Reading an EPROM with an Ethernet Card

Mar 2009

I have a 26-year old computer that's on its last legs. It's a Zenith Z-100, of the Heathkit H-110 kit variety. It was my first home computer, and I had sooooo much fun with it and learned a lot hacking away on it. There's a lot of sentimental value to it, so I'd love to preserve it — not necessarily the hardware but the experience of running its software, including what I wrote for it.

To do that requires an emulator. The Z-100 is not a PC compatible, so the many PC emulators that are available won't work. Maybe one day I'll modify one to do the job. However, an emulator needs the original software including the firmware from the machine. On powering it up for the first time in five years I found that the machine would no longer boot from floppy disk (this unit has no hard drives) indicating a problem with the floppy disk controller board. The rest of the machine seemed to work, although the composite video showed shimmering colours around any text like the boot prompt.

This presented a problem because I'd been hoping to use MS-DOS's DEBUG utility to dump the firmware contents. So if it won't boot an OS then what could I do to read the firmware? It's a standard 2764 EPROM so I figured I could interface to it directly; I plugged it into a digital designer and prototyped a simple circuit for connection to a PC parallel port. This proved to be unstable and the EPROM would lock up after a few seconds of operation. While doing more research I happened to stumble across a web page that mentioned using an Ethernet card's boot ROM socket to read an EPROM. That was the bright spark of an idea I needed.

I knew about Ethernet boot ROMs but hadn't a clue how they worked. Some reading taught me that the card simply maps the contents of the ROM into the PC address space meant for BIOS Extensions. A normal boot ROM will contain a BIOS Extension signature and checksum; if those are good then its code will be executed during the PC's boot process. The Z-100 boot ROM is not a BIOS Extension so its code will not be executed but will be mapped into the PC's memory.

The 2764 is a 28-pin part. Most Ethernet cards now have a 32-pin boot ROM socket, if they have one at all. The only card I had with a 28-pin socket was an ancient 3Com 3c509. This card defaults to the socket being disabled and requires a configuration utility to enable it. The utility only runs under MS-DOS, or early Windows versions maybe. The commonly available Linux utility that can update the card's configuration knows nothing about enabling the boot ROM socket. After a final struggle the socket was enabled and I was able to read the EPROM. Under Linux it was easy to dd the appropriate range from /dev/mem to archive the data.

What a roundabout way to extract all of 8k of data but what could I do with the original equipment not able to load an OS? Had I been thinking ahead years ago I would have dumped the boot ROM while the machine was working fully.