Library> McuReaders Destinations: Home | Library | Change Log | Index
Search | Go

All of the MCU readers described here take advantage of a design flaw of oki MCUs (and the design flaw is present on all MCUs we have seen to date). MCUs can use both internal ROM or external ROM for program memory storage, and a GND or +5v signal on _EA(EA prime - normally has line above EA) is used to control whether internal or external program memory is selected. *Oki MCUs do not Latch the state of the _EA pin on startup - by some clever trickery, the internal code memory can be unmasked after the MCU has begun executing code.

All of the ROM dumpers that take advantage of this flaw operate like this:

  • Manually wire an I/O pin to the _EA pin of the MCU. Use a pull up/pull down resistor if necessary.
  • Use a ROM that is larger than the internal ROM of MCU. Make sure all address lines are connected as need be.
  • Initialize serial port of MCU for communication with PC
  • Jump above the masked ROM area (32k for 66207, 48k for 66507, ...)
  • Flip state of _EA using I/O pin
  • Enter delay loop long enough to allow internal ROM to be masked into memory again
  • Copy ROM contents out the serial port

There are several designs that have been tested:

A reader for other chips would require adjusting the board physical package and the code for clock speed and ROM size.

Parents: Web Home Revision: r1.2 - 05 Mar 2004 - 17:46 GMT - blundar { Edit | Attach | History | More }
Copyright © 2002-present by the contributing authors. All material on this collaboration platform is the property of the
contributing authors, and is covered by the Non-Commercial Share-Alike License unless explicitly stated otherwise.
Ideas, requests, problems regarding the PGMFI TWiki?? E-Mail the WikiAdmin
Site Designed By: Digital Fusion   Need a website?