Home
Back to Projects

Introduction
Circuit description
Software

8049spy.zip
(2940 bytes)

What do you do when you have to read the internal ROM contents of a 8048 or 8049 processor and you don't own a programmer for those devices? You simply build this 8049 spy of course!
That is exactly what I did when I wanted to know how my Philips Frequency Counter PM 6668 worked. With this knowledge I was able to add some interesting features to that beautiful counter. You can find a description of the SB-6668 project elsewhere on this site.

This 8049 Spy is not a stand alone project. It is designed as an I/O expansion to my 6802 Nano Computer. So if you're interested in this 8049 Spy, you should start building the 6802 Nano Computer first.
As an alternative you can connect the 8049 Spy to just about any other micro controller that has about 12 I/O lines free (or 11 and one serial output). But then you'll have to write the program that reads the ROM contents yourself, something that is not that difficult really.

Operation of the 8049 Spy is not difficult. Simply insert the 8048 or 8049 processor you want to read, apply the 12V power supply and the contents of the ROM will be transferred through the serial link to your PC. The file is transferred in Intel Hex format, and the communication is set to 9600 baud, 8 data bits, no parity, 1 stop bit.
A total of 4 kb is transferred this way. Originally the 8048 only has 1 kb of ROM, and the 8049 contains 2 kb of ROM. But since the addressing mechanism of the 8048 family was designed to accommodate a maximum of 4 kb, I decided to read the entire 4 kb address space. You can simply ignore or delete the part of the file that you're not interested in.

As you can see in this diagram you don't need too much hardware to read the ROM contents of an 8049. The main part in the diagram is the 8049 (or 8048) that you want to read. Apart from that you only need a voltage regulator, an inverter circuit and a crystal oscillator.

The voltage regulator is needed here, because you also need a 12V supply to connect to the EA line of the 8049, which places it in programming mode.
Warning: This 12V must be a regulated 12V, and not a roughly rectified 12V originating from a cheap mains adapter!
The 5V output of the 7805 is used to supply the 8049 under test and the 6802 Nano Computer.

The inverter circuit is used to invert the RESET signal coming from the 6802 Nano Computer. This is necessary to keep the RESET to the 8049 activated until the program decides to release it.

The crystal oscillator is nothing more than a simple crystal and two capacitors to ground.

To the left of the diagram you see the I/O connections to the 6802 Nano Computer.

Finally the SEND output is the serial output of the 8049 Spy. This signal is at TTL level (in fact open collector with passive pull-up), and therefore needs some translation before it can be connected to the RS-232 port of a PC. I simply used an SB-Bus driver to take care of this signal translation.

Reading a byte from ROM on an 8048 is only a matter of taking its EA line high up to 12V, keep RESET low and apply a 12 bit address. Then you must release the RESET (making it high), and the ROM byte will be presented on the DB port of the processor.
This is exactly what the program does in the RDBYTE routine.

This byte is then packed in an Intel HEX file record and sent through a serial connection to the PC. In order to do that we need the routines SNDBYTE (which translates a byte into two ASCII characters) and SCHOUT (which sends one ASCII character at a rate of 9600 baud).
The main program loop takes care of assembling the Intel HEX file records one by one, until a total of 4 kb is sent. Finally the End Of File record is simply copied to the output and then the program will hang itself in an infinite loop.

I have included both the source listing and the assembled file in the download package. If you want to make changes to the program you'll also have to download and install the SB-Assembler.