How do I trace io calles?

I have an old EPROM programmer that will only run on an xt or at running at 12 MHz or less. If I can capture the io calls I can rewrite the software on another platform. Is there a program I can run under dos, or dos emu, that wi,l show the direct io calls?

Sorry if this is not the correct forum, not quite sure where to start on this one.

Len

Do you know the make and model of your programmer? If it's one of the Sunshine models, there's quite a bit of information here that might help.

Hi, it is a Modular Circuit Technology MCT-MMP. It burns the 8748 type intel microcontroller chips. The interface card is pretty simple and just uses two ttl buffer ships and some decoder logic. Inside the programmer are two 8255 ic's, the programming power supplies, and some other logic. There is one chip that they have sanded off the face so I can't tell what is is. It's a 20 pin ic, probably a PLD.

I can spend a bit of time reverse engineering the schematic, although if I could do a trace on the IO calls it would really speed things up.

len

I would suggest taking a disassembler to whatever program it came with. It shouldn't be too big a deal to reverse engineer from that; certainly far easier than trying to work with monitoring I/O ports or playing with tracing circuit logic.

It's an EXE about 35k. The code wont convert to a .com/bin because it has relocatable code segments. Can you recommend a disassemble that deals well with an .EXE? (And is free.)

len

deathshadow said:

I would suggest taking a disassembler to whatever program it came with. It shouldn't be too big a deal to reverse engineer from that; certainly far easier than trying to work with monitoring I/O ports or playing with tracing circuit logic.

Click to expand...

The free version of IDA should do what you want. It can handle EXE files very nicely.

I downloaded IDA, what a cool program. Not being a 8088 expert though I took a different path. I enabled port tracinging on dosemu and got a bunch of logs showing the io port "commands" to the programmer. In a few days I should be able to reverse engineer the programmer and write a program to start burning again. If anyone else has interest in this programmer I will gladly post the code.

Thanks for all your advice.

Len

For what it's worth, a couple of years ago, I did ask JDR Microelectronics if they'd hung onto any of their archives. They said they hadn't. I did manage to retrieve some good stuff from jameco, however.

What stuff from jameco?

Chuck(G) said:

For what it's worth, a couple of years ago, I did ask JDR Microelectronics if they'd hung onto any of their archives. They said they hadn't. I did manage to retrieve some good stuff from jameco, however.

Click to expand...

8008guy said:

I have an old EPROM programmer that will only run on an xt or at running at 12 MHz or less. If I can capture the io calls I can rewrite the software on another platform. Is there a program I can run under dos, or dos emu, that wi,l show the direct io calls?

Click to expand...

Len,

I found a utility that likely won't work for you, as it requires protected mode (386 or better.) However, someone searching for a utility that does this from within DOS may want to take a look at a set of programs that I encountered recently in a file called IOMON2.ZIP.

From the documentation:

While it can be found in a number of places online, I have verified that the link below contains what I have.

https://github.com/codersclub/pascal_sources/blob/master/comm/iomon2.zip?raw=true

I haven't used this, but am working on a project where it was used to trace io calls, much like you are attempting.

I did get a good look at the io calls using dosemu under Linux. Tonight I started controlling the programmer with my own c code in Linux. I think I have enough to write the sw now.

There are a few io ports that are not immediatly obvious tho. To completely understand what is happening I may have to reverse engineer the schematic. Although so far my testing appears that the signals I understand are enough to get the programmer working.

Got to love old hardware!

Here is a URL that will be of interest for Sourcer.

http://reverseengineering.stackexch...e-sourcer-syntax-for-defining-data-structures

The 48P-01.SDF file I sent can be edited to further assist you in making sure the code disassembles correctly.

Reference the following information:

For defining data structures use the same format like all other referances

viz segff ds,<options> label,comment

define your structure details one line per item below DS without segffset

SR normally creates a file <infile.SDF> with sdf extension (sourcer default definition file)
copy paste that file as <infile.def> and start modifying it to suit the needs.

c:\> sr foo.com (define your prefs for assembler etc here and press g)
c:\> ren foo.sdf foo.def
c:\> edit foo.def

seg_a:3127 da, r 0D ; data_137
seg_a:3157 da, r 55 somesymbol ;
seg_a:31AC ds, r 0020 MyStruct ;// struct defined here (Array of 0x20 structs)
dd, c 4 int blah ; member 1 // need foo.rem file for comments
dw short foo ; memeber 2
dw short yaa ; member 3
da, r 6 pathname ; member 4
dd magic ; member 5
seg_a:3BB0 da, r 29 ; data_185

alt+f alt+ s

c:\> sr foo.def

output (comments are from foo.rem file (you will have a sample file testyn.rem in your installation copy paste rename foo.rem and edit that file if you need comments)

C:\>grep -i -A 20 "This is mystruct" Foo.LST

3BC5:31AC B9F9 0008 int dd 8B9F9h
; This is mystruct
; defined as
; typeded struct _MYSTR
; {
; ulong
; short
; short
; char[06]
; ulong
; }Mystr, *PMystr;
3BC5:31B0 45E8 short dw 45E8h
3BC5:31B2 E8F5 short dw 0E8F5h
3BC5:31B4 10 FC E8 C6 EC E8 pathname db 10h, 'ⁿΦ╞∞Φ'
3BC5:31BA DB84 B800 magic dd 0B800DB84h
3BC5:31BE 0006 36E8 int1 dd 36E80006h
3BC5:31C2 E8F0 short1 dw 0E8F0h
3BC5:31C4 F5A7 short1 dw 0F5A7h
3BC5:31C6 B9 08 00 pathname1 db '╣', 8, 0
3BC5:31C9 E8 2C F5 db 'Φ,⌡'
3BC5:31CC 61E8 B9FA magic1 dd 0B9FA61E8h
3BC5:31D0 0008 23E8 int2 dd 23E80008h

C:\>

Larry