Alex-aut wrote on 2020-11-28, 10:43:
Please mattw, allow me to note, that SC88 needs only 20 bit of adressing, because used chip is hardwired in word modus. The adress-bit A0 in this case is used as the data_15 line.
The SC88 used ROM 'S can be configured in byte- as well in word mode. In the schematic the ROM's are used in word-mode.
I see, the question is if that fact can be used to further speed-up guessing of the address line scrambling - after first 10 bits the difficulty for me comes from the increasingly bigger and bigger block to verify if that block makes senses not and if it looks descrambled or not, actually each step the block doubles. so, it's exponential.
I looked at bit 11 and bit 12 and the only sequences that kind of look potentially possible based on the structure of the data is:
"14,6,10,5,12,7, 13, 1, 3, 2, 4, 0"
"6,14,10,5,12,7, 13, 1, 3, 2, 4, 0"
but as I said the blocks to verify just becomes bigger and bigger to be able to make fast conclusions.
in any way, I have no SC88 to sniff the address lines with logic probes, as @kitrinx did with SC-55. So, I cannot do much more, but my point was to show that SC-88 Waverom is almost hacked and data value bit shuffling is the same as SC-55/MKII and first 10 bits of address line scrambling are "10,5,12,7, 13, 1, 3, 2, 4, 0". And also to explain, why figuring our first 10 bits address line scrambling is even manually possible.
Actually, maybe someone based on the above information can find the descrambling assembler code in the Control ROM, if it's done there and figure out the rest even without SC-88 hardware and logic probles.