| Author |
Message |
- Joined: 28 Sep 1999
- Posts: 1197
|
Majesco GG
 Posted: Thu Jan 25, 2001 10:01 pm
|
This probably isn't possible, but I was wondering if anyone has tried to dump the ROM in the new Majesco GG's that does the cartridge checksum stuff.
If the GG is anything like the Genesis 3, the ROM is probably surface mounted or set up in a way making it hard or impossible to get at. But I figured I'd ask. ;)
|
| |
  
|
- Site Admin
- Joined: 25 Oct 1999
- Posts: 2029
- Location: Monterey, California
|
Posted: Fri Jan 26, 2001 4:32 pm
|
Quote > This probably isn't possible, but I was wondering if anyone has tried to dump the ROM in the new Majesco GG's that does the cartridge checksum stuff.
> If the GG is anything like the Genesis 3, the ROM is probably surface mounted or set up in a way making it hard or impossible to get at. But I figured I'd ask. ;)
Not that I know of, It probably be a monster to unmount and read (unless it can be read in-circuit via some expensive electrical engineering tool that none of us could afford), but it's probably possible to map the boot rom back into the memory (whatever port write switches from the boot room to the cart rom can probably be reversed) and either dump it to the screen in hex and let some poor slob try to copy it all down, or dump it to saveram and read with with SMSReader.
|
| |
|
- Joined: 21 Apr 2000
- Posts: 598
- Location: Newcastle upon Tyne, England
|
Posted: Fri Jan 26, 2001 5:26 pm
|
Heliophobe wrote:
Quote > [...] it's probably possible to map the boot rom back into the memory (whatever port write switches from the boot room to the cart rom can probably be reversed) and either dump it to the screen in hex and let some poor slob try to copy it all down, or dump it to saveram and read with with SMSReader.
That's probably the easiest option (as if such a thing was ever easy...)
I think the boot ROM is internal to the custom chip anyway (the 315-5682 which contains the Z80, VDP, sound hardware, and everything else), so getting the data out by conventional means is probably impossible.
I'm no Z80 coder, but if someone can write a SMS program which performs something along the lines of the following:
1) Transfer itself to user RAM and continue running from there.
2) Use the mysterious port (port 3E?) to select the boot ROM.
3) Copy the boot ROM data into user RAM.
4) Select the cartridge again.
5) Transfer the boot ROM data to the cartridge (somewhere between 0x0000 - 0x7FFF).
...then I'll put it on my 32K RAM cart and do the deed :-)
Mike
|
| |
|
- Site Admin
- Joined: 25 Oct 1999
- Posts: 2029
- Location: Monterey, California
|
Posted: Fri Jan 26, 2001 5:41 pm
|
Quote >
> Heliophobe wrote:
> > [...] it's probably possible to map the boot rom back into the memory (whatever port write switches from the boot room to the cart rom can probably be reversed) and either dump it to the screen in hex and let some poor slob try to copy it all down, or dump it to saveram and read with with SMSReader.
>
> That's probably the easiest option (as if such a thing was ever easy...)
> I think the boot ROM is internal to the custom chip anyway (the 315-5682 which contains the Z80, VDP, sound hardware, and everything else), so getting the data out by conventional means is probably impossible.
Really? All in one chip? That's very interesting.
How's the battery life on Majescos? (I know it's the screen that sucks the battery, but still I wonder)
Quote > I'm no Z80 coder, but if someone can write a SMS program which performs something along the lines of the following:
> 1) Transfer itself to user RAM and continue running from there.
> 2) Use the mysterious port (port 3E?) to select the boot ROM.
If I can find out what that port is (and assuming it's the same on a Maj. game gear) I can try it.
If it's not the same, I can't think of anyway to reverse engineer it. I guess we can start writing values to unmapped ports and see if there's a change in the contents of the rom area after each one.
Quote > 3) Copy the boot ROM data into user RAM.
> 4) Select the cartridge again.
> 5) Transfer the boot ROM data to the cartridge (somewhere between 0x0000 - 0x7FFF).
> ...then I'll put it on my 32K RAM cart and do the deed :-)
Hah! I can write directly to the rom area on your sram carts with the write enable switch on! I hadn't thought of that.
(then again, I feel a little bad messing with Majesco, they brought back the GameGear, and I wouldn't want to piss 'em off too much. But what do they lose if we see their boot rom?)
|
| |
|
- Joined: 28 Sep 1999
- Posts: 1197
|
Posted: Fri Jan 26, 2001 9:26 pm
|
Quote > I think the boot ROM is internal to the custom chip anyway (the 315-5682 which contains the Z80, VDP, sound hardware, and everything else), so getting the data out by conventional means is probably impossible.
The Genesis 3 has a bit that that when written to, disables the boot room and swaps in the cartridge ROM with no way to reverse the process. Maybe the GG is the same way.
I wonder what would happen if you had a program running in RAM, and reset the custom chip and not the Z80 (if such an idea is even possible), so the boot ROM 'switch' would be cleared, but the Z80 program would still be running...
That's all wild speculation, of course. :)
|
| |
|
- Joined: 21 Apr 2000
- Posts: 598
- Location: Newcastle upon Tyne, England
|
Posted: Sat Jan 27, 2001 1:47 pm
|
Quote > > I think the boot ROM is internal to the custom chip anyway (the 315-5682 which contains the Z80, VDP, sound hardware, and everything else), so getting the data out by conventional means is probably impossible.
> Really? All in one chip? That's very interesting.
Yep - almost everything is inside this one huge SMT chip:
The chip at the bottom right is a 32K SRAM; there's also an 8K SRAM at the other side of the board, not shown in this picture. That's all there is, apart from voltage regulators and the like.
Quote > How's the battery life on Majescos? (I know it's the screen that sucks the battery, but still I wonder)
It's pretty poor - 2 hours (or near enough) on AA Ni-Cd rechargeables. As you say, it's the screen (and backlight) which drains the power, and this is unchanged on the Majesco model.
Quote > > I'm no Z80 coder, but if someone can write a SMS program which performs something along the lines of the following:
> > 1) Transfer itself to user RAM and continue running from there.
> > 2) Use the mysterious port (port 3E?) to select the boot ROM.
> If I can find out what that port is (and assuming it's the same on a Maj. game gear) I can try it.
I think port 3E was used to select between the four slots on the SMS. It's a leap of faith to presume it's the same on the Majesco GG, but it may be worth a try :-)
Quote > > 3) Copy the boot ROM data into user RAM.
> > 4) Select the cartridge again.
> > 5) Transfer the boot ROM data to the cartridge (somewhere between 0x0000 - 0x7FFF).
> > ...then I'll put it on my 32K RAM cart and do the deed :-)
> Hah! I can write directly to the rom area on your sram carts with the write enable switch on! I hadn't thought of that.
Yeah, so long as there are prompts for write enable and disable somewhere in the program it should be fine. (You can't remove or insert the cart with write enable set, or you risk corrupting the data.)
Quote > (then again, I feel a little bad messing with Majesco, they brought back the GameGear, and I wouldn't want to piss 'em off too much. But what do they lose if we see their boot rom?)
Not a lot really. Actually, maybe they'd send the ROM dump if we asked nicely? :-)
Mike
|
| |
|
