Edinburgh Hacklab

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Oberheim Matrix 1000 ======

The Oberheim Matrix 1000 is an MC6809-based synthesiser that is just begging to be reverse engineered.

http://www.vintagesynth.com/oberheim/mat1000.php

===== Schematics =====

{{ :matrix1ksch.zip |}}

===== Github repo =====

https://github.com/8BitPimp/OberheimMatrix1000

===== Tools and resources =====

==== DASMx ====

> DASMx is a disassembler for a range of common microprocessors.

http://myweb.tiscali.co.uk/pclare/DASMx/

==== Arto's 6809 page ====

> This page have been made to give general information about Motorola's 6809 and Hitachi's 6309 mikroprosessors: instructions, emulators, tools, debuggers, disassemblers and assemblers. 

Includes Arto's DASM09 disassembler

http://atjs.mbnet.fi/mc6809/

==== Hermann Sieb's f9dasm ====

> Based on Arto Salmi's C core that can be found somewhere on the 'net I built a complete 6800/6809/6309 disassembler that can handle input files in a variety of formats (Intel Hex / Motorola S09 / Flex9 Binary / Binary). Since disassembly without guidance produces measly results, it can load information files with quite a lot of directives, too.

https://github.com/Arakula/f9dasm

==== radare2 ====

> Radare is a portable reversing framework 

http://radare.org/r/

Gareth is working on a [[https://github.com/gareth8118/radare2-extras/tree/6809wip|6809 plugin for radare2]] specifically for this project. 

==== Matrix 6/100 links ====

http://www.tauntek.com/Matrix6Firmware.htm

http://www.tauntek.com/codeinfo.txt

http://wolzow.mindworks.ee/analog/m1k-firmware.htm


===== Memory Map =====

<code>
0x0000-0x1fff:
    I/O*
    U819: {
    0x0000-0x03ff T1*
    0x0400-0x07ff T2*
    0x0800-0x0bff T3*
    0x0c00-0x0fff T4*
        T1-T4 are 82C54 Programmable Timers
    0x1000 DAC
        0x1000
            $ U712 - 74LS374 - DAC HI 7
            b00000001 - DAC 5
            b00000010 - DAC 6
            b00000100 - DAC 7
            b00001000 - DAC 8
            b00010000 - DAC 9
            b00100000 - DAC 10
            b01000000 - DAC 11
            b10000000 - FASTX

        0x1010
            $ U713 - 74HC138 - DAC LO 5
            b00000100 - U715 - 74HC138 - S&H Enable
            b00001000 - DAC 0
            b00010000 - DAC 1
            b00100000 - DAC 2
            b01000000 - DAC 3
            b10000000 - DAC 4

    0x1400-0x17ff UORV* {
    
        0x1400-0x15ff - $ U809 - 68B50 - UART (if A9 = 0) {
            0x1406 - Control/Status {
                Control (write-only) {
                    Bit 0: Counter Divide Select 0 (CR0)
                    Bit 1: Counter Divide Select 1 (CR1)
                    Bit 2: Word Select 1 (CR2)
                    Bit 3: Word Select 2 (CR3)
                    Bit 4: Word Select 3 (CR4)
                    Bit 5: Transmit Control 1 (CR5)
                    Bit 6: Transmit Control 2 (CR6)
                    Bit 7: Receive Interrupt Enable (CR7)
                }
                Status (read-only) {
                    Bit 0: Receive Data Register Full (RDRF)
                    Bit 1: Transmit Data Register Empty (TDRE)
                    Bit 2: Data Carrier Detect (/DCD) active low
                    Bit 3: Clear To Send (/CTS) active low
                    Bit 4: Framing error (FE)
                    Bit 5: Receiver Overrun (OVRN)
                    Bit 6: Parity Error (PE)
                    Bit 7: Interrupt Request (IRQ)
                }
            }
            0x1407 - Transmit/Receive Data
        }
        0x1600 - 82C54 Programmable Timer (if A9 = 1) {
            This timer is the source of /IRQ back to the 6809
            0x1600 - Counter 0 Register
            0x1601 - Counter 1 Register
            0x1602 - Counter 2 Register
            0x1603 - Control Word Register
        }
    }
       
    0x1800-0x1bff SW*
        Front panel switches: {
            0x1800: Read push buttons 0-7
            
            0x1801: Read pushbuttons {
               Bit 7: n/c
               Bit 6: SEL
               Bit 5: BANK
               Bit 4: +
               Bit 3: -
               Bit 2: ENTER
               Bit 1: 9
               Bit 0: 8
            }
        }
    0x1c00-0x1fff WRITE ONLY
        U820: {
        0x1c00-0x1c7f L1* RA1-RA6, NOT
        0x1c80-0x1cff L2* RB1-RB6
        0x1d00-0x1d7f L3* - SYNC1/MUTE/SYNC2
        0x1d80-0x1dff MISC*
            $ U818 - 74LS174 - 6bit latch, address bank register {
                b000001 - VA13
                b000010 - VA14
                b000100 - VA15
                b001000
                b010000
                b100000
            }
        0x1e00-0x1e7f LED1*
        0x1e80-0x1eff LED2*
        0x1f00-0x1f7f LED3*
            (LED1 to 3 are 7-segment displays labelled DISP 1 to 3 respectively. Segment mapping tbd)
        0x1f80-0x1fff LED4*
            6 single LEDs {
                0x01 - CHANNEL
                0x02 - UNITS
                0x04 - DATA D
                0x08 - EXT. F
                0x40 - FINE T
                0x80 - PITCH
                (bits 4 and 5 not connected)
            }
        }
    }

0x2000
    $ U803 - 27512 (Patches) {

        Bank Select - VA13, VA14, VA15
    }
The code rom is
0x4000
    $ U802 - 27512 (Expansion) {

        Bank Select - VA13, VA14, VA15
    }

0x6000
    $ U8012B - 43256 {
        RAM
        Bank Select - VA13, VA14
        0x7fff - Initial stack location (set at PC 0x800E)
                 (Bank 0 only?)        
    }

0x8000
    $ U809 - 27256 {
        0x8000 Rom Base (27256)
        0x8003 Reset Handler
        0x84b4 IRQ Handler (PIT IRQ)
        0x85e3 FIRQ Handler (Serial IRQ)
        0xFFF0 Vector Table
    }
</code>

===== Component Datasheets =====

==== 6850 UART ====

{{ :ef6850p.pdf | Datasheet}}

==== 82C54 Programmable Interval Timer ====

{{ :82c54.pdf | Datasheet}}
===== Using r2 =====

To start radare2 on the image:

<code>
$ r2 -a mc6809 -m 0x8000 27256.bin
</code>