What's new

antron

Beginner
Joined
Aug 19, 2017
Messages
16
Reaction score
11
Location
California, USA
Does anyone know if the firmware for the Toshiba PF D29C051 has ever been dumped?

I spoke to John at PNL Video and he doesn't have access to it. He could never get an unencrypted dump himself either. For this reason he was unable to repair one of my New Net City chassis.

Fortunately I bought 2 more on eBay and one is running fine. I am willing to offer the other as a possible firmware dump candidate if anyone has any idea about how to do it. I don't know if decapping is a possible option here.

Best,
A
 
Toshiba PF Monitor chassis micro controllers:

PB9929 Chassis
-TMP87CK38N

PD2367 Chassis
-TMP87CM38NG

1843 Chassis
-TMP87CM38N-5NF5

PE0493 Chassis
-TMP88PS38BNG



TMP87CM38NG
----------
ROM-32K bytes
RAM-1K bytes

For a replacement, it looks like you would want to use the OTP variant TMP87PS38N/F (write and verify like a TC571000)

From the (TMP87PS38N) OTP datasheet:
1617907000349.png



I was going to attempt to put a Mask ROM version in PROM mode and see if I was able to read data from it - just haven't got around to actually doing it yet.
I found a similar Mask ROM variant micro controller (TMP87CM38N-1H55) that is used in a TV or something, I was going to try this PROM mode on that chip before risking it on a real NNC micro.

Hope someone can find this info useful and finally dump these things, I'll follow up when I finally get around to testing this chip I got. Still need to order sockets and rig up the pins as described above, also need to see if my Top 2049 will even support TC571000 - or if this is an excuse to get a better EPROM programmer.
 
If you need some Toshiba perfect flat chassis in your dumping, I might be able to loan you some from what I have.
 
Hi! :)

You have had news since ?

The TMP87CM38N-5NF5 from my 1843 Chassis suffered some kind of power surge damage at the time.

If I don't put the Extend remote in place of the original one, all my settings collapse.

And if I don't install a remote control.

it's the same I had hieroglyphs instead of digital alpha to the setting values ,I had to scroll a full turn to make them disappear X/
 
Last edited:
I did build the adapter and it does seemingly work to read the OTP chip (TMP87PS38N). However, still no luck with dumping the test MCU (TMP87CM38N-1H55) or the MCU off the PB-9929 (TMP87CK38N).

When I dump the OTP chip - I see sections of all 0xFF and some sections of other random hex. I am assuming the 0xFF are the ROM area and the other random hex is some code needed for the MCU.
When I dump the test MCU (TMP87CM38N-1H55) - All I got was a bunch of 0xDF repeating.
When I dump the PB9929 MCU (TMP87CK38N) - All I got was a bunch of 0xFF repeating.

IMG-3757.JPG




So I think this will work to program a new OTP replacement, but still no luck on getting the code out of the original MCU. At this point it might just be better to start looking at reverse engineering the functions of the MCU (isn't all that much) and making a pin compatible replacement. I believe all the MCU does is set some reference voltages for the video preamp (M52337SP on the PB9929) and use some PWM outputs to drive various control transistors for tweaking size and shape.
 
Hi! :)

You have had news since ?

The TMP87CM38N-5NF5 from my 1843 Chassis suffered some kind of power surge damage at the time.

If I don't put the Extend remote in place of the original one, all my settings collapse.

And if I don't install a remote control.

it's the same I had hieroglyphs instead of digital alpha to the setting values ,I had to scroll a full turn to make them disappear X/


That is really odd, I have never seen the remote needing to be attached at all, let alone getting the hieroglyphics. I know in the datasheet for the MCU, the OSD has a lot of characters available, including glyphs, sounds like you somehow got into that part of the MCU memory.



I have been playing around with a new remote board tester, looking for other hidden menus

IMG-3967.JPG




I discovered a few new things:

1. You can make the word 'Memory' appear if after you exit the setting menu, you hit another button. Not sure the meaning here - is it writing or reading from memory ? Haven't noticed that it is saving or recalling settings, pry missing some key step.

2. You can get a manual H. Freq Adjustment. All I have been able to do with this is take a working game and mess up the H sync, still neat you can mess with it.
IMG-3966.jpg
IMG-3964.jpg




I still need to record the pin voltages needed to access these menus, so far I have just been slowly turning POTs and hitting the buttons till cool stuff happens.
 
Back
Top