Skip to content

Instantly share code, notes, and snippets.

@devinacker

devinacker/ctk551.txt

Last active August 26, 2021 16:54
Show Gist options
  • Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
Save devinacker/cb3a05c8c3c5b67e7db0e39e3a66facb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ctk551.txt
CTK-551 ROM dump (little endian):
https://revenant1.net/ctk551.bin
CTK-541 service manual (identical PCBs to CTK-551):
https://www.synthxl.com/wp-content/uploads/2020/04/Casio-CTK-541-Service-Manual.pdf
CPU: "Casio GT913F", 20-bit address bus, 16-bit data bus
Similar CTK models feature a uPD913 or uPD914, i.e. the GT913F is apparently a rebranded NEC chip.
Instruction set seems to be based on Hitachi H8/300, but with opcodes 5xxx-7xxx rearranged.
Quote from service manual:
"The 16-bit CPU contains a 1k-byte RAM, three 8-bit I/O ports, two timers, a key controller and serial interfaces."
(The actual architecture / instruction set isn't mentioned, though.)
Instructions/opcodes seem to be (usually) word-sized, sometimes with word-sized operand(s)?
ROM has empty space from $00F308-00FFFF, registers and RAM may live in here somewhere.
(Some of the below example routines contain words in the $FF00-FFFF range which may be register or RAM addresses)
000000: vector table
0302
0302
0302
0302
0300
0656
0700
0854
07A2
07BC
0814
0300
0300
0300
0300
000300: dummy/unused interrupts
5980 - rte
000302:
5F07 - mov.w #imm,r7
FB7C
0420
07C0
F821
7C08 - mov.b r0l,addr
FFF5
07C0
0782
F8FD - mov.b #$fd,r0l
7C08 - mov.b r0l,addr
FFF0
F800 - mov.b #$00,r0l
7C08 - mov.b r0l,addr
FFF2
F80D - mov.b #$0d,r0l
7C08 - mov.b r0l,addr
FFF1
F800 - mov.b #$00,r0l
7C08 - mov.b r0l,addr
FFF3
F800 - mov.b #$00,r0l
7C08 - mov.b r0l,addr
FFF4
5C80 - jsr addr
112A
F83B - mov.b #$3b,r0l
7C08 - mov.b r0l,addr
FFE0
F883 - mov.b #$83,r0l
7C08 - mov.b r0l,addr
FFE2
6D00 - mov.w addr,r0
FFD2
5670
.-- 4704
| 6D00 - mov.w addr,r0
| FFD0
`-> F049 - mov.b #$49,r0h
F832 - mov.b #$32,r0l
7D00 - mov.w r0,addr
FFD2
F096 - mov.b #$96,r0h
F830 - mov.b #$30,r0l
7D00 - mov.w r0,addr
FFD4
6D00 - mov.w addr,r0
FFD2
5670
.-- 4704
| 6D00 - mov.w addr,r0
| FFD0
`-> F800
5008
5018
7C08 - mov.b r0l,addr
FDAE
5A80 - jmp addr
03A8
40FE - infinite loop
0007A2:
7B70 - push r0
6C08 - mov.b addr,r0l
FFE2
E808 - and #$08,r0l
F087 - mov.b #$87,r0h
1408 - or r0h,r0l
7C08 - mov.b r0l,addr
FFE2
F880 - mov.b #$80,r0l
7C08 - mov.b r0l,addr
FC6B
6B70 - pop r0
5980 - rte
0007BC:
7B70 - push r0
7B71 - push r1
6C08 - mov.b addr,r0l
FFE3
6C00 - mov.b addr,r0h
FFE2
5260
C0B0
7C00 - mov.b r0h,addr
FFE2
6C00 - mov.b addr,r0h
FC2C
5620
.-- 4636 - bne forward
| 6C00 - mov.b addr,r0h
| FC1B
| A003
|-- 472E - beq forward
| A8F8
|-- 442A - bcc forward
| 6C00 - mov.b addr,r0h
| FC1B
| A003
|-- 4722 - beq forward
| 6C09 - mov.b addr,r1l
| FC6B
|-- 4B1C - bmi forward
| F100 - mov.b #$00,r1h
| 7E18
| FD14
| 0A09
| E93F
| 7C09 - mov.b r1l,addr
| FC6B
| 6C01 - mov.b addr,r1h
| FC6C
| 1C91
|-- 4606 - bne forward
| C980 - or #$80,r1l
| 7C09 - mov.b r1l,addr
| FC6B
`-> 6B71 - pop r1
6B70 - pop r0
5980 - rte
000814:
7B70 - push r0
7B71 - push r1
6C09 - mov.b addr,r1l
FFE2
6C08 - mov.b addr,r0l
FC6E
6C00 - mov.b addr,r0h
FC6D
1C08 - cmp.b r0h,r0l
.-- 4720 - beq ...
| F000 - mov.b #$00,r0h
| 6E00
| FC6F
| 7C00 - mov.b r0h,addr
| FFE1
| 5279
| C970 - or #$70,r1l
| 7C09 - mov.b r1l,addr
| FFE2
| 0A08
| E81F - and #$1f,r0l
| 7C08 - mov.b r0l,addr
| FC6E
| 6B71 - pop r1
| 6B70 - pop r0
| 5980 - rte
|
`-> F9F7 - mov.b #$f7,r1l
7C09 - mov.b r1l,addr
FFE2
6B71 - pop r1
6B70 - pop r0
5980 - rte
007080: table of test mode LCD strings (8 chars each)
007150: some related code
5F02 - mov.w #imm,r2
7080 - address of string table
F000 - mov.b #$00,r0h
0900 - add r0,r0
0900 - add r0,r0
0900 - add r0,r0
0902 - add r0,r2
F008 - mov.b #$08,r0h
[...]
008F58: table of instrument names (8 chars each)
009288: table of rhythm names (8 chars each)
0095B8: table of song names (8 chars each)
0098E8: table of misc. LCD strings (8 chars each)
005120: some related code
5F02 - mov.w #imm,r2
8F58 - address of instrument names
.-> 6C0C - mov.b addr,r4l
| FC34
| F400 - mov.b #$00,r4h
| 0944 - add r4,r4
| 0944 - add r4,r4
| 0944 - add r4,r4
| 0942 - add r4,r2
| 40D8 - bra ...
|
| 5F02 - mov.w #imm,r2
| 9288 - address of rhythm names
|-- 40EA - bra ...
|
| 5F02 - mov.w #imm,r2
| 95B8 - address of song names
|-- 40E4 - bra ...
|
| 5F02 - mov.w #imm,r2
| 98E8 - address of misc. strings
`-- 40DE - bra ...
[...]
Raw
gt913.txt
GT913 | H8/300 | desc
------+--------+---------------------------------------------------------------
0000 | 0000 | NOP
09xy | 09xy | ADD Rx, Ry
14xy | 14xy | OR Rx, Ry
19xy | 19xy | SUB Rx, Ry
1Cxy | 1Cxy | CMP.B Rx, Ry
4xyy | 4xyy | Bxx PC+yy (branch)
5800 | 5470 | RTS
5980 | 5670 | RTE
5A80 | 5A00 | JMP addr
5C80 | 5E00 | JSR addr
5F0x | 790x | MOV.W #imm, Rx
6Bxy | 6Dxy | MOV.W @Rx+, Ry (pop)
| (b7=0) |
6C0x | 6A0x | MOV.B addr, Rx
6D0x | 6B0x | MOV.W addr, Rx
7Bxy | 6Dxy | MOV.W Ry, @Rx- (push)
| (b7=1) |
7C0x | 6A8x | MOV.B Rx, addr
7D0x | 6B8x | MOV.W addr, Rx
Axyy | Axyy | CMP #$yy, Rx
Cxyy | Cxyy | OR #$yy, Rx
Exyy | Exyy | AND #$yy, Rx
Fxyy | Fxyy | MOV.B #$yy, Rx
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment