Sony DTL-H2000 Mechacon Firmware

BIOS, Controllers, Memory Cards, Serial I/O, Parallel I/O, etc.
Post Reply
User avatar
Admin / PSXDEV
Admin / PSXDEV
Posts: 2393
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Sony DTL-H2000 Mechacon Firmware

Post by Shadow » December 11th, 2017, 2:06 am

Sony DTL-H2000 CD-ROM Mechacon 'Fujitsu 27C256A-15' EPROM dumped 11/DEC/2017 by Trimesh.

This is the EPROM that was dumped exactly.

Two EPROM's from two H2000's to ensure good valid dumps (one EPROM is from my H2000).
The 'Micro-SD Card' was used as a wedge to help press the EPROM into the socket since it had a poor connection.


You do not have the required permissions to view the files attached to this post.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

User avatar
PSX Aptitude
PSX Aptitude
Posts: 198
Joined: December 20th, 2013, 2:25 pm
PlayStation Model: DTL-H1202
Location: Hong Kong

Re: Sony DTL-H2000 Mechacon Firmware

Post by TriMesh » December 13th, 2017, 12:33 pm

Having had a chance to look at this dump, here are a few observations:

1) Although it's a 32K EPROM, only the upper 16K is being used and the lower 16K is filled with 0xff - this is consistent with the socket on the piggyback chip being wired to take either a 27128 or a 27256.
2) Unlike the production units, the CPU is not a 68HC05 - the instruction set seems to match the Sony SPC700 core (same CPU used in the SNES audio system)
3) The correct origin for the code seems to be 0xc000 (once you strip the inital 16K of 0xffs) - the last locations in ROM seem to be the reset vector and they point to 0xc000, which contains plausible looking initialization code.
4) All the interrupt vectors seem to point to the same address - 0xd7a8 - which just contains a reti instruction, so it appears that this code (like the HC05 code) doesn't use interrupts at all and operates purely on polling.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest