Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - GG 1-ASIC bios skip mod - just bridge J1?

Reply to topic
Author Message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13238
  • Location: London
Reply with quote
GG 1-ASIC bios skip mod - just bridge J1?
Post Posted: Sun Jun 10, 2007 12:10 pm
Someone contacted me about why, back in 199x, he had to have his Game Gear "repaired" by the shop when a pirate cart didn't work. I immediately suspected it was an issue with the "PRODUCED BY OR UNDER LICENCE FROM..." screen checking for "TMR SEGA" in the ROM, and this was confirmed as the bumper screen had indeed disappeared at the time. but I was interested to see how the "repair" had achieved this.

As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you.
gamegear2.JPG (125.79 KB)
GG 1-ASIC with J1 bridged
gamegear2.JPG

  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Sun Jun 10, 2007 8:10 pm
Last edited by Charles MacDonald on Sun Jun 10, 2007 9:07 pm; edited 1 time in total
Quote
As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you.


It works! When J1 is shorted, the BIOS ROM doesn't load. I plugged Space Harrier in and it booted directly.

Since the GG was open and the soldering iron was on, I found J2/J3 select the territory. With the silkscreen text oriented towards you, the jumpers look like this:


A   B
C   D
^
| J2
| J3


A,B are +5V, D is ground, C is the territory mode input. Normally A-C are bridged so this signal is high and "Overseas mode" is selected. Bridge C-D so the signal is low and that enabled "Japan (Domestic mode)".

It seems leaving C unconnected defaults to overseas mode but you should probably tie it high/low to be sure.

Was hoping to find a PAL/NTSC jumper, but it seems to not be present.

EDIT: My GG doesn't have J2/J3 in the same position as the one in Maxim's post. The pads are all of an equal size and equally spaced away from each other with the silkscreen text and arrow next to them. Be careful! ;)
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Sun Jun 10, 2007 8:57 pm
Last edited by Charles MacDonald on Wed Jun 13, 2007 9:08 pm; edited 2 times in total
Some BIOS-less GG Z80 tests:
After a warm reset (Z80 /RST asserted) the registers are set up like so:

SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All retain former values
I = $00, R = $00

After a cold reset (power switched on) the registers are set up like so:

SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All zero
I = $00, R = $00

After loading all registers with $FF, during the time that power is switched off and then back on each set bit gradually resets to zero. This is why the cold boot state is zero for most all registers but the ones that have fixed values due to Z80 /RST being pulsed.

It only takes a few seconds for all of them to change to zero. If you turn the GG back on before then, the values will be random as random 1 bits have turned to 0 and others are still preserved.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Mon Jun 11, 2007 4:47 pm
Was there any difference for OUT (C),0 (opcode ED71) as well?
Did it output $FF instead of $00 on the GG?
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Mon Jun 11, 2007 5:09 pm
Last edited by Charles MacDonald on Wed Jun 13, 2007 9:04 pm; edited 1 time in total
FluBBa wrote
Was there any difference for OUT (C),0 (opcode ED71) as well?
Did it output $FF instead of $00 on the GG?


Yes, my GG always does 'out (c), $FF' instead of 'out (c), $00'.

I've attached the register dumping and 'out-test' programs.

For the register dumping program, it will capture and print the register values and then load all registers with a value before HALTing. Hold start to load registers with $0000, don't hold start to load registers with $FFFF. You'd use it like this:

1st time:
- Turn on GG, turn off GG. Registers now loaded with $FFFF.
- Don't wait
- Turn on GG, values displayed are what was retained during power-cycling.

2nd time:
- Turn on GG, turn off GG. Registers now loaded with $FFFF.
- Wait 10 seconds or longer
- Turn on GG, values displayed are what was retained during power-cycling.

For the quick cycle, all values should be retained. For the long wait all values should be zero apart from the few I've described. Then again:

1st time:
- Hold START and turn on GG, turn off GG. Registers now loaded with $0000.
- Don't wait
- Turn on GG, values displayed are what was retained during power-cycling.

2nd time:
- Hold START and turn on GG, turn off GG. Registers now loaded with $0000.
- Wait 10 seconds or longer
- Turn on GG, values displayed are what was retained during power-cycling.

In both cases all registers will be zero apart from the few special cases.

For the out-test program, it writes $A5 to 12 bytes, then overwrites them with 'out (c), 0' after loading all the registers with $0000 (on the assumption some internal bus is used as the data source, but it apparently isn't). The values printed should all be $FF.

If you or anyone else would like to test these programs and share the results, I'd appreciate it.

I've done some SMS VDP 2 timing tests, and found I could get H counter values for various video 'events' by connecting the VDP /N-L (HL trigger input) pin to other signals, like /CSYNC, /Y1 (pixel transparency indicator) and /BURST (color burst insertion strobe) as well as /NMI and /INT to find out exactly what the H counter value is when they trigger. I'll try to get my experiments done this week and write about it.

EDIT: Fixed the program to save A,F properly.
gg-out.zip (2.21 KB)
Game Gear "out (c), 0" test program
gg-reg2.zip (2.55 KB)
Z80 register test program (fixed)

  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Mon Jun 11, 2007 5:22 pm
I don't have a GG so I can't test any specifics for that one, I only have a SMS1 and hopefully soon a MegaDrive so I can use my PowerBase converter.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Tue Jun 12, 2007 11:18 pm
Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation?
Do you have results from a SMS without a bios as well?
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Wed Jun 13, 2007 4:26 am
FluBBa wrote
Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation?
Do you have results from a SMS without a bios as well?


Oops, I just realized saving I and R overwrites the value of A and F on startup. Sorry!

I wonder how I can save A and F without SP being set up. With the assumption that the registers default to zero, 'push af' will store the values at $FFFF and $FFFE. For a 32K ROM this won't cause any trouble.

But then the stack pointer is invalid for any tests where the power is quickly cycled and the resulting SP value is non-zero. I suppose a message could be displayed to warn the user if the SP startup value was not within a RAM area, then you'd know the values of A,F were invalid.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Jun 2007
  • Posts: 2
Reply with quote
I am Maxim's contact
Post Posted: Wed Jun 13, 2007 7:39 pm
Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post."
I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear. I personally have two GameGears, one in good state and one in below average state. I wish I knew programming so that the "registers" discussed here would make sense to me. Can you guys help me somewhat?
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Re: I am Maxim's contact
Post Posted: Wed Jun 13, 2007 9:02 pm
linobollansee wrote
Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post."


Sorry, I don't have a camera to take a picture. In the photo of your Game Gear, notice there is no label for J3, though I assume it is the two larger solder pads to the right of J2.

On mine J3 is to the right of J2, but the solder pads are all the same size. In addition the two lower pads of J2 and J3 are shorted together, and there is no connection in the picture.

Quote
I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear.


I only have one. I experimented with J1 and later J2/J3 after reading Maxim's post, but I hadn't studied the picture closely. J1 is in the same position as yours on my Majesco GG, but J2/J3 are different as I've explained.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Wed Jun 13, 2007 9:36 pm
Maybe this topic should be split (is that possible?)...
I've fixed quite a few things on my SMS emulator now regarding GG emulation so now TMS9918 modes can change the palette.
Speaking of startup values, do you know how the palette is set up on startup?
Twisty.png (547 B)
Twisty on SMSAdvance
Twisty.png

  View user's profile Send private message Visit poster's website
  • Joined: 13 Jun 2007
  • Posts: 2
Reply with quote
Charles' Majesco Circuitry
Post Posted: Wed Jun 13, 2007 10:01 pm
Can you get a friend to take a picture of your Majesco GG circuitry?
Perhaps my GameGear HAS no J2/J3 and the region cannot be modified.
I am not willing to risk tampering with the NON labelled J2/J3 it yet, unless I have some extra money. I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on? It could break the gamegear so maybe the best would be to use a very small, very flat style switch (moved with your fingernail) into the battery pack. Can you tell me how old you are Charles? Are you a programmer? How did you get so good? Do you have MSN Messenger so I can speak to you directly?
  View user's profile Send private message
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Re: Charles' Majesco Circuitry
Post Posted: Wed Jun 13, 2007 10:23 pm
Quote
Can you get a friend to take a picture of your Majesco GG circuitry?


I don't have any plans to do that, but if I do take a picture at some point in the future I'll post it here.

Quote
I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on?


I don't think anything bad would happen, but just to be sure I wouldn't change the switch while the power was turned on. Putting it in the battery compartment so no accidents can occur is a good idea.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
MegaDrive Startup Values.
Post Posted: Fri Feb 22, 2008 2:58 pm
Last edited by FluBBa on Fri Feb 22, 2008 9:01 pm; edited 1 time in total
I added a register dump feature to my test program and the results from my PAL MegaDrive with a PowerBase Converter are:

SP: $DFFF
IR: $001D
AF: $FFA3
BC: $FFFF
DE: $FFFF
HL: $E001
IX: $FFFF
IY: $FFFF
AF': $FFFF
BC': $FFFF
DE': $FFFF
HL': $FFFF

The only unstable register is HL' which sometimes become $FDFF or $FFDF also.
Is there some "minibios" or hardware which sets the SP and/or HL?
Edit: added clarification of hardware.
  View user's profile Send private message Visit poster's website
  • Joined: 31 Oct 2007
  • Posts: 847
  • Location: Estonia, Rapla city
Reply with quote
Post Posted: Fri Feb 22, 2008 5:09 pm
There shouldn't be anything else than TMSS (if present), but it touches only 68K AFAIK, Z80 is left untouched... SEGA manual also states that there's no BIOS used in SMS mode.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Fri Feb 22, 2008 9:06 pm
I did use a PowerBase Converter with my MD, is there anything like that in it?
Do we have pictures of the inside here at SMSPower?
Should I take some?
Can someone run my test program on a bios-less SMS?
jpx072? Do you have the ability to do this or is it messy to change your bioses? Right now the program is 32kB but I can scale it down to 16kB if that is necessary.
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Sat Feb 23, 2008 1:57 am
FluBBa wrote
I did use a PowerBase Converter with my MD, is there anything like that in it?


Some Genesis/MegaDrive consoles have a built-in BIOS that does a check of the cartridge, much like the Majesco Game Gear for example. However, when booting from the Power Base Converter the BIOS is completely disabled, it only exists for the 68000 side anyway.

This is why executing a game from a Super Magic Drive copier causes the "Licenced by" screen to show up only after the game has started and the Z80-driven menu program is done, because at the point the /M3 pin goes high the 68000 is reset and the internal BIOS is enabled.

The Power Base Converter has no ROM for the Z80, all that's present is a CK2605 PLA chip for controlling cartridge and card slot selection. It doesn't have enough connections to the Z80 data bus to provide program code either.

So I think it's safe to say both the BIOS (when present) and PBC have no effect on the Z80 state when powering up.

Quote
Do we have pictures of the inside here at SMSPower? Should I take some?


I don't think we do, that might be a nice addition.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Wed Feb 27, 2008 11:12 am
Charles did you ever find out the HCount values for VBL, HBL ints and NMI?
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Wed Feb 27, 2008 12:37 pm
My GG has no BIOS screen (standard) and J1 here has a jumpering component installed. I can't find J2 or J3 anywhere. Anybody want to speculate on what happens if J1 is removed?
IMG055.jpg (36.47 KB)
J1 area - normal no BIOS 1 ASIC GG
IMG055.jpg

  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13238
  • Location: London
Reply with quote
Post Posted: Wed Feb 27, 2008 12:51 pm
DMEnduro wrote
Anybody want to speculate on what happens if J1 is removed?

Speculations:
1. You get the secret GG BIOS that's never been seen before
2. It tries to access a BIOS that isn't there and locks up (probably reading $ff = rst $38 and looping there forever)
3. The Game Gear explodes
4. The universe implodes
5. J1 isn't a BIOS toggle, it's the region selector on that model

If you give it a try, and it's not #4, let us know the results :)
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Fri Feb 29, 2008 5:12 am
I was hoping for #5, betting on #2, and surprisingly got #1.

I got the secret GG BIOS! Sorta.

It just looks like the normally described one.

PRODUCED BY OR
UNDER LICENSE FROM
SEGA ENTERPRISES LTD.

White text on blue background.

So... what does this mean?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13238
  • Location: London
Reply with quote
Post Posted: Fri Feb 29, 2008 7:10 am
Can you dump it?
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Fri Feb 29, 2008 10:03 am
No, I don't have that sort of equipment.
What's the likeliness of it being on the ASIC?
There's only two other ICs on the board:
(Hitachi) 65256BLFP-12T
Sony CXK5864CM-70LL

A little research tells me that we have a 32K RAM and an 8K RAM. Is that right?

The board is labeled IC BD GG MAIN USA VA1 837-9024 MADE IN JAPAN
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13238
  • Location: London
Reply with quote
Post Posted: Fri Feb 29, 2008 10:45 am
There's a good chance it's in the ASIC. To dump it, you can use:
- an SRAM-based devcart (eg. SMSReader SRAM cart) with a program that copies the BIOS onto the cart space
- a devcart that supports backup RAM (eg. Tototek SMS-PRO, GG-PRO, hacked SMS game with SRAM), similar deal
- any devcart, so long as you're happy to copy 1KB from the screen

On GGs, the BIOS and cart are accessible simultaneously (the BIOS replaces the first 1KB of ROM space) so you don't even need to write a RAM-resident dumper, so it's pretty easy to code.
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Sat Mar 01, 2008 4:46 pm
Quote
So... what does this mean?


It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS *disabled* which is unusual. But that nice picture you took clearly showed the original jumper configuration, so it seems legit.

You could argue that as they had the jumper there at all, it was intended to be used in some situations. I wonder why, though. A very cool find!
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Sun Mar 02, 2008 6:58 am
I'd like to get an SMS-PRO, but I'll have to organise a credit card first. I'm also going to look into building an SMSReader + cart.

Charles MacDonald wrote
It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS *disabled* which is unusual.
I'm interested in knowing how unusual/common this configuration is now.
  View user's profile Send private message
  • Joined: 08 Feb 2008
  • Posts: 75
  • Location: Slovakia
Reply with quote
Post Posted: Sun Mar 02, 2008 10:42 am
SMS II with disabled bios (rerouted CE line from bios to cartridge connector) running VDPTEST.sms (running 3-times) :

Test: 1st - 2nd - 3rd

SP: $FFFF - FFFF - FFFF
IR: $0019 - 0019 - 0019
AF: $FFFF - FFFF - FFFF
BC: $BDBF - BDBF- BDBD
DE: $FFFF - FFED - FFFF
HL: $FFFF - FFFF - FFFF
IX: $BDFF - BDBF - BDFF
IY: $FFBD - FFBD - FFBD
AF': $FFFF- FFFF - FFBF
BC': $BFBD - BFBD - BDBF
DE': $FFFF - FFEF - FFFF
HL': $FFFF - BFBF - FFFD

(bios chip was not even present on the board)

Hope it helps :) cheers
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Sun Mar 02, 2008 1:45 pm
Thanks a lot jpx072! =)
Can you write what kind of Z80 that is in your SMSII? or can that be seen on any of the photos you allready have put up here?
I'll open up my MD and write down the Z80 version there as well.
  View user's profile Send private message Visit poster's website
  • Joined: 08 Feb 2008
  • Posts: 75
  • Location: Slovakia
Reply with quote
Post Posted: Sun Mar 02, 2008 1:54 pm
My SMSII Z80 - see photo ;)
Z80.JPG (12.98 KB)
Z80.JPG

  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Sun Mar 02, 2008 6:59 pm
Thanks again for the info it's really good for the documentation of the SMS.
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1151
Reply with quote
Post Posted: Sun Mar 02, 2008 11:01 pm
FluBBa wrote
Charles did you ever find out the HCount values for VBL, HBL ints and NMI?


I can't remember, sorry. I will try to do this at some point - keep asking about it (send PMs or something) and nag me so I don't forget.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jul 2005
  • Posts: 411
  • Location: GBG
Reply with quote
Post Posted: Mon Mar 03, 2008 8:07 am
Charles MacDonald wrote
keep asking about it (send PMs or something) and nag me so I don't forget.

He he, well, I'll try :)
I guess you only really need to do the test for one of the interrupts as we know how they relate to each other now.
  View user's profile Send private message Visit poster's website
Reply to topic



Back to the top of this page

Back to SMS Power!