The MC68705P5 is one model of a family of microcontrollers from Motorola. It has 1804 bytes of EPROM and 112 bytes of RAM.
I was able to electronically dump the EPROM using non-user mode. I used a 1 MHz clock on the EXTAL pin with XTAL grounded, tied /RESET, /INT and TIMER high,
and connected PC0 to 7.5V via a 1K resistor. I tied the PORT A pins to +5 and ground using 8 1K resistors to set it to $9D, the opcode for NOP. The entire 2K address
space contents were output on PORT B, including the I/O ports, RAM, EPROM and bootstrap ROM; I captured the bytes using a logic analyzer.
In NUM, the chip outputs address information, fetches an opcode from memory as normal, outputs that opcode, then executes the opcode input on port A. Since the resistors feed it NOPs,
it just keeps fetching the next byte and outputting it, dumping all of memory. The address info that's output is a permutation of 8 of the address bits; additional information is
output on port C<3:1>.
I erased and reprogrammed the chip, using a PIC 18F46K22 in place of the EPROM and counter circuit that the datasheet describes. It takes 82 seconds to program the chip and less than 1 second to verify.
I burned a small program that outputs the accumulator to port B, then increments it and loops. I set the SNM bit to set secure non-user mode, and the EPROM contents were no longer output
when I tried to electronically dump them; instead, the programmed code ran normally.
6805 family info
back to Decap page
back to Home page