Forums

Weird unique piece of software today.
Head up to http://www.smspower.org !
The SMS Prototype M404 BIOS shows a nice animation. The Store Display Unit one is mainly of interest to hacker and programmers, as the system has to be studied first if we want to be able to emulate its behavior.

Sorry if my picture are not excellent.

Quoting the text files embedded along with the dumps:

SMS Prototype M404 [BIOS].txt:

-------------------------------------------
Sega Master System Prototype M404 BIOS
Dumped by Omar Cornut (Bock) on 2004/10/01
http://www.smspower.org
-------------------------------------------

This is from a prototype Sega Master System that I acquired. This
model was sent to Sega of America at some point (undated). The BIOS
is on an EPROM, and is labelled:

oekaki (in Japanese hiragana)
M404

My uneducated guess is that "M404" stands for "Mark 4 version 04".
Mark 4 is the codename for the Master System. Version 04 may stand
for the BIOS version.

What the BIOS does is:

- Display an animation (maybe better than final unit animation).
- Copy a block of code to RAM at location $C100.
- Try to detect a valid media on card, cartridge or expansion slot
(in this order). If found, enable slot and jump to $0000 to
execute.
- Else, loop indefinitely.

The media detection code itself is very different from final units.
What it does for each port is:

- Look for the "COPYRIGHT SEGA" string at location $7FE0 on media.
- Look for the "COPYRIGHTSEGA" string at location $7FE0 on media.
- Look for values C3 C8 00 01 at location $0038 (int vector) on
media. This stands for a 'JP $00C8' instruction followed by a $01.

As a result, most retail Sega Master System games will not boot using
this prototype BIOS, as they do not contain either string. There is a
minimal chance that some games may contain the right byte sequence at
$0038.

Two games were found to contain this identification string:
- Japanese version of Fantasy Zone (first SMS cartridge ever
released)
- Choplifter (first or second SMS cartridge ever developed)

I modified an original piece of software (Alex Kidd in Miracle World)
to include the required string, and it played well on the system.

For reference, retail Export SMS BIOSes look for a header starting
with "TMR SEGA" at location $7FF0. This header is described at:
http://www.smspower.org/dev/sdsc/SDSCROMTag101.txt
Note that this DOES NOT apply to this prototype BIOS. The Japanese
SMS BIOS only looks for some non-sequential data, based on the fact
that early Japanese software did not have any header. So I cannot
conclude whether this prototype BIOS and the associated unit were
made before or after the release of the Japanese SMS.

There's no hidden game or other features included in this BIOS, as
far as I know (I've read most of the Z80 code). The code does not
access the PSG or controller ports.

-Omar Cornut
http://www.smspower.org

SMS Store Display Unit [BIOS].txt:

-------------------------------------------
Sega Master System Store Display Unit BIOS
Dumped by Omar Cornut (Bock) on 2004/10/01
http://www.smspower.org
-------------------------------------------

Note: This dump will not show anything on any SMS emulator. It is
meant to function with dedicated hardware that is not emulated and
may never be emulated.

This is from Sega Master System Store Display units. These are heavy
units used to promote the console in North American shops, back in
the days. The unit must be opened to access the cartridge/card slots
inside. They allow up to 16 cartridges and 3 (or 16, depending on the
unit) cards to be plugged in, and the game to play is selected via a
front panel.

The unit resets itself after a few minutes, based on dipswitch
settings.

I dumped this BIOS image from an EPROM chip located on both models
(16-3 and 16-16 models). Their content is the same.

Those units have two Z80 CPUs onboard. My guess is that the first one
is part of a standard SMS circuitry, while the second one is in
charge of checking the front panel, switching/start games, and
maintaining a timer to reset the software periodically. I think this
BIOS code is run on the second Z80 but I'm not sure.

Memory Map:
BIOS Code $0000-$3FFF (16 Kb)
RAM $4000-$47FF (2 Kb)
RAM $C000+ (? Kb)

It accesses memory locations $4000 and $8000 in a way suggesting that
they have special behavior.

What puzzles me is that this BIOS ROM contains code to write certain
values to RAM at $C000 and jump back to address $0000, which is the
booting behavior of a standard SMS BIOS. This kind of code should be
run on the main Z80 running the game.

Hypothesis: the second Z80 has access to the main system RAM (mapped
at $C000+) and copies a booting procedure for the main Z80 to execute.

Sorry if this is incomplete. I did not spend much time working on
this. There's still more to study and solve if someone aims to
emulate the behavior of this unit. The information above is
incomplete and may be inaccurate.

-Omar Cornut
http://www.smspower.org

*Updated Smschecker DAT files for all systems.
*Added too many ROMS(approx 20 new roms) to list. (all from Maxim's mirror)
*Added New Smspower Release's
SMS Prototype M404 [BIOS]
SMS Store Display Unit [BIOS]

all can be found here www.smspower.org/smscartpad

Speaking of my mirror, I did update it this afternoon with all currently available SMS Power releases, back to Wonder Boy in Monster World from August '99. The rest of the releases will have to be found by hand :)

http://smspowermirror.tk

It won't be there forever, please don't abuse it by leeching everything.

That M404 Prototype Bios is AWESOME!

The only thing that could make it more awesome is if someone were to hack it to remove the header checking, add Snail Maze, and use the remaining 20K or so of ROM to add a high quality sample of the Sega Chorus to the startup, so that anyone with moderate soldering skills could burn a 32K eprom and replace the bios in their favorite SMS unit.

But I guess it's only a dream of mine..... Unless any nice programmers want to do this for me :)

Glad you like that.

Removing header checking would be fairly quick.
Add the snail game faisable, though requiring a little more time. A sample would not fit in 20 kb.

Why don't you venture into SMS programming?
http://www.smspower.org/maxim/howtoprogram

Anyway, one of the idea I have in mind since a long time, and that probably won't be done until ten more centuries unless someone pick it up, would be to write a "super BIOS", including various functionnalities but maybe also some nice animation.

SMS Boot Loader does that, although it is very simple:

Mike Gordon said he once tried to replace his BIOS with that and it worked.

Were there any types of store displays for the NTSC community?

Stan Stepanic wrote

Were there any types of store displays for the NTSC community?

What do you mean? The SMS Store Display Unit from where I dumped the BIOS and which I took in pictures are both US units.

Oh, sorry, I read through that so fast I missed it.

I just came upon this topic recently and came upon this lost BIOS. If you wanted to hack the BIOS to make it "usable" in more realistic circumstances, I have a couple ideas that would make it more entertaining.

First, the little "Sega" ditty that's in the production US BIOS could still be used, the two parts timed accordingly to parts of the prototype logo.

Second, I've also grown fond of the tune and effects played in the Japan BIOS's "instructions" screen (the music is Space Harrier, IINM). If you could incorporate that into the BIOS as well as the "instructions" screen (instead of the simple one in the US screen), I think you'd turn a very neat trick. If I had the time, I might have delved into Z80 assembler and make the attempt myself. It's become an utter fascination to me.

Author	Message
Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	[Release] SMS Prototype M404 BIOS, SMS Store Display Unit BIOS Posted: Sun Jan 09, 2005 1:54 pm
	Weird unique piece of software today. Head up to http://www.smspower.org ! The SMS Prototype M404 BIOS shows a nice animation. The Store Display Unit one is mainly of interest to hacker and programmers, as the system has to be studied first if we want to be able to emulate its behavior. Sorry if my picture are not excellent. Quoting the text files embedded along with the dumps: SMS Prototype M404 [BIOS].txt: ------------------------------------------- Sega Master System Prototype M404 BIOS Dumped by Omar Cornut (Bock) on 2004/10/01 http://www.smspower.org ------------------------------------------- This is from a prototype Sega Master System that I acquired. This model was sent to Sega of America at some point (undated). The BIOS is on an EPROM, and is labelled: oekaki (in Japanese hiragana) M404 My uneducated guess is that "M404" stands for "Mark 4 version 04". Mark 4 is the codename for the Master System. Version 04 may stand for the BIOS version. What the BIOS does is: - Display an animation (maybe better than final unit animation). - Copy a block of code to RAM at location $C100. - Try to detect a valid media on card, cartridge or expansion slot (in this order). If found, enable slot and jump to $0000 to execute. - Else, loop indefinitely. The media detection code itself is very different from final units. What it does for each port is: - Look for the "COPYRIGHT SEGA" string at location $7FE0 on media. - Look for the "COPYRIGHTSEGA" string at location $7FE0 on media. - Look for values C3 C8 00 01 at location $0038 (int vector) on media. This stands for a 'JP $00C8' instruction followed by a $01. As a result, most retail Sega Master System games will not boot using this prototype BIOS, as they do not contain either string. There is a minimal chance that some games may contain the right byte sequence at $0038. Two games were found to contain this identification string: - Japanese version of Fantasy Zone (first SMS cartridge ever released) - Choplifter (first or second SMS cartridge ever developed) I modified an original piece of software (Alex Kidd in Miracle World) to include the required string, and it played well on the system. For reference, retail Export SMS BIOSes look for a header starting with "TMR SEGA" at location $7FF0. This header is described at: http://www.smspower.org/dev/sdsc/SDSCROMTag101.txt Note that this DOES NOT apply to this prototype BIOS. The Japanese SMS BIOS only looks for some non-sequential data, based on the fact that early Japanese software did not have any header. So I cannot conclude whether this prototype BIOS and the associated unit were made before or after the release of the Japanese SMS. There's no hidden game or other features included in this BIOS, as far as I know (I've read most of the Z80 code). The code does not access the PSG or controller ports. -Omar Cornut http://www.smspower.org SMS Store Display Unit [BIOS].txt: ------------------------------------------- Sega Master System Store Display Unit BIOS Dumped by Omar Cornut (Bock) on 2004/10/01 http://www.smspower.org ------------------------------------------- Note: This dump will not show anything on any SMS emulator. It is meant to function with dedicated hardware that is not emulated and may never be emulated. This is from Sega Master System Store Display units. These are heavy units used to promote the console in North American shops, back in the days. The unit must be opened to access the cartridge/card slots inside. They allow up to 16 cartridges and 3 (or 16, depending on the unit) cards to be plugged in, and the game to play is selected via a front panel. The unit resets itself after a few minutes, based on dipswitch settings. I dumped this BIOS image from an EPROM chip located on both models (16-3 and 16-16 models). Their content is the same. Those units have two Z80 CPUs onboard. My guess is that the first one is part of a standard SMS circuitry, while the second one is in charge of checking the front panel, switching/start games, and maintaining a timer to reset the software periodically. I think this BIOS code is run on the second Z80 but I'm not sure. Memory Map: BIOS Code $0000-$3FFF (16 Kb) RAM $4000-$47FF (2 Kb) RAM $C000+ (? Kb) It accesses memory locations $4000 and $8000 in a way suggesting that they have special behavior. What puzzles me is that this BIOS ROM contains code to write certain values to RAM at $C000 and jump back to address $0000, which is the booting behavior of a standard SMS BIOS. This kind of code should be run on the main Z80 running the game. Hypothesis: the second Z80 has access to the main system RAM (mapped at $C000+) and copies a booting procedure for the main Z80 to execute. Sorry if this is incomplete. I did not spend much time working on this. There's still more to study and solve if someone aims to emulate the behavior of this unit. The information above is incomplete and may be inaccurate. -Omar Cornut http://www.smspower.org

Youltar Site Admin Joined: 28 Oct 2004 Posts: 306 Location: Wisconsin, U.S.A.	Mirrored on FTP Posted: Sun Jan 09, 2005 2:18 pm
	Updated Smschecker DAT files for all systems. Added too many ROMS(approx 20 new roms) to list. (all from Maxim's mirror) *Added New Smspower Release's SMS Prototype M404 [BIOS] SMS Store Display Unit [BIOS] all can be found here www.smspower.org/smscartpad

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Sun Jan 09, 2005 4:19 pm
	Speaking of my mirror, I did update it this afternoon with all currently available SMS Power releases, back to Wonder Boy in Monster World from August '99. The rest of the releases will have to be found by hand :) http://smspowermirror.tk It won't be there forever, please don't abuse it by leeching everything.

Raccoon Lad Joined: 16 Dec 2004 Posts: 495 Location: El Cerrito, CA	Posted: Mon Jan 10, 2005 3:54 am
	That M404 Prototype Bios is AWESOME! The only thing that could make it more awesome is if someone were to hack it to remove the header checking, add Snail Maze, and use the remaining 20K or so of ROM to add a high quality sample of the Sega Chorus to the startup, so that anyone with moderate soldering skills could burn a 32K eprom and replace the bios in their favorite SMS unit. But I guess it's only a dream of mine..... Unless any nice programmers want to do this for me :)

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Jan 10, 2005 6:44 pm
	Glad you like that. Removing header checking would be fairly quick. Add the snail game faisable, though requiring a little more time. A sample would not fit in 20 kb. Why don't you venture into SMS programming? http://www.smspower.org/maxim/howtoprogram Anyway, one of the idea I have in mind since a long time, and that probably won't be done until ten more centuries unless someone pick it up, would be to write a "super BIOS", including various functionnalities but maybe also some nice animation. SMS Boot Loader does that, although it is very simple: Mike Gordon said he once tried to replace his BIOS with that and it worked.

Stan Joined: 20 Dec 2004 Posts: 187	Posted: Tue Jan 11, 2005 2:18 am
Stan Joined: 20 Dec 2004 Posts: 187	Were there any types of store displays for the NTSC community?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Tue Jan 11, 2005 9:06 am
	Stan Stepanic wrote Were there any types of store displays for the NTSC community? What do you mean? The SMS Store Display Unit from where I dumped the BIOS and which I took in pictures are both US units.

Stan Joined: 20 Dec 2004 Posts: 187	Posted: Tue Jan 11, 2005 8:46 pm
Stan Joined: 20 Dec 2004 Posts: 187	Oh, sorry, I read through that so fast I missed it.

whosasking Joined: 19 Apr 2005 Posts: 1	An idea... Posted: Tue Apr 19, 2005 3:34 pm
whosasking Joined: 19 Apr 2005 Posts: 1	I just came upon this topic recently and came upon this lost BIOS. If you wanted to hack the BIOS to make it "usable" in more realistic circumstances, I have a couple ideas that would make it more entertaining. First, the little "Sega" ditty that's in the production US BIOS could still be used, the two parts timed accordingly to parts of the prototype logo. Second, I've also grown fond of the tune and effects played in the Japan BIOS's "instructions" screen (the music is Space Harrier, IINM). If you could incorporate that into the BIOS as well as the "instructions" screen (instead of the simple one in the US screen), I think you'd turn a very neat trick. If I had the time, I might have delved into Z80 assembler and make the attempt myself. It's become an utter fascination to me.

Forums

View topic - [Release] SMS Prototype M404 BIOS, SMS Store Display Unit BIOS