Forums

Someone contacted me about why, back in 199x, he had to have his Game Gear "repaired" by the shop when a pirate cart didn't work. I immediately suspected it was an issue with the "PRODUCED BY OR UNDER LICENCE FROM..." screen checking for "TMR SEGA" in the ROM, and this was confirmed as the bumper screen had indeed disappeared at the time. but I was interested to see how the "repair" had achieved this.

As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you.

gamegear2.JPG (125.79 KB)

GG 1-ASIC with J1 bridged

Quote

As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you.

It works! When J1 is shorted, the BIOS ROM doesn't load. I plugged Space Harrier in and it booted directly.

Since the GG was open and the soldering iron was on, I found J2/J3 select the territory. With the silkscreen text oriented towards you, the jumpers look like this:

A B
C D
^
| J2
| J3

A,B are +5V, D is ground, C is the territory mode input. Normally A-C are bridged so this signal is high and "Overseas mode" is selected. Bridge C-D so the signal is low and that enabled "Japan (Domestic mode)".

It seems leaving C unconnected defaults to overseas mode but you should probably tie it high/low to be sure.

Was hoping to find a PAL/NTSC jumper, but it seems to not be present.

EDIT: My GG doesn't have J2/J3 in the same position as the one in Maxim's post. The pads are all of an equal size and equally spaced away from each other with the silkscreen text and arrow next to them. Be careful! ;)

Some BIOS-less GG Z80 tests:
After a warm reset (Z80 /RST asserted) the registers are set up like so:

SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All retain former values
I = $00, R = $00

After a cold reset (power switched on) the registers are set up like so:

SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All zero
I = $00, R = $00

After loading all registers with $FF, during the time that power is switched off and then back on each set bit gradually resets to zero. This is why the cold boot state is zero for most all registers but the ones that have fixed values due to Z80 /RST being pulsed.

It only takes a few seconds for all of them to change to zero. If you turn the GG back on before then, the values will be random as random 1 bits have turned to 0 and others are still preserved.

Was there any difference for OUT (C),0 (opcode ED71) as well?
Did it output $FF instead of $00 on the GG?

FluBBa wrote

Was there any difference for OUT (C),0 (opcode ED71) as well?
Did it output $FF instead of $00 on the GG?

Yes, my GG always does 'out (c), $FF' instead of 'out (c), $00'.

I've attached the register dumping and 'out-test' programs.

For the register dumping program, it will capture and print the register values and then load all registers with a value before HALTing. Hold start to load registers with $0000, don't hold start to load registers with $FFFF. You'd use it like this:

1st time:
- Turn on GG, turn off GG. Registers now loaded with $FFFF.
- Don't wait
- Turn on GG, values displayed are what was retained during power-cycling.

2nd time:
- Turn on GG, turn off GG. Registers now loaded with $FFFF.
- Wait 10 seconds or longer
- Turn on GG, values displayed are what was retained during power-cycling.

For the quick cycle, all values should be retained. For the long wait all values should be zero apart from the few I've described. Then again:

1st time:
- Hold START and turn on GG, turn off GG. Registers now loaded with $0000.
- Don't wait
- Turn on GG, values displayed are what was retained during power-cycling.

2nd time:
- Hold START and turn on GG, turn off GG. Registers now loaded with $0000.
- Wait 10 seconds or longer
- Turn on GG, values displayed are what was retained during power-cycling.

In both cases all registers will be zero apart from the few special cases.

For the out-test program, it writes $A5 to 12 bytes, then overwrites them with 'out (c), 0' after loading all the registers with $0000 (on the assumption some internal bus is used as the data source, but it apparently isn't). The values printed should all be $FF.

If you or anyone else would like to test these programs and share the results, I'd appreciate it.

I've done some SMS VDP 2 timing tests, and found I could get H counter values for various video 'events' by connecting the VDP /N-L (HL trigger input) pin to other signals, like /CSYNC, /Y1 (pixel transparency indicator) and /BURST (color burst insertion strobe) as well as /NMI and /INT to find out exactly what the H counter value is when they trigger. I'll try to get my experiments done this week and write about it.

EDIT: Fixed the program to save A,F properly.

gg-out.zip (2.21 KB)

Game Gear "out (c), 0" test program

gg-reg2.zip (2.55 KB)

Z80 register test program (fixed)

I don't have a GG so I can't test any specifics for that one, I only have a SMS1 and hopefully soon a MegaDrive so I can use my PowerBase converter.

Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation?
Do you have results from a SMS without a bios as well?

FluBBa wrote

Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation?
Do you have results from a SMS without a bios as well?

Oops, I just realized saving I and R overwrites the value of A and F on startup. Sorry!

I wonder how I can save A and F without SP being set up. With the assumption that the registers default to zero, 'push af' will store the values at $FFFF and $FFFE. For a 32K ROM this won't cause any trouble.

But then the stack pointer is invalid for any tests where the power is quickly cycled and the resulting SP value is non-zero. I suppose a message could be displayed to warn the user if the SP startup value was not within a RAM area, then you'd know the values of A,F were invalid.

Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post."
I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear. I personally have two GameGears, one in good state and one in below average state. I wish I knew programming so that the "registers" discussed here would make sense to me. Can you guys help me somewhat?

linobollansee wrote

Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post."

Sorry, I don't have a camera to take a picture. In the photo of your Game Gear, notice there is no label for J3, though I assume it is the two larger solder pads to the right of J2.

On mine J3 is to the right of J2, but the solder pads are all the same size. In addition the two lower pads of J2 and J3 are shorted together, and there is no connection in the picture.

Quote

I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear.

I only have one. I experimented with J1 and later J2/J3 after reading Maxim's post, but I hadn't studied the picture closely. J1 is in the same position as yours on my Majesco GG, but J2/J3 are different as I've explained.

Maybe this topic should be split (is that possible?)...
I've fixed quite a few things on my SMS emulator now regarding GG emulation so now TMS9918 modes can change the palette.
Speaking of startup values, do you know how the palette is set up on startup?

Twisty.png (547 B)

Twisty on SMSAdvance

Can you get a friend to take a picture of your Majesco GG circuitry?
Perhaps my GameGear HAS no J2/J3 and the region cannot be modified.
I am not willing to risk tampering with the NON labelled J2/J3 it yet, unless I have some extra money. I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on? It could break the gamegear so maybe the best would be to use a very small, very flat style switch (moved with your fingernail) into the battery pack. Can you tell me how old you are Charles? Are you a programmer? How did you get so good? Do you have MSN Messenger so I can speak to you directly?

Quote

Can you get a friend to take a picture of your Majesco GG circuitry?

I don't have any plans to do that, but if I do take a picture at some point in the future I'll post it here.

Quote

I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on?

I don't think anything bad would happen, but just to be sure I wouldn't change the switch while the power was turned on. Putting it in the battery compartment so no accidents can occur is a good idea.

I added a register dump feature to my test program and the results from my PAL MegaDrive with a PowerBase Converter are:

SP: $DFFF
IR: $001D
AF: $FFA3
BC: $FFFF
DE: $FFFF
HL: $E001
IX: $FFFF
IY: $FFFF
AF': $FFFF
BC': $FFFF
DE': $FFFF
HL': $FFFF

The only unstable register is HL' which sometimes become $FDFF or $FFDF also.
Is there some "minibios" or hardware which sets the SP and/or HL?
Edit: added clarification of hardware.

There shouldn't be anything else than TMSS (if present), but it touches only 68K AFAIK, Z80 is left untouched... SEGA manual also states that there's no BIOS used in SMS mode.

I did use a PowerBase Converter with my MD, is there anything like that in it?
Do we have pictures of the inside here at SMSPower?
Should I take some?
Can someone run my test program on a bios-less SMS?
jpx072? Do you have the ability to do this or is it messy to change your bioses? Right now the program is 32kB but I can scale it down to 16kB if that is necessary.

FluBBa wrote

I did use a PowerBase Converter with my MD, is there anything like that in it?

Some Genesis/MegaDrive consoles have a built-in BIOS that does a check of the cartridge, much like the Majesco Game Gear for example. However, when booting from the Power Base Converter the BIOS is completely disabled, it only exists for the 68000 side anyway.

This is why executing a game from a Super Magic Drive copier causes the "Licenced by" screen to show up only after the game has started and the Z80-driven menu program is done, because at the point the /M3 pin goes high the 68000 is reset and the internal BIOS is enabled.

The Power Base Converter has no ROM for the Z80, all that's present is a CK2605 PLA chip for controlling cartridge and card slot selection. It doesn't have enough connections to the Z80 data bus to provide program code either.

So I think it's safe to say both the BIOS (when present) and PBC have no effect on the Z80 state when powering up.

Quote

Do we have pictures of the inside here at SMSPower? Should I take some?

I don't think we do, that might be a nice addition.

Charles did you ever find out the HCount values for VBL, HBL ints and NMI?

My GG has no BIOS screen (standard) and J1 here has a jumpering component installed. I can't find J2 or J3 anywhere. Anybody want to speculate on what happens if J1 is removed?

IMG055.jpg (36.47 KB)

J1 area - normal no BIOS 1 ASIC GG

DMEnduro wrote

Anybody want to speculate on what happens if J1 is removed?

Speculations:
1. You get the secret GG BIOS that's never been seen before
2. It tries to access a BIOS that isn't there and locks up (probably reading $ff = rst $38 and looping there forever)
3. The Game Gear explodes
4. The universe implodes
5. J1 isn't a BIOS toggle, it's the region selector on that model

If you give it a try, and it's not #4, let us know the results :)

I was hoping for #5, betting on #2, and surprisingly got #1.

I got the secret GG BIOS! Sorta.

It just looks like the normally described one.

PRODUCED BY OR
UNDER LICENSE FROM
SEGA ENTERPRISES LTD.

White text on blue background.

So... what does this mean?

Can you dump it?

No, I don't have that sort of equipment.
What's the likeliness of it being on the ASIC?
There's only two other ICs on the board:
(Hitachi) 65256BLFP-12T
Sony CXK5864CM-70LL

A little research tells me that we have a 32K RAM and an 8K RAM. Is that right?

The board is labeled IC BD GG MAIN USA VA1 837-9024 MADE IN JAPAN

There's a good chance it's in the ASIC. To dump it, you can use:
- an SRAM-based devcart (eg. SMSReader SRAM cart) with a program that copies the BIOS onto the cart space
- a devcart that supports backup RAM (eg. Tototek SMS-PRO, GG-PRO, hacked SMS game with SRAM), similar deal
- any devcart, so long as you're happy to copy 1KB from the screen

On GGs, the BIOS and cart are accessible simultaneously (the BIOS replaces the first 1KB of ROM space) so you don't even need to write a RAM-resident dumper, so it's pretty easy to code.

Quote

So... what does this mean?

It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS *disabled* which is unusual. But that nice picture you took clearly showed the original jumper configuration, so it seems legit.

You could argue that as they had the jumper there at all, it was intended to be used in some situations. I wonder why, though. A very cool find!

I'd like to get an SMS-PRO, but I'll have to organise a credit card first. I'm also going to look into building an SMSReader + cart.

Charles MacDonald wrote

It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS *disabled* which is unusual.

I'm interested in knowing how unusual/common this configuration is now.

SMS II with disabled bios (rerouted CE line from bios to cartridge connector) running VDPTEST.sms (running 3-times) :

Test: 1st - 2nd - 3rd

SP: $FFFF - FFFF - FFFF
IR: $0019 - 0019 - 0019
AF: $FFFF - FFFF - FFFF
BC: $BDBF - BDBF- BDBD
DE: $FFFF - FFED - FFFF
HL: $FFFF - FFFF - FFFF
IX: $BDFF - BDBF - BDFF
IY: $FFBD - FFBD - FFBD
AF': $FFFF- FFFF - FFBF
BC': $BFBD - BFBD - BDBF
DE': $FFFF - FFEF - FFFF
HL': $FFFF - BFBF - FFFD

(bios chip was not even present on the board)

Hope it helps :) cheers

Thanks a lot jpx072! =)
Can you write what kind of Z80 that is in your SMSII? or can that be seen on any of the photos you allready have put up here?
I'll open up my MD and write down the Z80 version there as well.

My SMSII Z80 - see photo ;)

Z80.JPG (12.98 KB)

Thanks again for the info it's really good for the documentation of the SMS.

FluBBa wrote

Charles did you ever find out the HCount values for VBL, HBL ints and NMI?

I can't remember, sorry. I will try to do this at some point - keep asking about it (send PMs or something) and nag me so I don't forget.

Charles MacDonald wrote

keep asking about it (send PMs or something) and nag me so I don't forget.

He he, well, I'll try :)
I guess you only really need to do the test for one of the interrupts as we know how they relate to each other now.

Author	Message
Maxim Site Admin Joined: 19 Oct 1999 Posts: 14740 Location: London	GG 1-ASIC bios skip mod - just bridge J1? Posted: Sun Jun 10, 2007 12:10 pm
	Someone contacted me about why, back in 199x, he had to have his Game Gear "repaired" by the shop when a pirate cart didn't work. I immediately suspected it was an issue with the "PRODUCED BY OR UNDER LICENCE FROM..." screen checking for "TMR SEGA" in the ROM, and this was confirmed as the bumper screen had indeed disappeared at the time. but I was interested to see how the "repair" had achieved this. As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you. gamegear2.JPG (125.79 KB) GG 1-ASIC with J1 bridged

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Sun Jun 10, 2007 8:10 pm Last edited by Charles MacDonald on Sun Jun 10, 2007 9:07 pm; edited 1 time in total
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Quote As you can see in the attached photo, it seems to entirely consist of blobbing solder over J1. I don't have a good way to see what's there normally, but I thought I'd see if anyone can confirm that's what J1 does. It'd cut down the boot time of all such GGs, even if the piracy aspect does not matter to you. It works! When J1 is shorted, the BIOS ROM doesn't load. I plugged Space Harrier in and it booted directly. Since the GG was open and the soldering iron was on, I found J2/J3 select the territory. With the silkscreen text oriented towards you, the jumpers look like this: A B C D ^ \| J2 \| J3 A,B are +5V, D is ground, C is the territory mode input. Normally A-C are bridged so this signal is high and "Overseas mode" is selected. Bridge C-D so the signal is low and that enabled "Japan (Domestic mode)". It seems leaving C unconnected defaults to overseas mode but you should probably tie it high/low to be sure. Was hoping to find a PAL/NTSC jumper, but it seems to not be present. EDIT: My GG doesn't have J2/J3 in the same position as the one in Maxim's post. The pads are all of an equal size and equally spaced away from each other with the silkscreen text and arrow next to them. Be careful! ;)

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Sun Jun 10, 2007 8:57 pm Last edited by Charles MacDonald on Wed Jun 13, 2007 9:08 pm; edited 2 times in total
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Some BIOS-less GG Z80 tests: After a warm reset (Z80 /RST asserted) the registers are set up like so: SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All retain former values I = $00, R = $00 After a cold reset (power switched on) the registers are set up like so: SP,AF,BC,DE,HL,IX,IY,AF',BC',DE',HL' = All zero I = $00, R = $00 After loading all registers with $FF, during the time that power is switched off and then back on each set bit gradually resets to zero. This is why the cold boot state is zero for most all registers but the ones that have fixed values due to Z80 /RST being pulsed. It only takes a few seconds for all of them to change to zero. If you turn the GG back on before then, the values will be random as random 1 bits have turned to 0 and others are still preserved.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Mon Jun 11, 2007 4:47 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Was there any difference for OUT (C),0 (opcode ED71) as well? Did it output $FF instead of $00 on the GG?

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Mon Jun 11, 2007 5:09 pm Last edited by Charles MacDonald on Wed Jun 13, 2007 9:04 pm; edited 1 time in total
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	FluBBa wrote Was there any difference for OUT (C),0 (opcode ED71) as well? Did it output $FF instead of $00 on the GG? Yes, my GG always does 'out (c), $FF' instead of 'out (c), $00'. I've attached the register dumping and 'out-test' programs. For the register dumping program, it will capture and print the register values and then load all registers with a value before HALTing. Hold start to load registers with $0000, don't hold start to load registers with $FFFF. You'd use it like this: 1st time: - Turn on GG, turn off GG. Registers now loaded with $FFFF. - Don't wait - Turn on GG, values displayed are what was retained during power-cycling. 2nd time: - Turn on GG, turn off GG. Registers now loaded with $FFFF. - Wait 10 seconds or longer - Turn on GG, values displayed are what was retained during power-cycling. For the quick cycle, all values should be retained. For the long wait all values should be zero apart from the few I've described. Then again: 1st time: - Hold START and turn on GG, turn off GG. Registers now loaded with $0000. - Don't wait - Turn on GG, values displayed are what was retained during power-cycling. 2nd time: - Hold START and turn on GG, turn off GG. Registers now loaded with $0000. - Wait 10 seconds or longer - Turn on GG, values displayed are what was retained during power-cycling. In both cases all registers will be zero apart from the few special cases. For the out-test program, it writes $A5 to 12 bytes, then overwrites them with 'out (c), 0' after loading all the registers with $0000 (on the assumption some internal bus is used as the data source, but it apparently isn't). The values printed should all be $FF. If you or anyone else would like to test these programs and share the results, I'd appreciate it. I've done some SMS VDP 2 timing tests, and found I could get H counter values for various video 'events' by connecting the VDP /N-L (HL trigger input) pin to other signals, like /CSYNC, /Y1 (pixel transparency indicator) and /BURST (color burst insertion strobe) as well as /NMI and /INT to find out exactly what the H counter value is when they trigger. I'll try to get my experiments done this week and write about it. EDIT: Fixed the program to save A,F properly. gg-out.zip (2.21 KB) Game Gear "out (c), 0" test program gg-reg2.zip (2.55 KB) Z80 register test program (fixed)

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Mon Jun 11, 2007 5:22 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	I don't have a GG so I can't test any specifics for that one, I only have a SMS1 and hopefully soon a MegaDrive so I can use my PowerBase converter.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Tue Jun 12, 2007 11:18 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation? Do you have results from a SMS without a bios as well?

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Wed Jun 13, 2007 4:26 am
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	FluBBa wrote Hmmm, on my emulator the reg test allways end up with A=FF and F=80 no matter what startup values I set to those registers (no bios used). I set some of the other registers to FF right now, can that affect the result or am I doing something wrong in my emulation? Do you have results from a SMS without a bios as well? Oops, I just realized saving I and R overwrites the value of A and F on startup. Sorry! I wonder how I can save A and F without SP being set up. With the assumption that the registers default to zero, 'push af' will store the values at $FFFF and $FFFE. For a 32K ROM this won't cause any trouble. But then the stack pointer is invalid for any tests where the power is quickly cycled and the resulting SP value is non-zero. I suppose a message could be displayed to warn the user if the SP startup value was not within a RAM area, then you'd know the values of A,F were invalid.

linobollansee Joined: 13 Jun 2007 Posts: 2	I am Maxim's contact Posted: Wed Jun 13, 2007 7:39 pm
linobollansee Joined: 13 Jun 2007 Posts: 2	Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post." I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear. I personally have two GameGears, one in good state and one in below average state. I wish I knew programming so that the "registers" discussed here would make sense to me. Can you guys help me somewhat?

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Re: I am Maxim's contact Posted: Wed Jun 13, 2007 9:02 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	linobollansee wrote Hi, I am the one who contacted Maxim and sent him a picture of my "repaired" GameGear which has J1 shorted. I would like to have a photo of Charles MacDonald's GameGear's circuitry because he claims "My GG doesn't have J2/J3 in the same position as the one in Maxim's post." Sorry, I don't have a camera to take a picture. In the photo of your Game Gear, notice there is no label for J3, though I assume it is the two larger solder pads to the right of J2. On mine J3 is to the right of J2, but the solder pads are all the same size. In addition the two lower pads of J2 and J3 are shorted together, and there is no connection in the picture. Quote I also wonder how many GameGears Charles MacDonald has seeing as he immediatly used his soldering iron on one with no fear. I only have one. I experimented with J1 and later J2/J3 after reading Maxim's post, but I hadn't studied the picture closely. J1 is in the same position as yours on my Majesco GG, but J2/J3 are different as I've explained.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Wed Jun 13, 2007 9:36 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Maybe this topic should be split (is that possible?)... I've fixed quite a few things on my SMS emulator now regarding GG emulation so now TMS9918 modes can change the palette. Speaking of startup values, do you know how the palette is set up on startup? Twisty.png (547 B) Twisty on SMSAdvance

linobollansee Joined: 13 Jun 2007 Posts: 2	Charles' Majesco Circuitry Posted: Wed Jun 13, 2007 10:01 pm
linobollansee Joined: 13 Jun 2007 Posts: 2	Can you get a friend to take a picture of your Majesco GG circuitry? Perhaps my GameGear HAS no J2/J3 and the region cannot be modified. I am not willing to risk tampering with the NON labelled J2/J3 it yet, unless I have some extra money. I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on? It could break the gamegear so maybe the best would be to use a very small, very flat style switch (moved with your fingernail) into the battery pack. Can you tell me how old you are Charles? Are you a programmer? How did you get so good? Do you have MSN Messenger so I can speak to you directly?

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Re: Charles' Majesco Circuitry Posted: Wed Jun 13, 2007 10:23 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Quote Can you get a friend to take a picture of your Majesco GG circuitry? I don't have any plans to do that, but if I do take a picture at some point in the future I'll post it here. Quote I also thought about building a wired region switch into the gamegear's body. What do you think would happen if the jumper position was accidently changed with the switch WHILE the system was on? I don't think anything bad would happen, but just to be sure I wouldn't change the switch while the power was turned on. Putting it in the battery compartment so no accidents can occur is a good idea.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	MegaDrive Startup Values. Posted: Fri Feb 22, 2008 2:58 pm Last edited by FluBBa on Fri Feb 22, 2008 9:01 pm; edited 1 time in total
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	I added a register dump feature to my test program and the results from my PAL MegaDrive with a PowerBase Converter are: SP: $DFFF IR: $001D AF: $FFA3 BC: $FFFF DE: $FFFF HL: $E001 IX: $FFFF IY: $FFFF AF': $FFFF BC': $FFFF DE': $FFFF HL': $FFFF The only unstable register is HL' which sometimes become $FDFF or $FFDF also. Is there some "minibios" or hardware which sets the SP and/or HL? Edit: added clarification of hardware.

TmEE Joined: 31 Oct 2007 Posts: 853 Location: Estonia, Rapla city	Posted: Fri Feb 22, 2008 5:09 pm
	There shouldn't be anything else than TMSS (if present), but it touches only 68K AFAIK, Z80 is left untouched... SEGA manual also states that there's no BIOS used in SMS mode.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Fri Feb 22, 2008 9:06 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	I did use a PowerBase Converter with my MD, is there anything like that in it? Do we have pictures of the inside here at SMSPower? Should I take some? Can someone run my test program on a bios-less SMS? jpx072? Do you have the ability to do this or is it messy to change your bioses? Right now the program is 32kB but I can scale it down to 16kB if that is necessary.

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Sat Feb 23, 2008 1:57 am
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	FluBBa wrote I did use a PowerBase Converter with my MD, is there anything like that in it? Some Genesis/MegaDrive consoles have a built-in BIOS that does a check of the cartridge, much like the Majesco Game Gear for example. However, when booting from the Power Base Converter the BIOS is completely disabled, it only exists for the 68000 side anyway. This is why executing a game from a Super Magic Drive copier causes the "Licenced by" screen to show up only after the game has started and the Z80-driven menu program is done, because at the point the /M3 pin goes high the 68000 is reset and the internal BIOS is enabled. The Power Base Converter has no ROM for the Z80, all that's present is a CK2605 PLA chip for controlling cartridge and card slot selection. It doesn't have enough connections to the Z80 data bus to provide program code either. So I think it's safe to say both the BIOS (when present) and PBC have no effect on the Z80 state when powering up. Quote Do we have pictures of the inside here at SMSPower? Should I take some? I don't think we do, that might be a nice addition.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Wed Feb 27, 2008 11:12 am
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Charles did you ever find out the HCount values for VBL, HBL ints and NMI?

DMEnduro Joined: 27 Apr 2005 Posts: 420 Location: Australia	Posted: Wed Feb 27, 2008 12:37 pm
	My GG has no BIOS screen (standard) and J1 here has a jumpering component installed. I can't find J2 or J3 anywhere. Anybody want to speculate on what happens if J1 is removed? IMG055.jpg (36.47 KB) J1 area - normal no BIOS 1 ASIC GG

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14740 Location: London	Posted: Wed Feb 27, 2008 12:51 pm
	DMEnduro wrote Anybody want to speculate on what happens if J1 is removed? Speculations: 1. You get the secret GG BIOS that's never been seen before 2. It tries to access a BIOS that isn't there and locks up (probably reading $ff = rst $38 and looping there forever) 3. The Game Gear explodes 4. The universe implodes 5. J1 isn't a BIOS toggle, it's the region selector on that model If you give it a try, and it's not #4, let us know the results :)

DMEnduro Joined: 27 Apr 2005 Posts: 420 Location: Australia	Posted: Fri Feb 29, 2008 5:12 am
	I was hoping for #5, betting on #2, and surprisingly got #1. I got the secret GG BIOS! Sorta. It just looks like the normally described one. PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES LTD. White text on blue background. So... what does this mean?

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14740 Location: London	Posted: Fri Feb 29, 2008 7:10 am
	Can you dump it?

DMEnduro Joined: 27 Apr 2005 Posts: 420 Location: Australia	Posted: Fri Feb 29, 2008 10:03 am
	No, I don't have that sort of equipment. What's the likeliness of it being on the ASIC? There's only two other ICs on the board: (Hitachi) 65256BLFP-12T Sony CXK5864CM-70LL A little research tells me that we have a 32K RAM and an 8K RAM. Is that right? The board is labeled IC BD GG MAIN USA VA1 837-9024 MADE IN JAPAN

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14740 Location: London	Posted: Fri Feb 29, 2008 10:45 am
	There's a good chance it's in the ASIC. To dump it, you can use: - an SRAM-based devcart (eg. SMSReader SRAM cart) with a program that copies the BIOS onto the cart space - a devcart that supports backup RAM (eg. Tototek SMS-PRO, GG-PRO, hacked SMS game with SRAM), similar deal - any devcart, so long as you're happy to copy 1KB from the screen On GGs, the BIOS and cart are accessible simultaneously (the BIOS replaces the first 1KB of ROM space) so you don't even need to write a RAM-resident dumper, so it's pretty easy to code.

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Sat Mar 01, 2008 4:46 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Quote So... what does this mean? It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS disabled which is unusual. But that nice picture you took clearly showed the original jumper configuration, so it seems legit. You could argue that as they had the jumper there at all, it was intended to be used in some situations. I wonder why, though. A very cool find!

DMEnduro Joined: 27 Apr 2005 Posts: 420 Location: Australia	Posted: Sun Mar 02, 2008 6:58 am
	I'd like to get an SMS-PRO, but I'll have to organise a credit card first. I'm also going to look into building an SMSReader + cart. Charles MacDonald wrote It seems that you have a regular Game Gear that shipped from the factory with the built-in BIOS disabled which is unusual. I'm interested in knowing how unusual/common this configuration is now.

jpx072 Joined: 08 Feb 2008 Posts: 75 Location: Slovakia	Posted: Sun Mar 02, 2008 10:42 am
jpx072 Joined: 08 Feb 2008 Posts: 75 Location: Slovakia	SMS II with disabled bios (rerouted CE line from bios to cartridge connector) running VDPTEST.sms (running 3-times) : Test: 1st - 2nd - 3rd SP: $FFFF - FFFF - FFFF IR: $0019 - 0019 - 0019 AF: $FFFF - FFFF - FFFF BC: $BDBF - BDBF- BDBD DE: $FFFF - FFED - FFFF HL: $FFFF - FFFF - FFFF IX: $BDFF - BDBF - BDFF IY: $FFBD - FFBD - FFBD AF': $FFFF- FFFF - FFBF BC': $BFBD - BFBD - BDBF DE': $FFFF - FFEF - FFFF HL': $FFFF - BFBF - FFFD (bios chip was not even present on the board) Hope it helps :) cheers

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Sun Mar 02, 2008 1:45 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Thanks a lot jpx072! =) Can you write what kind of Z80 that is in your SMSII? or can that be seen on any of the photos you allready have put up here? I'll open up my MD and write down the Z80 version there as well.

jpx072 Joined: 08 Feb 2008 Posts: 75 Location: Slovakia	Posted: Sun Mar 02, 2008 1:54 pm
jpx072 Joined: 08 Feb 2008 Posts: 75 Location: Slovakia	My SMSII Z80 - see photo ;) Z80.JPG (12.98 KB)

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Sun Mar 02, 2008 6:59 pm
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Thanks again for the info it's really good for the documentation of the SMS.

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Sun Mar 02, 2008 11:01 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	FluBBa wrote Charles did you ever find out the HCount values for VBL, HBL ints and NMI? I can't remember, sorry. I will try to do this at some point - keep asking about it (send PMs or something) and nag me so I don't forget.

FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Posted: Mon Mar 03, 2008 8:07 am
FluBBa Joined: 21 Jul 2005 Posts: 412 Location: GBG	Charles MacDonald wrote keep asking about it (send PMs or something) and nag me so I don't forget. He he, well, I'll try :) I guess you only really need to do the test for one of the interrupts as we know how they relate to each other now.

Forums

View topic - GG 1-ASIC bios skip mod - just bridge J1?