I "needed" to figure out how disk i/o worked. While I could keep on using Ghidra on the system test and OS files, I felt that to make real progress on reverse-engineering, I'd need to pull the 64K ROM. I already pulled short bits and pieces with my memory-to-screen dumper, transcribing it manually or with AI, and disassembling, but it was a slow and annoying process.

It was time for something quite different. I probably could have physically taken the unit apart and pulled the data off the ROM chip. But it's scary to do that. The oscilloscope board is above the computer board, and above both is the scary power supply with a big warning. I had to dig through there once when I shorted something in setting up my Gotek and had to reinsulate the ribbon cable (it burned through the insulation on one wire but the wire was intact).
The alternative I settled on was QR codes. Now that I could run C code on the device, I could put a chunk of ROM into a QR code, take a photo of the screen, and decode on my PC.
The first challenge was finding a QR code library for C that I could run on the device itself. I tried some and they were slow or crashy on large QR codes. I was abotu to give up, until I came across the Nayuki library. It worked great on the device.
The second challenge was decoding a big sequence of QR code screen photographs programmatically. It turns out that most of the standard QR code python libraries weren't able to handle the combination between the logic analyzer's little CRT screen and the large QR codes I was using. I don't know if it was the scan lines, the specific contrast issues, the screen curvature, or the Moire. I ended up going with the QReader library which uses machine learning to preprocess the QR code. As a result it takes several settings. But it works. For most of the images.
I ended up sending 512 bytes of ROM at a time, base64-encoded (I couldn't get binary-encoded QR codes to decode properly using QReader). QR code generation on the logic analyzer was slow, and I added a bit of a pause. As a result, each QR code was shown for about 10 seconds at a time. I had a Sony A7RII camera pointed at the screen, with an external timer taking a picture every two seconds, in case not every picture worked. The setup took about a thousand pictures. I downsized them with Imagemagick, and ran them through QReader to reconstruct a ROM binary. All code is here.

At some point the cat walked between the camera and the screen, but didn't stay long enough to mess up all the pictures of that particular QR code. I had one hiccup: I accidentally deleted the photos mid-way through the run, and had to re-take the rest.
But then I had a nice 64K ROM file, which I was able to run through Ghidra.
Alexander R Pruss
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.