Upd7801-reader

This is a PCB designed to read the internal mask ROM contents from NEC "µCOM-87" microcontrollers (µPD7801 aka uPD7801, etc.) and automatically output them in Intel hex format over serial.

Specs

• Support for all NEC "µCOM-87" series microcontrollers:
  • uPD7801
  • uPD7802
• Automatic ROM size detection (4/6kb)
• Power input: 7.5-9V DC, center positive
• Serial output: 38400 baud, 8N1, Intel hex format

Usage

Zipped gerbers and ROM are available from the releases page.

• Burn the firmware ROM to a 27C256 or compatible EPROM or flash chip (e.g. Atmel AT29C256, Winbond W27E257).
• Assemble the board (all parts are through-hole for convenience).
• Connect the 2-pin serial header to a USB UART adapter or something similar. Configure your computer's serial port as described in "Specs".
• Plug in power and turn the board on. The ROM dump will automatically start being dumped over serial. The "Ready" LED will flash while this is in progress, then becomes solid once it's finished.
• Press Reset or cycle power to dump again, if needed.

The resulting Intel hex file can be converted to a raw ROM image using objcopy, SRecord, or similar tools.

About the process

Unlike its successor, the uPD7810 series, these chips don't have any mode pins for enabling or disabling the chip's internal ROM. As a result, on the 7801 and 7802, it's normally enabled all the time, and the chips can't be repurposed as ROMless parts.

However, after some testing, it was found that overclocking the chip above a certain level will effectively disable the internal ROM, causing instructions to be fetched from external memory even within the normally-internal address range. This board exploits that effect and boots into external ROM by doing this:

• put pulldowns on the data bus so NOPs are executed when internal and external memory are both disabled
• on reset, switch to a ~11MHz clock and disable the external EPROM
• after execution reaches address 0x2000 (signaled by M1 & A13 & !RD), switch to normal clock and enable EPROM
• code in external ROM reads and outputs the internal ROM contents

Note that this setup is somewhat dependent on the temperature of the chip. During testing, it tended to work long enough to perform a few consecutive dumps via the reset button, but once it has been powered on for a minute or so, the clock glitching will probably become unreliable or stop working (no LED activity). If this happens, just leave the power off for a few minutes.

Alternately, you might find that a slower clock (~8-10) is more stable, but will probably require briefly waiting for the chip to warm up a bit. Be sure to adjust your serial baud rate and possibly also adjust the output timing in the ROM (e.g. add an extra NOP to Serial_WriteByte to get 31250 baud with a 10 MHz clock, or 25000 baud with a 8 MHZ clock).

This board has been used to successfully dump a couple of different chips so far, but I still consider it a proof of concept. If there's enough interest I may revisit it to try to make it more stable.

Parts

Disclaimer

Use this board at your own risk. It was designed to be simple, but assumes you have basic experience working with electronics, including soldering. I am not responsible if you happen to blow something up.

License

PCB design and schematics are released under the Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA) license. The firmware source (in the rom directory) is released as public domain.