• Please review our updated Terms and Rules here

Assembler and disassembler for Intel D8742

S

silence012

Experienced Member
Joined
Oct 21, 2020
Messages
65
Location
Austria
Hi,

Does anyone know any assembler and disassembler that can be used for Intel D8742?

Kind regards,
Branko
 
I've more or less got MCS-48 working in my stuff, but you will have to build it from source, and it's only tested to work on Linux and Mac because I don't do any development on Windows. Also the disassembler is an interactive disassembler, sort of like an IDA-lite, so it may take a little getting used to.

The last zip release of the assembler is woefully out of date (extreme procrastination at work), so you need to use svn to get the current version of both.


svn co http://svn.xi6.com/svn/asmx/branches/2.x asmx
svn co http://svn.xi6.com/svn/disx4/trunk disx4
 
Chuck(G) said:
Are you sure that you mean the 8742--which is a UPI with EPROM
Click to expand...
Good point, I seem to recall that UPI has a couple of instructions different. 8048 is a minor mess. In addition to having instruction set variants, it's a pain to disassemble stuff where jump addresses depend on CPU flags. I ended up trying to scan back to look for bank switch opcodes. I recently added the ability to add 2 bits of hints to an instruction that could override a guess, but had already done 8048 by then. It was 65816 that ended up requiring the hint flags!
 
@Chuck(G) I am trying to fix an Zenith SuperSport 286 and it has D8742 which is involved very early in booting process. Basically, the computer will not boot if D8742 is not happy :)

What I am trying to achieve is to disassembly the code from it, and see what actually it tries to do.

Thanks a lot for info.
 
Yup, 8742/8042 are Universal peripheral interfaces. They have a simple microcontroller in them. MCS-48 assembly is very close but not exactly correct.

Branko and I are working on the same problem. I have two Zenith Supersport 286s, one iwth an 8742 and one with a 8042. The 8742/8042 are interchangeable between them, so they are very compatible. The 8042 from a different motherboard is NOT compatible. It's clear from logic analyzer traces that there is some intelligence in the rom program in the 8x42 that will eventually cause pin 32 to signal the rest of the board that it's time to wake up, acting as reset line.

The 8x42 in Branko's Zenith supersport never tiggers pin 32, however a logic analyzer shows the same frantic address/data communication that mine shows. At some point, mine is happy and the 8x42 hits pin 32 and wakes the rest of the board up. By reverse-engineering the rom code in the 8x42 we're hoping to understand the conditions that makes the program trigger pin 32.

(pin32 is "P15" on the chip, so I'd expect to see an "outl p1,a" with the accumulator containing a bitwise operation for p15 (port 1, bit 6?) and/or 0x20)
 
silence012 said:
I am trying to fix an Zenith SuperSport 286 and it has D8742 which is involved very early in booting process. Basically, the computer will not boot if D8742 is not happy
Click to expand...
So it's the keyboard BIOS chip? Have you dumped it yet? Hopefully it isn't read-protected. Next you need to find a schematic or something that tells which port pins go where. It seems you may already have that. Sometimes you can guess things from context, but it really helps to not have to guess.

And if you have images you just want disassembled, zip and upload them. It's sort of like candy to me, and it should only take a couple of hours, since I designed my disassembler to be fast to use. (One nice thing is that x48 code can't be very big!) But I'll be driving to Dallas for VCFSW tomorrow, so that'll slow me down a bit if you don't post something today. I wouldn't mind having something to show off using my disassembler, so I would chew on it once I got there.

I'll probably also have to tweak my disassembler if it's not the x48 variant I've been using. (Probably my assembler too, since I like to go full circle and generate a matching binary.) It'll end up being a different CPU name to tell them apart.
 
I have the rom downloaded from the D8742 (and the 80C42 - they are similar but slightly different code)

BUT: It uses UPI-41 assembly language, not MCS-48. MC48 is very close, but there are critical tweaks.
UPI-41: https://www.ceibo.com/eng/datasheets/Intel-8041-Manual.pdf
MCS-48: https://devsaurus.github.io/mcs-48/mcs-48.pdf

Example: mcs-48 has no opcode for 0x22 (0010 0010) and an mcs-48 disassembler spits out a line that cryptically just says ".db 0x22" But upi-41 DOES have an opcode that makes sense in the context. ("IN A,DBB "Input data bus contents to accumulator")

I have downloaded an mcs-48 disassembler and I've had it pass through once. Now I'm working with a disassembled version that is about 95% correct, and I'm walking through each line and verifying / correcting as needed.

So far the D8742 code jumps from 0x0000 to 0x0648, then it seems to put 0xe7ff onto the address bus, sends a dma request, loops at x0662 waiting for data, reads the data pins, some some bit magic, then pulls pin32 low. After that it jumps elsewhere in the code that I have not disassembled yet.

It's a surprisingly fun puzzle... :)
 

Attachments

  • z_8742.zip
    1.7 KB · Views: 2
Yeah, it seems I went through all that 8742 stuff a while back because I had a bunch of keyboard BIOS dumps to work with. So that was already sorted.

A quick check, and I think you might be interested in this part:

Code: 
0670:    23DF            MOV    A,#0DFH
0672:    39              OUTL    P1,A
 

Attachments

  • z_8742.BIN.asm.zip
    11.3 KB · Views: 1
Bruce Tomlin said:
Yeah, it seems I went through all that 8742 stuff a while back because I had a bunch of keyboard BIOS dumps to work with. So that was already sorted.

A quick check, and I think you might be interested in this part:

Code: 
0670:    23DF            MOV    A,#0DFH
0672:    39              OUTL    P1,A
Click to expand...

Definitely. I'm currently tracing the P1 and P2 pins on the motherboard to see where they go. Example, chip leg 32 is "p15" within the chip, part of "port 1" (p10-p17) This goes to a hex inverter and then becomes a reset line. So what do the rest do?

It definitely reaches out by placing 0xe7ff on port1 and port 2 then makes a dma request. Then when it gets the response it wants it takes leg 32 low. So, what does it not like about the input on Branko's Zenith?

I will be repeating my logic analyzer traces with much more focus on port1, port2, data etc, especially with respect to the timing of power and reset. Maybe I can actually visualize e7ff on the chip legs during hat very first part of startup.
 
Scruit said:
I have the rom downloaded from the D8742 (and the 80C42 - they are similar but slightly different code)
Click to expand...
Hi Scruit,

May I ask you how did you achieve to extract the firmware from the EPROM/ROM of your D8742 and 80C42 ICs? Did they have the security bit code protection enabled?
I'm currently in a project that involves disassembling the code from an old PC AT keyboard controller (8042 family), but in order to do so I first need a way to read the code in its program memory (dump its content).
Any guidance or source of information of how you did it will be much appreciated.

Regards.

[PS: I understand my question may not be directly related to the post, but as a new user of the forum I wasn't able to ask you this through DM. I hope moderators are Ok with this.]
 
Raul Medina said:
Hi Scruit,

May I ask you how did you achieve to extract the firmware from the EPROM/ROM of your D8742 and 80C42 ICs? Did they have the security bit code protection enabled?
I'm currently in a project that involves disassembling the code from an old PC AT keyboard controller (8042 family), but in order to do so I first need a way to read the code in its program memory (dump its content).
Any guidance or source of information of how you did it will be much appreciated.

Regards.

[PS: I understand my question may not be directly related to the post, but as a new user of the forum I wasn't able to ask you this through DM. I hope moderators are Ok with this.]
Click to expand...

- My TL866 II could not read the chip.

- The 8042 and 8742 chips had to be read using this reader/programmer:
I had to buy the optional "MCS-48 Adapter" - this is critical!!

- I did not have to deal with a security bit.


Good luck!
 
You must log in or register to reply here.
Back
Top