From: "Jeff" <fyberoptic1979@...>
Jul 25, 2007
Hiya folks. I got a Mailstation a few years ago, but at the time,
develop=
ment was still barely in the hardware discovery phase, with no
hope in sig=
ht of ever running homebrew code or reflashing the
device. I figured all =
efforts were about dead, and stopped keeping
up with it. I also messed ar=
ound with the thing using my own POP
account for a bit, but then got tired=
of it altogether and stashed it
away.
Well I got to thinking about a pro=
ject I'm planning involving a
microcontroller and graphical LCD, and happe=
ned to remember having
the Mailstation stashed away, so I dug it back out =
to muck around
with, deciding to see what people have been up to since I l=
ast
checked.
Quite a bit, apparently! Not only do they know a lot about =
the
components and memory layout and such, but apparently there's a
coupl=
e different methods of running homebrew code. Pretty great work
there, gu=
ys.
I'm not keen on totally reflashing my MS at this point though,
partia=
lly cause I don't want to risk messing it up with no hopes of
reflashing i=
t due to the tiny board components, so I decided to try
using the hex edit=
or functionality to enter code manually. I'm a bit
confused on how to use=
it, however.
For the record, I have an old black DET1, and a demo unit at=
that.
Following the instructions in the spew.txt, I got to the hex viewe=
r.
It then says in order to enter hex edit mode, you use "G710304x",
alo=
ng with control-s to edit. A few things about this, though:
- Firstly, ho=
w does the hex editor addressing work in order for me to
know what device/=
page/sector/whatever of ram/codeflash/dataflash?
- I noticed that unless I=
use the "G710304x" first, I can't edit at
all. Why is this? And is the =
"x" significant? I found that even if
I put an x after a normal address (=
0000 for example), I still can't
edit without using that particular addres=
s above beforehand.
- Is it even possible for me to modify ram from there?=
It'd be nice
if I could enter code there to test without updating the fl=
ash over
and over. And in the event that you can enter code into the ram =
from
the hex editor, does it still exist once the MS starts up?
- Less im=
portantly, I don't have a control key. I found simply
pressing "s" enters=
and exits edit mode, though. I guess it makes no
difference, but thought=
it worth mentioning.
I think that's all I meant to ask. At first, I tho=
ught I might just
carefully remove the guts (storing'em away just in case)=
and reuse
the keyboard and LCD along with something like an 8052 variant,=
but
if there's some chance I can put my own code into the thing and get
=
some functionality out of what's already there, that'd be pretty
cool. I =
think I read elsewhere here that it has like 9 or 10 pages
of flash free, =
so that's quite a bit for development purposes. 128k
of ram is pretty dec=
ent, too.
Oh also, in the Yahoo icon apps, what return address would I jum=
p to
in order to get back to the menu? Preferably the application menu,
=
but either is fine. The spew.txt example jumps to 0000, which
apparently =
resets the device.
From: "iwireless2001" <waynem@...>
Jul 25, 2007
Hiya folks. I got a Mailstation a few years ago, but at the time,
opment was still barely in the hardware discovery phase, with
no
n sight of ever running homebrew code or reflashing the
ed all efforts were about dead, and stopped keeping
messed around with the thing using my own POP
n got tired of it altogether and stashed
it
inking about a project I'm planning involving a
hical LCD, and happened to remember having
so I dug it back out to muck around
ave been up to since I last
only do they know a lot about the
but apparently there's a
ode. Pretty great
work
shing my MS at this point though,
essing it up with no hopes of
ents, so I decided to try
de manually. I'm a
bit
e record, I have an old black DET1, and a demo unit at that.
the instructions in the spew.txt, I got to the hex
viewer.
s in order to enter hex edit mode, you use "G710304x",
l-s to edit. A few things about this, though:
hex editor addressing work in order for me
to
ctor/whatever of ram/codeflash/dataflash?
e the "G710304x" first, I can't edit at
x" significant? I found that even
if
(0000 for example), I still can't
dress above beforehand.
m there? It'd be
nice
ting the flash over
into the ram
from
s up?
no
=
meant to ask. At first, I thought I might
just
uts (storing'em away just in case) and reuse
with something like an 8052 variant, but
t my own code into the thing and get
ready there, that'd be pretty
it has like 9 or 10 pages
opment purposes.
128k
he Yahoo icon apps, what return address would I jump
to
back to the menu? Preferably the application menu,
The spew.txt example jumps to 0000, which
.
First off your using one of the first Mailstations ever made, and it =
does not have a lot of ROM or RAM in it. The Hex editor "is" editing
the=
entire memory in the unit !!! If I remember there is NO flash
memory in =
that unit.
The code that you put in is the "Password" to get into the Hex =
editor
as per what the manufacturer picked for that unit. That is why it i=
s
that particular code and nothing else !!
Good luck with your project !!=
Wayne
From: "Jeff" <fyberoptic1979@...>
Jul 25, 2007
wrote:
it
does not have a lot of ROM or RAM in it. The Hex editor "is"
editing
the entire memory in the unit !!! If I remember there is NO flash
y in that unit.
the Hex
editor
is why it
is
ith your project !!
Naw it's pretty much the standard hardware =
as anyone elses of this
model. The only thing different about it being a =
display model that
I'm aware of is that I can specify my own POP and SMTP =
servers in the
settings. I double-checked all the chips before, it's got =
the same
128KB EPROM, 512KB EEPROM, 1MB Flash, and 128KB SRAM that I've se=
en
others list as their models having.
Plus I've flashed some test code i=
n with the "Yahoo icon" method to
see if it'd work, and it saves it.
Anyh=
oo if that's really just a code and not some particular memory
location, t=
hen it still leaves me wondering how to use the hex
editor. I initially t=
hought it was only editing code, but then I
found that one can also access=
their emails from here as well, so I
really have no idea which chips I'm =
accessing at any particular
location.
I'm also curious if someone could g=
ive me the entire series of
identifier bytes that belong to one of the cus=
tom apps. I'd kind of
like to figure out the icon format if possible, eve=
n though I'm sure
others have tried and might have had more skill at figur=
ing it out
than me. I've messed with my share of graphics data for other =
stuff
though so I thought I'd like to take a look just in case. Even more=
helpful along with that data would also be an image of the icon
itself t=
o compare against.
From: "Cyrano Jones" <cyranojones_lalp@...>
Jul 26, 2007
ation, then it still leaves me wondering how to use the hex
nitially thought it was only editing code, but then I
also access their emails from here as well, so I
ich chips I'm accessing at any particular
It's just a back do=
or they left, not a real address.
The first thing you get to is just a h=
ex-viewer.
The viewer has a hidden command "^s" that puts you
in edit mo=
de, but only if the edit-mode has been
enabled. The menu says ^s, but you=
are right,
just s works, too. By the way, the ctrl key is
labeled "Fn".=
When you enter <ctrl-s> (or just <s>), the viewer
checks a flag to see =
if you are allowed to edit, and
if so, kicks you over to edit mode. If yo=
u are
not allowed to edit, you just stay in viewer mode.
The only way to g=
et that flag set is to first enter
"go" mode, where there is a hidden comm=
and "x".
Whenever you feed an "x" to go mode, it will check
the value in=
the address buffer. If that buffer
does not have the value "710304", the=
"x" command
does nothing.
But if the secret number is in that buffer
(d=
isplayed in middle of screen), then it sets the
edit-enable flag. Bet the=
y thought no one would
ever figure *that* out! ;^)
After setting flag, y=
ou need to go back to viewer
mode. Easiest way to get back is with <back>=
key.
If you hit enter instead, it will try to put you
at an address way=
past the end of the dataflash.
I think it rounds down to the highest pos=
sible
address. Then you will need to "go" again, to
get to where you wan=
t to edit. If you leave with
r
sector you were previously viewing.
If you have successfully set the ed=
it-enable
flag, you can now toggle between editor and viewer
with ^s (I c=
an't remember if plain <s> works to
leave edit mode). You have to leave e=
dit mode
to move to another sector, but you only need to
set the enable f=
lag once.
This viewer/editor only works with the dataflash.
From: "Jeff" <fyberoptic1979@...>
Jul 26, 2007
Jones" <cyranojones_lalp@...> =
wrote:
iest way to get back is with <back> key.
That's useful to know, I always=
hit enter then had to jump back with
another goto.
or only works with the dataflash.
Do we know how much of the dataflash =
can be used for our own
purposes? Or more to the point, is anything in th=
ere truly vital to
the functionality of the MS? Could one "break" the MS =
by writing
junk data to a particular place? If so, I would assume one cou=
ld
just reset the MS and that'd fix it, but I dunno what all a reset
actu=
ally performs.
In a related question, how much of the ram is important? I=
s any of
it used for servicing interrupt(s) and such, with the risk of
cr=
ashing it if one started using particular pages?
I still don't know what t=
he interrupt routines of the MS are even
doing though, or what mode it run=
s in or any of that, or as to
whether one could write their own routines f=
or handling them.
I mostly want to just load stuff in via the parallel por=
t into a
section of ram, to avoid constant rewriting to the dataflash. I =
figure one could do this fairly easily without erasing all the
existing c=
odeflash like mailbug seems to do. I also don't see why it
wouldn't be po=
ssible at this point to totally commandeer the hardware
away from the main=
MS code, using the ram and such for our own
purposes and just never retur=
ning to the MS code. If interrupts were
a problem, one could probably jus=
t disable them (well, except NMI,
assuming it's used) and manually strobe =
for keyboard input.
Out of curiosity, what's the 128KB EPROM for, when ass=
umedly the code
is all in the 1MB of flash?
Anyway I have lots of quest=
ions, not sure how many have been answered
somewhere that I haven't notice=
d, but hopefully I'm not being a
nuisance. hehe
And thanks for the help =
so far!
From: "Cyrano Jones" <cyranojones_lalp@...>
Jul 27, 2007
I think dataflash pages 0 thru 7 are available for apps.
the point, is anything in there truly vital to
MS? Could one "break" the MS by writing
?
Pages 8 thru 63 of the dataflash are used by the mailstation
code, fo=
r storing email, settings, etc.
reset the MS and that'd fix it, but I dunno what all a reset
rforms.
Running the flash test will erase almost everything in dataflash,
=
except the serial number, IIRC. My hunch is you could fix
anything you br=
eak by running flash test.
important? Is any of
the risk of
Darn go=
od question! We don't really know what pages of the
RAM might be unused. =
I think that all of the RAM used by
int's is in RAM page 0 (which is always=
found in slotC000).
he MS are even
as to
The=
re are int's for keyboard, modem, caller ID, some timers,
and prob the RTC.=
Both INT & NMI are vectored to service routine in codeflash,
so to writ=
e your own, you would need to modify codeflash.
IOW, if you are writting an=
app that runs from dataflash,
you would just let mailstation handle its in=
terrupts. But your
app can set timers, and then receive timer events. I'=
m
pretty sure that when your app is active, it will get
keyboard and modem =
events by default.
port into a
. I
xisting codeflash like mailbug seems to do.
The newest version that I was=
working on last fall (which
got pushed onto back burner, and is unfortunat=
ely still there)
will work without erasing any of the codeflash. You will
=
have to edit about 10 bytes or so of the dataflash by
hand (with the mailst=
ation's native hex editor).
ble at this point to totally commandeer the hardware
MS code, using the ram and such for our own
rning to the MS code.
Absolutely! And you could just reboot the mails=
tation
to exit your app. (Jump to #0000)
em, one could probably just disable them (well, except NMI,
s used) and manually strobe for keyboard input.
I don't see any problem wi=
th letting the mailstation
handle the interupts either, and using the built=
in keyboard
routines.
I don't know yet just how to get an app in the me=
nu,
except by putting it into the dataflash, but for
testing purposes, you=
could run it from RAM using mailbug.
B EPROM for, when assumedly the code
It h=
olds the code run by the modem chip. There is also a RAM chip
for the mode=
m.
ance. hehe
AFAICR, there really hasn't been *any* frequently asked questi=
on
in this group! The documentation has not really been organized
very wel=
l. There is some in the file section, some in msg archive,
and some on the=
linux-hacker.net BBS. And, I still have a lot I need
to get around to pos=
ting. Too many projects, too little time.
r!
No problem!
I do intend to resurect mailbug sometime "real soon now", =
but
even if I worked full time on it, it might take a week or two
just to r=
emember where I was at last fall.
From: "Jeff" <fyberoptic1979@...>
Jul 27, 2007
Jones" <cyranojones_lalp@...> =
wrote:
I think you've just answered=
a question I had. When perusing the I-
Appliance board when I first got b=
ack into this, I found the very
useful ports list for the MS, which listed=
the codeflash as having 64
pages, and the dataflash as 32 pages. In anot=
her post, I found
somebody pointing out that the smaller chip had less pos=
sible write
cycles than the larger one, which didn't make any sense to use=
it as
the dataflash since it was the one getting written to all the time.=
You seem to be confirming that the smaller 512KB chip is indeed
codefla=
sh, with the larger 1MB chip being dataflash. Correct?
t's for keyboard, modem, caller ID, some timers,
Both INT & NMI are vectored to service routine in codeflash,
your own, you would need to modify codeflash.
n app that runs from dataflash,
interrupts. But your
. I'm
nd modem events by default.
I'm assuming the timers are set/triggered via =
MS code? In the ports
list, "p3.4 =3D increment time16" makes me think th=
at on every
increment of some time value (16th of a second?) the interrupt=
gets
triggered, from which the MS interrupt code keeps track of these
in=
crements, and checks to see if any software timers were set/
triggered.
onto back burner, and is unfortunately still there)
sing any of the codeflash. You will
the dataflash by
That =
sounds pretty useful if you ever get back around to working on
it. I know=
how it goes about things getting pushed back for other
projects and such,=
though.
hehe I hear ya.
do intend to resurect mailbug sometime "real soon now", but
ked full time on it, it might take a week or two
was at last fall.
Last fall I had my head buried in the workings of th=
e original
Nintendo, and was making an add-on board for it to load my own =
code
into a ram/flash cartridge, though the add-on unfortunately never got=
finished due to the seeming jungle of wires required to assemble it.
An=
other of those "I'll finish it sometime" projects, which are more
exciting=
on paper than when trying to actually complete them!
From: "Neil Morrison" <neilsmorr@...>
Jul 27, 2007
IIRC, one memory map I saw shows an 8K (or 16K?) page which is empty -
coul=
d take a Basic interpreter.
Neil
ano Jones"
ataflash can be used for our own
ges 0 thru 7 are available for apps.
From: "Cyrano Jones" <cyranojones_lalp@...>
Jul 27, 2007
for storing email, settings, etc.
question I had. When perusing the I-
ack into this, I found the very
ed the codeflash as having 64
another post, I found
ss possible write
e to use it as
the time.
eed
No, =
I was just typing when I should have been sleeping (or
maybe I *was* asleep=
???).
Make that "pages 8 thru 31 of the dataflash are used by the
mailstat=
ion..."
The codeflash is 64 16k pages, and the dataflash 32 16k pages.
Th=
e dataflash is eraseable in 256 byte sectors, while
the codeflash is erased=
in 64K byte sectors.
From: "Cyrano Jones" <cyranojones_lalp@...>
Jul 31, 2007
/triggered via MS code? In the ports
makes me think that on every
ond?) the interrupt gets
ps track of these
ere set/
; Use the set timer function from ms firmware
Set_a=
_timer EQU #070D ;Set_a_timer(who, msec, persist)
; Now we can set a t=
imer like this
ld hl,#0001 ; persist =3D true
push hl
=
ld hl,500 ; 500 millisec
push hl
ld hl,#00ff ;=
who =3D current app
push hl
call Set_a_timer ; Set_a_timer(wh=
o, msec, persist)
pop hl
pop hl
pop hl
; Then in your=
event handler, look for events with sig =3D #05,
; they should arrive eve=
ry half second.
There are 10 timers that can be set at same time, but
as=
far as I can see, each app can only use one, because
they would all send =
the same event (sig =3D #05). It
would be hard to distinguish between two =
timers, if
you did set two.
I used the notation "time16" to distinguish a=
16 bit
timebase from another 32 bit timebase (which I called
"time32", o=
ddly enough). The above 10 timers are in
addition to both time16 and time=
32.
Time32 is advanced by 16 every keyscan interrupt.
Each of the 10 tim=
ers is also incremented by the same
keyscan interrupt. I was wondering wh=
y time32 would
count by 16's, and I thought maybe I figured it out.
1/60=
=3D .0166666, so I thought that maybe this was a
60hz interrupt, with clo=
se to 16 ms period.
But now I see that the timers are advanced by just 1, =
and if the units on the timers are milliseconds (I
think I verified this?=
??), then there must be
interrupt every milisecond.
n that I was working on last fall (which
nd is unfortunately still there)
odeflash. You will
by
etty useful if you ever get back around to working on
goes about things getting pushed back for other
gh.
I spent=
some time over weekend looking over my files
and trying to refresh my mem=
ory. I found a version 0.0.4
which I don't know is usable or not, and a 0=
.0.5 (windows
version), which is definitely not done.
I remember I had t=
o uninstall the dos version of freepascal
(or at least I thought I needed =
to) to get the windows
version working. I never got the windows version w=
orking,
but instead got a related IDE (Lazarus) working. Lazarus
is a cr=
oss-platform (win, linux, mac) open-source clone
of Borland's Delphi.
I h=
ave never used Delphi (or Lazarus) before, so I guess
you know what soaked=
up all my time last fall! :-)
I was getting tired of waiting for the pro=
ject to rebuild,
and the docs said the long wait was due to the fact they =
were using the gnu linker.
They had a developer version (as opposed to la=
st stable
release) that had a much faster linker, and I tried to
get it g=
oing, but I never got it to work with a
particular widget (color text) tha=
t I really needed.
About there is where I stopped work on it, for various =
other reasons (Partly 'coz I was also playing with
AVR's at the time).
=
Over the weekend, I also looked for my mailstation
hardware, and I just co=
uld not find the units I was
working with, or even my laplink cable! I mo=
ved
a couple months ago, and all these damn boxes
look the same!!!
do intend to resurect mailbug sometime "real soon now", but
worked full time on it, it might take a week or two
ere I was at last fall.
s of the original
d my own code
y never got
mble it.
more
Tha=
t sounds pretty cool! I bet others might want
something like that, if not=
to develop games, then
at least to load rom files! ;^)
Mailbug actually=
started life as pacbug, a similar
tool for arcade Pac Man hardware (I gue=
ss I don't
have much imagination when it comes to naming software).
And In another branch of this thread "Neil Morrison" wrote:
ow how much of the dataflash can be used for our own
e memory map I saw shows an 8K (or 16K?) page which is empty -
a Basic interpreter.
Yeah, I think the last page of the codeflash is unus=
ed,
at least in 2.22r, 2.53yr & 2.54. Not real sure about
the others, but=
I'll bet it's empty in all, coz the
functionality of all models is pretty =
similar.
I think the earlier 2.xx models actually have *more*
functional=
ity than the 3.xx & 4.xx models
From: "Jeff" <fyberoptic1979@...>
Jul 31, 2007
Jones" <cyranojones_lalp@...> =
wrote:
EQU #070D ;Set_a_timer(who, msec, persist)
I keep seeing references to fu=
nctions from the MS firmware, yet the
only list I've ever seen (on I-Appli=
ance) is a half-completed one
from page 1 of the codeflash (the jump table=
for mostly the flash
update routines). But even this list is lacking thi=
ngs like
bytesend, which you used in Spew. Is there a more complete list =
of
various useful functions (and hopefully with their required
parameters=
), or did you simply figure out most of these yourself?
I've started goin=
g through disassembled code for the jump table I
mentioned, to find a byte=
recieve function and possibly other useful
things, but a list would obviou=
sly save me from rediscovering what
others have surely painstakingly done =
already.
#05,
After looking back o=
ver your Hello World app, I came to realize why
exactly the initial jump i=
n the icon header was called
"eventhandler", since it's obviously called e=
very time an event
happens, not just to start the app. It seems rather we=
ll designed
for handling such third-party apps. Seems kind of a shame tha=
t more
were never officially made for it.
tall the dos version of freepascal
o get the windows
ing,
ross-platform (win, linux, mac) open-source clone
at soaked up all my time last fall! :-)
My first compilable language was =
Turbo Pascal, which I learned the
ins and outs of by pouring over the exce=
llent built-in help. I've
never found another language since that made it=
so easy to learn just
with the stuff they included. I never had Turbo C =
until long after I
learned C, but I remember C never came as easy to me as=
Pascal had.
I messed with FreePascal once because I was pleased to see th=
e
language revived (having never really used Delphi or ever having any
re=
al urge to). But it's just not the same when I can't write
plain'ol DOS a=
pps.
code
=
got =
it. =
more =
t sounds pretty cool! I bet others might want
ot to develop games, then
actually started life as pacbug, a similar
are (I guess I don't
are).
The cartridge aspect I did complete, using a flash eeprom to r=
eplace
the code rom on a real cartridge (as many others have done). The
=
thing about NES carts though is that there's tons of variations,
mostly di=
fferent takes on paging different sections of code and
graphics, so withou=
t adding some real brains like an FPGA to handle
all the varieties, you en=
d up basically building a board that might
support a couple different cart=
ridge types, and you're limited to the
games that would run on those. I t=
hink there have been a couple of
hardcore guys that have made almost truly=
universal flash carts
though.
In some cases you can modify the original =
rom images to run on a cart
even if it was designed for a different type. =
While most cartridges
had two separate rom chips, one for code and one fo=
r character data
(aka tiles/sprites), I chose to use a cartridge type that=
uses SRAM
in place of character rom, and uses a simple paging mechanism f=
or the
code rom. This worked natively for various games, but for others
=
that wanted an actual character rom chip, I could write a loader into
the =
rom code which ran before the game did, copy the character rom
data from s=
omewhere in the code rom into the SRAM in the cart, then
jump back to the =
original starting point for the game.
The board I was making would have =
implemented basically a BIOS into
the NES, starting up to that instead of =
running whatever cartridge
might be inside. From there I would have been =
able to transfer code
to a ram cart, update the flash in my current cart, =
and be able to
disable all this to switch control over to the cartridge it=
self.
That's where the complexity came in, due to the various signals I h=
ad
to intercept to/from the cartridge. I probably could just use
somebod=
y like ExpressPCB to make a board for me to avoid soldering
all the wires,=
but I need to at least test the design one day.
Also, as for transferring=
code to the NES, I found that one can get
by with using a controller port=
, and get a decent 4-5KB/s. Perfectly
fine for the size of data I'd be de=
aling with, to avoid further
complexity of adding in some other form of tr=
ansfer.
least in 2.22r, 2.53yr & 2.54. Not real sure about
l bet it's empty in all, coz the
milar.
ality than the 3.xx & 4.xx models
After dumping the dataflash, there se=
ems to be a ton of it not used.
I think the really only important parts a=
re the last two sectors, one
of which contains the serial number, and the =
other some unknown
bytes. Other than that, it mostly seems to be third-pa=
rty apps at
the top of it all, and then your email somewhere around the mi=
ddle.
Since email is kind of unnecessary now, I don't see why one couldn'=
t
use that entire area for other storage, assuming the MS never writes
an=
ything in there at some other time.
I also had a thought in regards to sim=
ply using it as a word
processor. One could still type stuff as emails, b=
ut then write a
little app to transfer the emails out via the parallel por=
t. The
whole dataflash took several seconds to transfer, but obviously th=
at
wouldn't be required just for the emails.