ralph at inputplus.co.uk
Thu Oct 2 00:21:33 BST 2008
> But nothing seems to come out. I need a scope.
> It might be waiting for some sort of passkey, although this seems a
> little unlikely. If so, though, our only options are either hope that
> some nice person from Amstrad tells us what it is, or else to build a
> JTAG adaptor and extract the ROM...
I suspect it's more primitive than the E2's PBL so I doubt a passkey is
required. Request 00 always replies with a NAK in PBL V3.1 but perhaps
it does something useful in the earlier version and was changed to be a
constant NAK later? Do you get anything from request 01?
PBL V3.1 Build:1277 EXP packet format
Offset Size Value Name Description
0 1 2 stx ASCII STX byte.
1 1 0/1 comp Is `data' compressed.
2 2 - len Length of data.
4 len - data Payload.
4+len 1 - cksum Sum modulo 0x100 of bytes in len and data.
First byte of payload gives message type.
Contents of data in received packet. First two bytes given request
number. Reply is request_number | 0x80 if all went well, or a NAK reply
NAK message, sent to indicate disagreement.
Request: 01 00
Set 0x1001c = 0x01 to remember request 01 received.
Reply: 81 00
More information about the e3-hacking