Skip to content

Instantly share code, notes, and snippets.

@devinacker

devinacker/ctk551.txt

Last active August 26, 2021 16:54
Show Gist options
  • Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ctk551.txt
CTK-551 ROM dump (little endian):
https://revenant1.net/ctk551.bin
CTK-541 service manual (identical PCBs to CTK-551):
https://www.synthxl.com/wp-content/uploads/2020/04/Casio-CTK-541-Service-Manual.pdf
CPU: "Casio GT913F", 20-bit address bus, 16-bit data bus
Similar CTK models feature a uPD913 or uPD914, i.e. the GT913F is apparently a rebranded NEC chip.
May be 78K-related, but I can't identify the instruction set based on any manuals that I can find.
Quote from service manual:
"The 16-bit CPU contains a 1k-byte RAM, three 8-bit I/O ports, two timers, a key controller and serial interfaces."
(The actual architecture / instruction set isn't mentioned, though.)
Instructions/opcodes seem to be (usually) word-sized, sometimes with word-sized operand(s)?
ROM has empty space from $00F308-00FFFF, registers and RAM may live in here somewhere.
(Some of the below example routines contain words in the $FF00-FFFF range which may be register or RAM addresses)
000000: vector table
0302
0302
0302
0302
0300
0656
0700
0854
07A2
07BC
0814
0300
0300
0300
0300
000300: dummy/unused interrupts
5980 - return from interrupt
0007A2:
7B70 - push (reg 0?)
6C08
FFE2
E808
F087
1408
7C08
FFE2
F880
7C08
FC6B
6B70 - pop (reg 0?)
5980 - return from interrupt
0007BC:
7B70 - push (reg 0?)
7B71 - push (reg 1?)
6C08
FFE3
6C00
FFE2
5260
C0B0
7C00
FFE2
6C00
FC2C
5620
.-- 4636 - branch forward
| 6C00
| FC1B
| A003
|-- 472E - branch forward
| A8F8
|-- 442A - branch forward
| 6C00
| FC1B
| A003
|-- 4722 - branch forward
| 6C09
| FC6B
|-- 4B1C - branch forward
| F100
| 7E18
| FD14
| 0A09
| E93F
| 7C09
| FC6B
| 6C01
| FC6C
| 1C91
|-- 4606 - branch forward
| C980
| 7C09
| FC6B
`-> 6B71 - pop (reg 1?)
6B70 - pop (reg 0?)
5980 - return from interrupt
000814:
7B70 - push (reg 0?)
7B71 - push (reg 1?)
6C09
FFE2
6C08
FC6E
6C00
FC6D
1C08
.-- 4720 - branch forward
| F000
| 6E00
| FC6F
| 7C00
| FFE1
| 5279
| C970
| 7C09
| FFE2
| 0A08
| E81F
| 7C08
| FC6E
| 6B71 - pop (reg 1?)
| 6B70 - pop (reg 0?)
| 5980 - return from interrupt
`-> F9F7
7C09
FFE2
6B71 - pop (reg 1?)
6B70 - pop (reg 0?)
5980 - return from interrupt
007080: table of test mode LCD strings (8 chars each)
007150: some related code
5F02
7080 - address of string table
F000
0900 \
0900 | - 3x bitshift? (n * 8)
0900 /
0902
F008
[...]
008F58: table of instrument names (8 chars each)
009288: table of rhythm names (8 chars each)
0095B8: table of song names (8 chars each)
0098E8: table of misc. LCD strings (8 chars each)
005120: some related code
5F02
8F58 - address of instrument names
.-> 6C0C
| FC34
| F400
| 0944 \
| 0944 | - 3x bitshift? (n * 8)
| 0944 /
| 0942
| 40D8 - unconditional branch backward
|
| 5F02
| 9288 - address of rhythm names
|-- 40EA - unconditional branch (to $005124?)
|
| 5F02
| 95B8 - address of song names
|-- 40E4 - unconditional branch (to $005124?)
|
| 5F02
| 98E8 - address of misc. strings
`-- 40DE - unconditional branch (to $005124?)
[...]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment