HD-AE5000 Hard Disk Expansion

The HD-AE5000 is an optional hard disk expansion for the KN5000 that provides 1.08GB storage for music files. This page documents the reverse engineering of its firmware.

Overview

Property Value
ROM File hd-ae5000_v2_06i.ic4
ROM Size 512KB
Base Address 0x280000
Firmware Version 2.33J (file version “V2.06i”)
Development Period Juli-Oktober 1996
Author M. Kitajima
Developers Technosoft (CH-Samstagern), Pointstyle (CH-Buttisholz)
Languages English, German, French (Latin-1 encoding)

The HDAE5000 firmware runs on the main CPU (TMP94C241F) when the expansion is present. It provides hard disk management, PC communication via parallel port, and file transfer capabilities.

Hardware Interface

Physical Connection

The HD-AE5000 connects to the KN5000 main board via cable W3 (part number QEX0ZA34008). The connector is labeled “HSQ(OPTION)” on the main PCB block diagram (service manual page II-3) and “FOR H.D. (OPTION)” on the wiring connection diagram (page II-1).

The expansion interface provides:

  • Address bus access (main CPU address space)
  • Data bus access (16-bit D0-D15)
  • PPI chip select (PPPCS) for the 8255-compatible PPI at 0x160000
  • HD control signals (HDOCS, HDRDY, HSQRAM)
  • Power (+5V, GND)
  • Presence detection line (active low, directly from PE port bit 0)

Note: The KN5000 service manual (EMID971655) does not include a dedicated HDAE5000 schematic page. The HD-AE5000 is documented as an option, and its internal schematic (PPI, ROM, IDE controller, parallel port) would require a separate HD-AE5000 service manual or physical board examination. The signal names above are derived from the main board schematic and firmware analysis.

Main CPU Bus Signals

The following HDAE5000-related signals appear on the main board schematic (CPU Section A, page II-11):

Signal Direction Description
PPPCS Output (Main CPU) PPI chip select (directly decoded from address bus for 0x160000)
HDOCS Output (Main CPU) HD option chip select
HDRDY Input (from HD) HD ready status
HSQRAM Control HD SQRAM signal (address space qualifier)
D0-D15 Bidirectional 16-bit data bus
A0-A18 Output (Main CPU) Address bus (subset)
PE.0 Input (from HD) Presence detection (active low)

PPI (8255) at 0x160000

The main CPU communicates with the HDAE5000 hardware via an Intel 8255-compatible Programmable Peripheral Interface (NEC uPD71055 on the HD-AE5000 board).

Address Port Direction Function
0x160000 Port A Output Data output to HD controller
0x160002 Port B Input Status input from HD controller
0x160004 Port C Output Control signals (strobe, handshake)
0x160006 Control Write PPI configuration (0x82)

PPI Control Register Configuration (0x82):

  • Bit 7 = 1: Mode set active
  • Port A: Mode 0, Output
  • Port B: Mode 0, Input
  • Port C: Output (both nibbles)

Presence Detection

The HD-AE5000 presence is detected via PE port bit 0 (active low):

BIT 0, (PE)           ; Check PE port bit 0
JR NZ, skip_hdae      ; If set, HD-AE5000 NOT present

ROM Entry Points

The HDAE5000 ROM has two primary entry points called by the main CPU firmware:

Address Function Target Description
0x280008 Boot Init JP 0x28F576 Called during system initialization
0x280010 Frame Handler JP 0x28F662 Called each frame for PPORT polling

Boot Initialization (0x28F576)

Called once during system startup if HDAE5000 is detected. The initialization sequence:

  1. Store workspace pointer - Saves main CPU workspace address at 0x23A1A2
  2. Initialize code section - Calls setup routines in code section 1 (0x280020)
  3. Copy data to DRAM - Copies 76,800 bytes to work areas:
    • Area 1: 0x1A0000 (38,400 bytes)
    • Area 2: 0x1A9600 (38,400 bytes)
  4. Register handlers - Registers callback handlers with main CPU’s subsystem
  5. Check HD presence - Calls routine at 0x2971A3 to detect hard disk
  6. Initialize HD - If HD present, performs full initialization with parameters
  7. Register frame handler - Sets up periodic update callback at 0x2803C2

Key RAM Variables

Address Name Purpose
0x22A000 HDAE5000_WORK_BUFFER Work buffer (0xF52A bytes, cleared at init)
0x23A19E HDAE5000_WORKSPACE_PTR2 Secondary workspace pointer
0x23A1A2 HDAE5000_WORKSPACE_PTR Pointer to main workspace structure
0x23952A HDAE5000_DATA_COPY_DEST Data copy destination
0x230EC2 HDAE5000_WORK_TEMP Temporary work variable
0x230EC4 HDAE5000_STATE_VAR State variable
0x230EC6 HDAE5000_CALC_RESULT Calculation result storage
0x230ECC HDAE5000_HANDLER_1 Registered handler function 1
0x230ED0 HDAE5000_PREV_STATE Previous state value
0x230ED2 HDAE5000_HANDLER_2 Registered handler function 2
0x230ED6 HDAE5000_HANDLER_3 Registered handler function 3
0x230EDA HDAE5000_INIT_FLAG Initialization result (0=no HD, non-zero=HD present)

Frame Handler (0x28F662)

Called repeatedly during normal operation to:

  • Poll for PC parallel port commands
  • Process PPORT protocol state machine
  • Handle file transfers and HD operations

PPORT Command Protocol

The PPORT (PC Parallel Port) protocol enables communication with the HD-TechManager5000 Windows software. Commands are sent from the PC to the KN5000 via the parallel port.

See Hard Disk Interface - PC Parallel Port Protocol for detailed handshaking protocol documentation derived from ppkn50.dll disassembly analysis.

Command List

Code Command Description
01 Send Infos About HD Report hard disk information to PC
02 Exit PPORT Terminate parallel port session
03 Read FSB from HD Read File System Block from hard disk
04 Sending FSB to PC Transfer FSB data to PC
05 Rcv FSB from PC Receive FSB data from PC
06 Writing FSB to HD Write FSB to hard disk
07 Load HD to Memory Load file from HD into KN5000 memory
08 Send data to PC Generic data transfer to PC
09 Sending files to PC File transfer to PC
10 Rcv data from PC Receive data from PC
11 Save memory to HD Save KN5000 memory to hard disk
16 Delete files Delete files from hard disk
17 Formating HD Format the hard disk
18 Switch HD-motor off Power down HD motor (spin down)
20 Send XapFile flash Transfer XAP file (flash data)

FSB (File System Block)

The FSB appears to be the filesystem metadata structure used by the HDAE5000. Operations 03-06 handle reading and writing this structure between the HD, KN5000 memory, and the PC.

PPORT Debug/Test Mode

The firmware includes a built-in test mode with diagnostic strings at 0x2E21D8:

  • PPORT TEST — Parallel port communication test
  • HDD ID READ — Hard disk identification read
  • FD TEST — Floppy disk test
  • Port test results: “=======> Port Test OK” / “=======> Port Test Error”
  • HDD test results: “=======> HDD OK” / “=======> HDD NG!”
  • Free capacity display: “Fre Capa: %3.1f [MB]”
  • HD type identification: “HD-TYPE : “

These indicate a service/diagnostics mode accessible during development or field service.

Windows DLL Callbacks

The HD-TechManager5000 Windows software uses DLL callbacks for UI interaction. These callback names were found in the firmware strings:

Color and Display Callbacks

  • LyricBackColorCheck - Background color validation for lyrics
  • LyricForeColorCheck - Foreground color validation for lyrics
  • LyricJumpEditCheck - Lyrics jump/edit mode validation

Timer and Switch Callbacks

  • ErrMsgTimerCatch - Error message display timer
  • FlsOverWrSwCatch - Flash overwrite switch handler
  • AttenHDFormatSwCatch - Attention HD format switch handler

File Operation Callbacks

  • FlsOverWrSwCatch - Overwrite switch
  • FlsDel1SwCatch, FlsDel2SwCatch - Delete switches
  • FlsFileLoadSwCatch - File load switch
  • FlsNamingCheck, FlsNamingCheck2 - File naming validation

Hard Disk Operation Callbacks

  • AttenCpToMarkSwCatch - Copy to mark attention
  • AttenCpToHDSwCatch - Copy to HD attention
  • AttenHDFormatSwCatch - HD format attention
  • AttenDelFileSwCatch - Delete file attention
  • AttenDelDirSwCatch - Delete directory attention

Performance/Composition Callbacks

  • SeparateBassPartCheck - Separate bass part mode
  • SeparateDrumPartCheck - Separate drum part mode
  • SeparateOutputModeCheck - Separate output mode
  • JumpAfterLoadModeEditCheck - Jump after load option
  • LoadByNumberModeEditCheck - Load by number option
  • QuickLoadModeEditCheck - Quick load mode option
  • WriteConfirmEditCheck - Write confirmation option
  • WriteProtectEditCheck - Write protection option

File Type Bit Callbacks (LBN prefix)

  • LBNMdBitCheck - Melody files
  • LBNRcmBitCheck - Rhythm Composer Memory
  • LBNMspBitCheck - Music Style Programmer
  • LBNTmBitCheck - Technical MIDI
  • LBNCmpBitCheck - Composer files
  • LBNSqtBitCheck - Sequencer Track
  • LBNPmtBitCheck - Performance Memory Track
  • LBNLswBitCheck - (Unknown type)

Delete Operation Callbacks

  • DelTlxEditCheck - Delete Technics Link files
  • DelMdEditCheck - Delete Melody files
  • DelRcmEditCheck - Delete RCM files
  • DelMspEditCheck - Delete MSP files
  • DelTmEditCheck - Delete TM files
  • DelCmpEditCheck - Delete Composer files
  • DelSqtEditCheck - Delete Sequencer files
  • DelPmtEditCheck - Delete PMT files
  • DelLswEditCheck - Delete LSW files
  • DelOptNameCheck, DelOptSwEventCatch - Delete options

File Types

The HDAE5000 handles various KN5000 file types, identified by suffix codes:

Extension Suffix Full Name Description
.MD Md Melody MIDI melody files
.RCM Rcm Rhythm Composer Memory Custom rhythm patterns
.MSP Msp Music Style Programmer Custom style programs
.TM Tm Technical MIDI Technical MIDI data
.CMP Cmp Composer Composer sequences
.SQT Sqt Sequencer Track Sequencer track data
.PMT Pmt Performance Memory Track Performance memories
.LSW Lsw (Unknown) Possibly “Live Sound Workshop”
.TLX Tlx Technics Link Exchange files with other Technics products
.SEQ Seq Sequence Sequencer data files
.SQF Sqf Sequencer File Sequencer file (alternate format)
.TTX Ttx (Unknown) Possibly text/lyrics data
.SDA Sda (Unknown) Sound Data Archive or similar

File info debug strings in the firmware show adr and size fields for each type, indicating structured binary formats with address and size metadata. The rb (read binary) mode string appears paired with each extension, confirming binary file I/O.

Event Handler Callback Names

The firmware’s HDAE5000_RECORD_COUNT section at 0x29D97E contains 46 named event handler callbacks. These are the internal names used by the firmware’s object dispatch system.

Event Callbacks (EV_ prefix)

These are triggered by system events during file operations and lyrics display:

Name Purpose
EV_DrawFDText Draw file dialog text
EV_InitFDFileSelect Initialize file selection dialog
EV_Scrollline Scroll line in display
EV_Drawsyllable Draw lyrics syllable
EV_Alldraw Redraw entire display
EV_Initlyrics Initialize lyrics display
EV_SETPOSITION Set playback position
EV_BEATMESSAGE Beat/timing message
EV_TICKS Tick counter event
EV_INITLYRICPARAM Initialize lyrics parameters
EV_TimerBack Timer callback
EV_AfterLoad Post-load event handler
EV_SeqStop Sequencer stop event

Method Callbacks (MT_ prefix)

These are method dispatchers for UI operations:

Name Purpose
MT_FdSaveLyric Save lyrics to file
MT_FdLoadLyric Load lyrics from file
MT_FdInfo File dialog info display
MT_FdFreshUp Refresh file dialog
MT_SelectDelFile Select file for deletion
MT_SelectDEL Confirm deletion
MT_LOOP Loop control
MT_SetStrAdr Set string address
MT_SelectAll Select all items
MT_SelectSAVE Save selection
MT_SelectOK / MT_SelectOK2 Confirm selection
MT_AckSelNum Acknowledge selection number
MT_ReqSelNum Request selection number
MT_SetSelNum Set selection number
MT_ChangeSelNum Change selection number
MT_UnderFlow Underflow handler
MT_OverFlow Overflow handler

UI Component Proc Callbacks

These are procedure callbacks for the 13 registered UI components (matching the Handler 0x016A data records):

Name Component
SelectListProc Main selection list
DbMemoClProc Database/memo
TtlScreenRProc Title screen
AcHddNamingWindowProc HDD naming dialog
IvHddNamingProc HDD naming input
HDTitleMenuProc DISK MENU entry
TtlScreenR2Proc / TtlScreenR3Proc Title screen variants
AcWindowPage1Proc Window page
IvScreenR2Proc Screen input handler
AcLanguageText1Proc Language text display
LyricBoxProc Lyrics display box
FDFileSelectProc File selection dialog

UI Pages

Page Name Purpose
PC_DATA_LINK_PAGE PC data link interface
HDD_UTIL_PAGE HDD utility operations

Trilingual UI Messages

The firmware contains a large block of trilingual UI messages at 0x2E3704 (HDAE5000_Multilingual_Messages, 9,340 bytes). Messages appear in groups of three: English, German, French. French strings use Latin-1 encoding for accented characters (e.g., é=0xE9, è=0xE8, ê=0xEA).

Sample messages:

English German French
Would you really delete the selected directory? Moechten Sie das angewaehlte Verzeichnis wirklich loeschen? Voulez-vous effacer ce répertoir?
Would you really delete the selected title? Moechten Sie den angewaehlten Titel wirklich loeschen? Voulez-vous effacer ce titre?
COPY FD TO HARD DISK COPY FD TO HARD DISK COPY FD TO HARD DISK

Note: German strings use ASCII transliterations for umlauts (“oe” for ö, “ae” for ä), while French uses actual Latin-1 accented characters.

Additional string data sections:

Address Label Size Content
0x2E1C82 HDAE5000_Config_Strings 1,366B Version string “V2.06i”, 20-entry status table, config codes
0x2E21D8 HDAE5000_Test_Strings 808B PPORT TEST, HDD ID READ, FD TEST, port test results
0x2E2500 HDAE5000_Dir_Strings 2,422B Directory management, file type info debug (adr/size per type)
0x2E2E76 HDAE5000_Char_Tables 1,561B Character set lookup tables
0x2E348F HDAE5000_Path_Strings 462B File path patterns and config strings
0x2E365D HDAE5000_UI_Icons 167B UI icon/pattern bitmap data
0x2E3704 HDAE5000_Multilingual_Messages 9,340B Trilingual UI messages (EN/DE/FR)
0x2E5B80 HDAE5000_Lang_Codes 590B Language codes, debug format strings, “TLhd”/”TLtr” markers

Firmware Versions

Multiple firmware versions exist for the HDAE5000:

Version Release Date Notes
v1.10i 1998-07-06 Initial release
v1.15i 1998-10-13 Bug fixes
v2.0i 1999-01-15 Added lyrics display feature
v2.06i Unknown Analyzed version (2.33J internal)

All versions are archived at archive.org.

Hardware Features

Based on marketing documentation and firmware analysis:

  • Storage: 2.5” Hard Disk Drive (1.08 GB capacity)
  • Flash-ROM/SRAM: Quick directory access cache
  • Parallel Port: DB-25 connector for PC communication
  • Audio Outputs: Channel separation options

Limitations

Files cannot be played directly from the hard drive during performance. All file operations occur during breaks to protect the drive mechanism. This is a design decision to prevent disk wear during live performance.

HD-TechManager5000 PC Software

The HD-TechManager5000 is a Windows 95 application developed by Pointstyle (CH-Buttisholz, Switzerland) for Key Soft Service (CH-Schenkon). It communicates with the KN5000 via a CE-approved parallel port cable connected to the DB-25 port on the rear of the keyboard.

  • Copyright: © 1994-97 Pointstyle
  • Programmers: R. Wapf and E. Kruppenbacher
  • Protocol design: A. Fässler (Technosoft, CH-Samstagern)
  • Requirements: Windows 95, 486+ CPU, 16MB RAM, LPT parallel port (does NOT run on Windows NT)
  • Main executable: HD-TE96.exe (with ppkn50.dll for parallel port protocol)
  • Additional DLL: ConvKN.dll (file conversion library)

Software Functions

The software has 4 main sections:

Section Function
CHECK PORT Tests parallel port communication (LPT1 default, 2-3 second handshake)
BACKUP Full or incremental backup of HD-AE5000 to PC. Three modes: Main (full mirror), Archive (incremental — only files with archive flag), Selected (resume from interruption point)
RESTORE Writes backup data from PC back to HD-AE5000. ~40% slower than backup. Optional 2-digit password protection per file
TOOLS File management operations on the HD-AE5000

TOOLS Sub-Functions

Tool Description
COPY TO HD-AE Copy KN5000 files from any PC drive to HD. Validates file integrity (rejects manipulated KN3000 files)
RENAME Rename songs (up to 26 characters) and directories. “Text einfügen”/”Text kopieren” for batch renaming
MOVE Logical-only directory reorganization (relinks entries, doesn’t move physical data). Updates F.L.S. references automatically
PRINT Print directory listings. Options: column/directory/alphabetical/F.L.S. layout, small/medium/large font, draft/high quality. Can also export to text file
EDIT-FLS Create and edit F.L.S. (File Load Scripts) — up to 32 file links per script with A.L. (Auto Load after sequencer stop) and A.S. (Auto Stop after load) for live performance
DELETE Delete files and directories from HD
FORMAT Format the HD-AE5000 hard disk

Keyboard Preparation (Slave Mode)

To use the software, the keyboard must be set to slave mode:

  1. Press MEMORY & CONTROL → (HD-AE5000) HARDDISK → SETUP & TOOLS → PC DATA LINK → START
  2. The keyboard becomes unresponsive during transfer — power cycle to exit slave mode

Update File Format

HDAE5000 firmware updates use file type ID 6:

Header: "Technics KN5000 HD-AEPRG DATA FILE    " (38 bytes)
Target: 0x280000 (512KB)

The update is loaded via the standard KN5000 firmware update mechanism when the appropriate disk is inserted.

Embedded Images

Four 8-bit indexed color images were extracted from the HDAE5000 ROM. These images are displayed on the KN5000’s LCD during HD-AE5000 operations.

Palette Discovery

Disassembly analysis of the boot initialization code at 0x28f585 revealed the palette setup:

  • Main images (Logo, Hands, FilePanel): Use palette at ROM offset 0x65dce (CPU address 0x2E5DCE)
  • Icon: Uses Windows halftone-style palette at ROM offset 0x6158e

The palette is loaded via a loop at 0x28f8e0 that iterates through all 256 entries, writing each RGB component (shifted right by 4 bits) to the VGA DAC registers at 0x3C8/0x3C9.

Image Locations

Image ROM Offset CPU Address Size Description
HDAE5000_Logo 0x2898e 0x2A898E 76,800 bytes Product logo with hard disk graphic
HDAE5000_Hands 0x3b98e 0x2BB98E 76,800 bytes Promotional image showing hands operating unit
HDAE5000_FilePanel 0x4e98e 0x2CE98E 76,800 bytes File selection UI with texture buttons
HDAE5000_Icon 0x6198e 0x2E198E 784 bytes Hard disk with magnetic head icon

Total embedded image data: ~231KB (images) + 2KB (palettes).

See the Image Gallery for the full images.

ROM Layout

The 512KB ROM is organized into several sections:

File Offset Address Size Description
0x00000-0x0001F 0x280000 32B Header with “XAPR4” magic and entry vectors
0x00020-0x0030D 0x280020 750B Handler_Registration - registers 11 callbacks (DISASSEMBLED)
0x0030E-0x0033A 0x28030E 45B Alloc_Memory_1 - palette at 0x2A898E (DISASSEMBLED)
0x0033B-0x00367 0x28033B 45B Alloc_Memory_2 - palette at 0x2BB98E (DISASSEMBLED)
0x00368-0x00394 0x280368 45B Alloc_Memory_3 - palette at 0x2CE98E (DISASSEMBLED)
0x00395-0x003C1 0x280395 45B Alloc_Memory_4 - palette at 0x2E198E, small 27x27 (DISASSEMBLED)
0x003C2-0x0F542 0x2803C2 61,825B Code section 1B - Register_Frame and utilities
0x0F543-0x0F56F 0x28F543 45B Alloc_Memory - primary display parameter lookup (DISASSEMBLED)
0x0F570-0x0F575 0x28F570 6B Get_Init_Flag - return HD presence flag (DISASSEMBLED)
0x0F576-0x0F661 0x28F576 236B Boot initialization routine
0x0F662-0x0F6DF 0x28F662 126B Frame_Handler (DISASSEMBLED)
0x0F6E0-0x0F780 0x28F6E0 161B Frame_Handler_Status (DISASSEMBLED)
0x0F781-0x0F784 0x28F781 4B Frame_Handler_Exit - JP to PPORT (DISASSEMBLED)
0x0F785-0x0F7DC 0x28F785 88B Clear_Work_Buffer (DISASSEMBLED)
0x0F7DD-0x0F7ED 0x28F7DD 17B Delay_Loop (DISASSEMBLED)
0x0F7EE-0x0F812 0x28F7EE 37B VGA_Port_Write (DISASSEMBLED)
0x0F813-0x0F8DF 0x28F813 205B Palette_Setup (DISASSEMBLED)
0x0F8E0-0x0F90A 0x28F8E0 43B Load_Palette (256 VGA entries) (DISASSEMBLED)
0x0F90B 0x28F90B 1B Finalize_Init - just RET (stub) (DISASSEMBLED)
0x0F90C-0x153E1 0x28F90C 23,254B Display_Init and remaining 2A code (LABEL)
0x153E2-0x15411 0x2953E2 48B PPORT command jump table (12 entries)
0x15412-0x15641 0x295412 560B PPORT menu strings
0x15642-0x171A2 0x295642 7,009B Code section 2B1 - PPORT handlers
0x171A3-0x1AE9E 0x2971A3 15,612B Check_HD_Present and HD routines
0x1AE9F-0x1AF2C 0x29AE9F 142B MemCopy, MemFill, StrCopy utilities (DISASSEMBLED)
0x1AF2D-0x1BFE0 0x29AF2D 4,275B Code routines (buffer validate, memcompare, multiply)
0x1BFE0-0x1C0A9 0x29BFE0 202B UI_Config strings (field names, CONVERTED)
0x1C0AA-0x2A5D2B 0x29C0AA 59,522B Record table + event handlers + UI pages + credits + demo data
0x2A5D2C-0x2A849A 0x2A5D2C 10,094B GFX_DATA_1 and GFX_DATA_2
0x2A849A-0x2BA1A5 0x2A849A 72,972B GFX_INIT_PARAMS
0x2BA1A6-0x2E1C81 0x2BA1A6 162,524B Font bitmap data
0x2E1C82-0x2E5DCE 0x2E1C82 16,716B String data sections (config, test, dir, multilingual)
0x2E5DCE-0x2F8DCE 0x2E5DCE 77,824B Palette data (256 × 4B RGBX entries, multiple palettes)
0x2F8DCE-0x2F94B2 0x2F8DCE 1,764B Display_Params (file extensions, format strings, CONVERTED)
0x2F94B2-0x2FFFFF 0x2F94B2 27,470B Init_Data (3,266B config + 24,204B padding zeros)
0x70000-0x7FFFF 0x2F0000 65,536B Padding zeros

PPORT Command Handler Jump Table

Located at 0x2953E2, this table contains 12 four-byte pointers to command handler routines:

Index Address Handler Description
0 0x2958D6 Cmd01_SendInfo Send HD info to PC
1 0x295914 Cmd02_Exit Exit PPORT mode
2 0x2959F6 Cmd03_ReadFSB Read FSB from HD
3 0x295D3C Cmd04_SendFSB Send FSB to PC
4 0x29605A Cmd05_RcvFSB Receive FSB from PC
5 0x296294 Cmd06_WriteFSB Write FSB to HD
6 0x29632A Cmd07_LoadHD Load HD to Memory
7 0x29633C Cmd08_SendData Send data to PC
8 0x2964A6 Cmd09_SendFiles Send files to PC
9 0x296588 Cmd10_RcvData Receive data from PC
10 0x29659A Cmd11_SaveMem Save memory to HD
11 0x296680 Cmd12_Nothing (reserved)

Key Routine Addresses

Code Section 1 (0x280020-0x28F575)

Address Name Description
0x280020 HDAE5000_Handler_Registration Registers 11 callbacks via RegisterObjectTable + final dispatch (DISASSEMBLED)
0x28030E HDAE5000_Alloc_Memory_1 Returns 0x2A898E, 320×240 (palette/display params)
0x28033B HDAE5000_Alloc_Memory_2 Returns 0x2BB98E, 320×240 (palette/display params)
0x280368 HDAE5000_Alloc_Memory_3 Returns 0x2CE98E, 320×240 (palette/display params)
0x280395 HDAE5000_Alloc_Memory_4 Returns 0x2E198E, 27×27 (small icon display mode)
0x2803C2 HDAE5000_Register_Frame Register frame handler callback
0x28F543 HDAE5000_Alloc_Memory Primary display lookup (0x2E61CE, 320×240)
0x28F570 HDAE5000_Get_Init_Flag Return HD presence flag from 0x230EDA

Code Section 2 (0x28F662-0x2FFFFF)

Address Name Description
0x28F662 HDAE5000_Frame_Handler Main entry - calculates display offset, calls callbacks
0x28F6E0 HDAE5000_Frame_Handler_Status Status check - monitors handler bit 2 changes
0x28F781 HDAE5000_Frame_Handler_Exit Exit via JP to PPORT_Handler at 0x29501C
0x28F785 HDAE5000_Clear_Work_Buffer Clear 0xF52A bytes at 0x22A000, copy 0xC82 bytes from ROM
0x28F7DD HDAE5000_Delay_Loop Nested delay loop - decrements XWA until zero
0x28F7EE HDAE5000_VGA_Port_Write Write byte C to VGA port WA (mapped at 0x170000+port)
0x28F813 HDAE5000_Palette_Setup Set one VGA palette entry (index in A, RGB in XBC)
0x28F8E0 HDAE5000_Load_Palette Load all 256 palette entries from ROM data
0x28F90B HDAE5000_Finalize_Init Just returns - 1-byte stub
0x28F90C HDAE5000_Display_Init Display/callback initialization via workspace
0x28B3B3 HDAE5000_Check_Status Status check routine
0x28AC68 HDAE5000_UI_Update UI update routine
0x29501C HDAE5000_PPORT_Handler PPORT state machine entry
0x2950F8 HDAE5000_Display_String Display string routine (heavily used)
0x2952D6 HDAE5000_PPORT_Menu PPORT menu handler
0x2971A3 HDAE5000_Check_HD_Present RAM test + HD initialization (32KB test fill)
0x2999B0 HDAE5000_Version_Info Version string block
0x29AE9F HDAE5000_MemCopy Memory copy utility (optimized word/dword operations)
0x29AEC7 HDAE5000_MemFill Memory fill (aligns to 4-byte, uses 32-bit writes)
0x29AF0B HDAE5000_StrCopy String copy (finds length, copies with null)
0x29B72D HDAE5000_Multiply 32-bit multiply routine
0x29BFE0 HDAE5000_UI_Config UI configuration field name strings
0x29C0AA HDAE5000_RECORD_TABLE 13-entry sub-object table (24 bytes each)
0x29D97E HDAE5000_RECORD_COUNT 46 event handler callback names
0x29DC14 HDAE5000_UI_Descriptors UI page descriptors and config data
0x29DF8A HDAE5000_UI_Page_Titles UI page title strings (“LYRICS WINDOW”)
0x29F9B2 HDAE5000_Panel_Save_UI Panel memory save/load UI strings
0x2A477C HDAE5000_Credits Developer credits (Technosoft/Pointstyle)
0x2A5634 HDAE5000_Demo_Data Demo song data and rhythm custom UI
0x2BA1A6 HDAE5000_Font_Data Font bitmap data (162KB)
0x2E1C82 HDAE5000_Config_Strings Version “V2.06i”, status table, config codes
0x2E21D8 HDAE5000_Test_Strings PPORT test and debug strings
0x2E2500 HDAE5000_Dir_Strings Directory management and file type info
0x2E2E76 HDAE5000_Char_Tables Character set lookup tables
0x2E348F HDAE5000_Path_Strings File path patterns and config
0x2E365D HDAE5000_UI_Icons UI icon/pattern bitmap data
0x2E3704 HDAE5000_Multilingual_Messages Trilingual messages (EN/DE/FR, 9,340B)
0x2E5B80 HDAE5000_Lang_Codes Language codes and file type strings
0x2F8DCE HDAE5000_Display_Params File extensions (.SEQ through .TTX)
0x2F94B2 HDAE5000_Init_Data Data copied to 0x23952A (0xC82 bytes)

Frame Handler Flow

The frame handler at 0x28F662 performs these steps:

  1. Check workspace pointer at 0x23A19E (skip if -1)
  2. Read handler states from 0x230ED2, 0x230ED6
  3. Calculate display offset, store at 0x230EC6
  4. Call registered callbacks via workspace function pointers
  5. Check handler 1 status bit 2 at 0x230ECC
  6. If status changed, call status routines at 0x28B3B3
  7. Exit via JP to PPORT handler at 0x29501C

Handler Registration (0x280020) – FULLY DISASSEMBLED

The HDAE5000_Handler_Registration routine registers 11 callback handlers with the main CPU’s workspace dispatch system via RegisterObjectTable (0xFA42FB), plus a final special call via dispatch offset 0x0270 for graphics initialization. This enables the HDAE5000 firmware to integrate with the main system’s event loop. Each handler registration copies a 14-byte parameter block to object_table[handler_id * 14] at the workspace base (0x027ED2).

For handler 0x016A (port 0x01600004), the handler function is read from workspace[0x0E0A][0x0168], which resolves to ClassProc (0xFA44E2) — the shared handler used by all DISK MENU modules. The actual firmware symbols for the dispatch system are: SendEvent (0xFA9660), ClassProc (0xFA44E2), ObjectProc (0xFA3D85), InheritedProc (0xFA4409), PostEvent (0xFAD61F).

Registration Structure (14 bytes on stack):

Offset Size Field Description
0x00 4 Port Address PPI port identifier (e.g., 0x01600004)
0x04 4 Handler Func Handler function pointer from workspace table
0x08 2 Record Count Number of 24-byte sub-object records
0x0A 4 Data Pointer Pointer to RAM or ROM data area

Registered Handlers:

ID Port Table Offset Size Data Pointer Purpose
0x016A 0x01600004 0x0168 var 0x29C0AA UI config strings
0x01CA 0x0160000C 0x013C var 0x2397EA RAM data area
0x01EA 0x0160000D 0x0140 var 0x239824 RAM data area
0x012A 0x01600002 0x0248 0x45 0x23952A Init data dest
0x042A 0x01600002 0x0248 0x45 0x239642 Init data area
0x010A 0x01600001 0x0244 0x0D 0x239872 RAM data
0x040A 0x01600001 0x0244 0x0D 0x2398AA RAM data
0x014A 0x01600003 0x024C 0x0E 0x239FD2 RAM data
0x044A 0x01600003 0x024C 0x0E 0x23A00E RAM data
0x007F 0x01600010 0x0280 0x315 0x2A5D2C ROM graphics
0x037F 0x0160000F 0x0148 0x315 0x2A6984 ROM graphics

Handler 0x016A Data Record Table (at 0x29C0AA): The data pointer for handler 0x016A points to a table of 13 named sub-objects (24-byte records each), representing the HDAE5000’s UI components:

Rec Sub-Index Name Function Notes
0 0x0000 SelectList 0x2807D9 Main selection list UI
1 0x0001 DbMemoCl 0x28122A Database/memo
2 0x0002 TtlScreenR 0x280489 Title screen
3 0x0003 AcHddNamingWindow 0x281411 HDD naming dialog
4 0x0004 IvHddNaming 0x282681 HDD naming input
5 0x0005 HDTitleMenu 0x2827A8 DISK MENU entry (linked to slot)
6 0x0006 TtlScreenR2 0x280567 Title screen variant
7 0x0007 TtlScreenR3 0x280645 Title screen variant
8 0x0008 AcWindowPage1 0x28043C Window page
9 0x0009 IvScreenR2 0x280723 Screen input handler
10 0x000A AcLanguageText1 0x28B554 Language text display
11 0x000B LyricBox 0x28CD08 Lyrics display box
12 0x000C FDFileSelect 0x28E61B File selection dialog

Each record links to a corresponding Root module (0x0160) component via a “next” pointer, forming an inheritance chain. Record 5 (“HDTitleMenu”) is the DISK MENU entry, matching the slot+0x00 = 0x016A0005 identifier.

Display Parameter Lookup (Alloc_Memory)

Five Alloc_Memory variants return display-related parameters based on a request code in XBC. Each variant returns a different palette data pointer for request A1:

Routine Address A1 Palette Ptr A2 Width A3 Height
Alloc_Memory_1 0x28030E 0x2A898E 320 240
Alloc_Memory_2 0x28033B 0x2BB98E 320 240
Alloc_Memory_3 0x280368 0x2CE98E 320 240
Alloc_Memory_4 0x280395 0x2E198E 27 27
Alloc_Memory 0x28F543 0x2E61CE 320 240

Request codes:

Request Code Return Value Description
0x01E000A1 Palette Ptr ROM address of palette data
0x01E000A2 Width Display width in pixels
0x01E000A3 Height Display height in pixels

The 320×240 resolution matches the KN5000’s LCD display. Alloc_Memory_4 returns 27×27 for small icon display mode.

VGA Palette Setup

The HDAE5000 uses memory-mapped VGA DAC registers for palette control. VGA I/O ports are mapped to CPU address 0x170000 + port_number:

VGA Port CPU Address Function
0x3C8 0x1703C8 Palette index register (write)
0x3C9 0x1703C9 Palette data (R, G, B sequentially)

Palette Loading Sequence:

  1. HDAE5000_Load_Palette at 0x28F8E0 loops through indices 255 to 0
  2. For each index, calculates offset = index × 4 into palette data
  3. Calls HDAE5000_Palette_Setup at 0x28F813 with index and RGBX pointer
  4. Palette_Setup writes index to 0x3C8, then R/G/B values to 0x3C9
  5. RGB values are right-shifted by 4 (VGA DAC uses 6-bit color channels)

RAM Test and HD Initialization (0x2971A3)

The HDAE5000_Check_HD_Present routine performs hardware validation:

  1. RAM Test Pattern Fill - Fills 32KB (0x230F1C-0x238F1C) with 0x5A5A
  2. Verify Pattern - Reads back and compares each word
  3. Clear RAM - Fills same range with 0x0000
  4. Initialize Variables - Sets up HD-related variables at 0x229Dxx:
    • 0x229D90: Status flag
    • 0x229D92: Result flag (returned in L)
    • 0x229D99-0x229DAE: Configuration flags
    • 0x229DC8: Control flag
    • 0x229DD9: Enable flag

Returns: L = 0 if no HD present, non-zero if HD detected.

Memory Utility Routines (0x29AE9F)

Optimized memory manipulation functions:

Address Function Description
0x29AE9F MemCopy Stack params: dest, src, count. Uses LDIRW for words.
0x29AEC7 MemFill Aligns to 4-byte boundary, then uses 32-bit writes
0x29AF0B StrCopy Finds string length, copies including null terminator

Version Info Block (0x2999B0)

Contains identification strings:

  • “Technics Software section M. Kitajima”
  • Version “2.33J”, also “2.21”
  • “TECHNICS KN5000”

Developer Credits (0x2A477C)

The HDAE5000_Credits section contains company identification strings embedded in data structures:

  • “Technosoft, CH-Samstagern” — Swiss software company (Samstagern, Canton of Zurich)
  • “Pointstyle, CH-Buttisholz” — Swiss company (Buttisholz, Canton of Lucerne)

These appear alongside configuration data blocks with byte parameters, suggesting they identify the companies responsible for different subsystems of the HDAE5000 firmware. The location near the Demo_Data section implies connection to the demo/rhythm customization features.

Disassembly Status

Component Status Notes
ROM rebuild 100% Byte-matching rebuild achieved
Entry point vectors 100% JP instructions at 0x280008, 0x280010
Boot initialization Disassembled 236 bytes at 0x28F576, fully documented with labels
Handler_Registration Disassembled 750 bytes - registers 11 callbacks via RegisterObjectTable
Alloc_Memory variants Disassembled 5 variants × 45 bytes = 225 bytes total
Get_Init_Flag Disassembled 6 bytes - HD presence flag getter
Load_Palette Disassembled 43 bytes - loads all 256 VGA palette entries
Code section 1B Labeled 61,825 bytes - Register_Frame and utilities
Clear_Work_Buffer Disassembled 88 bytes - clears 62KB work area, copies 3KB init data
Delay_Loop Disassembled 17 bytes - nested delay loop decrementing XWA
VGA_Port_Write Disassembled 37 bytes - writes byte to VGA port at 0x170000+port
Palette_Setup Disassembled 205 bytes - converts 8-bit RGB to VGA 6-bit format
Finalize_Init Disassembled 1 byte - just RET (stub routine)
Display_Init Label exposed 23,254 bytes - display callback initialization
Frame_Handler Disassembled 126 bytes - main entry, display offset calc, callback dispatch
Frame_Handler_Status Disassembled 161 bytes - monitors bit 2, triggers display init
Frame_Handler_Exit Disassembled 4 bytes - JP to PPORT handler
PPORT jump table Disassembled 12 labeled dd entries
PPORT strings Disassembled 560 bytes - 21 menu strings as ASCII literals
Code section 2B Labeled Split into 3 parts (Handlers, Check_HD_Present, MemCopy)
Embedded images 100% 4 images + 2 palettes extracted (~233KB)
Filesystem In progress Documented – FSB/FGB/FEB hierarchy, most routines disassembled

Summary:

  • Labels: 147 (101 in symbol reference file)
  • Bytes disassembled (code): ~2,621
  • Bytes converted to readable data/strings: ~67,000 (UI config, event handlers, trilingual messages, file types, credits, character tables, display params)
  • Bytes in .incbin: 407,370 (77.6% of ROM)
  • Binary files referenced: 4 (code_2803c2, code_28f90c, code_295642, code_2971b7, code_29af2d)

The remaining .incbin blocks are primarily: font bitmaps (162KB), palette data (78KB), graphics init params (73KB), and code routines (85KB across 4 binaries).

MAME Emulation Status

Component Status Notes
Extension board detection Working ROM loads at 0x280000, board detected by firmware
Extension DRAM Working 256KB RAM at 0x200000-0x27FFFF
IDE/ATA interface Wired ata_interface_device connected at CS0 (0x130010-0x13001F), CS1 (0x130020-0x130021)
Hard disk image Loadable Standard IDE HDD image via -hard flag
PPI (parallel port) Stubbed i8255 device instantiated but callbacks not connected
IRQ routing TODO ATA INTRQ (CN6 pin 58) not yet routed to CPU
Homebrew ROM loading Working Custom ROMs loadable via -extension hdae5000

The MAME driver file is src/devices/bus/technics/kn5000/hdae5000.cpp. ATA registers are decoded with LOGMASKED logging for protocol analysis.

Creating Test Disk Images for MAME

This section explains how to create a virtual hard disk image for testing the HDAE5000 hard disk expansion in MAME.

Prerequisites

You need chdman, the MAME Compressed Hunks of Data manager tool. It is built alongside MAME and should be available at the root of your MAME build directory (e.g., mame/chdman). Verify it is present:

./chdman help createhd

Disk Geometry

The real HD-AE5000 used a 2.5” laptop IDE hard disk with approximately 1.08GB capacity. The firmware reads the drive’s CHS (Cylinder/Head/Sector) geometry via the ATA IDENTIFY DEVICE command (0xEC) and uses CHS addressing for all disk operations.

A reasonable geometry for a ~1GB drive is:

Parameter Value
Cylinders 2100
Heads 16
Sectors per track 63
Bytes per sector 512
Total capacity 1,083,801,600 bytes (~1.03GB)

These values are representative of typical 2.5” IDE drives from the mid-1990s. The firmware accepts whatever geometry the drive reports, so the exact values are not critical.

Creating a Blank CHD Image

Use chdman createhd to create a blank hard disk image in MAME’s CHD (Compressed Hunks of Data) format:

chdman createhd --output hdae5000.chd --chs 2100,16,63 --sectorsize 512

This creates a compressed CHD file. Since the disk is blank (all zeros), the CHD will be very small (around 1MB) despite representing a ~1GB drive. The file grows as data is written to it.

To create an uncompressed CHD (slightly faster for testing, but uses more disk space):

chdman createhd --output hdae5000.chd --chs 2100,16,63 --sectorsize 512 --compression none

Creating a Raw Disk Image (Alternative)

MAME also accepts raw disk images with .hd or .hdi extensions. A raw image is simply a file containing the raw sector data:

# Create a 1GB sparse file (instant, uses no actual disk space until written)
truncate -s 1083801600 hdae5000.hd

Note: Raw images do not carry CHS metadata. MAME will infer geometry from the file size, which may not exactly match what the firmware expects. CHD images are recommended because they embed the CHS parameters explicitly.

Loading the Disk Image in MAME

Use the -hard option to attach the disk image when launching MAME with the HDAE5000 extension:

mame kn5000 -extension hdae5000 -hard hdae5000.chd

The -extension hdae5000 flag loads the HDAE5000 extension board ROM, and -hard attaches the disk image to the IDE interface.

For automated/headless testing, add the standard skip flags:

mame kn5000 -extension hdae5000 -hard hdae5000.chd \
  -skip_gameinfo -seconds_to_run 120 -nothrottle -window

Expected Behavior

When booting with a blank/unformatted disk, the firmware should:

  1. Detect the HD-AE5000 board via the PE port bit 0 presence line
  2. Issue IDENTIFY DEVICE (0xEC) to read the drive’s CHS geometry
  3. Attempt to read the FSB (File System Block) from the disk
  4. Report an error because the disk has no valid filesystem – expect messages like “Hard disk FSB read error” or “Hard disk FAT read error” (the firmware uses “FAT” loosely in error messages despite using a custom filesystem)

To format the disk, you would normally use:

  • On the keyboard: MEMORY & CONTROL -> (HD-AE5000) HARDDISK -> SETUP & TOOLS -> select format option
  • From a PC: The HD-TechManager5000 software’s TOOLS -> FORMAT function via the parallel port interface (not yet emulated in MAME)

Pre-Formatting Disk Images

The HDAE5000 uses a custom proprietary filesystem with a three-level hierarchy of FSB (File System Block), FGB (File Group Block), and FEB (File Entry Block) structures. This is not a standard filesystem like FAT.

No tool currently exists to pre-format disk images with the HDAE5000 filesystem structure from outside MAME. The filesystem layout is partially documented:

  • FSB occupies the first few sectors (Sectors 0-4) and contains volume metadata, directory pointers, and a sector allocation table
  • Sector allocation uses VarInt-encoded entries in a 20KB table (max 20,457 sectors)
  • Directory entries are 37 bytes each on disk, with up to 120 total slots across 5 pages of 24 entries
  • Partitions support up to 16 per disk, each with up to 40 file entries

Building a pre-formatting tool is possible given the filesystem documentation, but the simplest approach is to format the disk through the firmware itself once the MAME emulation is complete enough to support the format operation.

Verifying the Disk Image

To inspect or verify a CHD image:

# Show CHD metadata (geometry, compression, size)
chdman info --input hdae5000.chd

# Extract raw data from CHD for analysis
chdman extracthd --input hdae5000.chd --output hdae5000.raw

# Convert raw image back to CHD
chdman createhd --input hdae5000.raw --output hdae5000.chd --chs 2100,16,63 --sectorsize 512

Workspace Pointer & Object Dispatch System

The main firmware passes workspace pointer 0x027ED2 in XWA when calling Boot_Init. This is the base of the firmware’s object table in main DRAM — a 14-byte-per-entry table supporting up to 1,120 objects (handler IDs 0x0000-0x045F). The HDAE5000 stores this at 0x23A1A2 and uses it to access the firmware’s callback dispatch system via handler table offsets at +0x0E0A and +0x0E88.

The XAPR detection flag at 0x03DD04 controls whether the Frame_Handler is called. The firmware sets this to 1 when the XAPR signature is validated, and checks it on every main loop iteration before calling the frame handler at 0x280010.

Firmware Dispatch Functions

The firmware’s object-oriented dispatch system uses these key functions (names from the main CPU symbol table):

Address Symbol Purpose
0xFA9660 SendEvent Synchronous event dispatch: looks up handler, calls identity query, then calls record function
0xFA44E2 ClassProc UI event handler shared by all DISK MENU modules (port 0x01600004)
0xFA3D85 ObjectProc Object lifecycle event handler (events 0x10-0x23)
0xFA4409 InheritedProc Follows “next handler” chain in data records
0xFA42FB RegisterObjectTable Copies 14-byte param block to object_table[id * 14]
0xFA431A RegisterObject Registers individual object entry
0xFA43B3 UnRegisterObject Removes object entry
0xFAD61F PostEvent Queues event for asynchronous dispatch (ring buffer at 0x02BC34)
0xFA40B2 InitializeObjectTable Clears all table entries and registers built-in handlers

See HDAE5000 Homebrew Development for detailed analysis of each function.

External References