Forums

How do I play this thing actually in Colour? It shows up in black and white (very very little colour does appear though) and it has quite a bit of ghosting and horizontal lines (alternating between two slightly different shades)

SAM_3138.JPG (527.72 KB)

black and white -> I suppose the console outputs PAL and your TV only accepts NTSC

I had a look, and it's another problem.

Brazil is PAL-M. Australia is PAL. Even though they are pal, they are different!

Is there any way to force my TV (Panasonic Viera) to use NTSC? I read that PAL-M is a lot closer to NTSC than to normal PAL

On my old panasonic tv to select "region" was done in the menu. Auto (sometimes works) & 3 other settings.

Chances are it's going to be hard to dump; a photo of the guts might help determine if it's a glop-top, and even if it's not some desoldering will probably be needed. As for the TV, you really need a compatible TV, switching to NTSC mode is unlikely to work. The most likely way to get it working is to do some kind of RGB mod.

Unfortunately, PAL-M won't work correctly on NTSC: the luminance is encoded the same way, but the colors are encoded differently; you'll get an image, but it will be in B&W.

-- edit --

Maybe you could try a transcoder (not sure how well it would work, though):

http://eletronicos.mercadolivre.com.br/conversores-transcoder/transcoder-pal-m-ntsc

Will this work? If it will, I'll buy it

http://www.ebay.com.au/itm/Mini-AV-CVBS-RCA-to-HDMI-Converter-Adapter-For-720P-1...

The "Sega" logo when you start the console looks similar to a Mega Drive logo. Is it possible that the 132 games are just one big Mega Drive ROM? If that's the case, is it possible to split out the games eventually at some stage? Although there would be no point splitting them would there?

If it is a Glob Top that would be more complex? Would I need to run wires to each trace leading to the ROM or something insane like that?

PICTURES! :D
I am quite excited to see those guts, glop or not. Besides, if there is even a single leaded IC on board, that will make it all the easier to trace back to the glop top pins and designate their functions.

Here's a photo of the inside...

master system evolution.jpg (141.91 KB)

Looks like an SMS on a chip and a ROM to me, but no video encoder chip so unlikely to be moddable. The HDMI converter will probably work, depending on how far out of spec the video output is (video game consoles often push the boundaries). Can we get a full resolution closeup of the main board?

Okay I bought it, we'll see if it will at least make the picture a little better.

It's not a glob top it seems but those chips look surface mounted! I really hate soldering surface mounted chips, so I won't be removing mine, I'm no good with these I'd damage it :(

It would be bizarre to mass produce through hole PCBs now.

Some earlier TecToy multi game systems seemed to have a lot of games exceeding Master System capabilities. It's possible it's an emulator underneath plus some "native" games on the hardware itself, hence an excessively good Sega logo, in which case the ROM dump won't yield Master System ROM images.

Maxim wrote

Can we get a full resolution closeup of the main board?

I'm sorry, the photo is not mine.

I suppose this system is same with 2007 / 2008 models:
http://www.assemblergames.com/forums/showthread.php?19582-2008-Master-System-from-Tec-Toy&p=310088&viewfull=1#post310088

..

Tycho wrote

Maybe I should buy a CRT TV from Brazil, pretty sure it would be virtually free

In fact everything in Brazil is expensive - even an old, used CRT TV.

Tycho wrote

but shipping would be a killer!

Yes. And we can only ship packages with less than 20 Kilograms to Australia - so you probably would have to import a very small Brazilian Pal-M television.

I personally think it's not worth just to play Master System Evolution's (badly) emulated games.

Followed better pictures of the inside.

So if I want to do the same than for the Megadrive 4 (See https://www.smspower.org/forums/16828-TecToyMegadrive4DumpsIncludingMasterSystem... ), I need to find TX and RX.

Games list of the Master System Evolution:

Official:

20 em 1
Action Fighter
Aerial Assault
Alex Kidd High Tech World
Alex Kidd in Miracle World
Alex Kidd in Shinobi World
Alex Kidd The Lost Stars
Alien Syndrome
Altered Beast
Astro Warrior / Pit Pot (as Pit Pot / Astro Warrior)
Aztec Adventure
Baku Baku Animal
Bank Panic
Battle Outrun
Black Belt
Bomber Raid
Bonanza Bros.
Bubble Bobble
Chase H.Q.
Columns
Cyber Shinobi
Double Target (Quartet)
Dragon Crystal
Enduro Racer
ESWAT: Cyber Police (as ESWAT - City Under Siege)
Fantasy Zone
Fantasy Zone 2
Fantasy Zone 3 (The Maze)
Gain Ground
Galactic Protector
Ghost House
Global Defense
G-Loc
Golden Axe
Golfmania
Great Soccer
Hang On
Kenseiden
Kung Fu Kid
Lord of The Sword
Machinegun Joe
Maze Walker
My Hero
The New Zealand Story
The Ninja
Penguin Land
Putt & Putter
Rainbow Islands
Rastan Saga
Renegade
Satellite 7
Scramble Spirits
Secret Commando
Shadow Dancer
Shinobi
Slap Shot
Sonic The Hedgehog
Sonic Drift 2 (Game Gear version)
Special Criminal Investigation
Super Space Invaders
Super Tennis
Thunder Blade
Transbot
Woody Pop
World Grand Prix
World Soccer

Tectoy Digital and Overplay:

Acerte o Alvo
Aquaduto
Arqueiro
Ataque dos Vermes
Aventuras na Floresta
Batalha Animal
Batalha no Mar
Bolas e Cores
Bolhas
Bombeiros
Cava Cava
Creature Capture
Domine o Território
Dominó
Dr. Limpeza
Fábrica de Chocolate
Hexágonos
Hockey de Mesa
Icepost Rescue
Junte 4
Master Pinball
Master Pong
Memória Master
Mina Terrestre
Minerador
Nim
Os 12 trabalhos de Jongo
Outsiders
Palhaços
Pense Bem 10 Jogos
Resta Um
Senha
Serpentes
Snowball
Sudoku
Tangram
Tanques

On Tectoy Digital and Overplay exclusives games, there is 16 games dumped ('cause of the Megadrive 4), and 21 games to dump.

Main Board.JPG (1.89 MB)

Power Board.JPG (1.78 MB)

Video Output Board.JPG (923.01 KB)

You can access Color & Switch Test (see: https://www.smspower.org/Games/ColorAndSwitchTest-SMS ) by starting the system while holding B and C (corresponding to 1 and 2) on the first controller.

The fact that this board has no SDRAM makes me think this "Noza 1.0B1" chip isn't a rebranded linux capable ARM MCU running an emulator, but a real custom solution close to an SMS-on-a-chip, on which a debug serial port would be useless.

It also seems to output composite video directly, which isn't something usually found on off-the-shelf MCUs.

Most SoCs from Rockchip, Allwinner and others are either offered in BGA or large (144+ pins) packages, so I wouldn't bet on those either.

How about reading the flash chip directly ? Hopefully there's no encryption or scrambling involved.

The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC).

This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout)

Quote

17:25, 16/06/2021] Sega Brasil: Falei com um amigo que trabalhou na TecToy
Ele me disse que vai ser difícil achar os jogos da memória
Pois são feitos em 1 só arquivo
E alguém teria que “dumpar” do vídeo game
E separar os jogos
E até hoje, ninguém fez isso…

Google trad: I spoke with a friend who worked at TecToy
He told me it will be difficult to find the memory games
Because they are made in one single file
And someone would have to dump the video game
And separate the games
And until today, no one has done that...

The problem is to dump the chip not to separates datas as we already have dumps of all commercial games, we can find them in the binary (unless datas are crypted)

Splitting a big file would be pretty easy really.

it's likely going to be simply a juxtaposition of all the ROMs anyway

ichigobankai wrote

The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC).

This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout)

Hadn't noticed that, I expected it to be some standard parallel flash with some pins routed under it.
Couldn't find any matching pinout looking at the standard MX products, so it might indeed be a customized part :(

Would they go through the trouble of using managed NAND for a chip that (my guess) isn't a SoC ?

Honestly I don't know.
It's can also be a classical parallel flash with a custom pinout.
Hard to know without desoldering the beast and see what's behind.

With all games, the flash should be around 16MB / 128Mb

..

I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online.

So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it...

I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead.

There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work.

Anyway, here is the picture of the chip, I hope it can help someone dump it.

mxic.jpg (231.85 KB)

noza10b1 wrote

I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online.

So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it...

I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead.

There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work.

Anyway, here is the picture of the chip, I hope it can help someone dump it.

Anyone?

I received the Master System Evolution from Revo (please see pictures he shared above).

On his model (PCI MSIII REV7 P1) the flash is in TSOP48 with a ref completely unknown to the internet:
MX S112964
MS132X1E => Master System 132 in 1 Evolution?
3H188600

Very likely to be proprietary, I was hoping for an easy MX29GL128 in TSOP56...

None of my or my friends' programmers (Xeltek 6100, Dataman 48, ProMan) has been able to identify the chip. It actually went very hot when inserted in the ZIF socket...

A few observations:
- there are 3 wires between the PSU board and the mainboard, one is identified as PAUSE on the silkscreen. It's connected to the P1 controller connector pin 7 on the mainboard but unconnected on the PSU board. Maybe other models have a PAUSE button on the console.
- the silkscreen says "+5V" on both the PSU and mainboard but it's actually 3.3V
- there's a jumper on the mainboard named CNC5. It's left open by default. When closed the console boots up to the colour and controller test program (same as maintaining A+C or B+C upon boot up).

Could it be a Macronix 64Mbit Flash in TSOP 48-pin package i.e. MX29 part?

It's closer to a MX23L6411 mask ROM but with pin 36 as A22 (making it 128Mb) and BYTE mode by default (pin 46 = A-1).

Ah I see. And you have the pinout. Sounds like a custom dumper rig from an Arduino or something is going to be the way to go.

I think I'll just modify the TSOP48 adapter I have here.

I was able to unsolder the flash, hopefully without damaging it.
One pad was lost, but it looks like a NC one, so it shouldn't matter.
I also had to remove CL6 and CL7, 100nF capacitors, because they were very close and I don't have an air blower.

Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3?

IMG_20221222_143932292.jpg (657.96 KB)

noza10b1 wrote

Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3?

It's not too hard, in principle. You might find a project out there that someone else has documented to get you started.

But to use an Arduino / RPi to read the ROM you will need to use whatever gpio you have available to bit-bang the address lines and then sample the data lines. Likely the various control lines you can hard wire appropriately.

I reckon you want:
OE# = 0
CE# = 0
WE# = 1
RESET = #1
WP# = 0
BYTE# = 0

I think you're best reading in 8-bit mode (hence BYTE# = 0), and you'll almost certainly need to multiplex the address bus somehow as I doubt you'll have enough gpio to address the entire memory as well as read back the data. One or more low voltage shift registers should do the trick, or a combination of shift registers and direct connection for the least significant bits. Take a look at the 74HC595. Or you could use a counter or something instead.

Alternatively if you don't want to faff with external chips you could manually dump the ROM in pages, the size of which is determined by how many least significant address lines you are able to control with gpio.

Be careful to only use the 3.3v supply. I know the gpio is 3.3v for the rpi, and I assume also true for the Arduino, and your ROM is also rated as max 3.6v.

EDIT1: also note well that in byte mode you need to send the lsb of the address (let's call it addr0) to the Q15 pin. The A0 pin receives addr1, the A1 pin receives addr2, and so on.

EDIT2: looks like the rpi3 has up to 27 external gpio, so that gives you 19 address lines of the required 24, after taking 8 for the data lines. If you manually paged the ROM that means you would need to capture 32 pages separately. Doable, but a little tedious. You'd only need a single 8 bit shift register or counter to map through the extra 5 bits.

Thanks for the detailed info!

The ParallelFLASHDumper project from cyphunk seems a good start.

I'll buy a shift register, to be able to read the whole flash at once.
I guess I'll make some experiments with RPi3's GPIO while I wait until my TSOP56 adapter arrives.

noza10b1 wrote

The ParallelFLASHDumper project from cyphunk seems a good start.

Ah yeah, that does look like a good one!
(link to project since I guess you still can't -- just keep posting!! ;)

noza10b1 wrote

I'll buy a shift register, to be able to read the whole flash at once.

If you do this project completely by the book, I think you'll need 4x 8-bit registers in total, 3x serial-to-parallel for the address lines and 1x parallel-to-serial for the data lines; or if you adapt it to make use of more direct gpio, I think you can maybe cut it down to the 1x parallel-to-serial as I suggested.

Depending on your geography, you should find that both parts are very inexpensive (< 1 USD each) so it might be worth buying a small batch of both types of shift register to be on the safe side.

After some pain, I was able to dump the flash contents with a RPi3.

As suggested by willbritton, I've used 3 shift registers (74HC595) for the 24-bit address bus (A-1 to A22), controlled by 2 GPIOs (data and clock/strobe). 8 GPIOs were used to read the data in byte mode and 2 GPIOs to control OE# and WE# (to be able to implement the "automatic select" command and read the manufacturer and device ids, to make sure the chip was working fine).

I've modified the ParallelFLASHDumper quite a bit, mostly by adding tests, changing pin assignments and refactoring code. I'll try to publish the modified version later.

So, now I'm not sure what's the best way to share this dump. Is it ok to just zip and post it here as an attachment?

About the contents, I've played a little with it and found some interesting things:
- It seems the initial memory is where the game selector/launcher resides. It's possible to run it with an emulator, but graphics are glitched and it resets when trying to launch any game.
- I was able to identify and extract 2 roms from the dump (I've only tried these 2 for now): Sonic and Alex Kidd in Miracle World. They are almost the same as other roms, but a few bytes are different (about 10 or so). Trying them on an emulator, I get only a black screen with Sonic and Alex Kidd hangs on the title screen. I tried to extract the bytes from Sonic again, directly from the flash, with a slower clock, but got the same content. Could this be some kind of copy protection?

rpi3_flash_dumper.jpg (813.08 KB)

I suspect it’s some divergence in the emulated system that needs to be handled in software. You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing.

noza10b1 wrote

They are almost the same as other roms, but a few bytes are different (about 10 or so).

can you share the diff so that we could figure out what is that for? :)

also, AFAIK, this is not emulation (in the software sense) but it's a RE-based ASIC.

Quote

You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing.

Ok, I have attached the dump file.

[Admin: attachment is now the full 16MB file]

mse.zip (7.16 MB)

Quote

can you share the diff so that we could figure out what is that for? :)

Sure. The first file is the one extracted from flash.

Sonic:

diff sonic_pi.txt sonic.txt
3,4c3,4
< 00000020 c3 ed 02 00 00 00 00 00 c3 fe 02 f5 3e 85 32 fe |............>.2.|
< 00000030 3f c3 00 05 00 00 00 00 c3 2b 00 44 65 76 65 6c |?........+.Devel|
---
> 00000020 c3 ed 02 00 00 00 00 00 c3 fe 02 00 00 00 00 00 |................|
> 00000030 00 00 00 00 00 00 00 00 c3 73 00 44 65 76 65 6c |.........s.Devel|
2045c2045
< 00007ff0 54 4d 52 20 53 45 47 41 59 59 c2 a8 76 70 00 40 |TMR SEGAYY..vp.@|
---
> 00007ff0 54 4d 52 20 53 45 47 41 59 59 1b a5 76 70 00 40 |TMR SEGAYY..vp.@|

Alex Kidd:

diff alex_pi.txt alex_kidd_in_miracle_world.txt
10c10
< 00000090 11 01 c0 01 ef 1f 75 ed b0 cd 41 03 cd 50 03 3e |......u...A..P.>|
---
> 00000090 11 01 c0 01 ff 1f 75 ed b0 cd 41 03 cd 50 03 3e |......u...A..P.>|
13c13
< 000000c0 f5 3e 85 32 fe 3f c3 38 05 e5 dd e5 fd e5 db bf |.>.2.?.8........|
---
> 000000c0 f5 c5 d5 e5 d9 08 f5 c5 d5 e5 dd e5 fd e5 db bf |................|

I'm trying to map the contents of the dump. Here is what I got so far.

01c000 - 05bfff - Sonic (differ)
164000 - 183fff - Alex Kidd in Miracle World (differ)
1c4000 - 1e3fff - Action Fighter (identical)
200000 - 23ffff - Aerial Assault (identical)
240000 - 27ffff - Alex Kidd - The Lost Stars (identical)
280000 - 2bffff - Alex Kidd in Shinobi World (identical)
2c0000 - 2dffff - Alex Kidd - High-Tech World (identical)
2e0000 - 31ffff - Alien Syndrome (differ but works)
800000 - 81ffff - Astro Warrior and Pit Pot (differ but works)
fbc000 - ffbfff - Altered Beast (identical)

The "works" is in the description means I can get in-game an play a bit without noticing any errors. It's nice to see that some games have no changes at all.

Astro Warrior and Pit Pot diff:

1034c1034
< 00004130 dd e5 fd e5 db bf db dd e6 10 21 f8 df 4e 77 a9 |..........!..Nw.|
---
> 00004130 dd e5 fd e5 db bf db c1 e6 10 21 f8 df 4e 77 a9 |..........!..Nw.|
1062c1062
< 000042f0 db dc c3 01 43 db dc e6 c0 47 db dd e6 3f 80 07 |....C....G...?..|
---
> 000042f0 db c0 c3 01 43 db c0 e6 c0 47 db c1 e6 3f 80 07 |....C....G...?..|

Alien Syndrome diff:

678,679c678,679
< 00002a60 c0 32 72 c4 32 0a c0 32 1b c0 3e 12 f7 3e f5 00 |.2r.2..2..>..>..|
< 00002a70 00 db dd e6 c0 fe c0 20 13 3e 55 00 00 db dd e6 |....... .>U.....|
---
> 00002a60 c0 32 72 c4 32 0a c0 32 1b c0 3e 12 f7 3e f5 d3 |.2r.2..2..>..>..|
> 00002a70 3f db dd e6 c0 fe c0 20 13 3e 55 d3 3f db dd e6 |?...... .>U.?...|

Looking at the Sonic ROM, it injects this to the interrupt handler:

jp $002B

It normally says "jp $0073". At $2b we have some injected code in normally-unused space:

   push af
   ld a, $85
   ld ($3FFE), a
   jp $500

This write to $3ffe is presumably a signal to the special mapper for this ROM. I assume this is paging some new code such that $500 is some special handler for this game. There is no other modification to the Sonic ROM.

In the first part of the ROM we have the selection menu, which seems to run in a hybrid SMS mode with a GG palette (?). At offset $500 in there we have:

   di
   call $55A
   ld ($3FFE), a
   jp $75

This is returning to just after the original VBlank handler's "push af". So it's injecting this $55a routine into the interrupt handler; it looks like it does this for several games, there's a bunch of similar "detour handlers" next to it.

At $55a we have:

   in a, ($cd)
   or a
   jr z, +++
   push hl
   in a, (Port_IOPort1)
   cp $FF
   jr nz, +
   in a, (Port_IOPort2)
   or $F0
   cp $FF
   jr nz, +
   ld hl, _RAM_FFF8_
   inc (hl)
   jr nz, ++
   inc hl
   inc (hl)
   jr nz, ++
+:
   jp 0

++:
   pop hl
+++:
   ld a, $87
   ret

This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure.

I/O ports Emulicious sees as used in its disassembly:

.define _PORT_61_ $61
.define _PORT_62_ $62
.define _PORT_63_ $63
.define _PORT_7E_ $7E
.define _PORT_88_ $88
.define _PORT_8C_ $8C
.define _PORT_8D_ $8D
.define _PORT_8E_ $8E
.define _PORT_8F_ $8F
.define _PORT_A0_ $A0
.define _PORT_C8_ $C8
.define _PORT_CA_ $CA
.define _PORT_CB_ $CB
.define _PORT_CD_ $CD
.define _PORT_CE_ $CE
.define _PORT_DC_ $DC

Seems like a lot...

The boot menu looks a lot like it was written in C, it is calling functions by passing parameters on the stack.

From https://bojoga.com.br/artigos/dossie-retro/os-modelos-renovados-do-master-system... :

Quote

totally emulating the console, thanks to the chip developed by the well-known retro console company AtGames. This unique chip, also known as SOAC (System On A Chip) called Noza (in honor of the enemies of the game Zillion) manages to emulate games from the Master System and Game Gear.

This claims the chip was designed by AtGames - famous for their bad Mega Drive efforts - and named after the enemies in Zillion, which is interesting.

Updated dump map:

01c000 - 05bfff - Sonic (diff, black screen)
164000 - 183fff - Alex Kidd in Miracle World (diff, hang on title)
1c4000 - 1e3fff - Action Fighter (equal)
200000 - 23ffff - Aerial Assault (equal)
240000 - 27ffff - Alex Kidd - The Lost Stars (equal)
280000 - 2bffff - Alex Kidd in Shinobi World (equal)
2c0000 - 2dffff - Alex Kidd - High-Tech World (equal)
2e0000 - 31ffff - Alien Syndrome (diff, ok)
800000 - 81ffff - Astro Warrior and Pit Pot (diff, ok)
bac000 - bcbfff - Sudoku (diff, ok)
bcc000 - beffff - Creature Capture (diff, ok)
bf0000 - bfffff - Nim (orig, ok)
c00000 - ceffff - Pense Bem (orig, some glitches, must dump until cfffff to work on gearsystem)
cf0000 - cf7fff - Master Pong (orig, ok)
cf8000 - d07fff - Dr. Limpeza (orig, runs with glitches)
d08000 - d13fff - Mina Terrestre (diff, runs with glitches)
d14000 - d23fff - Os Doze Trabalhos de Jongo (diff, runs with glitches)
d24000 - d43fff - Tangram (diff, ok)
d44000 - d53fff - Aquaduto (orig, ok)
d54000 - d63fff - Bombeiros (diff, ok)
d64000 - d73fff - Outsiders (orig, ok)
d74000 - d87fff - Bolhas (diff, ok)
d88000 - d9ffff - Master Pinball (orig, ok)
da0000 - dabfff - Dominó (diff, ok)
dac000 - dbbfff - Serpentes (orig, ok)
dbc000 - dcbfff - Memória Master (diff, runs with glitches)
dcc000 - ddffff - Bolas e Cores (diff, ok)
de0000 - deffff - Acerte o Alvo (diff, ok)
df0000 - dfffff - Aventuras na Floresta (orig, ok)
e00000 - e0ffff - Domine o Território (orig, glitches)
e10000 - e1ffff - Arqueiro (orig, ok)
e20000 - e2bfff - Ataque dos Vermes (orig, ok)
e2c000 - e3bfff - Batalha Animal (orig, ok)
e3c000 - e47fff - Batalha no Mar (orig, ok)
e48000 - e53fff - Tanques (orig, ok)
e54000 - e63fff - Cava Cava (diff, ok)
e64000 - e87fff - Fábrica de Chocolate (diff, ok)
e88000 - e97fff - Hexágonos (orig, ok)
e98000 - ea3fff - Hockey de Mesa (orig, ok)
ea4000 - ec3fff - Icepost Rescue (orig, ok)
edc000 - ee7fff - Junte 4 (orig, ok)
ee8000 - ef7fff - Minerador (diff, ok)
ef8000 - f0bfff - Palhaços (diff, ok)
f0c000 - f17fff - Resta Um (orig, ok)
f18000 - f2bfff - Senha (diff, ok)
f2c000 - f3bfff - Snowball (orig, ok)
fbc000 - ffbfff - Altered Beast (equal)

I guess all Tectoy Digital and Overplay games are listed now.
I've used Gearsystem to test them.

On the real system, does a button trigger a return to the game selection menu from Sonic? What happens if you hold a controller button at the same time as pressing it?

The real system has a 6-button controller. If you hold the top 3 at the same time it goes back to the menu.
But this is supposed to work on any game.

Maxim wrote

At $55a we have:

   in a, ($cd)
   or a
   jr z, +++
   push hl
   in a, (Port_IOPort1)
   cp $FF
   jr nz, +
   in a, (Port_IOPort2)
   or $F0
   cp $FF
   jr nz, +
   ld hl, _RAM_FFF8_
   inc (hl)
   jr nz, ++
   inc hl
   inc (hl)
   jr nz, ++
+:
   jp 0

++:
   pop hl
+++:
   ld a, $87
   ret

This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure.

I guess this is the code that checks if the 'reboot' keys are pressed. If so, it forces the mapper to map the menu ROM again and finally it jumps to zero. Why it increments the contents that way it's everyone's guess - we should probably disassemble the menu ROM to understand how this mapper works.

Author	Message
Tycho Joined: 16 Dec 2009 Posts: 240	Master System Evolution 132 games (was: Received this in the mail this evening :) Posted: Thu Apr 24, 2014 11:44 am Last edited by Tycho on Mon Jul 03, 2023 10:58 pm; edited 1 time in total
Tycho Joined: 16 Dec 2009 Posts: 240	How do I play this thing actually in Colour? It shows up in black and white (very very little colour does appear though) and it has quite a bit of ghosting and horizontal lines (alternating between two slightly different shades) SAM_3138.JPG (527.72 KB)

kamillebidan Joined: 25 Feb 2013 Posts: 387 Location: Osaka	Posted: Thu Apr 24, 2014 11:52 am
	black and white -> I suppose the console outputs PAL and your TV only accepts NTSC

Tycho Joined: 16 Dec 2009 Posts: 240	Posted: Thu Apr 24, 2014 12:16 pm
Tycho Joined: 16 Dec 2009 Posts: 240	I had a look, and it's another problem. Brazil is PAL-M. Australia is PAL. Even though they are pal, they are different! Is there any way to force my TV (Panasonic Viera) to use NTSC? I read that PAL-M is a lot closer to NTSC than to normal PAL

omp Joined: 13 Nov 2007 Posts: 219	Posted: Thu Apr 24, 2014 12:34 pm
omp Joined: 13 Nov 2007 Posts: 219	On my old panasonic tv to select "region" was done in the menu. Auto (sometimes works) & 3 other settings.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Thu Apr 24, 2014 12:58 pm
	Chances are it's going to be hard to dump; a photo of the guts might help determine if it's a glop-top, and even if it's not some desoldering will probably be needed. As for the TV, you really need a compatible TV, switching to NTSC mode is unlikely to work. The most likely way to get it working is to do some kind of RGB mod.

haroldoop Joined: 25 Feb 2006 Posts: 903 Location: Belo Horizonte, MG, Brazil	Posted: Thu Apr 24, 2014 4:03 pm
	Unfortunately, PAL-M won't work correctly on NTSC: the luminance is encoded the same way, but the colors are encoded differently; you'll get an image, but it will be in B&W. -- edit -- Maybe you could try a transcoder (not sure how well it would work, though): http://eletronicos.mercadolivre.com.br/conversores-transcoder/transcoder-pal-m-ntsc

Tycho Joined: 16 Dec 2009 Posts: 240	Posted: Fri Apr 25, 2014 3:44 am Last edited by Tycho on Mon Jul 03, 2023 10:59 pm; edited 1 time in total
Tycho Joined: 16 Dec 2009 Posts: 240	Will this work? If it will, I'll buy it http://www.ebay.com.au/itm/Mini-AV-CVBS-RCA-to-HDMI-Converter-Adapter-For-720P-1... The "Sega" logo when you start the console looks similar to a Mega Drive logo. Is it possible that the 132 games are just one big Mega Drive ROM? If that's the case, is it possible to split out the games eventually at some stage? Although there would be no point splitting them would there? If it is a Glob Top that would be more complex? Would I need to run wires to each trace leading to the ROM or something insane like that?

Jazzmarazz Joined: 17 Sep 2013 Posts: 140 Location: TC, MI	Posted: Fri Apr 25, 2014 5:08 am
	PICTURES! :D I am quite excited to see those guts, glop or not. Besides, if there is even a single leaded IC on board, that will make it all the easier to trace back to the glop top pins and designate their functions.

gallos_11 Joined: 07 Jun 2010 Posts: 199	Posted: Fri Apr 25, 2014 7:01 am
gallos_11 Joined: 07 Jun 2010 Posts: 199	Here's a photo of the inside... master system evolution.jpg (141.91 KB)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Fri Apr 25, 2014 7:25 am
	Looks like an SMS on a chip and a ROM to me, but no video encoder chip so unlikely to be moddable. The HDMI converter will probably work, depending on how far out of spec the video output is (video game consoles often push the boundaries). Can we get a full resolution closeup of the main board?

Tycho Joined: 16 Dec 2009 Posts: 240	Posted: Fri Apr 25, 2014 10:14 am
Tycho Joined: 16 Dec 2009 Posts: 240	Okay I bought it, we'll see if it will at least make the picture a little better. It's not a glob top it seems but those chips look surface mounted! I really hate soldering surface mounted chips, so I won't be removing mine, I'm no good with these I'd damage it :(

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Fri Apr 25, 2014 2:15 pm
	It would be bizarre to mass produce through hole PCBs now. Some earlier TecToy multi game systems seemed to have a lot of games exceeding Master System capabilities. It's possible it's an emulator underneath plus some "native" games on the hardware itself, hence an excessively good Sega logo, in which case the ROM dump won't yield Master System ROM images.

gallos_11 Joined: 07 Jun 2010 Posts: 199	Posted: Fri Apr 25, 2014 3:34 pm
gallos_11 Joined: 07 Jun 2010 Posts: 199	Maxim wrote Can we get a full resolution closeup of the main board? I'm sorry, the photo is not mine. I suppose this system is same with 2007 / 2008 models: http://www.assemblergames.com/forums/showthread.php?19582-2008-Master-System-from-Tec-Toy&p=310088&viewfull=1#post310088

Tycho Joined: 16 Dec 2009 Posts: 240	Posted: Fri May 09, 2014 9:17 am Last edited by Tycho on Fri May 17, 2024 10:41 pm; edited 1 time in total
Tycho Joined: 16 Dec 2009 Posts: 240	..

macbee Joined: 15 Sep 2010 Posts: 49 Location: Brazil	Posted: Fri May 09, 2014 4:45 pm
macbee Joined: 15 Sep 2010 Posts: 49 Location: Brazil	Tycho wrote Maybe I should buy a CRT TV from Brazil, pretty sure it would be virtually free In fact everything in Brazil is expensive - even an old, used CRT TV. Tycho wrote but shipping would be a killer! Yes. And we can only ship packages with less than 20 Kilograms to Australia - so you probably would have to import a very small Brazilian Pal-M television. I personally think it's not worth just to play Master System Evolution's (badly) emulated games.

Revo Guest	Posted: Sat Jun 12, 2021 12:17 pm
Revo Guest	Followed better pictures of the inside. So if I want to do the same than for the Megadrive 4 (See https://www.smspower.org/forums/16828-TecToyMegadrive4DumpsIncludingMasterSystem... ), I need to find TX and RX. Games list of the Master System Evolution: Official: 20 em 1 Action Fighter Aerial Assault Alex Kidd High Tech World Alex Kidd in Miracle World Alex Kidd in Shinobi World Alex Kidd The Lost Stars Alien Syndrome Altered Beast Astro Warrior / Pit Pot (as Pit Pot / Astro Warrior) Aztec Adventure Baku Baku Animal Bank Panic Battle Outrun Black Belt Bomber Raid Bonanza Bros. Bubble Bobble Chase H.Q. Columns Cyber Shinobi Double Target (Quartet) Dragon Crystal Enduro Racer ESWAT: Cyber Police (as ESWAT - City Under Siege) Fantasy Zone Fantasy Zone 2 Fantasy Zone 3 (The Maze) Gain Ground Galactic Protector Ghost House Global Defense G-Loc Golden Axe Golfmania Great Soccer Hang On Kenseiden Kung Fu Kid Lord of The Sword Machinegun Joe Maze Walker My Hero The New Zealand Story The Ninja Penguin Land Putt & Putter Rainbow Islands Rastan Saga Renegade Satellite 7 Scramble Spirits Secret Commando Shadow Dancer Shinobi Slap Shot Sonic The Hedgehog Sonic Drift 2 (Game Gear version) Special Criminal Investigation Super Space Invaders Super Tennis Thunder Blade Transbot Woody Pop World Grand Prix World Soccer Tectoy Digital and Overplay: Acerte o Alvo Aquaduto Arqueiro Ataque dos Vermes Aventuras na Floresta Batalha Animal Batalha no Mar Bolas e Cores Bolhas Bombeiros Cava Cava Creature Capture Domine o Território Dominó Dr. Limpeza Fábrica de Chocolate Hexágonos Hockey de Mesa Icepost Rescue Junte 4 Master Pinball Master Pong Memória Master Mina Terrestre Minerador Nim Os 12 trabalhos de Jongo Outsiders Palhaços Pense Bem 10 Jogos Resta Um Senha Serpentes Snowball Sudoku Tangram Tanques On Tectoy Digital and Overplay exclusives games, there is 16 games dumped ('cause of the Megadrive 4), and 21 games to dump. Main Board.JPG (1.89 MB) Power Board.JPG (1.78 MB) Video Output Board.JPG (923.01 KB)

Revo Guest	Posted: Sat Jun 12, 2021 2:29 pm
Revo Guest	You can access Color & Switch Test (see: https://www.smspower.org/Games/ColorAndSwitchTest-SMS ) by starting the system while holding B and C (corresponding to 1 and 2) on the first controller.

furrtek Joined: 05 Mar 2006 Posts: 54 Location: France	Posted: Sat Jun 12, 2021 7:55 pm
furrtek Joined: 05 Mar 2006 Posts: 54 Location: France	The fact that this board has no SDRAM makes me think this "Noza 1.0B1" chip isn't a rebranded linux capable ARM MCU running an emulator, but a real custom solution close to an SMS-on-a-chip, on which a debug serial port would be useless. It also seems to output composite video directly, which isn't something usually found on off-the-shelf MCUs. Most SoCs from Rockchip, Allwinner and others are either offered in BGA or large (144+ pins) packages, so I wouldn't bet on those either. How about reading the flash chip directly ? Hopefully there's no encryption or scrambling involved.

ichigobankai Joined: 04 Jul 2010 Posts: 546 Location: Angers, France	Posted: Tue Jun 15, 2021 4:33 pm
	The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC). This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout)

Revo Guest	Posted: Wed Jun 16, 2021 4:36 pm
Revo Guest	Quote 17:25, 16/06/2021] Sega Brasil: Falei com um amigo que trabalhou na TecToy Ele me disse que vai ser difícil achar os jogos da memória Pois são feitos em 1 só arquivo E alguém teria que “dumpar” do vídeo game E separar os jogos E até hoje, ninguém fez isso… Google trad: I spoke with a friend who worked at TecToy He told me it will be difficult to find the memory games Because they are made in one single file And someone would have to dump the video game And separate the games And until today, no one has done that...

ichigobankai Joined: 04 Jul 2010 Posts: 546 Location: Angers, France	Posted: Wed Jun 16, 2021 5:06 pm
	The problem is to dump the chip not to separates datas as we already have dumps of all commercial games, we can find them in the binary (unless datas are crypted)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Wed Jun 16, 2021 8:54 pm
	Splitting a big file would be pretty easy really.

sverx Joined: 05 Sep 2013 Posts: 3936 Location: Stockholm, Sweden	Posted: Thu Jun 17, 2021 12:14 pm
	it's likely going to be simply a juxtaposition of all the ROMs anyway

furrtek Joined: 05 Mar 2006 Posts: 54 Location: France	Posted: Fri Jun 18, 2021 7:18 pm
furrtek Joined: 05 Mar 2006 Posts: 54 Location: France	ichigobankai wrote The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC). This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout) Hadn't noticed that, I expected it to be some standard parallel flash with some pins routed under it. Couldn't find any matching pinout looking at the standard MX products, so it might indeed be a customized part :( Would they go through the trouble of using managed NAND for a chip that (my guess) isn't a SoC ?

ichigobankai Joined: 04 Jul 2010 Posts: 546 Location: Angers, France	Posted: Sat Jun 19, 2021 6:52 am
	Honestly I don't know. It's can also be a classical parallel flash with a custom pinout. Hard to know without desoldering the beast and see what's behind. With all games, the flash should be around 16MB / 128Mb

Tycho Joined: 16 Dec 2009 Posts: 240	Posted: Sat Jul 17, 2021 6:58 am Last edited by Tycho on Mon Jul 03, 2023 10:57 pm; edited 1 time in total
Tycho Joined: 16 Dec 2009 Posts: 240	..

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Sat Mar 26, 2022 1:55 am
noza10b1 Joined: 26 Mar 2022 Posts: 18	I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online. So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it... I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead. There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work. Anyway, here is the picture of the chip, I hope it can help someone dump it. mxic.jpg (231.85 KB)

DokiDokiByun Joined: 05 Feb 2020 Posts: 14 Location: Bra	Posted: Sun Jun 05, 2022 3:19 pm
DokiDokiByun Joined: 05 Feb 2020 Posts: 14 Location: Bra	noza10b1 wrote I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online. So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it... I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead. There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work. Anyway, here is the picture of the chip, I hope it can help someone dump it. Anyone?

Apocalypse Joined: 26 Feb 2021 Posts: 163	Posted: Sat Dec 17, 2022 3:41 am
Apocalypse Joined: 26 Feb 2021 Posts: 163	I received the Master System Evolution from Revo (please see pictures he shared above). On his model (PCI MSIII REV7 P1) the flash is in TSOP48 with a ref completely unknown to the internet: MX S112964 MS132X1E => Master System 132 in 1 Evolution? 3H188600 Very likely to be proprietary, I was hoping for an easy MX29GL128 in TSOP56... None of my or my friends' programmers (Xeltek 6100, Dataman 48, ProMan) has been able to identify the chip. It actually went very hot when inserted in the ZIF socket... A few observations: - there are 3 wires between the PSU board and the mainboard, one is identified as PAUSE on the silkscreen. It's connected to the P1 controller connector pin 7 on the mainboard but unconnected on the PSU board. Maybe other models have a PAUSE button on the console. - the silkscreen says "+5V" on both the PSU and mainboard but it's actually 3.3V - there's a jumper on the mainboard named CNC5. It's left open by default. When closed the console boots up to the colour and controller test program (same as maintaining A+C or B+C upon boot up).

asynchronous Joined: 14 Aug 2000 Posts: 752 Location: Adelaide, Australia	Master System Evolution 132 games (was: Received this in the mail this evening :) Posted: Sat Dec 17, 2022 5:14 pm
	Could it be a Macronix 64Mbit Flash in TSOP 48-pin package i.e. MX29 part?

Apocalypse Joined: 26 Feb 2021 Posts: 163	Posted: Sat Dec 17, 2022 8:11 pm
Apocalypse Joined: 26 Feb 2021 Posts: 163	It's closer to a MX23L6411 mask ROM but with pin 36 as A22 (making it 128Mb) and BYTE mode by default (pin 46 = A-1).

asynchronous Joined: 14 Aug 2000 Posts: 752 Location: Adelaide, Australia	Master System Evolution 132 games (was: Received this in the mail this evening :) Posted: Sun Dec 18, 2022 3:39 am
	Ah I see. And you have the pinout. Sounds like a custom dumper rig from an Arduino or something is going to be the way to go.

Apocalypse Joined: 26 Feb 2021 Posts: 163	Posted: Sun Dec 18, 2022 11:41 pm
Apocalypse Joined: 26 Feb 2021 Posts: 163	I think I'll just modify the TSOP48 adapter I have here.

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Thu Dec 22, 2022 6:23 pm
noza10b1 Joined: 26 Mar 2022 Posts: 18	I was able to unsolder the flash, hopefully without damaging it. One pad was lost, but it looks like a NC one, so it shouldn't matter. I also had to remove CL6 and CL7, 100nF capacitors, because they were very close and I don't have an air blower. Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3? IMG_20221222_143932292.jpg (657.96 KB)

willbritton Joined: 06 Mar 2022 Posts: 697 Location: London, UK	Posted: Fri Dec 23, 2022 1:05 am
	noza10b1 wrote Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3? It's not too hard, in principle. You might find a project out there that someone else has documented to get you started. But to use an Arduino / RPi to read the ROM you will need to use whatever gpio you have available to bit-bang the address lines and then sample the data lines. Likely the various control lines you can hard wire appropriately. I reckon you want: OE# = 0 CE# = 0 WE# = 1 RESET = #1 WP# = 0 BYTE# = 0 I think you're best reading in 8-bit mode (hence BYTE# = 0), and you'll almost certainly need to multiplex the address bus somehow as I doubt you'll have enough gpio to address the entire memory as well as read back the data. One or more low voltage shift registers should do the trick, or a combination of shift registers and direct connection for the least significant bits. Take a look at the 74HC595. Or you could use a counter or something instead. Alternatively if you don't want to faff with external chips you could manually dump the ROM in pages, the size of which is determined by how many least significant address lines you are able to control with gpio. Be careful to only use the 3.3v supply. I know the gpio is 3.3v for the rpi, and I assume also true for the Arduino, and your ROM is also rated as max 3.6v. EDIT1: also note well that in byte mode you need to send the lsb of the address (let's call it addr0) to the Q15 pin. The A0 pin receives addr1, the A1 pin receives addr2, and so on. EDIT2: looks like the rpi3 has up to 27 external gpio, so that gives you 19 address lines of the required 24, after taking 8 for the data lines. If you manually paged the ROM that means you would need to capture 32 pages separately. Doable, but a little tedious. You'd only need a single 8 bit shift register or counter to map through the extra 5 bits.

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Fri Dec 23, 2022 5:14 pm
noza10b1 Joined: 26 Mar 2022 Posts: 18	Thanks for the detailed info! The ParallelFLASHDumper project from cyphunk seems a good start. I'll buy a shift register, to be able to read the whole flash at once. I guess I'll make some experiments with RPi3's GPIO while I wait until my TSOP56 adapter arrives.

willbritton Joined: 06 Mar 2022 Posts: 697 Location: London, UK	Posted: Fri Dec 23, 2022 6:12 pm
	noza10b1 wrote The ParallelFLASHDumper project from cyphunk seems a good start. Ah yeah, that does look like a good one! (link to project since I guess you still can't -- just keep posting!! ;) noza10b1 wrote I'll buy a shift register, to be able to read the whole flash at once. If you do this project completely by the book, I think you'll need 4x 8-bit registers in total, 3x serial-to-parallel for the address lines and 1x parallel-to-serial for the data lines; or if you adapt it to make use of more direct gpio, I think you can maybe cut it down to the 1x parallel-to-serial as I suggested. Depending on your geography, you should find that both parts are very inexpensive (< 1 USD each) so it might be worth buying a small batch of both types of shift register to be on the safe side.

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Thu Jan 05, 2023 2:56 am
noza10b1 Joined: 26 Mar 2022 Posts: 18	After some pain, I was able to dump the flash contents with a RPi3. As suggested by willbritton, I've used 3 shift registers (74HC595) for the 24-bit address bus (A-1 to A22), controlled by 2 GPIOs (data and clock/strobe). 8 GPIOs were used to read the data in byte mode and 2 GPIOs to control OE# and WE# (to be able to implement the "automatic select" command and read the manufacturer and device ids, to make sure the chip was working fine). I've modified the ParallelFLASHDumper quite a bit, mostly by adding tests, changing pin assignments and refactoring code. I'll try to publish the modified version later. So, now I'm not sure what's the best way to share this dump. Is it ok to just zip and post it here as an attachment? About the contents, I've played a little with it and found some interesting things: - It seems the initial memory is where the game selector/launcher resides. It's possible to run it with an emulator, but graphics are glitched and it resets when trying to launch any game. - I was able to identify and extract 2 roms from the dump (I've only tried these 2 for now): Sonic and Alex Kidd in Miracle World. They are almost the same as other roms, but a few bytes are different (about 10 or so). Trying them on an emulator, I get only a black screen with Sonic and Alex Kidd hangs on the title screen. I tried to extract the bytes from Sonic again, directly from the flash, with a slower clock, but got the same content. Could this be some kind of copy protection? rpi3_flash_dumper.jpg (813.08 KB)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Thu Jan 05, 2023 7:33 am
	I suspect it’s some divergence in the emulated system that needs to be handled in software. You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing.

sverx Joined: 05 Sep 2013 Posts: 3936 Location: Stockholm, Sweden	Posted: Thu Jan 05, 2023 8:06 am
	noza10b1 wrote They are almost the same as other roms, but a few bytes are different (about 10 or so). can you share the diff so that we could figure out what is that for? :) also, AFAIK, this is not emulation (in the software sense) but it's a RE-based ASIC.

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Thu Jan 05, 2023 5:58 pm
noza10b1 Joined: 26 Mar 2022 Posts: 18	Quote You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing. Ok, I have attached the dump file. [Admin: attachment is now the full 16MB file] mse.zip (7.16 MB)

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Thu Jan 05, 2023 6:04 pm
noza10b1 Joined: 26 Mar 2022 Posts: 18	Quote can you share the diff so that we could figure out what is that for? :) Sure. The first file is the one extracted from flash. Sonic: diff sonic_pi.txt sonic.txt 3,4c3,4 < 00000020 c3 ed 02 00 00 00 00 00 c3 fe 02 f5 3e 85 32 fe \|............>.2.\| < 00000030 3f c3 00 05 00 00 00 00 c3 2b 00 44 65 76 65 6c \|?........+.Devel\| --- > 00000020 c3 ed 02 00 00 00 00 00 c3 fe 02 00 00 00 00 00 \|................\| > 00000030 00 00 00 00 00 00 00 00 c3 73 00 44 65 76 65 6c \|.........s.Devel\| 2045c2045 < 00007ff0 54 4d 52 20 53 45 47 41 59 59 c2 a8 76 70 00 40 \|TMR SEGAYY..vp.@\| --- > 00007ff0 54 4d 52 20 53 45 47 41 59 59 1b a5 76 70 00 40 \|TMR SEGAYY..vp.@\| Alex Kidd: diff alex_pi.txt alex_kidd_in_miracle_world.txt 10c10 < 00000090 11 01 c0 01 ef 1f 75 ed b0 cd 41 03 cd 50 03 3e \|......u...A..P.>\| --- > 00000090 11 01 c0 01 ff 1f 75 ed b0 cd 41 03 cd 50 03 3e \|......u...A..P.>\| 13c13 < 000000c0 f5 3e 85 32 fe 3f c3 38 05 e5 dd e5 fd e5 db bf \|.>.2.?.8........\| --- > 000000c0 f5 c5 d5 e5 d9 08 f5 c5 d5 e5 dd e5 fd e5 db bf \|................\|

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Fri Jan 06, 2023 3:07 am
noza10b1 Joined: 26 Mar 2022 Posts: 18	I'm trying to map the contents of the dump. Here is what I got so far. 01c000 - 05bfff - Sonic (differ) 164000 - 183fff - Alex Kidd in Miracle World (differ) 1c4000 - 1e3fff - Action Fighter (identical) 200000 - 23ffff - Aerial Assault (identical) 240000 - 27ffff - Alex Kidd - The Lost Stars (identical) 280000 - 2bffff - Alex Kidd in Shinobi World (identical) 2c0000 - 2dffff - Alex Kidd - High-Tech World (identical) 2e0000 - 31ffff - Alien Syndrome (differ but works) 800000 - 81ffff - Astro Warrior and Pit Pot (differ but works) fbc000 - ffbfff - Altered Beast (identical) The "works" is in the description means I can get in-game an play a bit without noticing any errors. It's nice to see that some games have no changes at all. Astro Warrior and Pit Pot diff: 1034c1034 < 00004130 dd e5 fd e5 db bf db dd e6 10 21 f8 df 4e 77 a9 \|..........!..Nw.\| --- > 00004130 dd e5 fd e5 db bf db c1 e6 10 21 f8 df 4e 77 a9 \|..........!..Nw.\| 1062c1062 < 000042f0 db dc c3 01 43 db dc e6 c0 47 db dd e6 3f 80 07 \|....C....G...?..\| --- > 000042f0 db c0 c3 01 43 db c0 e6 c0 47 db c1 e6 3f 80 07 \|....C....G...?..\| Alien Syndrome diff: 678,679c678,679 < 00002a60 c0 32 72 c4 32 0a c0 32 1b c0 3e 12 f7 3e f5 00 \|.2r.2..2..>..>..\| < 00002a70 00 db dd e6 c0 fe c0 20 13 3e 55 00 00 db dd e6 \|....... .>U.....\| --- > 00002a60 c0 32 72 c4 32 0a c0 32 1b c0 3e 12 f7 3e f5 d3 \|.2r.2..2..>..>..\| > 00002a70 3f db dd e6 c0 fe c0 20 13 3e 55 d3 3f db dd e6 \|?...... .>U.?...\|

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Fri Jan 06, 2023 2:28 pm
	Looking at the Sonic ROM, it injects this to the interrupt handler: jp $002B It normally says "jp $0073". At $2b we have some injected code in normally-unused space: push af ld a, $85 ld ($3FFE), a jp $500 This write to $3ffe is presumably a signal to the special mapper for this ROM. I assume this is paging some new code such that $500 is some special handler for this game. There is no other modification to the Sonic ROM. In the first part of the ROM we have the selection menu, which seems to run in a hybrid SMS mode with a GG palette (?). At offset $500 in there we have: di call $55A ld ($3FFE), a jp $75 This is returning to just after the original VBlank handler's "push af". So it's injecting this $55a routine into the interrupt handler; it looks like it does this for several games, there's a bunch of similar "detour handlers" next to it. At $55a we have: in a, ($cd) or a jr z, +++ push hl in a, (Port_IOPort1) cp $FF jr nz, + in a, (Port_IOPort2) or $F0 cp $FF jr nz, + ld hl, _RAM_FFF8_ inc (hl) jr nz, ++ inc hl inc (hl) jr nz, ++ +: jp 0 ++: pop hl +++: ld a, $87 ret This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Fri Jan 06, 2023 2:37 pm
	I/O ports Emulicious sees as used in its disassembly: .define _PORT_61_ $61 .define _PORT_62_ $62 .define _PORT_63_ $63 .define _PORT_7E_ $7E .define _PORT_88_ $88 .define _PORT_8C_ $8C .define _PORT_8D_ $8D .define _PORT_8E_ $8E .define _PORT_8F_ $8F .define _PORT_A0_ $A0 .define _PORT_C8_ $C8 .define _PORT_CA_ $CA .define _PORT_CB_ $CB .define _PORT_CD_ $CD .define _PORT_CE_ $CE .define _PORT_DC_ $DC Seems like a lot... The boot menu looks a lot like it was written in C, it is calling functions by passing parameters on the stack.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Fri Jan 06, 2023 4:20 pm
	From https://bojoga.com.br/artigos/dossie-retro/os-modelos-renovados-do-master-system... : Quote totally emulating the console, thanks to the chip developed by the well-known retro console company AtGames. This unique chip, also known as SOAC (System On A Chip) called Noza (in honor of the enemies of the game Zillion) manages to emulate games from the Master System and Game Gear. This claims the chip was designed by AtGames - famous for their bad Mega Drive efforts - and named after the enemies in Zillion, which is interesting.

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Sat Jan 07, 2023 3:43 am
noza10b1 Joined: 26 Mar 2022 Posts: 18	Updated dump map: 01c000 - 05bfff - Sonic (diff, black screen) 164000 - 183fff - Alex Kidd in Miracle World (diff, hang on title) 1c4000 - 1e3fff - Action Fighter (equal) 200000 - 23ffff - Aerial Assault (equal) 240000 - 27ffff - Alex Kidd - The Lost Stars (equal) 280000 - 2bffff - Alex Kidd in Shinobi World (equal) 2c0000 - 2dffff - Alex Kidd - High-Tech World (equal) 2e0000 - 31ffff - Alien Syndrome (diff, ok) 800000 - 81ffff - Astro Warrior and Pit Pot (diff, ok) bac000 - bcbfff - Sudoku (diff, ok) bcc000 - beffff - Creature Capture (diff, ok) bf0000 - bfffff - Nim (orig, ok) c00000 - ceffff - Pense Bem (orig, some glitches, must dump until cfffff to work on gearsystem) cf0000 - cf7fff - Master Pong (orig, ok) cf8000 - d07fff - Dr. Limpeza (orig, runs with glitches) d08000 - d13fff - Mina Terrestre (diff, runs with glitches) d14000 - d23fff - Os Doze Trabalhos de Jongo (diff, runs with glitches) d24000 - d43fff - Tangram (diff, ok) d44000 - d53fff - Aquaduto (orig, ok) d54000 - d63fff - Bombeiros (diff, ok) d64000 - d73fff - Outsiders (orig, ok) d74000 - d87fff - Bolhas (diff, ok) d88000 - d9ffff - Master Pinball (orig, ok) da0000 - dabfff - Dominó (diff, ok) dac000 - dbbfff - Serpentes (orig, ok) dbc000 - dcbfff - Memória Master (diff, runs with glitches) dcc000 - ddffff - Bolas e Cores (diff, ok) de0000 - deffff - Acerte o Alvo (diff, ok) df0000 - dfffff - Aventuras na Floresta (orig, ok) e00000 - e0ffff - Domine o Território (orig, glitches) e10000 - e1ffff - Arqueiro (orig, ok) e20000 - e2bfff - Ataque dos Vermes (orig, ok) e2c000 - e3bfff - Batalha Animal (orig, ok) e3c000 - e47fff - Batalha no Mar (orig, ok) e48000 - e53fff - Tanques (orig, ok) e54000 - e63fff - Cava Cava (diff, ok) e64000 - e87fff - Fábrica de Chocolate (diff, ok) e88000 - e97fff - Hexágonos (orig, ok) e98000 - ea3fff - Hockey de Mesa (orig, ok) ea4000 - ec3fff - Icepost Rescue (orig, ok) edc000 - ee7fff - Junte 4 (orig, ok) ee8000 - ef7fff - Minerador (diff, ok) ef8000 - f0bfff - Palhaços (diff, ok) f0c000 - f17fff - Resta Um (orig, ok) f18000 - f2bfff - Senha (diff, ok) f2c000 - f3bfff - Snowball (orig, ok) fbc000 - ffbfff - Altered Beast (equal) I guess all Tectoy Digital and Overplay games are listed now. I've used Gearsystem to test them.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14939 Location: London	Posted: Sat Jan 07, 2023 10:04 am
	On the real system, does a button trigger a return to the game selection menu from Sonic? What happens if you hold a controller button at the same time as pressing it?

noza10b1 Joined: 26 Mar 2022 Posts: 18	Posted: Sat Jan 07, 2023 1:50 pm
noza10b1 Joined: 26 Mar 2022 Posts: 18	The real system has a 6-button controller. If you hold the top 3 at the same time it goes back to the menu. But this is supposed to work on any game.

sverx Joined: 05 Sep 2013 Posts: 3936 Location: Stockholm, Sweden	Posted: Sun Jan 08, 2023 2:40 pm
	Maxim wrote At $55a we have: in a, ($cd) or a jr z, +++ push hl in a, (Port_IOPort1) cp $FF jr nz, + in a, (Port_IOPort2) or $F0 cp $FF jr nz, + ld hl, _RAM_FFF8_ inc (hl) jr nz, ++ inc hl inc (hl) jr nz, ++ +: jp 0 ++: pop hl +++: ld a, $87 ret This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure. I guess this is the code that checks if the 'reboot' keys are pressed. If so, it forces the mapper to map the menu ROM again and finally it jumps to zero. Why it increments the contents that way it's everyone's guess - we should probably disassemble the menu ROM to understand how this mapper works.

Forums

View topic - Master System Evolution 132 games (was: Received this in the mail this evening :)