I don't know how to chain ROM0 to ROM1 and ROM2 to see a combined view. Maybe Michael Zapf can help us here?

[HackMac]

What would be the best tool for disassembling the roms?

Did you tried out my tool within the TI-Disk Manager? There is an interactive Disassembler Editor.

This picture is taken from the screenshot section of my Wiki pages.

 

With this editor you can interactively define which area of code should displayed as data, text or mnemonics. You can define labels or symbols, add comments to every row or insert a block comment that combines multiple rows (i.e. to comment a whole subroutine). Also jumping around through the code is possible while (right-)clicking on an address or the forward and backward buttons. (You can not jump to all addresses, only those which are addessable within the file.) The actual session will automatically be stored if you close the window, so you can continue at the same position later, if you need. There is a submenu under the Windows menu, it calls "Continue Disassembling for ...", where you can find all your sessions. Choose one and you can continue your work. When the disassembling process is finished, you can save your result into a text file.

Since version 2.7.20, the TI-Disk Manager shows additional informations in the Disassembler Editor in a tooltip. Here you can see how many clock cycles a specific instruction would need and which status flag are altered.

Since version 2.7.22, the Disassembler Editor opens ROM dump files and decodes its headers automatically (i.e. the sources of DSR-ROM or cartridge ROM dumps has a better pre formatted output provided with labels to lists and program entries). Additionally this tool knows of the special opcodes from various CPUs: TMS9900, TMS9995, TMS99110, TMS9980 and TMS9940

Edited October 26, 2016 by HackMac

[kl99]

Did you tried out my tool within the TI-Disk Manager? There is an interactive Disassembler Editor.

 

Hi HackMac,

thanks for the tip. I fear your software is a Mac only release, right?

[HackMac]

Jupp! And you don't use a Mac or Hackintosh!?

[+mizapf]

Okay. Fixed Files are in this post. Can't update the former post for some reason.

 

Files:

ROM0 = 8KByte, 0000-1FFF

ROM1 = 8KByte, 2000-3FFF

ROM2 = 8KByte, 4000-5FFF

 

Disk Image with the 3 Files in correct TI format, Program, 33 Sectors:

99-2-DUMPS.dsk

 

Binary Files for the Pc:

ti-99-2-rom-dumps-files.zip

 

It seems there is one Eprom not dumped yet. I need to enable some bank switching for that.

Have fun.

 

P.S: You can use the disassembler function (right click) of TiImageTool to disassemble any Assembler in those to the 9900 Source Code.

 

Klaus, this is outright fantastic. We did not have any dumps for the TI-99/2 in MAME, and there was only an untested prototype emulation. Now I can finish that one finally. Great great news.

[+acadiel]

What's the memory map of this thing look like anyway?

[kl99]

 

Klaus, this is outright fantastic. We did not have any dumps for the TI-99/2 in MAME, and there was only an untested prototype emulation. Now I can finish that one finally. Great great news.

 

I wanted to write to you anyhow regarding this! It seems this is one of the late versions of the prototypes. The 99/2 from Fabrice is containing less Rom (not yet dumped afaik). Somewhere during the development phase the 99/2 team decided to upgrade the space for the Rom.

The last eprom (hidden by bank switching) is not yet dumped.

I was a bit busy with keeping my promises to the man who donated the 99/2 to me, to scan the European manuals he is missing in the Cyc. So far I did go through my collection (after Copenhagen/Chicago 2016) and updated my catalog on the site: http://www.ti99.eu/?page_id=1369&lang=en

Further one of our birds keeps requiring us to go to the doctor with her a lot.

So any help that shortens my time to figure out how to enable the hidden bank would be welcome.

 

Here is some motherboard/internal photos:

http://www.ti99.eu/?page_id=3353&lang=en

 

I am planning to take the 99/2 to Birkenau in April. Jens-Eike will be providing a display.

[+mizapf]

Here is some text from Raphael Nabet (back from 1999!) found in the file ti99_2.cpp in MAME.

 

An interesting thing is whether this is the 24K or the 32K variant that you have.

 

Experimental ti99/2 driver

TODO :
  * find a TI99/2 ROM dump (some TI99/2 ARE in private hands)
  * test the driver !
  * understand the "viden" pin
  * implement cassette
  * implement Hex-Bus

  Raphael Nabet (who really has too much time to waste), december 1999, 2000
*/

/*
  TI99/2 facts :

References :
* TI99/2 main logic board schematics, 83/03/28-30 (on ftp.whtech.com, or just ask me)
  (Thanks to Charles Good for posting this)

general :
* prototypes in 1983
* uses a 10.7MHz TMS9995 CPU
* 24 or 32kb ROM (16kb plain (1kb of which used by vdp), 16kb split into 2 8kb pages)
* 4kb 8-bit RAM, 256 bytes 16-bit RAM
* custom vdp shares CPU RAM/ROM.  The display is quite alike to tms9928 graphics mode, except
  that colors are a static B&W, and no sprite is displayed. The config (particularily the
  table base addresses) cannot be changed.  Since TI located the pattern generator table in
  ROM, we cannot even redefine the char patterns (unless you insert a custom cartidge which
  overrides the system ROMs).  VBL int triggers int4 on tms9995.
* CRU is handled by one single custom chip, so the schematics don't show many details :-( .
* I/O :
  - 48-key keyboard.  Same as TI99/4a, without alpha lock, and with an additional break key.
    Note that the hardware can make the difference between the two shift keys.
  - cassette I/O (one unit)
  - ALC bus (must be another name for Hex-Bus)
* 60-pin expansion/cartidge port on the back

memory map :
* 0x0000-0x4000 : system ROM (0x1C00-0x2000 (?) : char ROM used by vdp)
* 0x4000-0x6000 : system ROM, mapped to either of two distinct 8kb pages according to the S0
  bit from the keyboard interface (!), which is used to select the first key row.
  [only on second-generation TI99/2 protos, first generation protos only had 24kb of ROM]
* 0x6000-0xE000 : free for expansion
* 0xE000-0xF000 : 8-bit "system" RAM (0xEC00-0xEF00 used by vdp)
* 0xF000-0xF0FB : 16-bit processor RAM (on tms9995)
* 0xF0FC-0xFFF9 : free for expansion
* 0xFFFA-0xFFFB : tms9995 internal decrementer
* 0xFFFC-0xFFFF : 16-bit processor RAM (provides the NMI vector)

CRU map :
* 0x0000-0x1EFC : reserved
* 0x1EE0-0x1EFE : tms9995 flag register
* 0x1F00-0x1FD8 : reserved
* 0x1FDA : tms9995 MID flag
* 0x1FDC-0x1FFF : reserved
* 0x2000-0xE000 : unaffected
* 0xE400-0xE40E : keyboard I/O (8 bits input, either 3 or 6 bit output)
* 0xE80C : cassette I/O
* 0xE80A : ALC BAV
* 0xE808 : ALC HSK
* 0xE800-0xE808 : ALC data (I/O)
* 0xE80E : video enable (probably input - seems to come from the VDP, and is present on the
  expansion connector)
* 0xF000-0xFFFE : reserved
Note that only A15-A11 and A3-A1 (A15 = MSB, A0 = LSB) are decoded in the console, so the keyboard
is actually mapped to 0xE000-0xE7FE, and other I/O bits to 0xE800-0xEFFE.
Also, ti99/2 does not support external instructions better than ti99/4(a).  This is crazy, it
would just have taken three extra tracks on the main board and a OR gate in an ASIC.

[+mizapf]

This is how far we get in MAME right now. There seems to be some problem since the emulated computer locks up by a RTWP pointing to itself. Also, the screen is filled with >FFFF (using a SETO), then the text is printed, but this does not look correct.