[E3-hacking] E1

Ralph Corderoy ralph at inputplus.co.uk
Thu Oct 2 00:21:33 BST 2008

Hi David,

> But nothing seems to come out. I need a scope.
> It might be waiting for some sort of passkey, although this seems a
> little unlikely. If so, though, our only options are either hope that
> some nice person from Amstrad tells us what it is, or else to build a
> JTAG adaptor and extract the ROM...

I suspect it's more primitive than the E2's PBL so I doubt a passkey is
required.  Request 00 always replies with a NAK in PBL V3.1 but perhaps
it does something useful in the earlier version and was changed to be a
constant NAK later?  Do you get anything from request 01?

    PBL V3.1 Build:1277 EXP packet format

        Offset  Size  Value  Name   Description
          0       1     2    stx    ASCII STX byte.
          1       1    0/1   comp   Is `data' compressed.
          2       2     -    len    Length of data.
          4      len    -    data   Payload.
        4+len     1     -    cksum  Sum modulo 0x100 of bytes in len and data.

    First byte of payload gives message type.

    Payload requests

    Contents of data in received packet.  First two bytes given request
    number.  Reply is request_number | 0x80 if all went well, or a NAK reply

        Request: 00
            Not used.
        Reply: 15
            NAK message, sent to indicate disagreement.

        Request: 01 00
            Set 0x1001c = 0x01 to remember request 01 received.
        Reply: 81 00



More information about the e3-hacking mailing list