Difference between revisions of "Datel Action Replay PC"
Line 157: | Line 157: | ||
<br /> |
<br /> |
||
=== |
=== Dip Switches / Jumpers: === |
||
The right 3 switches on the dip switch block (S4-S6) control the ROM address, while the left two switches control the IO port. S3, the third switch from the left, is not explained. |
|||
The manual lists the following values: |
|||
{| class="wikitable" |
|||
|+ROM Address |
|||
!S4 |
|||
!S5 |
|||
!S6 |
|||
!Address |
|||
|- |
|||
|UP |
|||
|UP |
|||
|UP |
|||
|DC00h |
|||
|- |
|||
|UP |
|||
|DOWN |
|||
|DOWN |
|||
|D800h |
|||
|- |
|||
|DOWN |
|||
|UP |
|||
|DOWN |
|||
|D400h |
|||
|- |
|||
|DOWN |
|||
|UP |
|||
|UP |
|||
|D200h |
|||
|- |
|||
|UP |
|||
|UP |
|||
|DOWN |
|||
|D000h |
|||
|- |
|||
|DOWN |
|||
|DOWN |
|||
|UP |
|||
|CC00h |
|||
|- |
|||
|UP |
|||
|DOWN |
|||
|UP |
|||
|C800h |
|||
|} |
|||
<br /> |
|||
{| class="wikitable" |
|||
|+IO Port |
|||
!S1 |
|||
!S2 |
|||
!Port |
|||
|- |
|||
|UP |
|||
|UP |
|||
|280h |
|||
|- |
|||
|DOWN |
|||
|UP |
|||
|290h |
|||
|- |
|||
|UP |
|||
|DOWN |
|||
|2A0h |
|||
|- |
|||
|DOWN |
|||
|DOWN |
|||
|2B0h |
|||
|} |
|||
===Firmware=== |
|||
[https://archive.org/details/actionreplaypcfirmwarev4 The firmware] is 128 kilobytes, separated into 16 8KB Pages. |
[https://archive.org/details/actionreplaypcfirmwarev4 The firmware] is 128 kilobytes, separated into 16 8KB Pages. |
||
Each page begins with a header that says which page it is, and mentions "(c) 1993 DATEL" |
Each page begins with a header that says which page it is, and mentions "(c) 1993 DATEL" |
||
Line 167: | Line 237: | ||
<br /> |
<br /> |
||
===Anti-virus functionality |
===Anti-virus functionality=== |
||
The firmware contains [https://twitter.com/Foone/status/1232324301656735745 the signature of 50 viruses], starting at offset 0x164D8. |
The firmware contains [https://twitter.com/Foone/status/1232324301656735745 the signature of 50 viruses], starting at offset 0x164D8. |
||
Revision as of 21:11, 6 March 2020
PCB components:
Name | Type | Manufacturer | Name/Value | Pins | Info | Notes |
---|---|---|---|---|---|---|
U1 | EPROM | National Semiconductor | NM27C010 | 32 | datasheet | |
U2 | Dual Flip-flop | HC74A | 14 | datasheet | ||
U3 | SRAM (8KB) | Hyundai | HM6264ALJ-10 | 28 | datasheet | 8 Kilobytes (8K words by 8-bits), 10 nanoseconds |
U4 | SRAM (128KB) | Hitachi | HM628128LFP-7 | 32 | datasheet | 128 Kilobytes (8K words by 8-bits), 70 nanoseconds.
L=low standby power (10 uW) |
U5 | 555 Timer | STMicroelectronics | NE555 | 8 | datasheet | |
P1 | Programmable Logic Array | AMD | PALCE20V8Q | 24 | datasheet | The part number "PALCE20V8Q" decodes as:
20 inputs, 8 flip/flops or outputs, Quarter power (55 mA Icc) |
P2 | Programmable Logic Array | AMD | PALCE20V8Q | 24 | datasheet | |
P3 | Programmable Logic Array | AMD | PALCE20V8Q | 24 | datasheet | |
P4 | Programmable Logic Array | AMD | PALCE20V8Q | 24 | datasheet | |
C1 | Capacitor | |||||
C2 | Capacitor | |||||
C3 | Capacitor | 1 uF / 63v | ||||
D1 | Diode | |||||
D2 | Diode | |||||
R1 | Resistor | 23k Ω | ||||
R2 | Resistor | 100k Ω | ||||
R3 | Resistor | 1K Ω | ||||
J1 | Connector | DB-9 male |
Dip Switches / Jumpers:
The right 3 switches on the dip switch block (S4-S6) control the ROM address, while the left two switches control the IO port. S3, the third switch from the left, is not explained.
The manual lists the following values:
S4 | S5 | S6 | Address |
---|---|---|---|
UP | UP | UP | DC00h |
UP | DOWN | DOWN | D800h |
DOWN | UP | DOWN | D400h |
DOWN | UP | UP | D200h |
UP | UP | DOWN | D000h |
DOWN | DOWN | UP | CC00h |
UP | DOWN | UP | C800h |
S1 | S2 | Port |
---|---|---|
UP | UP | 280h |
DOWN | UP | 290h |
UP | DOWN | 2A0h |
DOWN | DOWN | 2B0h |
Firmware
The firmware is 128 kilobytes, separated into 16 8KB Pages. Each page begins with a header that says which page it is, and mentions "(c) 1993 DATEL"
The AREPLAY.COM file has error strings for "Action Replay ram not switchable" and "Replay base address is not being shadowed" which suggests the larger SRAM chip (U4) is being used to shadow the EPROM at runtime.
There was at least one upgrade to the EPROM provided, which involved mailing out a replacement chip to users.
Anti-virus functionality
The firmware contains the signature of 50 viruses, starting at offset 0x164D8.
Each name is proceeded by an 0xFE character, can be up to 26 letters long, and is padded with spaces.
IBM Control
The external "paddle" features a button, switch, and LED. The PCB inside calls it the "Datel IBM Control"
Connection | Color | |
---|---|---|
1 | N/C | N/A |
2 | LED | Brown |
3 | Switch | Black |
4 | Button | Blue |
5 | Ground | Green |
6 | N/C | |
7 | N/C | Yellow |
8 | N/C | |
9 | N/C | |
Shell | N/C | Orange |
Credits:
The firmware contains credits at offset 4F64: (TODO: See if you can view this from within the program)
Action Replay v1.3 (c) 1993 DATEL Programmer ............................ Simon P.Constable Project Manager ......................... Wayne H.Beckett Design ................................... Mike J.Connors ......................................... Wayne H.Beckett Hardware .................................. Roy C.Harding Support .................................... Mark Wallace .......................................... Damon P.Barwin
Twitter Threads:
- When the Brandon unit first showed up on ebay (April 24th, 2019)
- In response to the LGR video (February 21st, 2020)
- Firmware image reverse engineering (February 25th 2020)
- Status update after the card arrived (February 27th, 2020)
Related Links:
- Lazy Game Reviews video on the Action Replay PC
- Manual, PCB images, and software
- VCFed thread
- Version 4 firmware dump