SPC7110 Reverse Engineering Project
Posted: Mon May 12, 2008 4:11 pm
We're looking for someone to build us a device to allow us to decompress arbitrary data from the SPC7110 chip from Epson, so we can reverse engineer the algorithm used.
The chip is used in Far East of Eden Zero, Momotarou Dentetsu Happy, and Super Power Leauge 4.
CaitSith2 has some source code up for talking to the SPC7110 here: http://www.caitsith2.com/snes/snes_cart_dumper.htm
The general process of setting up a decompression:
1. If the data rom is > 1MB, Goto step 2, otherwise go to step 3.
2. Initialize access, by writing this sequence of bytes to 00:4830.
0x80 0x00 0x80 0x80 0x00 0x80 0x00 0x80 0x00 0x80 0x00 0x80 0x80 0x00 0x80 0x00.
3. Write 0x00 to 00:480B
4. Write the address of the table to 00:4801-4803, with low byte to 00:4801
5. Write the Index to 00:4804
6. Set DMA channel to 00:4807 (not needed if dumping directly)
7. Write offset to return after finished decompressing, to 00:4805-4806, low byte to 00:4805.
8. Read 00:480C until bit 7 is set. (any attempts to read decompressed data before the chip is finished, results in 0x00 being returned. The decompression buffer is 32K as far as we know.)
9. Write 0x00 to 00:4808-4809.
10. Read 00:4800 for however many bytes your going to read from the decompression buffer.
If you wish to read any bytes above the 1MB boundry, (E0:0000-FF:FFFF), you need to follow step 2 above.
The beginning of the data rom is always 0x01020408 0x10204080, and the end of the data rom is always 0xFEFDFBF7 0xEFDFBF7F. This was put in place for checking that data rom access works when the spc7110 runs its hardware test. This is why the first table is always at 0x000008 from the beginning of the data rom.
---------------
We basically need a PC program with source code too (DOS, Windows, Linux, or BSD doesn't really matter as long as it works), that would allow us to pass a block of data to the chip, then return the decompressed data.
Can be connected to the PC via any normal port, serial, parrallel, USB, or FireWire, two connections are fine too (although preferably not two parrallels, since I don't know any of us with a single PC with that).
I imagine to do the hardware, it would need a ROM emulator replacing the data ROM, and some type of connector to a PC on the other end.
We'll handle setting up automated tests once we have a working device and software to simply talk to it. Anyone have the skill and interested in building us what we need? Also, please let us know in advance how much this will cost (hardware, and effort), so we can raise the money. If any hardware is needed that we already have, let us know.
Many thanks in advance.
The chip is used in Far East of Eden Zero, Momotarou Dentetsu Happy, and Super Power Leauge 4.
CaitSith2 has some source code up for talking to the SPC7110 here: http://www.caitsith2.com/snes/snes_cart_dumper.htm
The general process of setting up a decompression:
1. If the data rom is > 1MB, Goto step 2, otherwise go to step 3.
2. Initialize access, by writing this sequence of bytes to 00:4830.
0x80 0x00 0x80 0x80 0x00 0x80 0x00 0x80 0x00 0x80 0x00 0x80 0x80 0x00 0x80 0x00.
3. Write 0x00 to 00:480B
4. Write the address of the table to 00:4801-4803, with low byte to 00:4801
5. Write the Index to 00:4804
6. Set DMA channel to 00:4807 (not needed if dumping directly)
7. Write offset to return after finished decompressing, to 00:4805-4806, low byte to 00:4805.
8. Read 00:480C until bit 7 is set. (any attempts to read decompressed data before the chip is finished, results in 0x00 being returned. The decompression buffer is 32K as far as we know.)
9. Write 0x00 to 00:4808-4809.
10. Read 00:4800 for however many bytes your going to read from the decompression buffer.
If you wish to read any bytes above the 1MB boundry, (E0:0000-FF:FFFF), you need to follow step 2 above.
The beginning of the data rom is always 0x01020408 0x10204080, and the end of the data rom is always 0xFEFDFBF7 0xEFDFBF7F. This was put in place for checking that data rom access works when the spc7110 runs its hardware test. This is why the first table is always at 0x000008 from the beginning of the data rom.
---------------
We basically need a PC program with source code too (DOS, Windows, Linux, or BSD doesn't really matter as long as it works), that would allow us to pass a block of data to the chip, then return the decompressed data.
Can be connected to the PC via any normal port, serial, parrallel, USB, or FireWire, two connections are fine too (although preferably not two parrallels, since I don't know any of us with a single PC with that).
I imagine to do the hardware, it would need a ROM emulator replacing the data ROM, and some type of connector to a PC on the other end.
We'll handle setting up automated tests once we have a working device and software to simply talk to it. Anyone have the skill and interested in building us what we need? Also, please let us know in advance how much this will cost (hardware, and effort), so we can raise the money. If any hardware is needed that we already have, let us know.
Many thanks in advance.
