VOGONS


First post, by mattw

User metadata
Rank Oldbie
Rank
Oldbie

hi All,

I wonder how Sound Bank ROM dumps are made, for example here:

Re: DB60XG / XR385 repair and modification

'jwt27 ' said: "I dumped the DB60XG's firmware ROM a (long) while ago"

that is very similar hardware to "NEC XR385" board, which I have, but cannot find any information how exactly I can read any of the chips on the board. (I wanted to use that board for practicing of doing such a task).

Also, there are Roland SC-55 ROM dumps floating around the Internet, including the 3 x 1MB ROM chips containing the Sound Bank. How that dump was made - how can I read those chips?

I am asking, because ultimately I want to dump the Sound Bank from my Yamaha SW1000XG - anyone knows anything about that - I cannot even identify, which chips hold the data, even less how I can read those chips.

So, if anyone, can point me to a right direction, I can solder, desolder, etc quite well, but I am completely lost on how such dumps are made.

Thanks!

Reply 1 of 10, by mkarcher

User metadata
Rank l33t
Rank
l33t

A ROM is a chip that can be easily read on a EPROM/Flash reading/programming device like the MiniPro TL866. In case of the sound cards discussed here, the ROM chips are SMD chips, so you need an adapter board. On the NEC XR385, the chip IC7 with the MX logo (for Macronix) definitely is a ROM chip in a PSOP44 case. Possibly the Yamaha-branded chips IC3(?) and IC6 in the same case are also ROM chips. You "just" need to desolder them, and connect them to an adapter that you can plug into an EPROM reader. The adapter might either be a PCB you solder the ROM chip to (cheap way), or it might have a solderless test socket (comfortable way).

Reply 2 of 10, by Tiido

User metadata
Rank l33t
Rank
l33t

Yeah, that's how things are done. You desolder the chip, pop it in a programming adaptor and use your favorite programmer to read the chip, assuming proper chip type is chosen as the pinouts of ROMs are not always same as normal EPROMs and flash chips one normally uses a programmer device for.

T-04YBSC, a new YMF71x based sound card & Official VOGONS thread about it
Newly made 4MB 60ns 30pin SIMMs ~
mida sa loed ? nagunii aru ei saa 😜

Reply 3 of 10, by mattw

User metadata
Rank Oldbie
Rank
Oldbie

OK, but in my case how I can ID what type of EPROM are those "Yamaha" branded chips - I mean the programmer and the adapter are probably dependent on the exact type - which pins are data, which are power supply pins, etc?

Reply 4 of 10, by mattw

User metadata
Rank Oldbie
Rank
Oldbie

I found interesting Twitter thread of how Creative CT1351V202 ROM/firmware was dumped:

https://twitter.com/TubeTimeUS/status/1137554976257929217

it's fascinating, but away over my skills - the chip top was "decapsulated" then with microscope and some jig i don't recognize (consisting of 44-PLCC to 40-DIP adapter and something to hold wire thinner than human hair in place to probe each line of the IC directly). I don't recognize the GUI of the software used either.

So, I guess with those "special" branded like Yamaha, Creative, etc PROMs it's not that simple and trivial to dump...

Reply 5 of 10, by Jorpho

User metadata
Rank l33t++
Rank
l33t++
mattw wrote on 2020-09-24, 04:17:

OK, but in my case how I can ID what type of EPROM are those "Yamaha" branded chips - I mean the programmer and the adapter are probably dependent on the exact type - which pins are data, which are power supply pins, etc?

Isn't there anything written on the chip already which may possibly be used to identify it in a Yamaha parts catalog?

Reply 6 of 10, by mattw

User metadata
Rank Oldbie
Rank
Oldbie
Jorpho wrote on 2020-09-24, 05:02:

Isn't there anything written on the chip already which may possibly be used to identify it in a Yamaha parts catalog?

in case of Yamaha SW60XG/DB60 ("db60" as far as i know is identical to what I have - "NEC XR385") here:

Re: DB60XG / XR385 repair and modification

'jwt27' described them as "Both wave ROMs appear to be 4Mx8 types" and that the chips are marked as "Yamaha XR371" and "XR392".

at least that is in 'jwt27' case and board, because on my "NEC XR385" board the marking is not even "XR", but "XQ" and it's not 371, but 731. So, it's XQ731 in my case and I am not alone as I found picture here:

https://www.wavetable.nl/wp-content/uploads/Y … maha-SW60XG.jpg

having the same XQ731 as I do and XR371 is nowhere to be found. In any way in which Yamaha part catalog that XQ731 (or XR371) is documented or even better - how it can be read and dumped?

In case of Yamaha SW1000XG - I have no any clue which Yamaha branded chips might be the PROMs holding the wave data (I see at least 5 chips based on their package as potential candidates - 2 of them are with "MX" logo as well and their marking is "XV389A0" and "XV390A0" - but I kind of doubt anyone knows those marking, I mean it's some custom Yamaha part obviously).

Reply 7 of 10, by mkarcher

User metadata
Rank l33t
Rank
l33t
mattw wrote on 2020-09-24, 04:17:

OK, but in my case how I can ID what type of EPROM are those "Yamaha" branded chips - I mean the programmer and the adapter are probably dependent on the exact type - which pins are data, which are power supply pins, etc?

I guess they are not EPROMs that you can "E"rase and "P"rogram, but plain old mask ROMs that get produced with specific content at the factory and can never by modified (while operated within specification). ROM pin assignments are mostly standardized since the late 80s (memory manufacturers have a joint working group called JEDEC that proposes pin assignments, and these proposals are virtually always used), so setting your EPROM reader for any kind of EPROM or ROM with the correct pinout (SOP-44/PSOP-44 in your case) should work. The most important variable is the supply voltage. You can measure the voltage in the operating device or you can use a continuity buzzer to check whether the supply pin of the ROM is directly connected to a supply rail on the waveblaster connector. I am quite confident your board is a good old 5V only design - but better check that before applying 5V to a low-voltage ROM that is specified at 3.7V absolute maximum.

The programmers have that many product type choices because the programming voltage and the suggested programming algorithm (or for more advanced chips: the sector layout and command set details) vary, but this does not affect read-out.

Reply 9 of 10, by leileilol

User metadata
Rank l33t++
Rank
l33t++

In some cases there can be specialized software that can dump the off a specific card directly, like AWE-DUMP for AWE32 cards (which involved some emu trickery to reverse it out)

apsosig.png
long live PCem

Reply 10 of 10, by mattw

User metadata
Rank Oldbie
Rank
Oldbie
leileilol wrote on 2020-09-26, 14:47:

In some cases there can be specialized software that can dump the off a specific card directly, like AWE-DUMP for AWE32 cards (which involved some emu trickery to reverse it out)

thanks, good to know about that tool, i have awe32 lying around somewhere...