Reverse engineering hardware by software

On Thu, Oct 13, 2016 at 07:23:40PM -0500, Jim Brain wrote:
>On 10/13/2016 12:45 AM, Marko Mäkelä wrote:
>>On Wed, Oct 12, 2016 at 10:49:09PM +0100, smf wrote:
>>
>>By the way, VICE should correctly emulate the memory accesses of the 
>>VIC-II, because it is capable of running the "dadb" test program 
>>that I wrote over 20 years ago.
>I've always wondered:
>
>20 years ago, what transpired to get you from:
>
>"Hey, I wonder..."
>to
>"OK, here's how we'll figure out how the VIC works, without anything 
>but the C64, an assembler, and the TV screen."

I guess I don't have to explain the 'why' part of doing it. We all like 
challenges.

Well, it is a complex story. I originally wanted to study something else 
than computer science, and only keep computers as a hobby. Then, after 
completing the basic university courses on mathematics and physics at 
the University of Helsinki I changed my mind and decided to switch to 
the Helsinki University of Technology. I did not want to waste half a 
year, so I got some sort of a 'foreign working practice' (to be admitted 
as part of my studies) in Lübeck, Germany. At that time (1994 to 1996), 
Internet was almost unheard of in the city. So, I set up a snail mail 
relay with Andreas Boose, with whom I had been in contact over the 
Internet for some time.  We'd mail 3.5" floppy disks back and forth, 
filled with Usenet articles and email, and my replies.

I also took a C128D and some Linux installation disks with me, and I 
installed Linux on a spare 386SX machine with 2MB RAM, to work on my 
6502 disassembler in my spare time. (If I remember correctly, the norm 
was 386DX with 4MB RAM in that era.) Of course there were some welcome 
distractions from the local community and fellow foreign students, from 
time to time.

Because I enjoyed the city and the working place and the opportunity to 
improve my German skills so much, I returned also in the summers of 1995 
and 1996, before and after doing the national military service. It could 
be that I wrote the "dadb" program during one of those later visits. I 
remember that it took at least a week of careful planning. And all the 
program does is change the screen color when you press space. It was 
preceded by some test programs that run in the $de00-$dfff open address 
space. That was much easier (maybe one night's task), because you could 
mostly ignore the exact value of the program counter. Just fill the 
stack with $de or $df, and arrange so that the VIC-II would fetch $60 
(RTS) or $40 (RTI) most of the time. In "dadb", I used the fill value 
$da and initialized the colour RAM mostly with 0.

In any case, it was Andreas Boose who came up with the idea of writing a 
test program that samples $de00 (or some unconnected address) at exactly 
one frame plus one cycle intervals and saves the result. He sent me some 
dot matrix printer printouts of the addresses that are being read.

No REU was used in the VIC-II reverse engineering, as far as I know.

A REU was used for reverse engineering the SID's noise waveform (with a 
cycle length of 2^23-1). Asger Alstrup in Denmark dumped the data using 
his REU. Maybe he was the one who figured out the formula as well.

I would say that the seed for all this was planted by Jouko Valta and 
others, who developed the x64 emulator (the precursor of VICE). I had 
written some test programs to reverse engineer the inner workings of the 
6510, for the "64doc" document.

>I mean, I read the articles back in the day, but I never could connect 
>the dots on how one figures out how to use software only to uncover the 
>details.

Maybe there simply was no other practical alternative. We did not have 
access to any fancy measurement hardware.

	Marko

       Message was sent through the cbm-hackers mailing list