AICA firmware dump?

[pikablue]

Dear All,

I'm currently trying to reverse engineer an 2002 vintage Yamaha chip that is similar - but not exactly the same - to the AICA ARM7 chip, and I am hoping that Yamaha reused alot of the AICA design in this particular chip. Given that you guys understand the Dreamcast inside out, I thought that you might be able to point me in the right direction. I've tried to search for this information but not found it anywhere; hence the direct questions.

Firstly : does the DC AICA actually load up firmware from (e.g.) onboard flash when it starts up? If so, does anybody have a binary image of that firmware? Have people dissassembled it, or have

Secondly : does anybody know what the memory map of the AICA is, in particular including any of the IO ports?

Best regards,

..pika..

[SMiTH]

I know there is a yamaha firmware dump by echelon or kalisto?
ppl say it is a nuked version that doesn't work.
idk?? but more than likely some1 will chime in with some info for ya.

i own a few yamaha pc cd rom drives and would like to see if they could be modded.
it would be nice to use a pc cd rom drive to replace the gd rom. (not just replace the laser lens)

i remember seeing a mod where they used a pc cd rom drive connected to dc gd rom ribbon cable. (also power from dc mobo to pc cd rom drive?)
the dc ribbon cable is less 1 pin when compared to the pc cd rom ribbon cable.

[SMiTH]

Here is the .nfo file for kalisto's yamaha firmware
I found kalisto's (KAL-GDRF.zip) *attached it as well
I looked at sdk r10 and I found the yamaha firmware? (going by kalisto .nfo)

DBFlash.zip
Attachment is the DBFlash folder.
GDRFlash folder has the firmware?
scsicom.bin?

Also attached dreamcast hardware pdf that shows info about yamaha aica.

idk maybe some1 will give you some more info?
I tried.
good luck.

Code: Select all

     ._______ /\______        _______.     ________/_________________________/\
     |      |/      /______/\ |      | eNf  \___  /  ______/\____   ____/      \
     |      /      //        \|      |__________\/_______      |     |/         \
     |           _//          \      |     /     \ .    |      |.   _//    |     \_
     |:           \            \     |    /       \     |      |:   \      |      /
    :|:     \      \    /\     \\    |   //        \           ||    \           /
    :::_____|\______\  /_________\______/___________\__________|_____|\  _______/
     <::-------------\/----------------/-------------------------------\/-------->
       :.  Proudly Presents :                                                   |
       |                                                                        |
       |      Game : Yamaha 400/GD-R firmware     checksum : A252B838           |
       |    Origin : katana devkit r9             Filename : KAL-GDRF.zip       |
       |  Released : August 6, 2000                    zip : 1                  |
       |  Platform : Sega Dreamcast (DC)            Format : BIN/firmware       |
       |                                                                        |
       +--|- -                                                            - -|--+
          | Release Notes -------------------------------------------------  |
       +--|- -                                                            - -|--+
       |                                                                        |
       |  Information seems to be leaking out about this one so we decided to   |
       |  make a public release to avoid "fixed" firmware that may not be so    |
       |  friendly to the precious yamaha 400.                                  |
       |                                                                        |
       |  Well, the rumors are true. This does work, we now have 8 of these     |
       |  units, and all of them can now read GD's                              |
       |                                                                        |
       |  This is not the original way that we began ripping GD's. we have an   |
       |  actual serial link setup that our hardware engineers figured out.     |
       |  This method of ripping is much more efficient as you may imagine      |
       |  we have known about this method for 3 weeks now but have chosen to    |
       |  keep it secret to protect Sega and the various developers that        |
       |  are licsenced by sega.                                                |
       |                                                                        |
       |  To date, Dreamcast Iso's are only available mostly to those with      |
       |  high speed internet access, or other connections.                     |
       |                                                                        |
       |  This will soon all change and only patches will need to be released   |
       |  to make self ripped games playable.                                   |
       |                                                                        |
       |  We hope that Sega and it's developers are up the the challenge that   |
       |  sony has been facing with the PSX. Sony has realized that the scene   |
       |  could help them and they used it to their advantage                   |
       |                                                                        |
       |                 "Adversity Brings Greatness"                           |
       |                                                                        |
       |   Directions                                                           |
       |  --------------                                                        |
       |                                                                        |
       |      The utility's filename is dld_dos.exe.  The utility               |
       |      takes four command-line parameters:                               |
       |                                                                        |
       |                                                                        |
       |   1) The flash file.  For this parameter, use                          |
       |      the scsicom.bin file path.                                        |
       |   2) The SCSI ID of the GD Writer to be reflashed.                     |
       |   3) The ASPI ID of the SCSI card on which the GD                      |
       |      Writer resides.  This is a zero-based index                       |
       |      to the card.                                                      |
       |   4) The value 11000.                           |
       |      For example:                              |
       |      dld_dos.exe scsicom.bin 5 0 11000                                 |
       |      will reflash the GD Writer on ASPI ID #0, on                  |
       |      SCSI ID #5.                                                      |
       |                                                                        |
       +--|- -                                                            - -|--+
          | Contact Information & Recruitment -----------------------------  |
       +--|- -                                                            - -|--+
       |                                                                        |
       |  Ever wanted to be a part of KALISTO? Well, now is your chance. We are |
       |  currently on the lookout for new members who can help the current #1  |
       |  team on the Playstation.                                              |
       |                                                                        |
       |  If you are able to:                                                   |
       |                                                                        |
       |  1) Supply Brand New & Un-released USA/PAL/JAP Playstation games.      |
       |  2) Crack/Code on the Playstation and are interested in having several |
       |     opportunities to display your work.                                |
       |  3) Supply PC hardware on a regular basis.                             |
       |  4) Run a T3+ Unix Shell Box in America or Europe with at least 3 gigs |
       |     of free space.                                                     |
       |                                                                        |
       |  NOTE: We do not need any more sites or couriers at this time, do not  |
       |        bother asking, thank you.                                       |
       |                                                                        |
       |  Then, contact us as soon as possible at [email protected]. We are      |
       |  interested to hear what you may have to offer our group and will      |
       |  be willing to negotiate details with you.                             |
       |                                                                        |
       |  If you need to reach us for any other reason, we can be reached via   |
       |  the following ways:                                                   |
       |                                                                        |
       |  E-Mail: [email protected]                                              |
       |     IRC: #kalisto on EFNet                                             |
       |                                                                        |
       +--|- -                                                            - -|--+
          | Greets --------------------------------------------------------  |
       +--|- -                                                            - -|--+
       |                                                                        |
       |  Class  -  Fairlight  -  Aggression  -  Menace  -  Cife  -  Paradox    |
       |  Static  -  Accession  -  Eurasia  -  Capital  -  Lightforce  -  Nil   |
       |  Trsi  -  Mups  -  Wackyiso  -  Myth  -  Deviance  -  Risciso  -  Rns  |
       |                                                                        |
       | .____ /\__________: ____________________/\                             |
       | |   |/   /    \   | |   \_  ___/__ ___/   \  kalisto psx 1998-2000+    |
       | |   /   /      \  |_/\  |____   |  /   |   \                           |
       | ||  \   \  /\  \\ |   \ |.  |   |  \\  |   /   we set the standards    |
       | |___|\  _\/______\____/_|_______|___\ ____/    we are the benchmark    |
       |       \/                             \/- eNf                          .:
      <------------------------------------------------------------------------::>

[pikablue]

Thanks very much for your quick reply, and the good data you've provided !

I may be being stupid, and will continue checking more thoroughly, but none of the supplied binary files seem to be ARM7 code. I'm looking for whatever is by default resident on the SDRAM attached to the AICA, I guess most of it would be sound data, but some of it should be executable ARM7 code. Do you know if there is an existing dump of the default sound data, because it might be contained in that?

Anyway, thanks for your support; I'll keep digging.

..pika..

[Dakangel]

Thanks very much for your quick reply, and the good data you've provided !

I may be being stupid, and will continue checking more thoroughly, but none of the supplied binary files seem to be ARM7 code. I'm looking for whatever is by default resident on the SDRAM attached to the AICA, I guess most of it would be sound data, but some of it should be executable ARM7 code. Do you know if there is an existing dump of the default sound data, because it might be contained in that?

Anyway, thanks for your support; I'll keep digging.

..pika..

You can analyze any Dreamcast emulator which has source code available, obviously only focusing in the audio part.
NullDc, Reicast, Flycast (For the Dreamcast auido part)
NullDC Naomi, Mame (For the Dreamcast, Naomi, Naomi 2, Atomiswave Arcade boards Audio part)

And the attached information Smith provide to you in the text files.
You are not digging enought...pika...

[mrneo240]

Thanks very much for your quick reply, and the good data you've provided !

I may be being stupid, and will continue checking more thoroughly, but none of the supplied binary files seem to be ARM7 code. I'm looking for whatever is by default resident on the SDRAM attached to the AICA, I guess most of it would be sound data, but some of it should be executable ARM7 code. Do you know if there is an existing dump of the default sound data, because it might be contained in that?

Anyway, thanks for your support; I'll keep digging.

..pika..

It appears you're saying Yamaha aica (audio/DSP)

And they're saying Yamaha gdrom drive.

The files linked are also unrelated to the aica dsp

[SMiTH]

ya i kinda figured after my post i was on a rant about the gd rom firmware..
i was like the hell with it, i was on a roll, i will keep going on about it.
then i realized the sound chip is probably what he is referring to lol

if you check out the .pdf , it has info about aica, i/o stuff, and various memory maps.
idk there is something useful to aica there for sure.

the yamaha gd rom firmware might be useful to some1?
maybe i will finally try flashing some of my yamaha pc cd rom drives?
idk

[pikablue]

It appears you're saying Yamaha aica (audio/DSP)

Exactly - the ARM7DI core inside the AICA subsystem.

NullDc, Reicast, Flycast (For the Dreamcast auido part)

I've started on going through the NullDC and Reicast github repos. I can see a lot of emulation of the AICA-as-seen-by-the-SH4, and a lot of emulation of the ARM7 opcodes and the DSP and register access, but I haven't found yet an explicit lump of ARM7 assembly that you would expect the core to run on power on (in order to start up the interrupt handling and things). Based on normal ARM7 behavior, I'd expect it at 0x00 in the AICA's SDRAM thats attached to the ARM core.

But early days yet - as said, I'm clearly not digging enough.

Thanks for all the pointers!

..pika..

[SMiTH]

at least the topic was seen by others and you got some info/help.
afterall the thread was idle for a day or so, until i started posting a barrage of irrelevant info.
and the docu i posted actually is pertinent to aica.

i might start approaching things differently here.
but for the most part, i always try to help in anyway i can.

yes, there are smart ppl here... but for reverse engineering and overly technical stuff, its probably best to seek out forums that are more geared towards that type of content and discussion.

either way its good to see new ppl here, and we will always try to help if we can.
welcome to dreamcast talk.

--keep us updated on your project with the yamaha aica

take err easy.

[TapamN]

I have never seen anything indicating that the AICA has any firmware built into the hardware. AFAIK, when it boots up, starts in a stopped state and the SH4 has to load code into it and start it. For the boot menu, this does come from the boot ROM, but games use their own drivers loaded from disc.