Progress is still being made on the exact modifications to be made to the video bios to get perfect picture in all video modes, so in parallel I am working to finialize the flashing patch so removal of the flash chip for programming is not required.

Currently to enable Vpp 12V for programming (pin11) I need to execute a sequence of read/writes to i/o addresses FC23h, F023h, C023h, 23h, 24h, 25h. The sequence was determined from disassembly of xpatch.exe

Update:

So the initial instructions on 23h do in fact seem to be an unlock sequence, and 24h,25h appear to be index and data registers. I had this feeling as xpatch was reading the values but doing nothing with them, so I started searching for the values with “unlock”.

https://patents.google.com/patent/US5630052

The above patent document basically confirms the concept of four consecutive reads, to FC23,F023,C023,23 to unlock/enter a configuration type command. So this is some progress, it is good to know these do not have any special meaning. This may be common knowledge people who work on these systems often.

So this leaves to do more investigation on the 24/25 index/data registers, and actually to understand what is this even commanding, the VLSI chip or the CPU. I am in the process removing the BGA packages from a board and tracing the wires out.

I want to understand their exact purpose of each register and not “guess”, however the datasheet for the VL82C420FC5 “SCAMP” (Single Chip At Mid Performance) is not available so I continue to read similiar datasheets for individual VLSI components to understand the methodologies and interfaces.

I got the correct adapter in and I have successfully dumped the contents of the flash. As expected the video bios is there. I am certain I could modify the XR registers in the vbios binary just like C&T BMP and it would work. The challenge now is how to flash from software.

Analyzing the contents of the flash should help me confirm I am reading it correctly through the flash chips CUI (Command User Interface), which is something I am still working on, based on the dissassembly of xpatch.exe

I did not get the _@REV from this yet, it had a sticker that said REV0.33

To make the TFT conversion complete, we need to modify the ROM bios to have the correct configuration values for the new display.

After some research I learned of the BMP (Bios Modification Program) provided to OEM’s by Chips&Technology for customizing the CT65535 video bios. It is simply a program that allows you to customize the bios binary. I was not able to find the BMP file for a CT65535 only a CT65545, however it was easy to see what it was doing and confirm that I had located the correct bytes within the video bios I had dumped from C000h.

I am expecting to find a copy of this video rom on the intel flash chip. I do not have the correct TSOP-40 for my ChipProg-40, however I will receive it next week and will dump the contents of the flash to confirm its contents and locations.

For my purposes I am fairly confident I will be able to edit the values, reprogram and put the chip back on. This is not ideal though so the goal is to flash/patch it with a program. I have been reviewing the xpatch.exe to understand how this is possible. I will not attempt anything until I have verified I can backup and program the chips off the board.

This is a disassembled version generated by Sourcer. This is VERY preliminary. I am also investigating with IDAPro 5.0 Free, which properly opens a MZ executable.