Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Pirated Master System Cartridges (pre-1993).

Reply to topic
Author Message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Pirated Master System Cartridges (pre-1993).
Post Posted: Tue Oct 22, 2024 4:19 am
A few have appeared in Brazil (although some say they never existed).

I recently had to shell out a lot of money to get some.

All the boards I've seen from this era are the same (I don't know if there are different ones).

They consist of:

1x Memory (Eprom or OTP)

2x 74LS670

1x 18CV8PC

Does anyone have any idea what this PAL circuit contains?

I believe someone here must know the logic that is missing to complement the two 74LS670s.

I made a video demonstrating the cartridges.

In this video I also show another board I have (this one doesn't work anymore). It had 15 or 16 32k games + a game selection menu. I've never seen another board like this. If anyone has the DUMP of this pack, I'd be grateful.

On the Master System boards, I dumped the contents of the Mortal Kombat eprom, and analyzing it with the hash analyzer, it showed me that the ROM is exactly the same as the one available on the internet.

I also tried to copy the board (I leave the gerber here), but I haven't tested it to see if it's working.

Demonstration video:
https://www.youtube.com/watch?v=8Yi62tzwLoc
carts.jpg (509.44 KB)
carts.jpg
boardf.jpg (308.75 KB)
boardf.jpg
boardb.jpg (347.04 KB)
boardb.jpg

  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 150
Reply with quote
Post Posted: Thu Oct 24, 2024 11:57 pm
How did you make the gerbers? Without making a schematic?

In any case, the two 74'670s are almost certainly implementing the three banks at $0000, $4000, $8000, and the PAL enabling ROM at the relevant time, and signalling when to update the contents of those two, and when to enable which output.

Only one 74'670 would only be enough to address 256KiB of game; they needed the second to use the 512KiB UVEPROM that's here - although they probably could have held it in the PAL instead...
  View user's profile Send private message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Fri Oct 25, 2024 3:09 pm
lidnariq wrote
How did you make the gerbers? Without making a schematic?

In any case, the two 74'670s are almost certainly implementing the three banks at $0000, $4000, $8000, and the PAL enabling ROM at the relevant time, and signalling when to update the contents of those two, and when to enable which output.

Only one 74'670 would only be enough to address 256KiB of game; they needed the second to use the 512KiB UVEPROM that's here - although they probably could have held it in the PAL instead...

Thank you very much for this information.

I made the gergber just by visualizing and manually drawing the game board. With DipTrace, in the PCB Layout function.
  View user's profile Send private message
  • Joined: 29 Jun 1999
  • Posts: 393
  • Location: Brazil
Reply with quote
Post Posted: Sat Oct 26, 2024 12:37 am
I remember renting that MK cartridge back in the day. Pirated games were hard to find but they were out there.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8745
  • Location: Paris, France
Reply with quote
Post Posted: Sun Oct 27, 2024 3:11 pm
For the records, I have those:

Basketball Nightmare
Olympic Games
Lucky Dime Caper
Mortal Kombat
Sonic The Hedgehog 2 [rom v0]
Streets of Rage [2] (SoR2 label, rom is SoR1)
Taz-Mania
  View user's profile Send private message Visit poster's website
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Tue Oct 29, 2024 7:39 pm
Last edited by clopes on Wed Oct 30, 2024 3:32 pm; edited 1 time in total
PrOfUnD Darkness wrote
I remember renting that MK cartridge back in the day. Pirated games were hard to find but they were out there.

I got another photo, (but from another forum):

Bock wrote
For the records, I have those:

Basketball Nightmare
Olympic Games
Lucky Dime Caper
Mortal Kombat
Sonic The Hedgehog 2 [rom v0]
Streets of Rage [2] (SoR2 label, rom is SoR1)
Taz-Mania


Thank you for this information, it's always good to know about other existing cartridges.

Regarding the 16 game cartridge (from SMD to MD) that I show in the video, a user from another forum informed me that it is the one in the attached image. I tried to buy one to dump, but the prices are very expensive and as it comes from another country it is even more expensive.
4in1 master.jpg (235.4 KB)
4in1 master.jpg
md 16 in 1.jpg (173.96 KB)
md 16 in 1.jpg

  View user's profile Send private message
  • Joined: 29 Jun 1999
  • Posts: 393
  • Location: Brazil
Reply with quote
Post Posted: Tue Oct 29, 2024 10:28 pm
Some extra pictures attached.


clopes, prazer em conhecê-lo.
79075f4033a038db567c8b7518e305e3.jpg (136.62 KB)
Sonic and Taz Mania
79075f4033a038db567c8b7518e305e3.jpg

  View user's profile Send private message Visit poster's website
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Wed Oct 30, 2024 3:29 pm
PrOfUnD Darkness wrote
Some extra pictures attached.


clopes, prazer em conhecê-lo.


Very thanks for the extra pictures.

PrOfUnD Darkness, o prazer foi meu.
  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 150
Reply with quote
Post Posted: Thu Oct 31, 2024 11:15 am
The pinouts of the non-ROM are:

18CV8
 -670we | 01  20 | 5V
Z80 a10 | 02  19 | ROM A16
Z80 a11 | 03  18 | ROM A15
 -reset | 04  17 | ROM A18
Z80 a12 | 05  16 | ROM A17
Z80 a14 | 06  15 | ROM A14
Z80 -wr | 07  14 | -romce
Z80 a13 | 08  13 | -670oe
Z80 a15 | 09  12 | -670we (also self pin 1)
    gnd | 10  11 | -ce3


74'670 #1
     d2 | 1 16 | 5v
     d1 | 2 15 | d3
     d0 | 3 14 | a0
     -- | 4 13 | a1
Z80 a15 | 5 12 | -670we
ROM A14 | 6 11 | -670oe
ROM A15 | 7 10 | ROM A17
    gnd | 8  9 | ROM A16

74'670 #2

     5v | 1 16 | 5v
     5v | 2 15 | d4
     5v | 3 14 | a0
     5v | 4 13 | a1
Z80 a15 | 5 12 | -670we
     -- | 6 11 | -670oe
     -- | 7 10 | ROM A18
    gnd | 8  9 | --


Given that the 74'670s do not have a connection to Z80 A14, they must have not implemented the bank at $0400-$3FFF.

From the wiring, the CUPL must be something like:

Pin 19 = ROMA16;
Pin 18 = ROMA15;
Pin 17 = ROMA18;
Pin 16 = ROMA17;
Pin 15 = ROMA14;
Pin 14 = !ROMCE;
Pin 13 = !OE670;
Pin 12 = !WE670;
Pin 11 = !CE3;
Pin 9 = Z80A15;
Pin 8 = Z80A13;
Pin 7 = !WR;
Pin 6 = Z80A14;
Pin 5 = Z80A12;
Pin 4 = !Reset;
Pin 3 = Z80A11;
Pin 2 = Z80A10;
Pin 1 = CLOCK;

/* Drive ROMA14..A18 when A14=A15=0 */
[ROMA14..18] = 0;
[ROMA14..18].OE = !Z80A14 & !Z80A15;

/* Tell 74'670s to drive ROMA14..A18 when A14!=0 or A15!=0 */
OE670 = Z80A14 # Z80A15;
/* Tell 74'670s to latch data bus in writes to the top 1KiB of address */
WE670 = Z80A15 & Z80A14 & Z80A13 & Z80A12 & Z80A11 & Z80A10 & WR & CE3;
/* Enable ROM in bottom 48K of address space */
ROMCE = !Z80A14 # !Z80A15;

But I really don't know why it has a connection to -reset, or feeds back 18CV8 pin 12 to pin 1. I don't see any obvious need for latching behavior here.

If you desoldered the PEEL, you could probably dump it by pretending it's a ROM.
  View user's profile Send private message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Thu Oct 31, 2024 5:27 pm
lidnariq wrote
The pinouts of the non-ROM are:

18CV8
 -670we | 01  20 | 5V
Z80 a10 | 02  19 | ROM A16
Z80 a11 | 03  18 | ROM A15
 -reset | 04  17 | ROM A18
Z80 a12 | 05  16 | ROM A17
Z80 a14 | 06  15 | ROM A14
Z80 -wr | 07  14 | -romce
Z80 a13 | 08  13 | -670oe
Z80 a15 | 09  12 | -670we (also self pin 1)
    gnd | 10  11 | -ce3


74'670 #1
     d2 | 1 16 | 5v
     d1 | 2 15 | d3
     d0 | 3 14 | a0
     -- | 4 13 | a1
Z80 a15 | 5 12 | -670we
ROM A14 | 6 11 | -670oe
ROM A15 | 7 10 | ROM A17
    gnd | 8  9 | ROM A16

74'670 #2

     5v | 1 16 | 5v
     5v | 2 15 | d4
     5v | 3 14 | a0
     5v | 4 13 | a1
Z80 a15 | 5 12 | -670we
     -- | 6 11 | -670oe
     -- | 7 10 | ROM A18
    gnd | 8  9 | --


Given that the 74'670s do not have a connection to Z80 A14, they must have not implemented the bank at $0400-$3FFF.

From the wiring, the CUPL must be something like:

Pin 19 = ROMA16;
Pin 18 = ROMA15;
Pin 17 = ROMA18;
Pin 16 = ROMA17;
Pin 15 = ROMA14;
Pin 14 = !ROMCE;
Pin 13 = !OE670;
Pin 12 = !WE670;
Pin 11 = !CE3;
Pin 9 = Z80A15;
Pin 8 = Z80A13;
Pin 7 = !WR;
Pin 6 = Z80A14;
Pin 5 = Z80A12;
Pin 4 = !Reset;
Pin 3 = Z80A11;
Pin 2 = Z80A10;
Pin 1 = CLOCK;

/* Drive ROMA14..A18 when A14=A15=0 */
[ROMA14..18] = 0;
[ROMA14..18].OE = !Z80A14 & !Z80A15;

/* Tell 74'670s to drive ROMA14..A18 when A14!=0 or A15!=0 */
OE670 = Z80A14 # Z80A15;
/* Tell 74'670s to latch data bus in writes to the top 1KiB of address */
WE670 = Z80A15 & Z80A14 & Z80A13 & Z80A12 & Z80A11 & Z80A10 & WR & CE3;
/* Enable ROM in bottom 48K of address space */
ROMCE = !Z80A14 # !Z80A15;

But I really don't know why it has a connection to -reset, or feeds back 18CV8 pin 12 to pin 1. I don't see any obvious need for latching behavior here.

If you desoldered the PEEL, you could probably dump it by pretending it's a ROM.


Thanks for the pins.

I desoldered the 18CV8pc.
But my eprom readers don't support this model.
Maybe it also has a read lock fuse?

With these pins that you provided, I could build a brute force reader to make all the attempts, and see what we get at the output.
But I still need to study to do that.
Maybe an Arduino Nano will do the trick?
But my question would be regarding the 18CV8pc having implemented a flipflop inside?
That would make things a little more difficult. From what I saw (quickly), these 74LS670 would be memories, so I think they could be used as flipflop locks?
Maybe you don't need the flipflops inside the 18CV8pc?

If the 18CV8pc is really acting as a device with just simple inputs and outputs, I could easily assemble a file and replicate it to a common eprom.
This would be interesting.
  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 150
Reply with quote
Post Posted: Fri Nov 01, 2024 4:10 am
clopes wrote
I desoldered the 18CV8pc.
But my eprom readers don't support this model.
Maybe it also has a read lock fuse?
It almost certainly does; I think almost all the parts in this family had one. Even on parts where it didn't really make sense

Quote
But my question would be regarding the 18CV8pc having implemented a flipflop inside?
It could, but my hunch is that it hasn't.
Quote
Maybe you don't need the flipflops inside the 18CV8pc?
One thing is certainly true: the 18CV8 only has 8 registers inside, and only 8 outputs. It is technically possible for the state to be hidden ("buried"), specifically if the macrocell is configured to "register feedback" and "combinatorial output", but my intuition is that it doesn't.

(Why? Because there's no obvious source of data to load state into the PEEL.. No connection to data bus or even the lower address lines. Just Z80 A10-A15)

Quote
If the 18CV8pc is really acting as a device with just simple inputs and outputs, I could easily assemble a file and replicate it to a common eprom.
ROMs are much slower - the fastest you'll find are 45-55ns, usually 70ns, while the PEEL here are 25ns grade.

But that's the right way to think about it - pretend the PEEL is a mask ROM, and connect pins 1-9,11 to fake ROM A0-A9, and pins 12-19 to fake ROM D0-D7.

If your objective is to make a repro, I'd suggest reaching for a modern equivalent like a 22V10 or 16V8, and replacing the (now extremely expensive) 74'670s with something like a 74'363/364/373/374/573/574.
  View user's profile Send private message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Fri Nov 01, 2024 3:22 pm
Thank you very much for all this information.

My main objective would be to preserve this part of history, and perhaps if a cartridge like these is burned, try to fix it in the collection.

As for the speed of memories. Would the overall working speed of the "Master system" require all the speed that PEEL provides?

I know a guy who made an Atari mapper coded inside eproms and flashes (he reports that, in the Atari case, he had problems with 150ns, but got it working with a 90ns/100ns flash/eprom. I'm not sure which the speed that the Master System requires.

In any case, to check if the logic is correct, and I have access to the EPM7032, I think they will do the job.

lidnariq wrote

Given that the 74'670s do not have a connection to Z80 A14, they must have not implemented the bank at $0400-$3FFF.

Can you recommend a game that I could test to prove this?

I will try to read the PEEL as soon as possible.
  View user's profile Send private message
  • Joined: 05 Sep 2013
  • Posts: 4029
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Fri Nov 01, 2024 5:10 pm
AFAIK some SMSs have 200ns RAM chips and they work fine
  View user's profile Send private message Visit poster's website
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Fri Nov 01, 2024 7:59 pm
sverx wrote
AFAIK some SMSs have 200ns RAM chips and they work fine

thanks for the information. So a flash should work fine
  View user's profile Send private message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Sun Nov 24, 2024 12:29 am
lidnariq wrote
But that's the right way to think about it - pretend the PEEL is a mask ROM, and connect pins 1-9,11 to fake ROM A0-A9, and pins 12-19 to fake ROM D0-D7.


I tried using this pinout but was unsuccessful (replicating the file in an A290021T-70 memory). I also used other memories, and I took care to replicate the content to the extra empty memory space. I also used the technique of grounding the extra addresses of the memories in use without success with the file read by the TOP3000 eprom reader. However, with this suggested pinout I had many inconsistencies in the PEEL readings.
I did a lot of reading and the files always came out different. The consistency of the files obtained improved a lot after I added PULLUPS or PULLDOWNS to the lines suggested as outputs.

After that, I studied the board and components and came up with another pinout (shown in the attached image). It seemed very coherent to me with just 3 lines of data output. That's what I thought following what was input and output on the bus and LS670 pins. I would like someone to take a look to confirm this.
With this pinout I assume that some I/O are defined as inputs. However, even so, the board did not work with a 70ns memory (the fastest I had on hand), instead of the PLD.
*With this new pin scheme, all readings matched perfectly (pullups, pulldowns and nothing).
Perhaps reading the output file can confirm whether the logic should be accepted in the scheme of this board.

Attached I include better quality photos of the front and back of the PCB without components, pinouts that I used, and output file (with the pinout provided)

Another thing I tested was the use of RESET. I raised the circuit pin and the board seems to have worked perfectly without using RESET.
BACK MST-101 - AFS.jpg (519.98 KB)
BACK MST-101 - AFS.jpg

  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 150
Reply with quote
Post Posted: Sun Nov 24, 2024 10:05 am
I'd actually expect some nonsense before you revised the wiring - I expect the five pins to the 74'670s that you've rewired as address lines to be left floating most of the time.

The dump confirms this; it shows the same contents repeated 16 times, in other words no address lines above A10 are used.

when A10 (-ce3 from card edge) is high, the three outputs are high.

when A3 (Z80 A14) is low, D0 (-romce) is low. When A0 (Z80 A15) is low, D0 (-romce) is low. Other inputs are ignored.

D2 (-670we) is only low if (0xdb or 0xfb), or: A7,A6,A4,A3,A1,A0 high, A2 low, meaning all six of Z80 A10 through A15 high and /WR low - all makes sense.

What I don't find plausible is that it shows that D1 (-670er) is always high. That signal should be low when at least one of A3 (Z80 A14) or A0 (Z80 A15) are high. Maybe pin 1 is involved...

If you have the noisy dump from before rewiring that would help too.

I don't know that the thing you're dumping the ROM with goes in order of increasing address, but you could also try swapping pins 9 and 1 (so that "ROM" A0 goes to PEEL "CLOCK")

Quote
Can you recommend a game that I could test to prove this?
sorry, I didn't notice this. There's only one game that uses slot0 - Space Gun.
  View user's profile Send private message
  • Joined: 19 Feb 2018
  • Posts: 37
  • Location: Brazil
Reply with quote
Post Posted: Mon Nov 25, 2024 4:44 pm
lidnariq wrote
Maybe pin 1 is involved...

If you have the noisy dump from before rewiring that would help too.

I don't know that the thing you're dumping the ROM with goes in order of increasing address, but you could also try swapping pins 9 and 1 (so that "ROM" A0 goes to PEEL "CLOCK")

Quote
Can you recommend a game that I could test to prove this?
sorry, I didn't notice this. There's only one game that uses slot0 - Space Gun.


As for the noisy files, I'll need to solder them again and read them again.

As for the new 5 input pins, I thought they were like this, because if I'm not mistaken they are directly connected to the LS670 output pins.

I need to test if my eprom reader device does inverted reading.

I'm going to test the game mentioned.

As for the PEEL clock pin 1, on the board it is physically connected as shown in the attached image.

Thanks for the tips. I'll study them.
EWIN-EWOUT.jpg (79.16 KB)
EWIN-EWOUT.jpg

  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 150
Reply with quote
Post Posted: Wed Nov 27, 2024 6:56 pm
clopes wrote
As for the new 5 input pins, I thought they were like this, because if I'm not mistaken they are directly connected to the LS670 output pins.
No, it should be relying on using the ability for the LS670 to stop driving its outputs. Reading banks $4000 and $8000 from the LS670s, but driving all 0s from the PEEL (probably???) on those same pins during bank $0000.
  View user's profile Send private message
Reply to topic



Back to the top of this page

Back to SMS Power!