Yeah, none of the commands seems to be useful for the X-Assist thing, but the command list doesn't contain any further commands. Oh, wait, the command list can be found by searching for the "sub r3,r2,2h / setb r2,r3,66h" opcode pair that checks for the command number to be in range the 02h..67h, and, there appear to be two such command lists: One for code relocated to RAM at 001A0000h and up, the other one used for code in EEPROM at 1F00000h and up.
So far I've disassembled only the EEPROM command list. The RAM command list seems to contain about a dozen of extra commands, but it's obviously for the Xplorer GUI, since it can't possibly coexist with games which may use the RAM at 001A0000h for their own purposes; so the RAM commands can't be used for X-Assist. Maybe there's a third command list elsewhere for use with X-Assist. Or theoretically, the X-Assist could upload it's own MIPS functions to the PSX, but I would doubt so.
Oh, and the Xkiller software includes a "Reset" function which I haven't yet figured out how it works. It's no real hardware reset (it doesn't work if a game disables IRQs or replaces the Kernel IRQ handler by custom code). And there's no Reset command (at least not in the EEPROM command list). I am having 2-3 ideas how it
might work - but I haven't nailed it down yet.
NB. a real hardware reset would be some must-have mod when actually using the xplorer for testing homebrew code on real hardware so one could re-upload the exe at any time even if the software has crashed or disables IRQs. I think one could just wire the spare /INIT signal (on DB25 parallel port) to the /RESET signal (on PSX expansion port) via a cheap 1N4148 diode.
And, some additions to the "xplorer.pdf" file: The "send a byte to psx" function looks correct, but the "get a byte from psx" function contains lots or errors:
- the first "set printer select line high" step is nonsense - just remove that step
- the other four "set printer select line low/high" should do just the opposite (low instead high, and vice-versa)
- the fixed/dummy bits in the last 4bit group aren't actually fixed ("high on slct" is correct for r4.52, but on r1.091 it's actually "low on slct", and maybe other firmware revisions use even different settings - so better don't rely on those dummy bits to have specific values.
There are also 1-2 mistakes in the schematic, and a bunch of missing bits & signals...
- EEPROM.pin1 is NC on 256Kx8 chip (however it is wired to A18 for use with 512Kx8 chips).
- EEPROM.pin30 is A17 from GAL.pin21 (not from PSX.A17), accordingly GAL.pin21 is EEPROM.A17 (not A14).
- Boards with solder pads for TWO EEPROMs are leaving A18 not connected on the 2nd EEPROM (but do connect A18 to the first EEPROM, so one could either use one 512K chip or two 256K chips).
- DB25.pin15./ERR is VCC via 0.47ohm (installed only on carts with SRAM, intended as supply for the X-ASSIST thing).
- SRAM (if any) is wired to GAL.pin17 (/CE), 74373.Q6 (A17 or CE2), 74373.Q7 (A18 or NC), other SRAM pins are wired straight to D0-D7, A0-A16, /RD, /WR.
- Existing boards seem to have 128K SRAM (if any), so SRAM A17/A18 aren't actually used (unless a board would have 512K SRAM), however, for 128K SRAMs one should switch SRAM CE2 (aka A17) high.
- VCC is 5V, derived from a 7805 voltage converter (with 7.5V used as input).
Or, more detailed, here are the whole pinouts for all logic components:
Code: Select all
Xplorer Pinout GAL20V8 (generic array logic)
1 IN0 (DB25.pin17./SEL)
2 IN1 (PSX.pin14.A0)
3 IN2 (PSX.pin48.A1)
4 IN3 (PSX.pin15.A2)
5 IN4 (74373.pin15.Q5)
6 IN5 (PSX.pin4./EXP)
7 IN6 (74373.pin12.Q4)
8 IN7 (PSX.pin26.A16) (EEPROM.pin2.A16) (SRAM.pin2.A16) (10000h)
9 IN8 (PSX.pin60.A17) (20000h)
10 IN9 (PSX.pin27.A18) (EEPROM.pin1.A18 or NC) (40000h)
11 IN10 (PSX.pin30./RD)
12 GND
---
13 IN11 (GND)
14 IN12 (/SWITCH_ON)
15 IO (74373.pin11.LE)
16 IO (PSX.pin6.D0)
17 IO (SRAM./CE.pin22)
18 IO (EEPROM2./CE.pin22) (for 2nd EEPROM chip, if any)
19 IO (EEPROM1./CE.pin22) (for 1st EEPROM chip)
20 IO (NC) (reportedly has wire?)
21 IO (EEPROM.pin30.A17) (reportedly A14 ?)
22 IO (74245.pin19./E)
23 IN13 (PSX.pin64./WR) (SRAM.29, EEPROM.31)
24 VCC
Note: The 28pin PLCC GAL has same pinout as the 24pin chip, but with four NC
pins inserted (at pin 1,8,15,22, whereof, there is a wire routed "through"
pin 8, so that pin isn't literally NC).
Xplorer Pinout 74373 (8bit tristate latch)
1 /OE (GND)
2 Q0 (DB25.pin13.SLCT)
3 D0 (PSX)
4 D1 (PSX)
5 Q1 (DB25.pin12.PE)
6 Q2 (DB25.pin11.BUSY)
7 D2 (PSX)
8 D3 (PSX)
9 Q3 (DB25.pin10./ACK)
10 GND
11 LE (GAL.pin15.LatchEnable)
12 Q4 (GAL.pin7)
13 D4 (PSX)
14 D5 (PSX)
15 Q5 (GAL.pin5)
16 Q6 (SRAM.pin30.A17 or CE2)
17 D6 (PSX)
18 D7 (PSX)
19 Q7 (SRAM.pin1.A18 or NC)
20 VCC
Xplorer Pinout 74245 (8bit bus transceiver)
1 DIR (GNDed)
2 D7 (PSX)
3 D6 (PSX)
4 D5 (PSX)
5 D4 (PSX)
6 D3 (PSX)
7 D2 (PSX)
8 D1 (PSX)
9 D0 (PSX)
10 GND
11 D0 (DB25.pin2)
12 D1 (DB25.pin3)
13 D2 (DB25.pin4)
14 D3 (DB25.pin5)
15 D4 (DB25.pin6)
16 D5 (DB25.pin7)
17 D6 (DB25.pin8)
18 D7 (DB25.pin9)
19 /E (GAL.pin22)
20 VCC
Xplorer Pinout 7805 (voltage regulator)
1 5V (VCC)
2 GND (GND)
3 7.5V (PSX.pin18,52)
Xplorer Pinout SWITCH (on/off)
OFF NC
COM PAL.pin14 (with 10K pull-up to VCC)
ON GND
Xplorer Pinout DB25 (parallel/printer port)
1 In /STB (NC)
2 In DATA0 (74245.pin11)
3 In DATA1 (74245.pin12)
4 In DATA2 (74245.pin13)
5 In DATA3 (74245.pin14)
6 In DATA4 (74245.pin15)
7 In DATA5 (74245.pin16)
8 In DATA6 (74245.pin17)
9 In DATA7 (74245.pin18)
10 Out /ACK (74373.Q3)
11 Out BUSY (74373.Q2)
12 Out PE (74373.Q1)
13 Out SLCT (74373.Q0)
---
14 In /LF (NC)
15 Out /ERR (VCC via 0.47ohm) (installed only on carts with SRAM)
16 In /INIT (NC)
17 In /SEL (GAL.IN0.pin1)
18..25 GND (Ground)