Subject: Hex Editor Usage

From: "Jeff" <fyberoptic1979@...>
Date: Wed, 25 Jul 2007 05:06:25 -0000

Hiya folks.  I got a Mailstation a few years ago, but at the time, 
development was still barely in the hardware discovery phase, with no 
hope in sight of ever running homebrew code or reflashing the 
device.  I figured all efforts were about dead, and stopped keeping 
up with it.  I also messed around with the thing using my own POP 
account for a bit, but then got tired of it altogether and stashed it 
away.

Well I got to thinking about a project I'm planning involving a 
microcontroller and graphical LCD, and happened to remember having 
the Mailstation stashed away, so I dug it back out to muck around 
with, deciding to see what people have been up to since I last 
checked.

Quite a bit, apparently!  Not only do they know a lot about the 
components and memory layout and such, but apparently there's a 
couple different methods of running homebrew code.  Pretty great work 
there, guys.

I'm not keen on totally reflashing my MS at this point though, 
partially cause I don't want to risk messing it up with no hopes of 
reflashing it due to the tiny board components, so I decided to try 
using the hex editor functionality to enter code manually.  I'm a bit 
confused on how to use it, however.

For the record, I have an old black DET1, and a demo unit at that.  
Following the instructions in the spew.txt, I got to the hex viewer.  
It then says in order to enter hex edit mode, you use "G710304x", 
along with control-s to edit.  A few things about this, though:

- Firstly, how does the hex editor addressing work in order for me to 
know what device/page/sector/whatever of ram/codeflash/dataflash?

- I noticed that unless I use the "G710304x" first, I can't edit at 
all.  Why is this?  And is the "x" significant?  I found that even if 
I put an x after a normal address (0000 for example), I still can't 
edit without using that particular address above beforehand.

- Is it even possible for me to modify ram from there?  It'd be nice 
if I could enter code there to test without updating the flash over 
and over.  And in the event that you can enter code into the ram from 
the hex editor, does it still exist once the MS starts up?

- Less importantly, I don't have a control key.  I found simply 
pressing "s" enters and exits edit mode, though.  I guess it makes no 
difference, but thought it worth mentioning.

I think that's all I meant to ask.  At first, I thought I might just 
carefully remove the guts (storing'em away just in case) and reuse 
the keyboard and LCD along with something like an 8052 variant, but 
if there's some chance I can put my own code into the thing and get 
some functionality out of what's already there, that'd be pretty 
cool.  I think I read elsewhere here that it has like 9 or 10 pages 
of flash free, so that's quite a bit for development purposes.  128k 
of ram is pretty decent, too.

Oh also, in the Yahoo icon apps, what return address would I jump to 
in order to get back to the menu?  Preferably the application menu, 
but either is fine.  The spew.txt example jumps to 0000, which 
apparently resets the device.

---

From: "iwireless2001" <waynem@...>
Date: Wed, 25 Jul 2007 16:25:36 -0000

> apparently resets the device.

First off your using one of the first Mailstations ever made, and it 
does not have a lot of ROM or RAM in it.  The Hex editor "is" editing 
the entire memory in the unit !!!  If I remember there is NO flash 
memory in that unit.

The code that you put in is the "Password" to get into the Hex editor 
as per what the manufacturer picked for that unit. That is why it is 
that particular code and nothing else !!

Good luck with your project !!
Wayne

---

From: "Jeff" <fyberoptic1979@...>
Date: Wed, 25 Jul 2007 21:33:24 -0000

--- In [email-masked], "iwireless2001" <waynem@...> 
> Good luck with your project !!

Naw it's pretty much the standard hardware as anyone elses of this 
model.  The only thing different about it being a display model that 
I'm aware of is that I can specify my own POP and SMTP servers in the 
settings.  I double-checked all the chips before, it's got the same 
128KB EPROM, 512KB EEPROM, 1MB Flash, and 128KB SRAM that I've seen 
others list as their models having.

Plus I've flashed some test code in with the "Yahoo icon" method to 
see if it'd work, and it saves it.

Anyhoo if that's really just a code and not some particular memory 
location, then it still leaves me wondering how to use the hex 
editor.  I initially thought it was only editing code, but then I 
found that one can also access their emails from here as well, so I 
really have no idea which chips I'm accessing at any particular 
location.

I'm also curious if someone could give me the entire series of 
identifier bytes that belong to one of the custom apps.  I'd kind of 
like to figure out the icon format if possible, even though I'm sure 
others have tried and might have had more skill at figuring it out 
than me.  I've messed with my share of graphics data for other stuff 
though so I thought I'd like to take a look just in case.  Even more 
helpful along with that data would also be an image of the icon 
itself to compare against.

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Thu, 26 Jul 2007 04:57:30 -0000

> really have no idea which chips I'm accessing at any particular 

It's just a back door they left, not a real address.  

The first thing you get to is just a hex-viewer.  
The viewer has a hidden command "^s" that puts you 
in edit mode, but only if the edit-mode has been 
enabled.  The menu says ^s, but you are right, 
just s works, too.  By the way, the ctrl key is 
labeled "Fn".

When you enter <ctrl-s>  (or just <s>), the viewer 
checks a flag to see if you are allowed to edit, and 
if so, kicks you over to edit mode.  If you are
not allowed to edit, you just stay in viewer mode.

The only way to get that flag set is to first enter 
"go" mode, where there is a hidden command "x".  
Whenever you feed an "x" to go mode, it will check 
the value in the address buffer.  If that buffer 
does not have the value "710304", the "x" command 
does nothing.

But if the secret number is in that buffer 
(displayed in middle of screen), then it sets the 
edit-enable flag.  Bet they thought no one would 
ever figure *that* out!  ;^)

After setting flag, you need to go back to viewer 
mode.  Easiest way to get back is with <back> key.  
If you hit enter instead, it will try to put you 
at an address way past the end of the dataflash.  
I think it rounds down to the highest possible 
address.  Then you will need to "go" again, to 
get to where you want to edit.  If you leave with 
<back> it will leave you pointing to whatever 
sector you were previously viewing.

If you have successfully set the edit-enable 
flag, you can now toggle between editor and viewer 
with ^s (I can't remember if plain <s> works to 
leave edit mode).  You have to leave edit mode 
to move to another sector, but you only need to 
set the enable flag once.

This viewer/editor only works with the dataflash.

--CJ

---

From: "Jeff" <fyberoptic1979@...>
Date: Thu, 26 Jul 2007 23:02:11 -0000

--- In [email-masked], "Cyrano 
> mode.  Easiest way to get back is with <back> key.  

That's useful to know, I always hit enter then had to jump back with 
another goto.

> This viewer/editor only works with the dataflash.

Do we know how much of the dataflash can be used for our own 
purposes?  Or more to the point, is anything in there truly vital to 
the functionality of the MS?  Could one "break" the MS by writing 
junk data to a particular place?  If so, I would assume one could 
just reset the MS and that'd fix it, but I dunno what all a reset 
actually performs.

In a related question, how much of the ram is important?  Is any of 
it used for servicing interrupt(s) and such, with the risk of 
crashing it if one started using particular pages?

I still don't know what the interrupt routines of the MS are even 
doing though, or what mode it runs in or any of that, or as to 
whether one could write their own routines for handling them.

I mostly want to just load stuff in via the parallel port into a 
section of ram, to avoid constant rewriting to the dataflash.  I 
figure one could do this fairly easily without erasing all the 
existing codeflash like mailbug seems to do.  I also don't see why it 
wouldn't be possible at this point to totally commandeer the hardware 
away from the main MS code, using the ram and such for our own 
purposes and just never returning to the MS code.  If interrupts were 
a problem, one could probably just disable them (well, except NMI, 
assuming it's used) and manually strobe for keyboard input.

Out of curiosity, what's the 128KB EPROM for, when assumedly the code 
is all in the 1MB of flash?  

Anyway I have lots of questions, not sure how many have been answered 
somewhere that I haven't noticed, but hopefully I'm not being a 
nuisance.  hehe

And thanks for the help so far!

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Fri, 27 Jul 2007 07:04:26 -0000

> purposes?  

I think dataflash pages 0 thru 7 are available for apps.

> Or more to the point, is anything in there truly vital to 
> junk data to a particular place?  

Pages 8 thru 63 of the dataflash are used by the mailstation 
code, for storing email, settings, etc.

> If so, I would assume one could 

Running the flash test will erase almost everything in dataflash,
except the serial number, IIRC.  My hunch is you could fix 
anything you break by running flash test.

> crashing it if one started using particular pages?

Darn good question!  We don't really know what pages of the
RAM might be unused.  I think that all of the RAM used by
int's is in RAM page 0 (which is always found in slotC000).

> whether one could write their own routines for handling them.

There are int's for keyboard, modem, caller ID, some timers,
and prob the RTC.  

Both INT & NMI are vectored to service routine in codeflash,
so to write your own, you would need to modify codeflash.
IOW, if you are writting an app that runs from dataflash,
you would just let mailstation handle its interrupts.  But your 
app can set timers, and then receive timer events.  I'm
pretty sure that when your app is active, it will get
keyboard and modem events by default.

> existing codeflash like mailbug seems to do. 

The newest version that I was working on last fall (which
got pushed onto back burner, and is unfortunately still there)
will work without erasing any of the codeflash.  You will
have to edit about 10 bytes or so of the dataflash by
hand (with the mailstation's native hex editor).

> I also don't see why it 
> purposes and just never returning to the MS code.  

Absolutely!    And you could just reboot the mailstation 
to exit your app.  (Jump to #0000)

> If interrupts were 

I don't see any problem with letting the mailstation
handle the interupts either, and using the built in keyboard
routines.  

I don't know yet just how to get an app in the menu, 
except by putting it into the dataflash, but for
testing purposes, you could run it from RAM using mailbug.
 
> is all in the 1MB of flash?  

It holds the code run by the modem chip.  There is also a RAM chip
for the modem.

> somewhere that I haven't noticed, but hopefully I'm not being a 

AFAICR, there really hasn't been *any* frequently asked question
in this group!  The documentation has not really been organized
very well.  There is some in the file section, some in msg archive,
and some on the linux-hacker.net BBS.  And, I still have a lot I need
to get around to posting.  Too many projects, too little time.

> And thanks for the help so far!

No problem!

I do intend to resurect mailbug sometime "real soon now", but
even if I worked full time on it, it might take a week or two
just to remember where I was at last fall.

--CJ

---

From: "Jeff" <fyberoptic1979@...>
Date: Fri, 27 Jul 2007 15:06:29 -0000

> code, for storing email, settings, etc.

I think you've just answered a question I had.  When perusing the I-
Appliance board when I first got back into this, I found the very 
useful ports list for the MS, which listed the codeflash as having 64 
pages, and the dataflash as 32 pages.  In another post, I found 
somebody pointing out that the smaller chip had less possible write 
cycles than the larger one, which didn't make any sense to use it as 
the dataflash since it was the one getting written to all the time.  
You seem to be confirming that the smaller 512KB chip is indeed 
codeflash, with the larger 1MB chip being dataflash.  Correct?

> keyboard and modem events by default.

I'm assuming the timers are set/triggered via MS code?  In the ports 
list, "p3.4 = increment time16" makes me think that on every 
increment of some time value (16th of a second?) the interrupt gets 
triggered, from which the MS interrupt code keeps track of these 
increments, and checks to see if any software timers were set/
triggered.

> hand (with the mailstation's native hex editor).

That sounds pretty useful if you ever get back around to working on 
it.  I know how it goes about things getting pushed back for other 
projects and such, though.

> Too many projects, too little time.

hehe I hear ya.

> just to remember where I was at last fall.

Last fall I had my head buried in the workings of the original 
Nintendo, and was making an add-on board for it to load my own code 
into a ram/flash cartridge, though the add-on unfortunately never got 
finished due to the seeming jungle of wires required to assemble it.  
Another of those "I'll finish it sometime" projects, which are more 
exciting on paper than when trying to actually complete them!

---

From: "Neil Morrison" <neilsmorr@...>
Date: Fri, 27 Jul 2007 18:20:23 -0000

IIRC, one memory map I saw shows an 8K (or 16K?) page which is empty -
could take a Basic interpreter.

Neil

--- In [email-masked], "Cyrano Jones"

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Fri, 27 Jul 2007 19:44:48 -0000

> codeflash, with the larger 1MB chip being dataflash.  Correct?

No, I was just typing when I should have been sleeping (or
maybe I *was* asleep???).

Make that "pages 8 thru 31 of the dataflash are used by the
mailstation..."

The codeflash is 64 16k pages, and the dataflash 32 16k pages.

The dataflash is eraseable in 256 byte sectors, while
the codeflash is erased in 64K byte sectors.

--CJ

---

From: "Cyrano Jones" <cyranojones_lalp@...>
Date: Tue, 31 Jul 2007 09:00:16 -0000

> increments, and checks to see if any software timers were set/

; Use the set timer function from ms firmware
Set_a_timer    EQU #070D  ;Set_a_timer(who, msec, persist)

; Now we can set a timer like this
      ld   hl,#0001     ; persist = true
      push hl
      ld   hl,500       ; 500 millisec
      push hl
      ld   hl,#00ff     ; who = current app
      push hl
      call Set_a_timer  ; Set_a_timer(who, msec, persist)
      pop  hl
      pop  hl
      pop  hl

; Then in your event handler, look for events with sig = #05, 
; they should arrive every half second.

There are 10 timers that can be set at same time, but 
as far as I can see, each app can only use one, because 
they would all send the same event (sig = #05).  It
would be hard to distinguish between two timers, if 
you did set two.

I used the notation "time16" to distinguish a 16 bit 
timebase from another 32 bit timebase (which I called 
"time32", oddly enough).  The above 10 timers are in 
addition to both time16 and time32.

Time32 is advanced by 16 every keyscan interrupt.  
Each of the 10 timers is also incremented by the same 
keyscan interrupt.  I was wondering why time32 would 
count by 16's, and I thought maybe I figured it out.  
1/60 = .0166666, so I thought that maybe this was a 
60hz interrupt, with close to 16 ms period.

But now I see that the timers are advanced by just 1, 
and if the units on the timers are milliseconds (I 
think I verified this???), then there must be 
interrupt every milisecond.

> > Too many projects, too little time.

I spent some time over weekend looking over my files 
and trying to refresh my memory.  I found a version 0.0.4 
which I don't know is usable or not, and a 0.0.5 (windows 
version), which is definitely not done. 

I remember I had to uninstall the dos version of freepascal 
(or at least I thought I needed to) to get the windows 
version working.  I never got the windows version working, 
but instead got a related IDE (Lazarus) working.  Lazarus 
is a cross-platform (win, linux, mac) open-source clone 
of Borland's Delphi.

I have never used Delphi (or Lazarus) before, so I guess 
you know what soaked up all my time last fall!  :-)

I was getting tired of waiting for the project to rebuild, 
and the docs said the long wait was due to the fact they 
were using the gnu linker.

They had a developer version (as opposed to last stable 
release) that had a much faster linker, and I tried to 
get it going, but I never got it to work with a 
particular widget (color text) that I really needed.

About there is where I stopped work on it, for various 
other reasons (Partly 'coz I was also playing with 
AVR's at the time).
 
Over the weekend, I also looked for my mailstation 
hardware, and I just could not find the units I was 
working with, or even my laplink cable!  I moved
a couple months ago, and all these damn boxes 
look the same!!!
 
> exciting on paper than when trying to actually complete them!

That sounds pretty cool!  I bet others might want 
something like that, if not to develop games, then 
at least to load rom files!  ;^)

Mailbug actually started life as pacbug, a similar 
tool for arcade Pac Man hardware (I guess I don't 
have much imagination when it comes to naming software).

> could take a Basic interpreter.

Yeah, I think the last page of the codeflash is unused,
at least in 2.22r, 2.53yr & 2.54.  Not real sure about 
the others, but I'll bet it's empty in all, coz the
functionality of all models is pretty similar.  
I think the earlier 2.xx models actually have *more* 
functionality than the 3.xx & 4.xx models

--CJ

---

From: "Jeff" <fyberoptic1979@...>
Date: Tue, 31 Jul 2007 20:08:58 -0000

> Set_a_timer    EQU #070D  ;Set_a_timer(who, msec, persist)

I keep seeing references to functions from the MS firmware, yet the 
only list I've ever seen (on I-Appliance) is a half-completed one 
from page 1 of the codeflash (the jump table for mostly the flash 
update routines).  But even this list is lacking things like 
bytesend, which you used in Spew.  Is there a more complete list of 
various useful functions (and hopefully with their required 
parameters), or did you simply figure out most of these yourself?  
I've started going through disassembled code for the jump table I 
mentioned, to find a byterecieve function and possibly other useful 
things, but a list would obviously save me from rediscovering what 
others have surely painstakingly done already.

> ; they should arrive every half second.

After looking back over your Hello World app, I came to realize why 
exactly the initial jump in the icon header was called 
"eventhandler", since it's obviously called every time an event 
happens, not just to start the app.  It seems rather well designed 
for handling such third-party apps.  Seems kind of a shame that more 
were never officially made for it.

> you know what soaked up all my time last fall!  :-)

My first compilable language was Turbo Pascal, which I learned the 
ins and outs of by pouring over the excellent built-in help.  I've 
never found another language since that made it so easy to learn just 
with the stuff they included.  I never had Turbo C until long after I 
learned C, but I remember C never came as easy to me as Pascal had.

I messed with FreePascal once because I was pleased to see the 
language revived (having never really used Delphi or ever having any 
real urge to).  But it's just not the same when I can't write 
plain'ol DOS apps.

> have much imagination when it comes to naming software).

The cartridge aspect I did complete, using a flash eeprom to replace 
the code rom on a real cartridge (as many others have done).  The 
thing about NES carts though is that there's tons of variations, 
mostly different takes on paging different sections of code and 
graphics, so without adding some real brains like an FPGA to handle 
all the varieties, you end up basically building a board that might 
support a couple different cartridge types, and you're limited to the 
games that would run on those.  I think there have been a couple of 
hardcore guys that have made almost truly universal flash carts 
though.

In some cases you can modify the original rom images to run on a cart 
even if it was designed for a different type.  While most cartridges 
had two separate rom chips, one for code and one for character data 
(aka tiles/sprites), I chose to use a cartridge type that uses SRAM 
in place of character rom, and uses a simple paging mechanism for the 
code rom.  This worked natively for various games, but for others 
that wanted an actual character rom chip, I could write a loader into 
the rom code which ran before the game did, copy the character rom 
data from somewhere in the code rom into the SRAM in the cart, then 
jump back to the original starting point for the game.  

The board I was making would have implemented basically a BIOS into 
the NES, starting up to that instead of running whatever cartridge 
might be inside.  From there I would have been able to transfer code 
to a ram cart, update the flash in my current cart, and be able to 
disable all this to switch control over to the cartridge itself.  
That's where the complexity came in, due to the various signals I had 
to intercept to/from the cartridge.  I probably could just use 
somebody like ExpressPCB to make a board for me to avoid soldering 
all the wires, but I need to at least test the design one day.

Also, as for transferring code to the NES, I found that one can get 
by with using a controller port, and get a decent 4-5KB/s.  Perfectly 
fine for the size of data I'd be dealing with, to avoid further 
complexity of adding in some other form of transfer.

> functionality than the 3.xx & 4.xx models

After dumping the dataflash, there seems to be a ton of it not used.  
I think the really only important parts are the last two sectors, one 
of which contains the serial number, and the other some unknown 
bytes.  Other than that, it mostly seems to be third-party apps at 
the top of it all, and then your email somewhere around the middle.  
Since email is kind of unnecessary now, I don't see why one couldn't 
use that entire area for other storage, assuming the MS never writes 
anything in there at some other time.

I also had a thought in regards to simply using it as a word 
processor.  One could still type stuff as emails, but then write a 
little app to transfer the emails out via the parallel port.  The 
whole dataflash took several seconds to transfer, but obviously that 
wouldn't be required just for the emails.