Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Master System Evolution 132 games (was: Received this in the mail this evening :)

Reply to topic Goto page 1, 2  Next
Author Message
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Master System Evolution 132 games (was: Received this in the mail this evening :)
Post Posted: Thu Apr 24, 2014 11:44 am
Last edited by Tycho on Mon Jul 03, 2023 10:58 pm; edited 1 time in total
How do I play this thing actually in Colour? It shows up in black and white (very very little colour does appear though) and it has quite a bit of ghosting and horizontal lines (alternating between two slightly different shades)
SAM_3138.JPG (527.72 KB)
SAM_3138.JPG

  View user's profile Send private message
  • Joined: 25 Feb 2013
  • Posts: 384
  • Location: Osaka
Reply with quote
Post Posted: Thu Apr 24, 2014 11:52 am
black and white -> I suppose the console outputs PAL and your TV only accepts NTSC
  View user's profile Send private message
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Post Posted: Thu Apr 24, 2014 12:16 pm
I had a look, and it's another problem.

Brazil is PAL-M. Australia is PAL. Even though they are pal, they are different!

Is there any way to force my TV (Panasonic Viera) to use NTSC? I read that PAL-M is a lot closer to NTSC than to normal PAL
  View user's profile Send private message
  • Joined: 13 Nov 2007
  • Posts: 219
Reply with quote
Post Posted: Thu Apr 24, 2014 12:34 pm
On my old panasonic tv to select "region" was done in the menu. Auto (sometimes works) & 3 other settings.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Thu Apr 24, 2014 12:58 pm
Chances are it's going to be hard to dump; a photo of the guts might help determine if it's a glop-top, and even if it's not some desoldering will probably be needed. As for the TV, you really need a compatible TV, switching to NTSC mode is unlikely to work. The most likely way to get it working is to do some kind of RGB mod.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2006
  • Posts: 863
  • Location: Belo Horizonte, MG, Brazil
Reply with quote
Post Posted: Thu Apr 24, 2014 4:03 pm
Unfortunately, PAL-M won't work correctly on NTSC: the luminance is encoded the same way, but the colors are encoded differently; you'll get an image, but it will be in B&W.

-- edit --

Maybe you could try a transcoder (not sure how well it would work, though):

http://eletronicos.mercadolivre.com.br/conversores-transcoder/transcoder-pal-m-ntsc
  View user's profile Send private message Visit poster's website
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Post Posted: Fri Apr 25, 2014 3:44 am
Last edited by Tycho on Mon Jul 03, 2023 10:59 pm; edited 1 time in total
Will this work? If it will, I'll buy it

http://www.ebay.com.au/itm/Mini-AV-CVBS-RCA-to-HDMI-Converter-Adapter-For-720P-1...

The "Sega" logo when you start the console looks similar to a Mega Drive logo. Is it possible that the 132 games are just one big Mega Drive ROM? If that's the case, is it possible to split out the games eventually at some stage? Although there would be no point splitting them would there?

If it is a Glob Top that would be more complex? Would I need to run wires to each trace leading to the ROM or something insane like that?
  View user's profile Send private message
  • Joined: 17 Sep 2013
  • Posts: 140
  • Location: TC, MI
Reply with quote
Post Posted: Fri Apr 25, 2014 5:08 am
PICTURES! :D
I am quite excited to see those guts, glop or not. Besides, if there is even a single leaded IC on board, that will make it all the easier to trace back to the glop top pins and designate their functions.
  View user's profile Send private message Visit poster's website
  • Joined: 07 Jun 2010
  • Posts: 195
Reply with quote
Post Posted: Fri Apr 25, 2014 7:01 am
Here's a photo of the inside...

  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Fri Apr 25, 2014 7:25 am
Looks like an SMS on a chip and a ROM to me, but no video encoder chip so unlikely to be moddable. The HDMI converter will probably work, depending on how far out of spec the video output is (video game consoles often push the boundaries). Can we get a full resolution closeup of the main board?
  View user's profile Send private message Visit poster's website
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Post Posted: Fri Apr 25, 2014 10:14 am
Okay I bought it, we'll see if it will at least make the picture a little better.

It's not a glob top it seems but those chips look surface mounted! I really hate soldering surface mounted chips, so I won't be removing mine, I'm no good with these I'd damage it :(
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Fri Apr 25, 2014 2:15 pm
It would be bizarre to mass produce through hole PCBs now.

Some earlier TecToy multi game systems seemed to have a lot of games exceeding Master System capabilities. It's possible it's an emulator underneath plus some "native" games on the hardware itself, hence an excessively good Sega logo, in which case the ROM dump won't yield Master System ROM images.
  View user's profile Send private message Visit poster's website
  • Joined: 07 Jun 2010
  • Posts: 195
Reply with quote
Post Posted: Fri Apr 25, 2014 3:34 pm
Maxim wrote
Can we get a full resolution closeup of the main board?

I'm sorry, the photo is not mine.

I suppose this system is same with 2007 / 2008 models:
http://www.assemblergames.com/forums/showthread.php?19582-2008-Master-System-from-Tec-Toy&p=310088&viewfull=1#post310088
  View user's profile Send private message
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Post Posted: Fri May 09, 2014 9:17 am
The converter was a waste of money.

It does get you perfect colour and sharp image, but the screen doesn't refresh properly. You just get diagonal chunks of an image which are still. At one point you could make out the normal Tec Toy menu half the screen displayed it, at other times its just a solid colour here or there displayed in diagonal lines ///

I'm guessing there's no way to hack this?

Another device I recently bought was a SCART to HDMI cable, and a MF converter for SCART as well, as well as a MS SCART cable, hoping I could convert the MS HDMI to scart. Unfortunately the image sucks with it, no image at all pops up, just audio.

Two converters to perform two different functions for MS but both don't work... sigh.

Maybe I should buy a CRT TV from Brazil, pretty sure it would be virtually free but shipping would be a killer!
  View user's profile Send private message
  • Joined: 15 Sep 2010
  • Posts: 49
  • Location: Brazil
Reply with quote
Post Posted: Fri May 09, 2014 4:45 pm
Tycho wrote
Maybe I should buy a CRT TV from Brazil, pretty sure it would be virtually free

In fact everything in Brazil is expensive - even an old, used CRT TV.

Tycho wrote
but shipping would be a killer!

Yes. And we can only ship packages with less than 20 Kilograms to Australia - so you probably would have to import a very small Brazilian Pal-M television.

I personally think it's not worth just to play Master System Evolution's (badly) emulated games.
  View user's profile Send private message Visit poster's website
Revo
  • Guest
Reply with quote
Post Posted: Sat Jun 12, 2021 12:17 pm
Followed better pictures of the inside.

So if I want to do the same than for the Megadrive 4 (See https://www.smspower.org/forums/16828-TecToyMegadrive4DumpsIncludingMasterSystem... ), I need to find TX and RX.


Games list of the Master System Evolution:

Official:

20 em 1
Action Fighter
Aerial Assault
Alex Kidd High Tech World
Alex Kidd in Miracle World
Alex Kidd in Shinobi World
Alex Kidd The Lost Stars
Alien Syndrome
Altered Beast
Astro Warrior / Pit Pot (as Pit Pot / Astro Warrior)
Aztec Adventure
Baku Baku Animal
Bank Panic
Battle Outrun
Black Belt
Bomber Raid
Bonanza Bros.
Bubble Bobble
Chase H.Q.
Columns
Cyber Shinobi
Double Target (Quartet)
Dragon Crystal
Enduro Racer
ESWAT: Cyber Police (as ESWAT - City Under Siege)
Fantasy Zone
Fantasy Zone 2
Fantasy Zone 3 (The Maze)
Gain Ground
Galactic Protector
Ghost House
Global Defense
G-Loc
Golden Axe
Golfmania
Great Soccer
Hang On
Kenseiden
Kung Fu Kid
Lord of The Sword
Machinegun Joe
Maze Walker
My Hero
The New Zealand Story
The Ninja
Penguin Land
Putt & Putter
Rainbow Islands
Rastan Saga
Renegade
Satellite 7
Scramble Spirits
Secret Commando
Shadow Dancer
Shinobi
Slap Shot
Sonic The Hedgehog
Sonic Drift 2 (Game Gear version)
Special Criminal Investigation
Super Space Invaders
Super Tennis
Thunder Blade
Transbot
Woody Pop
World Grand Prix
World Soccer

Tectoy Digital and Overplay:

Acerte o Alvo
Aquaduto
Arqueiro
Ataque dos Vermes
Aventuras na Floresta
Batalha Animal
Batalha no Mar
Bolas e Cores
Bolhas
Bombeiros
Cava Cava
Creature Capture
Domine o Território
Dominó
Dr. Limpeza
Fábrica de Chocolate
Hexágonos
Hockey de Mesa
Icepost Rescue
Junte 4
Master Pinball
Master Pong
Memória Master
Mina Terrestre
Minerador
Nim
Os 12 trabalhos de Jongo
Outsiders
Palhaços
Pense Bem 10 Jogos
Resta Um
Senha
Serpentes
Snowball
Sudoku
Tangram
Tanques

On Tectoy Digital and Overplay exclusives games, there is 16 games dumped ('cause of the Megadrive 4), and 21 games to dump.
Main Board.JPG (1.89 MB)
Main Board.JPG
Power Board.JPG (1.78 MB)
Power Board.JPG
Video Output Board.JPG (923.01 KB)
Video Output Board.JPG

 
Revo
  • Guest
Reply with quote
Post Posted: Sat Jun 12, 2021 2:29 pm
You can access Color & Switch Test (see: https://www.smspower.org/Games/ColorAndSwitchTest-SMS ) by starting the system while holding B and C (corresponding to 1 and 2) on the first controller.
 
  • Joined: 05 Mar 2006
  • Posts: 53
  • Location: France
Reply with quote
Post Posted: Sat Jun 12, 2021 7:55 pm
The fact that this board has no SDRAM makes me think this "Noza 1.0B1" chip isn't a rebranded linux capable ARM MCU running an emulator, but a real custom solution close to an SMS-on-a-chip, on which a debug serial port would be useless.

It also seems to output composite video directly, which isn't something usually found on off-the-shelf MCUs.

Most SoCs from Rockchip, Allwinner and others are either offered in BGA or large (144+ pins) packages, so I wouldn't bet on those either.

How about reading the flash chip directly ? Hopefully there's no encryption or scrambling involved.
  View user's profile Send private message Visit poster's website
  • Joined: 04 Jul 2010
  • Posts: 539
  • Location: Angers, France
Reply with quote
Post Posted: Tue Jun 15, 2021 4:33 pm
The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC).

This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout)
  View user's profile Send private message
Revo
  • Guest
Reply with quote
Post Posted: Wed Jun 16, 2021 4:36 pm
Quote
17:25, 16/06/2021] Sega Brasil: Falei com um amigo que trabalhou na TecToy
Ele me disse que vai ser difícil achar os jogos da memória
Pois são feitos em 1 só arquivo
E alguém teria que “dumpar” do vídeo game
E separar os jogos
E até hoje, ninguém fez isso…


Google trad: I spoke with a friend who worked at TecToy
He told me it will be difficult to find the memory games
Because they are made in one single file
And someone would have to dump the video game
And separate the games
And until today, no one has done that...
 
  • Joined: 04 Jul 2010
  • Posts: 539
  • Location: Angers, France
Reply with quote
Post Posted: Wed Jun 16, 2021 5:06 pm
The problem is to dump the chip not to separates datas as we already have dumps of all commercial games, we can find them in the binary (unless datas are crypted)
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Wed Jun 16, 2021 8:54 pm
Splitting a big file would be pretty easy really.
  View user's profile Send private message Visit poster's website
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Thu Jun 17, 2021 12:14 pm
it's likely going to be simply a juxtaposition of all the ROMs anyway
  View user's profile Send private message Visit poster's website
  • Joined: 05 Mar 2006
  • Posts: 53
  • Location: France
Reply with quote
Post Posted: Fri Jun 18, 2021 7:18 pm
ichigobankai wrote
The MX chip looks like more a NAND than NOR for me (with all these pins tied to GND or VCC).

This Could be even worse than that and be a proprietary chip (like MX in Snes cartridges with there specific pinout)


Hadn't noticed that, I expected it to be some standard parallel flash with some pins routed under it.
Couldn't find any matching pinout looking at the standard MX products, so it might indeed be a customized part :(

Would they go through the trouble of using managed NAND for a chip that (my guess) isn't a SoC ?
  View user's profile Send private message Visit poster's website
  • Joined: 04 Jul 2010
  • Posts: 539
  • Location: Angers, France
Reply with quote
Post Posted: Sat Jun 19, 2021 6:52 am
Honestly I don't know.
It's can also be a classical parallel flash with a custom pinout.
Hard to know without desoldering the beast and see what's behind.

With all games, the flash should be around 16MB / 128Mb
  View user's profile Send private message
  • Joined: 16 Dec 2009
  • Posts: 244
Reply with quote
Post Posted: Sat Jul 17, 2021 6:58 am
Last edited by Tycho on Mon Jul 03, 2023 10:57 pm; edited 1 time in total
..
  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sat Mar 26, 2022 1:55 am
I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online.

So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it...

I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead.

There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work.

Anyway, here is the picture of the chip, I hope it can help someone dump it.
mxic.jpg (231.85 KB)
mxic.jpg

  View user's profile Send private message
  • Joined: 05 Feb 2020
  • Posts: 14
  • Location: Bra
Reply with quote
Post Posted: Sun Jun 05, 2022 3:19 pm
noza10b1 wrote
I've opened up my Master System Evolution to see if I could find out what flash chip it uses, and, at least in my case, it's a MX29GL128F, from MXIC, with 128Mb. It's easy to find its datasheet online.

So I guess it should be possible to desolder and dump it. I'm just not sure if I have the needed tools and skills to do it, and then solder it back without breaking it...

I think I would need a TSOP-56 adapter and a programmer, but the programmers I've found around here are pretty expensive. Maybe something like a RPi could be used instead.

There is also a 56 PIN TSOP testing clip from Xinga Electronic that looks great (I can't post the link). It seems it would make it possible to read the flash without needing to desolder it. Unfortunately, with the shipping and taxes, it would not be cheap. The Noza chip would probably need to be held in reset too, for this to work.

Anyway, here is the picture of the chip, I hope it can help someone dump it.





Anyone?
  View user's profile Send private message
  • Joined: 26 Feb 2021
  • Posts: 158
Reply with quote
Post Posted: Sat Dec 17, 2022 3:41 am
I received the Master System Evolution from Revo (please see pictures he shared above).

On his model (PCI MSIII REV7 P1) the flash is in TSOP48 with a ref completely unknown to the internet:
MX S112964
MS132X1E => Master System 132 in 1 Evolution?
3H188600

Very likely to be proprietary, I was hoping for an easy MX29GL128 in TSOP56...

None of my or my friends' programmers (Xeltek 6100, Dataman 48, ProMan) has been able to identify the chip. It actually went very hot when inserted in the ZIF socket...

A few observations:
- there are 3 wires between the PSU board and the mainboard, one is identified as PAUSE on the silkscreen. It's connected to the P1 controller connector pin 7 on the mainboard but unconnected on the PSU board. Maybe other models have a PAUSE button on the console.
- the silkscreen says "+5V" on both the PSU and mainboard but it's actually 3.3V
- there's a jumper on the mainboard named CNC5. It's left open by default. When closed the console boots up to the colour and controller test program (same as maintaining A+C or B+C upon boot up).
  View user's profile Send private message Visit poster's website
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Master System Evolution 132 games (was: Received this in the mail this evening :)
Post Posted: Sat Dec 17, 2022 5:14 pm
Could it be a Macronix 64Mbit Flash in TSOP 48-pin package i.e. MX29 part?
  View user's profile Send private message
  • Joined: 26 Feb 2021
  • Posts: 158
Reply with quote
Post Posted: Sat Dec 17, 2022 8:11 pm
It's closer to a MX23L6411 mask ROM but with pin 36 as A22 (making it 128Mb) and BYTE mode by default (pin 46 = A-1).
  View user's profile Send private message Visit poster's website
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Master System Evolution 132 games (was: Received this in the mail this evening :)
Post Posted: Sun Dec 18, 2022 3:39 am
Ah I see. And you have the pinout. Sounds like a custom dumper rig from an Arduino or something is going to be the way to go.
  View user's profile Send private message
  • Joined: 26 Feb 2021
  • Posts: 158
Reply with quote
Post Posted: Sun Dec 18, 2022 11:41 pm
I think I'll just modify the TSOP48 adapter I have here.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Thu Dec 22, 2022 6:23 pm
I was able to unsolder the flash, hopefully without damaging it.
One pad was lost, but it looks like a NC one, so it shouldn't matter.
I also had to remove CL6 and CL7, 100nF capacitors, because they were very close and I don't have an air blower.

Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3?

  View user's profile Send private message
  • Joined: 06 Mar 2022
  • Posts: 596
  • Location: London, UK
Reply with quote
Post Posted: Fri Dec 23, 2022 1:05 am
noza10b1 wrote
Does anyone know how to build a dumper with a TSOP56 adapter and an Arduino/ESP32/RPi3?

It's not too hard, in principle. You might find a project out there that someone else has documented to get you started.

But to use an Arduino / RPi to read the ROM you will need to use whatever gpio you have available to bit-bang the address lines and then sample the data lines. Likely the various control lines you can hard wire appropriately.

I reckon you want:
OE# = 0
CE# = 0
WE# = 1
RESET = #1
WP# = 0
BYTE# = 0

I think you're best reading in 8-bit mode (hence BYTE# = 0), and you'll almost certainly need to multiplex the address bus somehow as I doubt you'll have enough gpio to address the entire memory as well as read back the data. One or more low voltage shift registers should do the trick, or a combination of shift registers and direct connection for the least significant bits. Take a look at the 74HC595. Or you could use a counter or something instead.

Alternatively if you don't want to faff with external chips you could manually dump the ROM in pages, the size of which is determined by how many least significant address lines you are able to control with gpio.

Be careful to only use the 3.3v supply. I know the gpio is 3.3v for the rpi, and I assume also true for the Arduino, and your ROM is also rated as max 3.6v.

EDIT1: also note well that in byte mode you need to send the lsb of the address (let's call it addr0) to the Q15 pin. The A0 pin receives addr1, the A1 pin receives addr2, and so on.

EDIT2: looks like the rpi3 has up to 27 external gpio, so that gives you 19 address lines of the required 24, after taking 8 for the data lines. If you manually paged the ROM that means you would need to capture 32 pages separately. Doable, but a little tedious. You'd only need a single 8 bit shift register or counter to map through the extra 5 bits.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Fri Dec 23, 2022 5:14 pm
Thanks for the detailed info!

The ParallelFLASHDumper project from cyphunk seems a good start.

I'll buy a shift register, to be able to read the whole flash at once.
I guess I'll make some experiments with RPi3's GPIO while I wait until my TSOP56 adapter arrives.
  View user's profile Send private message
  • Joined: 06 Mar 2022
  • Posts: 596
  • Location: London, UK
Reply with quote
Post Posted: Fri Dec 23, 2022 6:12 pm
noza10b1 wrote
The ParallelFLASHDumper project from cyphunk seems a good start.

Ah yeah, that does look like a good one!
(link to project since I guess you still can't -- just keep posting!! ;)

noza10b1 wrote
I'll buy a shift register, to be able to read the whole flash at once.

If you do this project completely by the book, I think you'll need 4x 8-bit registers in total, 3x serial-to-parallel for the address lines and 1x parallel-to-serial for the data lines; or if you adapt it to make use of more direct gpio, I think you can maybe cut it down to the 1x parallel-to-serial as I suggested.

Depending on your geography, you should find that both parts are very inexpensive (< 1 USD each) so it might be worth buying a small batch of both types of shift register to be on the safe side.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Thu Jan 05, 2023 2:56 am
After some pain, I was able to dump the flash contents with a RPi3.

As suggested by willbritton, I've used 3 shift registers (74HC595) for the 24-bit address bus (A-1 to A22), controlled by 2 GPIOs (data and clock/strobe). 8 GPIOs were used to read the data in byte mode and 2 GPIOs to control OE# and WE# (to be able to implement the "automatic select" command and read the manufacturer and device ids, to make sure the chip was working fine).

I've modified the ParallelFLASHDumper quite a bit, mostly by adding tests, changing pin assignments and refactoring code. I'll try to publish the modified version later.

So, now I'm not sure what's the best way to share this dump. Is it ok to just zip and post it here as an attachment?

About the contents, I've played a little with it and found some interesting things:
- It seems the initial memory is where the game selector/launcher resides. It's possible to run it with an emulator, but graphics are glitched and it resets when trying to launch any game.
- I was able to identify and extract 2 roms from the dump (I've only tried these 2 for now): Sonic and Alex Kidd in Miracle World. They are almost the same as other roms, but a few bytes are different (about 10 or so). Trying them on an emulator, I get only a black screen with Sonic and Alex Kidd hangs on the title screen. I tried to extract the bytes from Sonic again, directly from the flash, with a slower clock, but got the same content. Could this be some kind of copy protection?
rpi3_flash_dumper.jpg (813.08 KB)
rpi3_flash_dumper.jpg

  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Thu Jan 05, 2023 7:33 am
I suspect it’s some divergence in the emulated system that needs to be handled in software. You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing.
  View user's profile Send private message Visit poster's website
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Thu Jan 05, 2023 8:06 am
noza10b1 wrote
They are almost the same as other roms, but a few bytes are different (about 10 or so).


can you share the diff so that we could figure out what is that for? :)

also, AFAIK, this is not emulation (in the software sense) but it's a RE-based ASIC.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Thu Jan 05, 2023 5:58 pm
Quote
You can either post the dump publicly or we could share it between emulator authors until it’s better supported, we have a private forum for that kind of thing.


Ok, I have attached the dump file.

[Admin: attachment is now the full 16MB file]
mse.zip (7.16 MB)

  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Thu Jan 05, 2023 6:04 pm
Quote
can you share the diff so that we could figure out what is that for? :)


Sure. The first file is the one extracted from flash.

Sonic:
diff sonic_pi.txt sonic.txt
3,4c3,4
< 00000020  c3 ed 02 00 00 00 00 00  c3 fe 02 f5 3e 85 32 fe  |............>.2.|
< 00000030  3f c3 00 05 00 00 00 00  c3 2b 00 44 65 76 65 6c  |?........+.Devel|
---
> 00000020  c3 ed 02 00 00 00 00 00  c3 fe 02 00 00 00 00 00  |................|
> 00000030  00 00 00 00 00 00 00 00  c3 73 00 44 65 76 65 6c  |.........s.Devel|
2045c2045
< 00007ff0  54 4d 52 20 53 45 47 41  59 59 c2 a8 76 70 00 40  |TMR SEGAYY..vp.@|
---
> 00007ff0  54 4d 52 20 53 45 47 41  59 59 1b a5 76 70 00 40  |TMR SEGAYY..vp.@|


Alex Kidd:
diff alex_pi.txt alex_kidd_in_miracle_world.txt
10c10
< 00000090  11 01 c0 01 ef 1f 75 ed  b0 cd 41 03 cd 50 03 3e  |......u...A..P.>|
---
> 00000090  11 01 c0 01 ff 1f 75 ed  b0 cd 41 03 cd 50 03 3e  |......u...A..P.>|
13c13
< 000000c0  f5 3e 85 32 fe 3f c3 38  05 e5 dd e5 fd e5 db bf  |.>.2.?.8........|
---
> 000000c0  f5 c5 d5 e5 d9 08 f5 c5  d5 e5 dd e5 fd e5 db bf  |................|
  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Fri Jan 06, 2023 3:07 am
I'm trying to map the contents of the dump. Here is what I got so far.

01c000 - 05bfff - Sonic (differ)
164000 - 183fff - Alex Kidd in Miracle World (differ)
1c4000 - 1e3fff - Action Fighter (identical)
200000 - 23ffff - Aerial Assault (identical)
240000 - 27ffff - Alex Kidd - The Lost Stars (identical)
280000 - 2bffff - Alex Kidd in Shinobi World (identical)
2c0000 - 2dffff - Alex Kidd - High-Tech World (identical)
2e0000 - 31ffff - Alien Syndrome (differ but works)
800000 - 81ffff - Astro Warrior and Pit Pot (differ but works)
fbc000 - ffbfff - Altered Beast (identical)


The "works" is in the description means I can get in-game an play a bit without noticing any errors. It's nice to see that some games have no changes at all.

Astro Warrior and Pit Pot diff:
1034c1034
< 00004130  dd e5 fd e5 db bf db dd  e6 10 21 f8 df 4e 77 a9  |..........!..Nw.|
---
> 00004130  dd e5 fd e5 db bf db c1  e6 10 21 f8 df 4e 77 a9  |..........!..Nw.|
1062c1062
< 000042f0  db dc c3 01 43 db dc e6  c0 47 db dd e6 3f 80 07  |....C....G...?..|
---
> 000042f0  db c0 c3 01 43 db c0 e6  c0 47 db c1 e6 3f 80 07  |....C....G...?..|


Alien Syndrome diff:
678,679c678,679
< 00002a60  c0 32 72 c4 32 0a c0 32  1b c0 3e 12 f7 3e f5 00  |.2r.2..2..>..>..|
< 00002a70  00 db dd e6 c0 fe c0 20  13 3e 55 00 00 db dd e6  |....... .>U.....|
---
> 00002a60  c0 32 72 c4 32 0a c0 32  1b c0 3e 12 f7 3e f5 d3  |.2r.2..2..>..>..|
> 00002a70  3f db dd e6 c0 fe c0 20  13 3e 55 d3 3f db dd e6  |?...... .>U.?...|
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Fri Jan 06, 2023 2:28 pm
Looking at the Sonic ROM, it injects this to the interrupt handler:

jp $002B


It normally says "jp $0073". At $2b we have some injected code in normally-unused space:

      push af
      ld a, $85
      ld ($3FFE), a
      jp $500


This write to $3ffe is presumably a signal to the special mapper for this ROM. I assume this is paging some new code such that $500 is some special handler for this game. There is no other modification to the Sonic ROM.

In the first part of the ROM we have the selection menu, which seems to run in a hybrid SMS mode with a GG palette (?). At offset $500 in there we have:

      di
      call $55A
      ld ($3FFE), a
      jp $75


This is returning to just after the original VBlank handler's "push af". So it's injecting this $55a routine into the interrupt handler; it looks like it does this for several games, there's a bunch of similar "detour handlers" next to it.

At $55a we have:

      in a, ($cd)
      or a
      jr z, +++
      push hl
      in a, (Port_IOPort1)
      cp $FF
      jr nz, +
      in a, (Port_IOPort2)
      or $F0
      cp $FF
      jr nz, +
      ld hl, _RAM_FFF8_
      inc (hl)
      jr nz, ++
      inc hl
      inc (hl)
      jr nz, ++
+:   
      jp 0
   
++:   
      pop hl
+++:   
      ld a, $87
      ret


This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Fri Jan 06, 2023 2:37 pm
I/O ports Emulicious sees as used in its disassembly:

.define _PORT_61_ $61   
.define _PORT_62_ $62   
.define _PORT_63_ $63   
.define _PORT_7E_ $7E   
.define _PORT_88_ $88   
.define _PORT_8C_ $8C   
.define _PORT_8D_ $8D   
.define _PORT_8E_ $8E   
.define _PORT_8F_ $8F   
.define _PORT_A0_ $A0   
.define _PORT_C8_ $C8   
.define _PORT_CA_ $CA   
.define _PORT_CB_ $CB   
.define _PORT_CD_ $CD   
.define _PORT_CE_ $CE   
.define _PORT_DC_ $DC   

Seems like a lot...

The boot menu looks a lot like it was written in C, it is calling functions by passing parameters on the stack.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Fri Jan 06, 2023 4:20 pm
From https://bojoga.com.br/artigos/dossie-retro/os-modelos-renovados-do-master-system... :
Quote
totally emulating the console, thanks to the chip developed by the well-known retro console company AtGames. This unique chip, also known as SOAC (System On A Chip) called Noza (in honor of the enemies of the game Zillion) manages to emulate games from the Master System and Game Gear.

This claims the chip was designed by AtGames - famous for their bad Mega Drive efforts - and named after the enemies in Zillion, which is interesting.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sat Jan 07, 2023 3:43 am
Updated dump map:

01c000 - 05bfff - Sonic (diff, black screen)
164000 - 183fff - Alex Kidd in Miracle World (diff, hang on title)
1c4000 - 1e3fff - Action Fighter (equal)
200000 - 23ffff - Aerial Assault (equal)
240000 - 27ffff - Alex Kidd - The Lost Stars (equal)
280000 - 2bffff - Alex Kidd in Shinobi World (equal)
2c0000 - 2dffff - Alex Kidd - High-Tech World (equal)
2e0000 - 31ffff - Alien Syndrome (diff, ok)
800000 - 81ffff - Astro Warrior and Pit Pot (diff, ok)
bac000 - bcbfff - Sudoku (diff, ok)
bcc000 - beffff - Creature Capture (diff, ok)
bf0000 - bfffff - Nim (orig, ok)
c00000 - ceffff - Pense Bem (orig, some glitches, must dump until cfffff to work on gearsystem)
cf0000 - cf7fff - Master Pong (orig, ok)
cf8000 - d07fff - Dr. Limpeza (orig, runs with glitches)
d08000 - d13fff - Mina Terrestre (diff, runs with glitches)
d14000 - d23fff - Os Doze Trabalhos de Jongo (diff, runs with glitches)
d24000 - d43fff - Tangram (diff, ok)
d44000 - d53fff - Aquaduto (orig, ok)
d54000 - d63fff - Bombeiros (diff, ok)
d64000 - d73fff - Outsiders (orig, ok)
d74000 - d87fff - Bolhas (diff, ok)
d88000 - d9ffff - Master Pinball (orig, ok)
da0000 - dabfff - Dominó (diff, ok)
dac000 - dbbfff - Serpentes (orig, ok)
dbc000 - dcbfff - Memória Master (diff, runs with glitches)
dcc000 - ddffff - Bolas e Cores (diff, ok)
de0000 - deffff - Acerte o Alvo (diff, ok)
df0000 - dfffff - Aventuras na Floresta (orig, ok)
e00000 - e0ffff - Domine o Território (orig, glitches)
e10000 - e1ffff - Arqueiro (orig, ok)
e20000 - e2bfff - Ataque dos Vermes (orig, ok)
e2c000 - e3bfff - Batalha Animal (orig, ok)
e3c000 - e47fff - Batalha no Mar (orig, ok)
e48000 - e53fff - Tanques (orig, ok)
e54000 - e63fff - Cava Cava (diff, ok)
e64000 - e87fff - Fábrica de Chocolate (diff, ok)
e88000 - e97fff - Hexágonos (orig, ok)
e98000 - ea3fff - Hockey de Mesa (orig, ok)
ea4000 - ec3fff - Icepost Rescue (orig, ok)
edc000 - ee7fff - Junte 4 (orig, ok)
ee8000 - ef7fff - Minerador (diff, ok)
ef8000 - f0bfff - Palhaços (diff, ok)
f0c000 - f17fff - Resta Um (orig, ok)
f18000 - f2bfff - Senha (diff, ok)
f2c000 - f3bfff - Snowball (orig, ok)
fbc000 - ffbfff - Altered Beast (equal)


I guess all Tectoy Digital and Overplay games are listed now.
I've used Gearsystem to test them.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Sat Jan 07, 2023 10:04 am
On the real system, does a button trigger a return to the game selection menu from Sonic? What happens if you hold a controller button at the same time as pressing it?
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sat Jan 07, 2023 1:50 pm
The real system has a 6-button controller. If you hold the top 3 at the same time it goes back to the menu.
But this is supposed to work on any game.
  View user's profile Send private message
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Sun Jan 08, 2023 2:40 pm
Maxim wrote

At $55a we have:

      in a, ($cd)
      or a
      jr z, +++
      push hl
      in a, (Port_IOPort1)
      cp $FF
      jr nz, +
      in a, (Port_IOPort2)
      or $F0
      cp $FF
      jr nz, +
      ld hl, _RAM_FFF8_
      inc (hl)
      jr nz, ++
      inc hl
      inc (hl)
      jr nz, ++
+:   
      jp 0
   
++:   
      pop hl
+++:   
      ld a, $87
      ret


This seems to be some sort of "return to menu" hook. Port $cd is non-standard, I guess it reads as 0 normally and lets the game continue; if non-zero, and any button is held, it seems to mess with addresses $fff8..9; $fff8 is the usual "3D glasses" register, but the purpose of this seems obscure.


I guess this is the code that checks if the 'reboot' keys are pressed. If so, it forces the mapper to map the menu ROM again and finally it jumps to zero. Why it increments the contents that way it's everyone's guess - we should probably disassemble the menu ROM to understand how this mapper works.
  View user's profile Send private message Visit poster's website
Reply to topic Goto page 1, 2  Next



Back to the top of this page

Back to SMS Power!