M-740 Reverse-Engineering And Hacking Adventures

...Dec-27 6:30 PM
word-on-the streets is the processor in your Brother Type-a-Graph is perhaps one of these variants:

https://en.wikipedia.org/wiki/Mitsubishi_740

Eric HertzDec-27 7:34 PM
ah hah! Here I just thought those looked like in-house numbers... I recall looking up tge 740-series in the past, can't recall why. I think it was on an old CD-player PCB I was thinking I might try to turn into an SBC...

Eric HertzDec-27 7:38 PM
I've found several such boards in my ol' scrap-boards collection that have uC's with a pin akin to the 8051's /EA, which basically forces the internal ROM to be bypassed in favor of an external-ROM... so a bunch of old PCBs from VCRs and stuff that could become kinda SBC/CPU-trainer boards of various different architectures

December 28, 2025

...6:00 AM. There is a German company making nibs, and some dude makes brass gears to replace the one that tends to crack

pen nibs:

https://www.best-electronics-ca.com/laser_printers.htm

scroll down to "Atari 1020 Color Plotter color pen set (4 colors) CO61420-01 $9.95"

I believe these are compatible. Do your own research, of course.

....

OK, so it's got TWO 740-series uCs... mask-rom... M50740 and M50745. Havent looked at it closely-enough to determine where they go... 

The 740 has two modes for using external ROM, one, IIRC, allows muxing the GPIOs with the data/address, on alternate clock-levels, kinda like DDR ("Eva-mode") which I think I recall a way I'd thought of the *last* time I looked at a 740-series to use to write/run a program that would dump the internal ROM... heh! BuT, I mean... this is way-off....

Eric Hertz9:30 PM
ah, so... no...

chicken-egg:

With "CNVSS" input pulled low during boot it defaults to "single chip mode" which boots from internal ROM, But could be switched, via software, to use external ROM instead... (of course, how could that be done in a mask-rom unless it was already coded to do-so...)

Eric Hertz9:33 PM
Whereas if CNVSS is high during boot, then it uses external rom... and, it makes no mention of being able to switch to internal rom via config bits, while mentioning that changing those same config bits *can* change between two external-ROM options (it seems booting with CNVSS=H results in latching/locking the corresponding config-bit, though that *could* be implied-but-not-true...)

Eric Hertz9:34 PM
the wording is unclear if changing CNVSS *during* operation changes any modes... only in one case does it say "setting it high then resetting" the other cases don't mention reset...

Eric Hertz9:36 PM
So, it's *plausible* precise-timing of CNVSS might result in e.g. grabbing a "read" instruction from external ROM, then changing CNVSS, then its actually *reading* that byte from internal ROM... But, otoh, this whole thing *might* be *intentionally* made this way precisely *to* read-protect the internal ROM...

Eric Hertz9:39 PM
OTW, I guess this is where... what's it called...? power-glitching might somehow cause an internal instruction to execute improperly to e.g. read an address other than intended...? I really *don't* grasp that concept, HaD's talked about it so many times... it seems like it'd be completely unpredictable to me...

Eric Hertz9:42 PM
it seems rather likely one uC is for e.g. peripherals (plotter, LCD, Keyboard) while the other might be the actual program/UI... So maybe the interface between the two could be tapped...

Eric Hertz9:45 PM
the 745 has an SPI port, but the 740 does not...

the 740 has a "4-bit I/O-expander" port, which looks a bit like the HD44780 interface, but *maybe* it's actually for uC-intercomms...