Sega Master System / Mark III / Game Gear|
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew
SMS BIOS version 2.0Posted: Fri Dec 26, 2014 7:51 pm
Last edited by Maxim on Wed Mar 04, 2015 7:59 pm; edited 1 time in total
This came up over at the Sega8bit forums:
Am I right in thinking this hasn't been dumped? Is it particularly unusual?
||Posted: Fri Dec 26, 2014 7:57 pm|
|I've only ever seen v1.3 of that particular boot screen. Hope you can get it dumped and see if there's any real changes some time soon!|
||Posted: Fri Dec 26, 2014 8:07 pm|
Interesting. I don't recall seeing that but it's something that is easy to overlook, so I may have a system with the same BIOS somewhere.
Asked more questions to the owner.
||Posted: Wed Jan 14, 2015 8:58 pm|
Interesting find, but is there anything interesting about the rom itself?
I hope they didn't just change the number from 1.3 to 2.0 ;)
||Posted: Wed Jan 14, 2015 9:13 pm|
|It is probably a very minor change, but nevertheless we'll get it dumped and check. Its owner agreed to let me borrow the console for dumping., so that may happen soon.|
||Posted: Wed Jan 14, 2015 10:43 pm|
|In my previous analysis of the BIOSes, which have version numbers past 2, the actual BIOS functionality doesn't change materially. I suspect it will be unexciting but we want completeness :) I'm curious to see if it is a mask ROM or an escaped EPROM. It seems strange for it to be rare.|
||Posted: Wed Jan 14, 2015 11:00 pm|
I guess we can always hope for a BIOS with the original EU/US SEGA Bumper logo followed by the JP Attract screen.
That would be the ultimate BIOS with Snail Maze game still hidden. :D
||Posted: Fri Feb 20, 2015 10:52 am|
I have the machine here.
Here are the information from the back (that Rudi also posted on Sega8bit forum).
SEGA MASTER SYSTEM
Model No 3010
Rating: DC 9V 850mA
Use 3025-18 AC Adaptor Only
Serial No: 77541514
Sega Enterprises, Ltd. Made In China
SMS 2.0 BIOS romPosted: Fri Feb 20, 2015 12:40 pm
Last edited by Bock on Wed Mar 04, 2015 10:56 am; edited 4 times in total
Attached unreleased dump of a very uncommon European BIOS dump from a SMS 1. It says "v2.0"
*EDIT* rom released and added to www.smspower.org/Games/SegaMasterSystemRom-SMS
FYI the other BIOS roms are
SMS Prototype (M404) [Proto] [BIOS]
SMS Prototype (v1.0) [Proto] [BIOS]
SMS (v1.3) [BIOS]
SMS Japanese (v2.1) [BIOS]
Hang On & Safari Hunt (v2.4, 1988) [BIOS]
Hang On (v3.4, 1988) [BIOS]
Missile Defense 3-D (v4.4, 1988) [BIOS]
Alex Kidd in Miracle World [BIOS] (no version)
Sonic The Hedgehog [BIOS] (no version)
It'd be interesting to know where does it sit and what are the differences with other known roms.
There's something odd, on the real hardware when booting the snail game, the tilemap shows a little glitch on two sides. Attached pictures.
It doesn't seem to repro on MEKA or Emulicious. The tile in question appears to be tile $B0 (referenced in tilemap at $39C0 and $39FE). The "correct" value shown with other version of the snail game and currently in MEKA is $00. I haven't investigated further yet.
If you zero 3 bytes from 0x114 you can cancel the cartridge check and boot into the instruction screen. Then UP+1+2 to start the secret snail game.
||Posted: Sat Feb 21, 2015 11:54 pm|
|When do these 2 glitches appear? Do they scroll in with the maze or do they appear right after the maze has finished scrolling?|
||Posted: Sun Feb 22, 2015 11:02 am|
|Sorry that wasn't explained. They become visible as the maze is scrolling in (to the left-most glitch is visible first and the right-most one later when the maze almost finished scrolling).|
||Posted: Sun Feb 22, 2015 11:59 am|
I did a very preliminary disassembly to compare 1.3 to 2.0...
Notes so far:
- v2 drops an unnecessary di at line 169
- Data at $1a7 ($1a6 in v1) is the 2.0/1.3 tilemap data
- v1.3 seems to have more data, pushing all the labels along by 8 bytes. I amended some of the label names in v2 to match, but far from all of them.
- Emulicious's disassembly didn't detect the code in RAM:
ld hl, $0288
ld de, $C700
ld bc, $00D9
call $C700 ; Possibly invalid
- The RAM-resident code is quite different between the two, but I didn't go into the details yet. I remember there were two distinct sets of code for the export BIOSes (albeit very similar) but I don't remember exactly how. I guess I lost that work from 9 years ago.
||Posted: Sun Feb 22, 2015 2:00 pm|
The glitches come from the values stored in $c9c0 and $c9fe.
These values are loaded into vram when the snail maze scrolls in.
RAM is only cleared at the beginning. So it seems like some code that is executed from RAM when $c700 is called overwrites these values with something non-zero.
||Posted: Sun Feb 22, 2015 2:21 pm|
As Maxim says, BIOS v2.0 is quite similar to v1.3.
Regarding the RAM-resident code, the main difference concerns the function which determines whether or not a cartridge (or card, etc.) is inserted. In v1.3, the following code is used:
This function may be called at $c736, $c731 or $c72c. It copies the ROM header into RAM, checks for "TMR SEGA" and then calls $c761. The function at $c761 ensures that the region code is 4 and that the checksum is correct.
In v2.0, the above code is replaced with:
This code copies the first 513 bytes of ROM into RAM and then simply checks that all 513 are not identical.
BIOS v2.0 therefore does not check for "TMR SEGA". It also does not perform the other header checks - although the function from $c761 is still present, it is never called.
I believe the detection algorithm used by v2.0 is similar to that used by the Japanese BIOS (which is numbered v2.1)?
||Posted: Sun Feb 22, 2015 2:25 pm|
Could it be then that in spite of the numbering, 2.0 came before 1.3 ?
I have the system here I'll open it and take pictures.
||Posted: Sun Feb 22, 2015 2:27 pm|
That's right - although the Japanese one masks out some of the bits. Maybe this was intended to be the Japanese BIOS? Only existing Japanese (and SG-1000) games need this lenient check.
MPR numbers should help with sequencing.
||Posted: Sun Feb 22, 2015 2:36 pm|
Indeed - BIOS v2.0 copies the first 513 bytes of ROM into $c9c0 - $cbc0.
I assume you tried to reproduce the glitch with a patched BIOS ("zero 3 bytes from 0x114")? Unfortunately this patch prevents the glitch from appearing, because it prevents the RAM-resident code from running at all.
An alternative patch, which should show the glitch on emulators, is to zero the byte at $02c5.
||Posted: Sun Feb 22, 2015 2:47 pm|
One further difference in the RAM-resident code: both versions of the BIOS end with the following instructions if a game is detected:
3E EB ld a,EBh
D3 3E outa (3Eh)
3A 00 C0 ld a,(C000h)
D3 3E outa (3Eh)
C3 00 00 jp 0000h
Version 2.0 adds a few additional instructions immediately before those above:
C7C0: 21 AC 03 ld hl,03ACh
C7C3: 22 03 C2 ld (C203h),hl
C7C6: 3E 03 ld a,03h
C7C8: FB ei
C7C9: CD 2E 04 call 042Eh
C7CC: F3 di
The effect of these additional instructions, along with 19 additional bytes of data at $03ac - $03be, is to zero the sprite palette.
||Posted: Sun Feb 22, 2015 2:50 pm|
|So does what you see depend on what's read from ROM - or rather, what the undriven expansion port gives you, assuming that's the last slot checked. Maybe they tested on hardware that returned zeroes.|
||Posted: Sun Feb 22, 2015 3:19 pm|
The ROM chip says
The board 1986 Made in Hong Kong, appears to be the same as
||Posted: Sun Feb 22, 2015 3:44 pm|
The BIOS is the chip marked "SONY MPR-10883" (the one marked "315-5216" is the I/O Controller).
This compares to MPR-11124 for the Japanese BIOS v2.1. Unfortunately, I do not believe that an MPR number for BIOS v1.3 is known (the chips are generally marked "SONY CXK3864").
It is a shame that the date stamped on the board simply reads "5 AUG" and is missing a year.
||Posted: Sun Feb 22, 2015 3:48 pm|
||Posted: Wed Feb 25, 2015 11:46 am|
I'll release that rom this week (among with a few others). I purchased the system from its owner in case there's any further useful investigation to do.
It's interesting because it means this system should be able to play SG-1000/Mark III cartridges with an adapter, and any Japanese card games without an adapter.
||Posted: Wed Feb 25, 2015 12:49 pm|
I've immediately improved the disassembler to disassemble code like that as well and just released the update. :)
||Posted: Fri Feb 27, 2015 7:38 am|
This seems unlikely, especially given that 2.0 contains unused code which is left over from 1.3.
It is possible that this is some form of prototype Japanese BIOS. However, I would expect such a prototype to be on an EPROM rather than a production-style mask ROM.
Another possibility is that this BIOS was intended for release in a Western country where SMS buyers might already own SG-1000/SC-3000 games. Perhaps the plan was to sell a cartridge adapter? If this is the case, it seems we can narrow down the location to somewhere in Europe, based on the source of this particular system and the country code on its base ("Use 3025-18 AC Adaptor Only").
I have confirmed using Kega Fusion that this BIOS allows the use of Japanese games. Have you been able to test this on the system itself?
||Posted: Wed Mar 04, 2015 10:40 am|
|I've tested a card game and it worked. I haven't tested a cartridge game but I assume which a custom cartridge adapter they would work.|
||Posted: Wed Mar 04, 2015 11:21 am|
The ROM is now available here:
||Posted: Sat Mar 07, 2015 5:49 pm|
Now it is:
SMS BIOS 1.3 Sharp MASK ROM
I took that out from a 1988 USA SMS I modded for a friend (FM + USA/JPN bios) a year ago. I kept the chip because I thought it could be something of importance. Seems like I was right.
Edit: SHA1 is C315672807D8DDB8D91443729405C766DD95CAE7
||Posted: Sun Mar 08, 2015 9:22 pm|
That matches the good dump of BIOS v1.3, so confirms that its number is MPR-10052. As expected, this precedes v2.0's MPR-10883.
Yes, this is useful information. Thanks.
||Posted: Sun Mar 08, 2015 9:56 pm|
Just mentioning, the date code on the Z80, the Gate Array and other parts at the system with the BIOS 2.0 suggest that the machine was assembled in the 1st half of 1987. Usually the newest part can give you a good idea.
For example the Z80 date code is 8722 (1987, week 22)
||Posted: Mon Mar 09, 2015 4:31 am|
We can conclude, then, that this machine was produced in August 1987.
||Posted: Tue Mar 10, 2015 7:43 pm|
I now have a full disassembly of BIOS 2.0, very similar to the 1.3 one; as with 1.3 it assembles to an exact binary copy of the dump.
You guys already found almost all the 1.3 <-> 2.0 differences, the only extra one I found was the removal of 6 bytes of data that was unused in 1.3 (under the label "MysteriousUnusedData" in my 1.3 disasm)
Once I'm done with the polish pass on 1.3 (add extra macros etc.) I will do the same for 2.0 and release the .asm file.
In the meantime, here is the full recap of 1.3 <-> 2.0 differences:
* Removed unnecessary di instruction after the call to the detection code in RAM
* In the instruction screen tile map, changed "V1.3" to "V2.0"
* Removed 6 data bytes that were unused in 1.3
* The BootGame code now zeroes the sprite palette
* The only major change is in the ROM detection code; in 2.0 the code copies the first 513 bytes of ROM into RAM and then simply checks that all 513 are not identical.
Interestingly they kept all the checksum and region check code (as well as the "TMR SEGA" string), and just wrote over the calls to these (as a result, the code copied to RAM is almost the same size as in 1.3)
Posted: Wed Mar 11, 2015 8:31 am
Last edited by segmtfault on Mon Oct 05, 2015 8:18 pm; edited 2 times in total
And here is the disassembly file for BIOS 2.0.
||Posted: Wed Mar 11, 2015 9:09 am|
|Great, you're saving me the effort :) Can you do v1.0 next?|
||Posted: Wed Mar 11, 2015 5:58 pm|
Yes, that was my plan :)
||Posted: Sat Mar 14, 2015 9:52 pm|
I think we can discount Germany, I have a 1986 launch version, It has a "TUV" (I guess some kind of German RF standard requirement) sticker on the base next to the model/serial sticker. I have also previously owned a German SMS II with the same sticker. According to the service manual these could be bought from Sega Japan for German systems, so it would seem that these were mandatory for German systems. Incidentally, "3025-18" seems to be that standard EU AC adapter (maybe because it released in Germany first but was later also compatible with other European countries). Also, the second digit of the serial number represents the year it was assembled (in this case 7=1987), although if a mainboard was manufactured at the end of a year then the actual assembly could occur in the following year.
Still, SC-3000 was never sold in Germany, mainly France and to a lesser extent Italy and Finland in Europe. The date from this console fits with French SMS launch, but French systems were RGB only, whereas this unit has RF out too. So we can rule out France and probably the SG-1000 adapter theory. Although with Sega's previous history of the Card Catcher in 1985 and Powerbase converter in 1989 that did seem like a realistic theory.
The country of origin could probably be rounded down by finding out which RF modulator it uses, but most of EU used B/G, UK: I.
So if we assume that this is a retail bios, is it possible that it was installed to the wrong model by mistake? That would seem like an easy mistake to make.
Check out this thread. A PAL 1988 Chinese system with JP cartridge slot but "Hang On game is built into the Powerbase". Unfortunately the owner sold it, so no way to check the bios. However, JP bios did not have Hang On, and Export bios with Hang On would have not been compatible with many JP carts, so as this console plays JP carts and not export ones then surely it must have a modified bios with similar changes to 2.0.
Obviously this is not the same bios (no Hang-On), but is it possible that the 1988 Chinese system with Hang On was not the first system released there, and another version with no game released the previous year based off of 1.3, but with the changes to 2.0 to allow it to play JP games?
Just speculation on my part, but we may get an idea if the 1988 Chinese bios ever gets dumped.
||Posted: Sat Mar 14, 2015 9:58 pm|
|Good point on the Chinese SMS. Somehow I never noticed / make the connection that it had an Asian cartridge slot but not the other features of a Japanese SMS.|
||Posted: Sat Mar 14, 2015 10:02 pm|
|Also, 2.1 released in the second half of 1987, wheras 2.4+ released in the second half of 1988, what happened to 2.2 and 2.3? Is it possible that Chinese bios with Hang On is V2.2 or V2.3?|
||Posted: Sat Mar 14, 2015 10:07 pm|
Yeah, no "3-D Glasses" port, so clearly a unique model rather than a re-boxed JP model.
||Posted: Sat Mar 14, 2015 10:18 pm|
Didn't the South Korean hardware (Gam Boy?) also had such configuration ?
I don't think SEGA would put the Space Harrier bios with Japanese text on something they were selling back then in South Korea.
Because at the time the bad feelings about WW2 and the Japanese military campaign in Asia were still strong.
To the point that for example popular arcade fighting games from Capcom and SNK made for official release on those countries had Japanese text converted to English and voice overs for special moves replaced with grunts/shouts.
||Posted: Sat Mar 14, 2015 10:39 pm|
A great article on South Korean gaming here, by someone who posts here. It does go into some of the issues you bring up. However, Gam*Boy released in 1989, so seems to post-date the Chinese system, maybe early systems have an undumped bios, but according to that article the ban on Japanese language in video games came much later. Also, early Korean systems are supposed to have FM capability, so maybe they were simply imported at first.
Still, I have a theory, 2.2=Hang On + no region check, 2.3=Hang On/Safari Hunt + no region check. Specific to to 1988 Chinese market, the only place we have seen PAL console with Asian cartridge port. Maybe 2.0 is the previous Chinese version of 1.3.
As to the reason why it was sold in China in the first place? Sega outsourced manufacturing, at first to Hong Kong based WKK who had factories in China. WKK also had a consumer sales division who sold the SMS in Hong Kong since the beginning in 1986, so I guess it was them who pushed for release in the mainland too.
||Posted: Sun Jun 07, 2015 3:16 pm|
Here's a 1987 PAL-D (China) Master System with a Japanese cartridge slot (No FM, Rapid Fire, or 3D adapter port). Model: 3095-15-B. Bios doesn't include Hang On, just the maze game. Label has "Hiroshima Trading Co., LTD." on it. I guess this was the model that this bios was intended for.
Picked up a sms V2.0 from ebay australiaPosted: Thu Mar 09, 2017 11:28 pm
I picked up a collection from ebay Australia a few weeks ago,
I went looking as the snail game has the distinct graphics bug
The unit came from victoria, the gent i bought it from said that it was from his childhood, a few of the games that came with it had receipts from local computer stores dated in the 80s which seem to support his claims,
If you want any photos or serial number etc just let me know,
||Posted: Fri Mar 10, 2017 8:36 am|
|Photos and serial numbers would be nice :)|
Photo's of V2.0 found in australiaPosted: Sun Mar 12, 2017 6:21 am
The serial number is similar but quite a few between the other one,
The date stamp on the pcb is 7 Dec, no year unfortunately.
Hope this info is useful,
||Posted: Sun Mar 12, 2017 7:01 am|
Year is 1987 according to the chips datecodes.
||Posted: Tue Mar 14, 2017 6:55 pm|
Neat, it's from the same batch (all PAL 1987 consoles come from this batch), but from towards the end (about 230,000 units manufactured in this batch), as the date stamp confirms. This should be a PAL-B(VV) console (only Australia had this standard), where as the other one should be PAL-G (most of mainland Europe except France).
After about 25,000 units or so they dropped the region code, which could have been a problem if for example Australian consoles got mixed up with European ones they wouldn't have been compatible with local televisions. They restored region codes after this batch, so maybe it resulted in some errors being made. So quite possibly a case of Chinese bios installed by error, but we don't have a Chinese bios dump to confirm.
I've been collating serial numbers. As this batch dropped region codes I noted which country the console showed up in (might not have originally been sold there).
First digit = Manufacturer (7 = Made in China, should be WKK).
Second digit = Year (7 = 1987)
77529373 3010 (FR)
77541514 3010 (BE) (Bios 2.0!)
77542424 3010 (DE)
77543978 3010 (DE)
77542857 3010 (DE)
77544216 3010 (DE)
77544634 3010 (DE)
77544885 3010 (DE)
77545641 3010 (DE)
77547322 3010 (UK)
77553394 3010 (DE)
77554809 3010 (DE)
77555349 3010 (DE)
77555425 3010 (DE)
77556558 3010 (PL)
77556977 3010 (DE)
77560925 3010 (DE)
77563886 3010 (UK)
77565067 3010 (UK)
77567493 3010 (DE)
77570880 3010 (DE)
77572419 3010 (DE)
77579019 3010 (DE)
77579285 3010 (DE)
77560586 3010 (DE)
77566720 3010 (DE)
77569188 3010 (DE)
77576362 3010 (FR)
77579285 3010 (DE)
77580270 3010 (DE)
77581861 3010 (PL)
77591792 3010 (UK)
77595986 3010 (FR)
77600008 3010 (UK)
77600892 3010 (UK)
77601581 3010 (UK)
77601998 3010 (UK)
77602845 3010 (DE)
77604211 3010 (UK)
77608096 3010 (IT)
77608211 3010 (PL)
77611823 3010 (FR)
77618441 3010 (FR)
77619762 3010 (FR)
77621530 3010 (FR)
77623258 3010 (FR)
77623472 3010 (FR)
77628547 3010 (UK)
77628709 3010 (UK)
77628909 3010 (UK)
77630232 3010 (UK)
77630529 3010 (UK)
77633719 3010 (UK)
77641076 3010 (FR)
77647777 3010 (FR)
77647813 3010 (FR)
77649932 3010 (UK)
77650949 3010 (UK)
77652349 3010 (UK)
77654171 3010 (UK)
77654550 3010 (UK)
77655080 3010 (UK)
77660193 3010 (UK)
77660519 3010 (UK)
77661546 3010 (UK)
77661998 3010 (UK)
77662917 3010 (UK)
77666713 3010 (FR)
77673412 3010 (FR)
77677842 3010 (HK)
77683115 3010 (DE)
77684797 3010 (DE)
77685010 3010 (DE)
77685917 3010 (DE)
77686530 3010 (DE)
77688990 3010 (DE)
77694630 3010 (UK)
77696293 3010 (SE)
77697471 3010 (FR)
77706146 3010 (FR)
77707831 3010 (FR)
77715011 3010 (UK)
77710024 3010 (UK)
77716637 3010 (UK)
77720590 3010 (ES)
77722322 3010 (ES)
77722782 3010 (ES)
77723363 3010 (AU)
77723371 3010 (AU) (Bios 2.0!)
77723381 3010 (AU)
77727037 3010 (CN)
||Posted: Tue Aug 08, 2017 10:22 pm|
Just recently saw this thread again and I decided to replace the Boot Loader BIOS on my later model SMS (board revision 837-6629, the one with Hang-On/Safari Hunt built-in) with the v2.0 BIOS. It works perfectly but since it's 8K, it has to be padded to 32K before burning in order for it to be a drop-in replacement. Here's the padded file, simply burn it to a 27C256 EPROM and you're in business.
||Posted: Mon Oct 02, 2017 11:25 am|
Thank you! :)