Skip to content

Instantly share code, notes, and snippets.

@devinacker
Last active August 26, 2021 16:54
Show Gist options
  • Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
CTK-551 ROM dump (little endian):
https://revenant1.net/ctk551.bin
CTK-541 service manual (identical PCBs):
https://www.synthxl.com/wp-content/uploads/2020/04/Casio-CTK-541-Service-Manual.pdf
CPU: "Casio GT913F", 20-bit address bus, 16-bit data bus
Similar CTK models feature a uPD913 or uPD914, i.e. the GT913F is apparently a rebranded NEC chip.
May be 78K-related, but I can't identify the instruction set based on any manuals that I can find.
Quote from service manual:
"The 16-bit CPU contains a 1k-byte RAM, three 8-bit I/O ports, two timers, a key controller and serial interfaces."
(The actual architecture / instruction set isn't mentioned, though.)
Instructions/opcodes seem to be (usually) word-sized, sometimes with word-sized operand(s)?
ROM has empty space from $00F308-00FFFF, registers and RAM may live in here somewhere.
(Some of the below example routines contain words in the $FF00-FFFF range which may be register or RAM addresses)
000000: vector table
0302
0302
0302
0302
0300
0656
0700
0854
07A2
07BC
0814
0300
0300
0300
0300
000300: dummy/unused interrupts
5980 - return from interrupt
0007A2:
7B70 - push (reg 0?)
6C08
FFE2
E808
F087
1408
7C08
FFE2
F880
7C08
FC6B
6B70 - pop (reg 0?)
5980 - return from interrupt
0007BC:
7B70 - push (reg 0?)
7B71 - push (reg 1?)
6C08
FFE3
6C00
FFE2
5260
C0B0
7C00
FFE2
6C00
FC2C
5620
4636
6C00
FC1B
A003
472E
A8F8
442A
6C00
FC1B
A003
4722
6C09
FC6B
4B1C
F100
7E18
FD14
0A09
E93F
7C09
FC6B
6C01
FC6C
1C91
4606
C980
7C09
FC6B
6B71 - pop (reg 1?)
6B70 - pop (reg 0?)
5980 - return from interrupt
000814:
7B70 - push (reg 0?)
7B71 - push (reg 1?)
6C09
FFE2
6C08
FC6E
6C00
FC6D
1C08
4720
F000
6E00
FC6F
7C00
FFE1
5279
C970
7C09
FFE2
0A08
E81F
7C08
FC6E
6B71 - pop (reg 1?)
6B70 - pop (reg 0?)
5980 - return from interrupt
F9F7
7C09
FFE2
6B71 - pop (reg 1?)
6B70 - pop (reg 0?)
5980 - return from interrupt
007080: table of test mode LCD strings (8 chars each)
007150: some related code
5F02
7080 - address of string table
F000
0900 \
0900 | - 3x bitshift? (n * 8)
0900 /
0902
F008
[...]
008F58: table of instrument names (8 chars each)
009288: table of rhythm names (8 chars each)
0095B8: table of song names (8 chars each)
0098E8: table of misc. LCD strings (8 chars each)
005120: some related code
5F02
8F58 - address of instrument names
.-> 6C0C
| FC34
| F400
| 0944 \
| 0944 | - 3x bitshift? (n * 8)
| 0944 /
| 0942
| 40D8 - unconditional branch backward
|
| 5F02
| 9288 - address of rhythm names
|-- 40EA - unconditional branch (to $005124?)
|
| 5F02
| 95B8 - address of song names
|-- 40E4 - unconditional branch (to $005124?)
|
| 5F02
| 98E8 - address of misc. strings
`-- 40DE - unconditional branch (to $005124?)
[...]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment