Assembler and disassembler for Intel D8742

[silence012]

Hi,

Does anyone know any assembler and disassembler that can be used for Intel D8742?

Kind regards,
Branko

 

[Bruce Tomlin]

I've more or less got MCS-48 working in my stuff, but you will have to build it from source, and it's only tested to work on Linux and Mac because I don't do any development on Windows. Also the disassembler is an interactive disassembler, sort of like an IDA-lite, so it may take a little getting used to.

The last zip release of the assembler is woefully out of date (extreme procrastination at work), so you need to use svn to get the current version of both.

asmx multi-CPU assembler

disx multi-CPU disassembler

svn co http://svn.xi6.com/svn/asmx/branches/2.x asmx
svn co http://svn.xi6.com/svn/disx4/trunk disx4

 

[Chuck(G)]

Are you sure that you mean the 8742--which is a UPI with EPROM (i.e. a peripheral)--not an MCU?
You can find the Intel MCS-48 assembler here: http://www.acebus.com/8048.htm for DOS.

 

[Bruce Tomlin]

Are you sure that you mean the 8742--which is a UPI with EPROM

Good point, I seem to recall that UPI has a couple of instructions different. 8048 is a minor mess. In addition to having instruction set variants, it's a pain to disassemble stuff where jump addresses depend on CPU flags. I ended up trying to scan back to look for bank switch opcodes. I recently added the ability to add 2 bits of hints to an instruction that could override a guess, but had already done 8048 by then. It was 65816 that ended up requiring the hint flags!

 

[silence012]

@Chuck(G) I am trying to fix an Zenith SuperSport 286 and it has D8742 which is involved very early in booting process. Basically, the computer will not boot if D8742 is not happy

What I am trying to achieve is to disassembly the code from it, and see what actually it tries to do.

Thanks a lot for info.

 

[Chuck(G)]

The 8742 is an EPROM version of the 8042 see here. It's not intended as a stand-alone MCU, but as a "slave" MCU. (Yeah, I know, small difference). There should be a bunch of information on the MCS-48 family on bitsavers. Also, there is this project for reading and programming the things, if your programmer doesn't already: https://www.mattmillman.com/project...8-8749-8741-8742-8048-8049-programmer-reader/

 

[Scruit]

Yup, 8742/8042 are Universal peripheral interfaces. They have a simple microcontroller in them. MCS-48 assembly is very close but not exactly correct.

Branko and I are working on the same problem. I have two Zenith Supersport 286s, one iwth an 8742 and one with a 8042. The 8742/8042 are interchangeable between them, so they are very compatible. The 8042 from a different motherboard is NOT compatible. It's clear from logic analyzer traces that there is some intelligence in the rom program in the 8x42 that will eventually cause pin 32 to signal the rest of the board that it's time to wake up, acting as reset line.

The 8x42 in Branko's Zenith supersport never tiggers pin 32, however a logic analyzer shows the same frantic address/data communication that mine shows. At some point, mine is happy and the 8x42 hits pin 32 and wakes the rest of the board up. By reverse-engineering the rom code in the 8x42 we're hoping to understand the conditions that makes the program trigger pin 32.

(pin32 is "P15" on the chip, so I'd expect to see an "outl p1,a" with the accumulator containing a bitwise operation for p15 (port 1, bit 6?) and/or 0x20)

 

[Bruce Tomlin]

I am trying to fix an Zenith SuperSport 286 and it has D8742 which is involved very early in booting process. Basically, the computer will not boot if D8742 is not happy

So it's the keyboard BIOS chip? Have you dumped it yet? Hopefully it isn't read-protected. Next you need to find a schematic or something that tells which port pins go where. It seems you may already have that. Sometimes you can guess things from context, but it really helps to not have to guess.

And if you have images you just want disassembled, zip and upload them. It's sort of like candy to me, and it should only take a couple of hours, since I designed my disassembler to be fast to use. (One nice thing is that x48 code can't be very big!) But I'll be driving to Dallas for VCFSW tomorrow, so that'll slow me down a bit if you don't post something today. I wouldn't mind having something to show off using my disassembler, so I would chew on it once I got there.

I'll probably also have to tweak my disassembler if it's not the x48 variant I've been using. (Probably my assembler too, since I like to go full circle and generate a matching binary.) It'll end up being a different CPU name to tell them apart.

 

[Scruit]

I have the rom downloaded from the D8742 (and the 80C42 - they are similar but slightly different code)

BUT: It uses UPI-41 assembly language, not MCS-48. MC48 is very close, but there are critical tweaks.
UPI-41: https://www.ceibo.com/eng/datasheets/Intel-8041-Manual.pdf
MCS-48: https://devsaurus.github.io/mcs-48/mcs-48.pdf

Example: mcs-48 has no opcode for 0x22 (0010 0010) and an mcs-48 disassembler spits out a line that cryptically just says ".db 0x22" But upi-41 DOES have an opcode that makes sense in the context. ("IN A,DBB "Input data bus contents to accumulator")

I have downloaded an mcs-48 disassembler and I've had it pass through once. Now I'm working with a disassembled version that is about 95% correct, and I'm walking through each line and verifying / correcting as needed.

So far the D8742 code jumps from 0x0000 to 0x0648, then it seems to put 0xe7ff onto the address bus, sends a dma request, loops at x0662 waiting for data, reads the data pins, some some bit magic, then pulls pin32 low. After that it jumps elsewhere in the code that I have not disassembled yet.

It's a surprisingly fun puzzle...

 

[Bruce Tomlin]

Yeah, it seems I went through all that 8742 stuff a while back because I had a bunch of keyboard BIOS dumps to work with. So that was already sorted.

A quick check, and I think you might be interested in this part:

0670:    23DF            MOV    A,#0DFH
0672:    39              OUTL    P1,A

 

[Scruit]

Yeah, it seems I went through all that 8742 stuff a while back because I had a bunch of keyboard BIOS dumps to work with. So that was already sorted.

A quick check, and I think you might be interested in this part:

0670:    23DF            MOV    A,#0DFH
0672:    39              OUTL    P1,A

Definitely. I'm currently tracing the P1 and P2 pins on the motherboard to see where they go. Example, chip leg 32 is "p15" within the chip, part of "port 1" (p10-p17) This goes to a hex inverter and then becomes a reset line. So what do the rest do?

It definitely reaches out by placing 0xe7ff on port1 and port 2 then makes a dma request. Then when it gets the response it wants it takes leg 32 low. So, what does it not like about the input on Branko's Zenith?

I will be repeating my logic analyzer traces with much more focus on port1, port2, data etc, especially with respect to the timing of power and reset. Maybe I can actually visualize e7ff on the chip legs during hat very first part of startup.

 

[JohnElliott]

I've recommended DISASMV2 (DOS-hosted) in the past; it can be found at http://cd.textfiles.com/pslv4nv11/DOS/PRGMMING/ among other places.