I've dumped the PSone/PAL CDROM controller BIOS last night, CRC32=2669A1A7h for the 16.5Kbyte ROM-image (IC304 52pin, chip name: "C 3060, SC430943PB, G63C 185, SS0L0130E").
That's been done using Motorola's build-in self-dumping function.
The way how to enter the selftest mode was more or less described in HC05 datasheets (which were a bit unclear since some sections suggested pulling PortC.7 to 2xVCC, and others said PortC.6, which made me feel uneasy, since one should probably avoid strapping the wrong pin to +7V) (anyways, it turned out to be C.7, aka Pin31).
And the datasheet contained some weird drawing that looked like a distorted timing diagram (which turned out to be totally meaningless, the PortC pins can be constant before+during+after /RESET).
The actual data transfer protocol wasn't documented in datasheets, but the decapped PSX/NTSC cdrom controller revealed it's inner workings. The PSone is using identical protocol (with same baudrate constants, ie. older PSX with 4.000MHz oscillator would transfer data at 9600 baud, and PSone transfers data at 10000 baud (apparently derived from around 4.19MHz clock source). The selfdump function is sending data in ASCII format, including spaces and linebreaks and 4-digit address for each byte, plus a request/echo pair for each byte - that looks nice when seeing the data arrive for the first time - but it's also endless slow (in total it takes around 130 bits per byte (ie. around 15 minutes to dump the whole 64Kbytes address space).
For error checking purposes, I've dumped it four times, which was really time consuming. Though there's also a upload & execute custom code function, that way one could transfer bytes in 10bits, and possibly even using something faster than 10000 baud. Maybe it'd be worth writing a custom highspeed dumping function (the programming efforts can't be more time consuming than using the original selfdump function).
The soldering stuff is relative simple & relative difficult: Basically one does need only four wires connected to the chip (two constant voltages: Pin17=3.5V, Pin31=7.5V, and two data lines: Pin50=TX and Pin51=RX with 3.5V levels each). It's a bit challenging because the SMD chip is having really tiny pins, and no solder pads/test points on PSone boards. I ended up using some strings pulled from a flexible wire, attaching that hair-fine strings to the chip, and then connected normal/bigger wires to the strings - and tried to stop breathing and moving... nonetheless I broke some connections 1-2 times. But anyways, after all, it did work fine!
Hope some people will dump some more cdrom bioses! There are probably around 20 different versions (at least five revisions, for each of the three regions, plus devrs versions). I can supply more info on the wiring (basicially that's just the above 4 pins), and on the protocol/software. Of course, the actual implemention depends on what hardware you are using to receive the data (=something that supports serial RX/TX at 3.5V levels).
My approach has been connecting the 3.5V signals to the controller port of another PSone, and then forwarding it to my PC's COM port at +/-9V RS232 levels (don't ask why, it was just the some hardware that I did have at hand).
PS. Should be recommended to lift that Pin31 before wiring 7.5V to it (if you don't: the MIPS CPU refuses to run, and the power LED glows double bright, that sweet effect doesn't affect dumping, but it might damage some other cdrom components, who knows).
EDIT: List of known dumped (and undumped) firmware versions:
Code: Select all
<pin> <--chip name--------------------------> <--CRC32/dumped----> <date,ver> <-----console/pcb------------------------> 80pin Sony [...] E35D, 424666 185, SSAD9441D 60BC954E TriMesh 94-09-19,C0 SCPH-1000 NTSC:J PU-7, 1-655-322-11 80pin Sony [...] E35D, 424660 185, SSAK9502A F82A2A46 TriMesh 94-11-18,C0 SCPH-1000 NTSC:J PU-7, 1-655-322-13 (also used in SCPH-3000 with PU-7 1-655-322-15) 80pin MC68HC705L16CFU D62P SSAW9601A ? - ..-..-..,.. DTL-H1000 NTSC:J PU-7, 1-655-322-14 80pin ? ? - ..-..-..,.. SCPH-100x ... PU-7 for other regions (if any) 80pin ? prototype? 424688 or so? ? - ..-..-..,.. SCPH-100x ... Early PU-8 versions for other regions 80pin Sony [...] E35D, 424686 185, SSBP9539B BB134697 Nocash 95-05-16,C1 SCPH-1002 PAL Early PU-8, 1-658-467-11 (borrowed from J, 2016) 80pin Sony [...] E35D, 424659 185, SSAC9539A 426C05E7 Nocash 95-07-24,C1 SCPH-1001 NTSC:U/C Early PU-8, 1-658-467-11 (borrowed from J, 2016) 80pin Sony [...] E35D, 424684 185, SSAM9542B 84D46B2A Shadow 95-07-24,C1 SCPH-1002 PAL Early PU-8, 1-658-467-11 (same as SC430917, but with different 80pin-style bootstrap rom) 80pin Sony [...] E35D, 424694 185, ... ? - ..-..-..,.. DTL-H1102 PAL Early PU-8, 1-658-467-13 (spotted on photo from SpaceCoyote) 52pin C 2021, SC430911PB ? - ..-..-..,.. SCPH-? Late PU-8, 1-658-467-21 (spotted on some photo) 52pin C 1021, SC430916PB, G63C 185, JSAB9624F A730082B TriMesh 95-07-24,C1 SCPH-5000 NTSC:J Late PU-8, 1-658-467-42 52pin C 3021, SC430917PB, G63C 185, JSAF9623G 96A79014 Nocash 95-07-24,C1 SCPH-1002 PAL Late PU-8, 1-658-467-22 (same as 424684, but with different 52pin-style bootstrap rom) 52pin C 2021, SC430918PB, G63C 185, JSBM9633B 1617EC6A TriMesh 95-07-24,C1 SCPH-1001 NTSC:U/C Late PU-8, 1-658-467-23 (same as the decapped chip-dump from psxdev.ru) 52pin D 2021, SC430920PB, G63C 185, JSAA9810A 7455BB05 TriMesh 95-07-24,D1 DTL-H1202 PAL Late PU-8, 1-658-467-43 (SC430920PB is also used on DTL-H2500) 52pin C 4021, SC430924PB, G63C 185, JSAB9645C AB3E59EB TriMesh 96-08-15,C2 SCPH-5903 NTSC:J PU-16 1-665-191-11 with sub board MP-45 1-665-192-11 (video cd) 52pin C 1030, SC430925PB, G63C 185, JSBK9708C A627277A TriMesh 96-09-12,C2 SCPH-5500 NTSC:J PU-18, 1-664-537-11 52pin W2021, SC430926PB, G63C 185, JSAA9645A DF333241 CharlesMacD 96-08-18,C1 DTL-H3001 NTSC:U/C Late PU-8, 1-658-467-23 (Yaroze) 52pin W3021, SC430927PB, ? - ..-..-..,.. DTL-H3002 PAL (Yaroze) 52pin C 3030, SC430929PB, G63C 185, JSBH9716A BA87A3E0 Nocash 97-01-10,C2 SCPH-5502 PAL PU-18, 1-664-537-62 52pin C 2030, SC430930PB, G63C 185, SSJZ9748A 2A93140F TriMesh 97-01-10,C2 SCPH-5501 NTSC:U/C PU-18, 1-664-537-62 52pin C 1040, SC430934PB, G63C 185, SSDG9745D F38341C4 TriMesh 97-08-14,C2 SCPH-7000 NTSC:J PU-20, 1-668-413-22 52pin C 3040, SC430935PB, G63C 185, SSBC9813D 33899F2A Nocash 97-08-14,C2 SCPH-7002 PAL PU-20, 1-668-413-32 (PCB borrowed from J, 2016) 52pin ? SC........ ? - ..-..-..,.. SCPH-7001 NTSC:U/C 52pin ? SC........ ? - ..-..-..,.. SCPH-7000W PlayStation (10 million model, not for sale, blue, region free) 52pin C 1050, SC430938PB, G63C 185, SSAM9850C 191772D1 TriMesh 98-06-10,C3 SCPH-7500 NTSC:J PU-22, 1-671-858-11 52pin C 3050, SC430939PB, G63C 185, SSAY9837A 9EAFB045 Nocash 98-06-10,C3 SCPH-7502 PAL PU-22, 1-671-858-11 (PCB borrowed from Jackal) 52pin C 2050, SC430940PB, G63C 185, SSDL9838A 184D34B6 TriMesh 98-06-10,C3 SCPH-7501 NTSC:U/C PU-22, 1-671-858-32 52pin C 1060, SC430942PB, G63C 185, SSAQ9920A 7F90B681 TriMesh 99-02-01,C3 SCPH-9000 NTSC:J PU-23, 1-674-987-11 52pin C 3060, SC430943PB, G63C 185, SS0L0130E 2669A1A7 Nocash 99-02-01,C3 SCPH-102 PAL PM-41, 1-679-335-51 52pin C 2060, SC430944PB, G63C 185, SSBR9924C BD117489 TriMesh 99-02-01,C3 SCPH-9001 NTSC:U/C PU-23, 1-674-987-11 52pin ? SC430947.. ? - ..-..-..,.. SCPH-100 NTSC:J PM-41(2) 52pin C 3070, SC430948PB, G63C 185, SSAE0138D 0E8AD915 Nocash A1-03-06,C3 SCPH-102 PAL PM-41(2), P-161125S-31-71 (pcb donated by Squaresoft74) 52pin ? SC430949.. ? - ..-..-..,.. SCPH-101 NTSC:U/C PM-41(2) 52pin ? SC430952.., G65C? 265? ? - ..-..-..,.. SCPH-103 PM-41(2), 1-679-335-82 (late asian model) ? ? ? ? - ..-..-..,.. DTL-H100x ? ? ? ? - ..-..-..,.. DTL-H110x ? ? ? ? - ..-..-..,.. DTL-H1200/DTL-H1201 32pin 27C256A-15 (EPROM 32Kx8) ("94/11/28") ? - ..-..-..,.. DTL-H2000 (Sony CXP82300 80pin SPC700 CPU with piggyback 32pin EPROM socket, not a Motorola HC05 CPU) ? ? ? ? - ..-..-..,.. DTL-H270x ? ? ? ? - ..-..-..,.. DTL-H3000 (yaroze/japan) (and, possible later yaroze versions exist, with PCBs newer than PU-8?) 80pin M...16, ... (sticker: "7/24, 2.'E") ? - ..-..-..,.. NOT FOR SALE, SONY, PU-9 ? ? ? ? - 98-06-10,C3 SCPH-9903 (region free) ? ? ? ? - ..-..-..,.. PS2...