Recover damaged CPU Diagnostic ROM

[MADrigal]

Hi all
Some may remember my post from 30 Jan 2023 on the CreatiVEmu website, in relation to my defective dump of the insanely rare "CPU Diagnostic Test". The story is quoted below:

Around 2008 I purchased an insanely rare cartridge containing a diagnostic program to test the CreatiVision 6502 CPU. This cartridge was definitely a VTech original: not a commercial product but "for internal use". It was found (one copy only) in the warehouse of the (now closed) official CreatiVision repair centre in Italy, owned by Zanussi Elettronica.
I believe VTech provided each repair centre with one copy of such cartridge. This would mean that just a handful of cartridges are in existence. The one in my possession is the only one I have ever seen or heard about.
The cartridge worked well when I first tested it, but then when the EPROM was unsoldered (so that it could be dumpet), it got slightly damaged. The dump is there, but it is partial. I then sent the EPROM to a MAME team member who was in charge to repair it - but he lost it.
Since 2010, no one knows where my one-of-a-kind EPROM is.

I have decided to release all my partial dumps of the EPROM, together with information and a Hex editor tool I created many years ago specifically to work on this ROM. I hope that one day, someone will be able to fix this rare file.

This ended up in long time CreatiVision enthusiast Andrew Davie starting a topic on the AtariAge forum - calling for arms and help from programmers and coders to solve this "puzzle". Some people came with interesting ideas

https://forums.atariage.com/topic/34726 ... challenge/

Today I received the below email from a gentleman called Chris:

Iv been looking at the EPROM CPU dump @www.madrigaldesign.it/creativemu
Iv come up with an idea to maybe get it working once again. However it is quite a long shot.
And would probably require help from the community.
My thought was that if only bit 1 and 6 are damaged than we could try a custom brute force attack/fix
That would simple change each bit 1 and 6, one at a time and wright the new changes to a file.
Then some small changes to the source code of a emulator to attempt to load the rom/new file. if it works
don’t actually run the rom just return true to the main program. And process accordingly.

I know this would take a long time to run/complete that’s where
If we spread the work load with the community than just maybe it will work?

Let me know what you think.

Honestly I am not in the position to provide any help on this, but I thought that someone out there may be interested in taking the challenge?

I am happy to provide you with Chris' contact details if you wish to speak to him directly

[chrisnewm]

Hi everyone. I've been working on the CPU cart recently and whipped up a little tool to help me with it. what it does is take a byte entered and swaps bits 1 and 6 respectively. To show all combination that byte could have been as well as print out the 6502 opcode next to it.

Thought if anyone else is working on this task this might help them out. do let me know of any bugs thanks.

Chris.

[nanochess]

I've posted it first in Atariage, but I solved the challenge.

First, I made a program to make a "good" ROM based on three of the best files provided (the best one is the 4k image file, a shame it is only half of the program). I thought I could get something working, but of course, it wasn't so easy. Later I added a fourth ROM to the data provided, but it has some bugs in other bits.

With the pseudo-repaired ROM I was able to code something bootable in assembler (typing from Masswerk's Virtual 6502 disassembler), taking in account my knowledge of the VDP access and VRAM location, also the non-used columns of machine code of the 6502 simplified a lot of things. Of course, deducting the proper instructions in the sequence, and I used my gasm80 assembler to assemble the final ROM.

To make sure I wasn't "inventing" code, I coded another tool that does a comparison against the "most" "good" image files.

Anyway, after 2000 lines of assembler code corrected, I was pretty tired but at least two tests worked.

Today, as there wasn't a Creativision emulator for Mac OS, I adapted CoolCV to have a 6502 processor emulation (internal WIP as it only drives the VDP and doesn't do anything else), and also added execution trace to see where it failed the tests.

And I've had success!!!

The Creativision 6502 diagnostic test is now fully corrected!!!

Of course, there are some bytes that are in doubt, but only finding another original EPROM could indicate it.

[MADrigal]

Omg I'm shocked!
I will download and try it asap. Meanwhile can you please clarify if you effectively changed the 2nd and 6th bit of each damaged byte and left the rest unaltered?
This really is groundbreaking and thanks so much!

If you would like to undertake a (much easier) challenge, we are now in a similar situation with the 4kbyte rom (of a 8k set) of the Colecovision Converter BIOS (Z80 code). Each byte has 1 bit damaged/missing. Fixing it shouldn't be hard as the Converter BIOS mimics the behaviour of the original Colecovision BIOS, although with different code.

Its posted in another thread. [EDIT: I thought I had posted the ROM on the forum but just realised I didn't. Will post later today]

With that EPROM, I have plans to post it to a decap facility and obtain a good dump regardless. It will just take months for it, but at least the EPROM has not gone list like the 6502 CPU test.

Endless thanks for now

[nanochess]

That's exactly what i did. Only bit 6 and 1 of each byte. The 4K dump was the best there as only bit 1 was damaged, but it provided only 2K of $a000-$a7ff and 2K of $b000-$b7ff.

However, there were a few parts of the dumps where several bytes in row were more severely damaged (runs of 5 to 10 bytes).

From the file I uploaded, the utility repair.c does the job of creating final.rom, and final.rom was passed through the Virtual 6502 disassembler, to create final.txt. You can see the severity of the damage, otherwise my tool would have repaired it.

recover.c is the utility I used to confirm that I didn't "invent" bytes. Many differences appear because the dumps are bad, however you can see these are bit variations.

[nanochess]

I just noticed my recover.c utility was prepared when I though the whole ROM as 4K, here is an updated version.

BTW, when you run it, you can notice the runs of bad bytes in the dumps.

[MADrigal]

Wonderful thanks!
I have briefly tested the reconstructed rom with creativisionemulator and I am really shocked. Grey screen with some nice text messages. The only time I used the EPROM before sending it for dumping, the output I got was totally different: a black screen with a list of opcodes. I thought that made sense but I now see the EPROM was already probably damaged.
Out of curiosity what is the program supposed to do? On creativisionemulator, all I see is "test 1 complete" and "test 2" seems in progress but never ends. How many tests are included and which ones?
Also will there be any more updates to your reconstructed rom?

[nanochess]

You wouldn't believe this, but I think the Creativision Emulator has a bug. It enters in a loop when doing DEX, and when X=$20 it changes to X=$FF so it never ends the loop. I revised the source code, but it looks good.

You can test it yourself by running it in trace mode (the -t command line option), just follow the assembler source to the last text displayed.

I had to adapt my CoolCV emulator to my 6502 core, and just made enough code to show VDP display.

I think you would have better luck on the real hardware.

About the background color I'm pretty sure it is black letters over gray background, the $b023 byte contains $1e in all dumps.

I've attached an image of how it looks in my emulator. It should look the same in real hardware.

I don't think it will be need to update it. The only thing I could do is when an EPROM surfaces, I could correct the remaining bytes. For example, there is a $fd byte to setup the cursor position along the text, I'm pretty sure it could be $ff. But doesn't affect operation.

[MADrigal]

OMG that is amazing!!!!!

[MADrigal]

@Nanochess - if you like the challenge... have a look at this:
viewtopic.php?p=4416#p4416