Sometimes, the smallest missing ROM becomes the biggest obstacle.
Back in 2017, I had the chance to dump the Konami Picno’s external base ROM and several cartridges. That preserved a substantial part of this unusual console’s software, but one crucial piece remained out of reach: the 32 KB internal ROM inside its Hitachi HD6435328F10 microcontroller.
It could not be dumped through the usual ROM-reader approach. And without it, emulating the machine was missing the very code that brings the hardware to life.
Today, October 5, 2026, we finally persuaded the Picno to reveal that missing piece — by sneaking a Trojan horse into a cartridge and making the console display its own internal ROM.
Konami’s Lesser-Known Console
When you hear “Konami,” you probably think of Castlevania, Contra or Gradius. A children’s drawing console is perhaps a little further down the list.
Yet that is exactly what the Konami Picno was: a Japan-only educational system combining a drawing tablet and pen with a television display. Released in 1992, and followed by the Picno 2 in 1993, it offered drawing, colouring and cartridge-based learning activities.
Even without a cartridge, its external base ROM provided built-in drawing functions. The cartridges themselves were remarkably thin, almost reminiscent of PC Engine HuCards — but their unusual ROM pinouts made the original dumping work an adventure of its own.
In 2017, I documented those connections and built a cartridge dumper around an Arduino Mega 2560. The external 512 KB base ROM could also be desoldered and read using a conventional programmer.
The microcontroller’s internal ROM was a different story.
Getting the Trojan Through the Gate
The trick was to let the Picno do the reading for us.
Although an external programmer could not simply extract the internal ROM, the console’s own processor could access it. What we needed was a way to run our code on the real hardware.
Our Trojan horse was Picno Art Puzzle, cartridge RX109.
We modified its ROM image and redirected a callback pointer in the cartridge header to a small routine of our own. Loaded onto a flash cartridge, the patched image gave the Picno a familiar cartridge structure to process — with our dumping code hidden inside.
The initial wrapper called the original Art Puzzle callback first, allowing the normal setup to take place. It then read the complete internal ROM address range, 0x0000–0x7FFF, and copied those 32,768 bytes into video memory.
The first proof-of-concept payload was just 59 bytes long.
A tiny passenger, carrying the key to a nine-year-old problem.
Turning a TV Picture Into a ROM Dump
Getting the bytes onto the screen was only half the challenge. We still had to recover them accurately on a PC.
The first approach displayed the ROM contents directly as pixel values, producing a colourful image of apparently meaningless data. For the final extraction, we moved to clearly defined black-and-white bit patterns.
The ROM was split into 64 pages of 512 bytes. Each page represented its data as a 128 × 32 matrix of bits, using enlarged pixel cells and markers to help locate the grid in captured frames.
That turned the Picno’s ordinary video output into a data export channel.
We recorded the output with a capture card, decoded the patterns on the PC and assembled the pages back into a binary file. A console designed to put children’s drawings on a television was now putting its own firmware there instead.
Two Runs, One ROM
We repeated the capture to check the result.
An initial comparison showed 16 differing bits. After correcting the sampling geometry, those differences disappeared: they were capture-decoding artefacts.
Both runs reconstructed the same complete 32 KB ROM.
The resulting dump has CRC32 2DED39B5.
Its contents also make sense as genuine firmware: a valid reset vector, coherent H8/500 startup code, a table of 192 jump entries and mathematical lookup data consistent with drawing and geometry routines.
After almost nine years, the missing internal ROM is finally preserved.
The Next Chapter
This does not instantly give us complete Picno emulation. The custom video hardware, memory behaviour, pen input and sound still need work.
But we can now study and execute the real internal firmware alongside the base ROM and cartridges, replacing a major unknown with actual code.
Back in 2017, I ended my original Picno post hoping that the last undumped chip could be read soon.
“Soon” turned out to take almost nine years.
And the way out was wonderfully appropriate for a drawing console: we made it draw its own ROM.
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
