Maelgrum wrote on 2023-10-05, 18:55:

From 4.13 […]
Show full quote

S95Sedan wrote on 2023-10-05, 18:45:

See attached; line 1225 (413) line 1095 (416) […]
Show full quote

Maelgrum wrote on 2023-10-05, 18:35:

Group 4 commands ( 4X)

See attached;
line 1225 (413)
line 1095 (416)

Yeah the code is the same but the routine doesnt jump to the table in 4.16. (hence the X0a60 vs X0260)
Dont know if this is intentional or another error on their part.

From 4.13

Copy code to clipboard

1convert_samplerate:
2	mov	dptr,#samplerate_table; 08b6   90 08 bb   ..;
3	movc	a,@a+dptr	; 08b9   93         .
4	ret			; 08ba   22         "
5;
6samplerate_table:	db	15h,16h,16h,16h,16h,16h,16h,16h		; 08bb ........
7	db	16h,16h,16h,16h,17h,17h,17h,17h		; 08c3 ........
8	db	17h,17h,17h,17h,17h,17h,18h,18h		; 08cb ........
9	db	18h,18h,18h,18h,18h,18h,18h,18h		; 08d3 ........
10	db	19h,19h,19h,19h,19h,19h,19h,19h		; 08db ........
11	db	1ah,1ah,1ah,1ah,1ah,1ah,1ah,1ah		; 08e3 ........
12	db	1bh,1bh,1bh,1bh,1bh,1bh,1bh,1bh		; 08eb ........
13	db	1ch,1ch,1ch,1ch,1ch,1ch,1ch,1dh		; 08f3 ........
14	db	1dh,1dh,1dh,1dh,1dh,1eh,1eh,1eh		; 08fb ........
15	db	1eh,1eh,1eh,1fh,1fh,1fh,1fh,1fh		; 0903 ........
16	db	1fh,20h,20h,20h,20h,20h,21h,21h		; 090b .     !!
17	db	21h,21h,21h,22h,22h,22h,22h,22h		; 0913 !!!"""""
18	db	23h,23h,23h,23h,24h,24h,24h,24h		; 091b ####$$$$
19	db	25h,25h,25h,25h,26h,26h,26h,26h		; 0923 %%%%&&&&
20	db	27h,27h,27h,27h,28h,28h,28h,29h		; 092b ''''((()
21	db	29h,29h,29h,2ah,2ah,2ah,2bh,2bh		; 0933 )))***++
22	db	2bh,2ch,2ch,2dh,2dh,2dh,2eh,2eh		; 093b +,,---..
23	db	2eh,2fh,2fh,30h,30h,30h,31h,31h		; 0943 .//00011
24	db	32h,32h,33h,33h,34h,34h,35h,35h		; 094b 22334455
25	db	36h,36h,37h,37h,38h,38h,39h,39h		; 0953 66778899
26	db	3ah,3bh,3bh,3ch,3dh,3dh,3eh,3fh		; 095b :;;<==>?
27	db	3fh,40h,41h,42h,42h,43h,44h,45h		; 0963 ?@ABBCDE
28	db	46h,47h,48h,49h,49h,4ah,4bh,4dh		; 096b FGHIIJKM
29	db	4eh,4fh,50h,51h,52h,53h,55h,56h		; 0973 NOPQRSUV
30	db	57h,59h,5ah,5ch,5dh,5fh,60h,62h		; 097b WYZ\]_`b
31	db	64h,66h,68h,6ah,6ch,6eh,70h,72h		; 0983 dfhjlnpr
32	db	75h,77h,7ah,7ch,7fh,82h,85h,89h		; 098b uwz|....
33	db	8ch,90h,93h,97h,9ch,0a0h,0a5h,0aah	; 0993 ..... %*
34	db	0afh,0b5h,0bbh,0c1h,0c8h,0d0h,0d8h,0e0h	; 099b /5;AHPX`
35	db	0eah,0f4h,0ffh,0ffh			; 09a3 jt..

Yeah that looks the same, apart from a label down the table.
But i suppose its a conversion error somewhere then.

See below.

S95Sedan wrote on 2023-10-05, 19:03:

Yeah that looks the same, apart from a label down the table.
But i suppose its a conversion error somewhere then.

See below.

From V4.16:

1convert_samplerate:
2	mov	dptr,#samplerate_table; 08b6   90 08 bb   ..;
3	movc	a,@a+dptr	; 08b9   93         .
4	ret			; 08ba   22         "
5;
6samplerate_table:	db	15h,16h,16h,16h,16h,16h,16h,16h		; 08bb ........
7	db	16h,16h,16h,16h,17h,17h,17h,17h		; 08c3 ........
8	db	17h,17h,17h,17h,17h,17h,18h,18h		; 08cb ........
9	db	18h,18h,18h,18h,18h,18h,18h,18h		; 08d3 ........
10	db	19h,19h,19h,19h,19h,19h,19h,19h		; 08db ........
11	db	1ah,1ah,1ah,1ah,1ah,1ah,1ah,1ah		; 08e3 ........
12	db	1bh,1bh,1bh,1bh,1bh,1bh,1bh,1bh		; 08eb ........
13	db	1ch,1ch,1ch,1ch,1ch,1ch,1ch,1dh		; 08f3 ........
14	db	1dh,1dh,1dh,1dh,1dh,1eh,1eh,1eh		; 08fb ........
15	db	1eh,1eh,1eh,1fh,1fh,1fh,1fh,1fh		; 0903 ........
16	db	1fh,20h,20h,20h,20h,20h,21h,21h		; 090b .     !!
17	db	21h,21h,21h,22h,22h,22h,22h,22h		; 0913 !!!"""""
18	db	23h,23h,23h,23h,24h,24h,24h,24h		; 091b ####$$$$
19	db	25h,25h,25h,25h,26h,26h,26h,26h		; 0923 %%%%&&&&
20	db	27h,27h,27h,27h,28h,28h,28h,29h		; 092b ''''((()
21	db	29h,29h,29h,2ah,2ah,2ah,2bh,2bh		; 0933 )))***++
22	db	2bh,2ch,2ch,2dh,2dh,2dh,2eh,2eh		; 093b +,,---..
23	db	2eh,2fh,2fh,30h,30h,30h,31h,31h		; 0943 .//00011
24	db	32h,32h,33h,33h,34h,34h,35h,35h		; 094b 22334455
25	db	36h,36h,37h,37h,38h,38h,39h,39h		; 0953 66778899
26	db	3ah,3bh,3bh,3ch,3dh,3dh,3eh,3fh		; 095b :;;<==>?
27	db	3fh,40h,41h,42h,42h,43h,44h,45h		; 0963 ?@ABBCDE
28	db	46h,47h,48h,49h,49h,4ah,4bh,4dh		; 096b FGHIIJKM
29	db	4eh,4fh,50h,51h,52h,53h,55h,56h		; 0973 NOPQRSUV
30	db	57h,59h,5ah,5ch,5dh,5fh,60h,62h		; 097b WYZ\]_`b
31	db	64h,66h,68h,6ah,6ch,6eh,70h,72h		; 0983 dfhjlnpr
32	db	75h,77h,7ah,7ch,7fh,82h,85h,89h		; 098b uwz|....
33	db	8ch,90h,93h,97h,9ch,0a0h,0a5h,0aah	; 0993 ..... %*
34	db	0afh,0b5h,0bbh,0c1h,0c8h,0d0h,0d8h,0e0h	; 099b /5;AHPX`
35	db	0eah,0f4h,0ffh,0ffh			; 09a3 jt..

From 4.13:

1convert_samplerate:
2	mov	dptr,#samplerate_table; 0987   90 09 8c   ...
3	movc	a,@a+dptr	; 098a   93         .
4	ret			; 098b   22         "
5;
6samplerate_table:	db	15h,16h,16h,16h,16h,16h,16h,16h		; 098c ........
7	db	16h,16h,16h,16h,17h,17h,17h,17h		; 0994 ........
8	db	17h,17h,17h,17h,17h,17h,18h,18h		; 099c ........
9	db	18h,18h,18h,18h,18h,18h,18h,18h		; 09a4 ........
10	db	19h,19h,19h,19h,19h,19h,19h,19h		; 09ac ........
11	db	1ah,1ah,1ah,1ah,1ah,1ah,1ah,1ah		; 09b4 ........
12	db	1bh,1bh,1bh,1bh,1bh,1bh,1bh,1bh		; 09bc ........
13	db	1ch,1ch,1ch,1ch,1ch,1ch,1ch,1dh		; 09c4 ........
14	db	1dh,1dh,1dh,1dh,1dh,1eh,1eh,1eh		; 09cc ........
15	db	1eh,1eh,1eh,1fh,1fh,1fh,1fh,1fh		; 09d4 ........
16	db	1fh,20h,20h,20h,20h,20h,21h,21h		; 09dc .     !!
17	db	21h,21h,21h,22h,22h,22h,22h,22h		; 09e4 !!!"""""
18	db	23h,23h,23h,23h,24h,24h,24h,24h		; 09ec ####$$$$
19	db	25h,25h,25h,25h,26h,26h,26h,26h		; 09f4 %%%%&&&&
20	db	27h,27h,27h,27h,28h,28h,28h,29h		; 09fc ''''((()
21	db	29h,29h,29h,2ah,2ah,2ah,2bh,2bh		; 0a04 )))***++
22	db	2bh,2ch,2ch,2dh,2dh,2dh,2eh,2eh		; 0a0c +,,---..
23	db	2eh,2fh,2fh,30h,30h,30h,31h,31h		; 0a14 .//00011
24	db	32h,32h,33h,33h,34h,34h,35h,35h		; 0a1c 22334455
25	db	36h,36h,37h,37h,38h,38h,39h,39h		; 0a24 66778899
26	db	3ah,3bh,3bh,3ch,3dh,3dh,3eh,3fh		; 0a2c :;;<==>?
27	db	3fh,40h,41h,42h,42h,43h,44h,45h		; 0a34 ?@ABBCDE
28	db	46h,47h,48h,49h,49h,4ah,4bh,4dh		; 0a3c FGHIIJKM
29	db	4eh,4fh,50h,51h,52h,53h,55h,56h		; 0a44 NOPQRSUV
30	db	57h,59h,5ah,5ch,5dh,5fh,60h,62h		; 0a4c WYZ\]_`b
31	db	64h,66h,68h,6ah,6ch,6eh,70h,72h		; 0a54 dfhjlnpr
32	db	75h,77h,7ah,7ch,7fh,82h,85h,89h		; 0a5c uwz|....
33	db	8ch,90h,93h,97h,9ch,0a0h,0a5h,0aah	; 0a64 ..... %*
34	db	0afh,0b5h,0bbh,0c1h,0c8h,0d0h,0d8h,0e0h	; 0a6c /5;AHPX`
35	db	0eah,0f4h,0ffh,0ffh			; 0a74 jt..

Dont see any difference ))

This is disassembled 4.13 and 4.16
.ctl files for D52 are made by my autotool

It's there a version string inside the firmware? Does it say 4.13 or 4.16?

Kahenraz wrote on 2023-10-05, 20:19:

It's there a version string inside the firmware? Does it say 4.13 or 4.16?

Not string. but 2 bytes: (from V4.16)
dspver: db 4,10h ; 1658 ..

Maelgrum wrote on 2023-10-05, 19:26:

This is disassembled 4.13 and 4.16
.ctl files for D52 are made by my autotool

Heres a more complete merged 4.13 one with some of the comparing done from this;
https://github.com/schlae/sb-firmware/blob/master/sbv202.asm

Alot of the names in general and of the command groups are added.

@Maelgrum : do you think it will work on older DSPs? I mean now after stage4 seems like perfected. I don't have any DSP 3.x or 2.x cards otherwise, would have tried "stage1" myself already and see what it will output.

Older versions of FW (less than 4) AFAIK do not have functions F9 and FA, without them, this method of dumping does not work.

mattw wrote on 2023-10-05, 20:54:

@Maelgrum : do you think it will work on older DSPs? I mean now after stage4 seems like perfected. I don't have any DSP 3.x or 2.x cards otherwise, would have tried "stage1" myself already and see what it will output.

This 'Stage 1' cannot work on DSP < 4.xx, it uses MPU-401, and injection attack is made via MPU recieve routine
F9 and FA - needs checking
[EDIT] no F9 and FA, and dont found any other mem read/write commands. but not looked very deep

So it sounds like based on the analysis so far 4.13 patch 4 is actually superior to 4.16 since it saves the registers properly and retains CSP support

maxtherabbit wrote on 2023-10-05, 21:02:

So it sounds like based on the analysis so far 4.13 patch 4 is actually superior to 4.16 since it saves the registers properly and retains CSP support

Better interrupt handlers is very minor improvement, but CSP support without hanging notes is good. So far it looks superior.
I am looking into cmd 0x14 (single cycle DMA) code path right now - can it be improved ?....

Having seen utilities that does EEPROM flashing on AWE64 sound cards. Could be possible to use the patched DSP v4.13 (or somehow a patched v4.16)?

Gmlb256 wrote on 2023-10-05, 21:09:

Having seen utilities that does EEPROM flashing on AWE64 sound cards. Could be possible to use the patched DSP v4.13 (or somehow a patched v4.16)?

Can you point at this utility ?

Maelgrum wrote on 2023-10-05, 21:07:

maxtherabbit wrote on 2023-10-05, 21:02:

So it sounds like based on the analysis so far 4.13 patch 4 is actually superior to 4.16 since it saves the registers properly and retains CSP support

Better interrupt handlers is very minor improvement, but CSP support without hanging notes is good. So far it looks superior.
I am looking into cmd 0x14 (single cycle DMA) code path right now - can it be improved ?....

Maybe enabling FIFO for command 0x14 can cure Single cycle DMA problem ...

Maelgrum wrote on 2023-10-05, 21:11:

Gmlb256 wrote on 2023-10-05, 21:09:

Having seen utilities that does EEPROM flashing on AWE64 sound cards. Could be possible to use the patched DSP v4.13 (or somehow a patched v4.16)?

Can you point at this utility ?

no those are for the EEPROM that contains IDs and the PnP info, not the DSP:

Re: SB2AWE EEPROM flasher utility.

SB2AWE EEPROM flasher utility.

I think Dell were the one that leaked the EEPROM tool, then it was reversed-engineered.

[EDIT] however, I am not sure considering my "conspiracy theory" about CT4170 and DSP V4.13 v DSPv4.16. I don't know why Dell needed to update only the EEPROM. maybe, only the EEPROM part of the Dell tool was reversed-engineered and it's capable to update/patch DSP. I don't know... but it makes no sense as all AWE64 have V4.16 and so it has to be limited to the EEPROM.

S95Sedan wrote on 2023-10-05, 20:34:

Heres a more complete merged 4.13 one with some of the comparing done from this; https://github.com/schlae/sb-firmware/blob/mast […]
Show full quote

Maelgrum wrote on 2023-10-05, 19:26:

This is disassembled 4.13 and 4.16
.ctl files for D52 are made by my autotool

Heres a more complete merged 4.13 one with some of the comparing done from this;
https://github.com/schlae/sb-firmware/blob/master/sbv202.asm

Alot of the names in general and of the command groups are added.

This merging is not reliable - it contains some invalid definitions , like:
m 24 autoinit_16bit ; 24h.2 x
this is not true ))
So it is better to analyze code, what was true in DSP 2.0, is not in DSP 4.xx

mattw wrote on 2023-10-05, 21:13:

no those are for the EEPROM that contains IDs and the PnP info, not the DSP: […]
Show full quote

Maelgrum wrote on 2023-10-05, 21:11:

Gmlb256 wrote on 2023-10-05, 21:09:

Having seen utilities that does EEPROM flashing on AWE64 sound cards. Could be possible to use the patched DSP v4.13 (or somehow a patched v4.16)?

Can you point at this utility ?

no those are for the EEPROM that contains IDs and the PnP info, not the DSP:

Re: SB2AWE EEPROM flasher utility.

SB2AWE EEPROM flasher utility.

I think Dell were the one leaked the EEPROM tool, then it was reversed-engineered.

That's a bummer, I thought that these utilities could flash the DSP firmware. 😒

Gmlb256 wrote on 2023-10-05, 21:19:

That's a bummer, I thought that these utilities could flash the DSP firmware. 😒

What I don't understand is why Dell released those AWE64 EEPROM flash tools in the first place - they say to recover your AWE64, but recover it from what? do they suffer some random EEPROM damage. I don't own AWE64 and I don't know. So, in what case the Dell tool was supposed to be used and intended originally for?

mattw wrote on 2023-10-05, 21:22:

Gmlb256 wrote on 2023-10-05, 21:19:

That's a bummer, I thought that these utilities could flash the DSP firmware. 😒

What I don't understand is why Dell released those AWE64 EEPROM flash tools in the first place - they say to recover your AWE64, but recover it from what? do they suffer some random EEPROM damage. I don't own AWE64 and I don't know. So, in what case the Dell tool was supposed to be used and intended originally for?

I don't know about it either tbh as mine never suffered that.

mattw wrote on 2023-10-05, 21:22:

What I don't understand is why Dell released those AWE64 EEPROM flash tools in the first place - they say to recover your AWE64, but recover it from what? do they suffer some random EEPROM damage. I don't own AWE64 and I don't know. So, in what case the Dell tool was supposed to be used and intended originally for?

As far as I'm aware, AWE64s store PNP configuration information in the eeprom and if it gets incompletely written while being changed (updated? rewritten on power-up?) it will render the card invisible.
Fortunately I personally have not suffered this.