Framebuffer Control

A project log for Reverse Engineering The Weather STAR 4000

The Weather STAR 4000: A Journey of reverse engineering the hardware to an iconic machine of the 1980s/90s.

techknighttechknight 03/19/2021 at 22:380 Comments

So now we have a basic way of hacking/testing the graphics card independently from everything else, Now its time to experiment with the Framebuffer control...

To do this, we need to study the 8031 ROM in much finer detail to figure out what it all does. 

So I stared at this ROM and picked it apart for hours on end, over the span of multiple days. 

I toyed around with one command at a time just to try and get a handle on whats going on. 

So in ROM, there is a Compare/Jump table that checks for a byte waiting in the FIFO. Once it sees a byte, it reads it and then does the "select case" to figure out what to do next based on the value of the byte sent. This is the command. 

This is the command table that I have figured out and made comments on: 

Now this ROM is commented out already based on what I knew, its still not 100% complete but its good enough for me to be able to do what I need to do. Commenting was easy enough to do once I figured out the address map of the 8031 on the graphics card, where everything resides. (those details can be found in the MAME driver for now, i may post that info later, but its not relevant to this article). 

So at this point, its pretty much just throwing commands at it with parameters and see what sticks to the wall, or what explodes. One of my favorite cheesy movies from the mid 90s "Hackers", the quote from Joey basically. "Its like choice". Throw commands at it, and see what happens. 

It isn't going to spit cash out in the middle of the street in bumsville Idaho though. Sorry. :-)

In order to do this, I had to setup my Arduino code so I could simply send serial hex data straight to the FIFO. one byte at a time, this makes it easier to experiment and just throw data at the framebuffer control to see what happens. 

Now, since I never kept a blog in real-time as I was experimenting with this thing, I don't remember detail for detail what I did and what each image actually was. But I will post the images and video clips below for posterity of my primitive experiments. 

This is when i drew some lines into framebuffer, and then I was able to send a control command that switches the resolution. 

This thing has a default color palette built into ROM that gets loaded on reset, so all these experiments are showing off the default palette. 

Here is a link to the Photos Album of the images and video clips of my experimentation process:

Basically, I determine the crawl, roll, page switching, etc commands but not yet their math or specifics. Without drawing things into framebuffer, I cant really figure out the fine details just quite yet. 

That's in the next installment. Stay Tuned....