Friday, May 15, 2020

Decapping is pure fun, fear and adrenaline


I decapped my last 8751H over 6 month's ago. So i was pretty excited when f250v contacted me for decapping a protected 8751H from his Street Figher (bootleg).
Read more about here.

He shipped the mcu last monday, i received it today and as i had a short period of free time i immediately started to work on it.

To be true, decapping a chip is pure adrenaline, a little bit of fear and in the end alot of fun. While it proved another time that my decapping method is working pretty good, it's always risky to decap a chip. (don't use too much heat / did i use enough polish / hopefully i did not accidentally cut a wire /...)

In the end it took about 15 minutes to open the chip, 5 minutes to erase the lock bit and after another 5 minutes we had the dump.







The next interesting fact was, that this dump matched the other existing Street Fighter mcu dump, which was just added 8 days ago to MAME (here). The previous dump was only possible, because an unsecured 8751H was found. 

Anyway, this confirmed the existing dump!

Thx to f205v for sending the 8751H to me, it was nice variety to my currently other work.


Sunday, May 10, 2020

Preserving a rare V.Smile Motion Demonstration Station / Kiosk

While i always keep my eyes open for rare / obscure systems, a rare Demonstration Station / Kiosk of the V.Smile Motion system showed up on the net.
You will not find any information or picture of such system anywhere and i had never seen one before somewhere for sale.
So i had to buy it!


Like all other Kiosk-Systems it's a complete AllinOne-Package. You have a TV, a complete V.Smile Motion system and 5 games included in one demonstration-case. The controller is wired, so that nobody could take it away. (V.Smile Motion has a wiresless controller)

This german Kiosk-System has five german games included. Selectable by pressing each button. (Micky Maus Wunderhaus, Dora, Winnie Puuh, Meister Manny, Tinkerbell)




Inside the console is a cartridge, which has a unique cover that i never have seen before. The cartridge is mounted inside the console and could not get removed.


The button of the currently running games is lighting!



As this was completely new, i was not sure what i will find inside. It could have been 5 demo-versions of the games or just the final\retail versions of each games. So the first part was to remove the cover of the game-selection.

 What was behind the cover was pretty interesting. They basically moved the main-pcb of the V.Smile Motion outside the console and mounted it on the back-side of the Kiosk-Case. They soldered in a 90 degree cartridge-slot and inside this slot they insert a huge custom cartridge. Which looked like a 5in1 Multicart (5 globs, each for one game)

left: big custom cartridge        right: main-pcb of the V.Smile Motion console

Main-PCB of the V.Smile Motion (looks like a standard main-pcb)

Custom Cartridge, inside my dumper
The next part was to get the games dumped. Luckily this Multi-Cartridge worked like "normal" carts, while just selecting each bank with the buttons.
That way i could dump all games pretty fast with my V.Smile dumper.

Now to the (maybe) sad part. All games matched the already existing dumps of the retail cartridges. Only "Meister Manny" was new/undumped, as the retail cartridge of the V.Smile Motion version is not dumped so far. But mostly for sure, it's also the same as the retail version.

Nevertheless this was a fun challenge to document this pretty rare hardware and we now know for sure the games inside are just like the same as the retail games.



 Another interesting V.Smile Kiosk-System popped up recently for sale:
Too expensive for me, but if someone wants to help with money just contact me.


Thursday, April 16, 2020

Bandai Design Master - Multicarts

Another exotic console is the Design Master Denshi Mangajuku made by Bandai in 1995.





This console only got 9 cartridges (4 Game-Carts / 4 Design Carts / 1 Special Cart) released and is basically a drawing handheld.



I got contacted for getting the cartridges dumped and within a couple of hours i had the complete cartridge-pinout reversed and the first dump of a cartridge. Within some months i got sent ALL available carts, for dumping, from three sources and now we have a complete dumped cartridge-set of this console.
The Weekly Shonen Jump Special cartridge is very interesting, as only 300 copies were made.

As the emulation of this console will be tricky (the console uses an MCU with internal data), we needed a fast way to confirm that the dumps are good. So i designed three multi-cartridges for this system.

Three Multicarts for the Design-Master. (You will need all three carts to play the complete library of this system)

A 4in1 Game-Cartridge, a 4in1 Design-Cartridge and the Weekly Shonen Jump Special-Cartridge.
Like the real carts, you can use the Game-Carts alone with the system or combine the Game-Carts with the Design-Carts.

Combined Game-Cart + Design-Cart







The Cartridges were designed to be as small as possible, while also good to be usable. That way the Design-Carts are only half the size of the Original.


Game-Cart inside the console
Game-Cart + Design-Cart inside the console
Weekly Shonen Jump Special-Cart inside the console




I have a small quantity of carts for sale.

Prices for the full set (three carts) is 30EUR.


Friday, April 3, 2020

Dumping an MCU from 1986 (HMCS40 - ALPHA-8505)

Last year i bought a big lot of gambling boards from an local operator. Inside this lot were four complete boards from an unknown game marked as BINGO TIME on an included sheet.


After all roms got dumped and submitted to MAME, it was pretty fast discovered that it fits perfectly into the "equites.cpp" driver.
The game also booted but got stuck at this screen:


If you look closer at the board you will find the ALPHA-8505 chip.


This chip is from the HMCS40 chip-family and we even already have dumps from the ALPHA-8303 in MAME. These were only possible because Tatsuyuki Satoh built the 8201 dumper back in 2003-2008. This dumper uses the LPT-port of an WindowsXP computer.

While i built that dumper already in 2019, for dumping the ALPHA-8505, i did not get good dumps with it. That way i thought the 8505 is different to the other supported chips.

As the four boards were on my shelf since months and i saw it mostly every day, i got interested in it again the last few days and rebuilt the complete dumper from scratch today.



I also used another old WindowsXP machine with the dumper. This time i got better results, the program ran through all pages of the testmode and within some seconds i got a 8kb file from it.

Comparing that file with the existing 8303 dump it mostly matched and only had 169 differences! I redumped all four of my 8505 chips and always got the same dumping result!

After sending the dump to MAME, i shortly after got the confirmation that the dump is good and the game boots through the romcheck.





The game is marked as working now, but without sound. Someone has to take a closer look at the sound-emulation, as this is currently not supported.

As we will need this dumper for some other currently missing ALPHA-8*** mcu's also in the future and as it's more complicated to solder the complete dumper by hand, i designed this little board:



The PCBs are already in production and should arrive here in the next few weeks, making it really easy to reproduce this dumper for more people in the world. (You only will need a WindowsXP machine with an real (no USB) LPT-port).
For the external +5v power it has a Mini-USB-Port which you can just connect to the usb-ports from your computer.


Thanks to Ivan for adding the game to MAME and to Tatsuyuki Satoh for making this dumper. Another rare game completely preserved.

Friday, February 21, 2020

Maybe MAME will read the good night stories for your kids in the near future



 A pretty interesting system for small kids is the STORY READER or GESCHICHTEN ERZÄHLER (how it's called in germany).
This system uses paper-books and cartridges (which contain the audio). Each page has small metal rectangles between the papers, so the console knows which page is currently opened.

The cartridges have only a 10-pin-connector which Sean Riddle reversed really quickly and got 23 english cartridges dumped.
The main problem was that it uses serial rom's (under one or two globs) for each cart. Which are not that easy to dump with normal programmers.
So i contacted Porchio if he could make an Arduino-based-dumper for this system and only a few days later i got his finished work sent.

The now available dumper is working perfectly with an Arduino UNO and only needs 6 wires. Which means it's pretty cheap and easy to built.

Dumping a 8mbit cartridge takes about 2 minutes.


Seven german carts for this system are now also dumped and i will try to get my fingers on the other 8 german carts.

Thanks to Sean and Porchio for this amazing work!

Hopefully someone will take a look at this stuff, as i'm pretty sure, if the "audio" is emulated in MAME it will be an easy hook up with the scanned pages and that way MAME could put your kids to bed.

Sunday, January 26, 2020

MSP55LV100S - SSOP70

Looks like this chip is completely undocumented in the net and a couple of people are searching for the pinout of this chip!

here it is:



confirmed as good on two dumped flashroms.

Monday, January 13, 2020

Casio Loopy - Little Romance

Next piece inside SSJ's package was the Casio Loopy cartridge Little Romance.






the roms got desoldered and dumped directly.
This game is now also preserved.

We are still in search of the last undumped Casio Loopy cartridge Chakura-kun no Omajinai Paradise (チャクラくんのおまじないパラダイス), contact us if you have it and want to help to preserve it.

Thx to SSJ for sending lending us his carts!

 

Casio Loopy - Video Seal Wordprocessor XK-700

SSJ sent me a package with some great stuff inside! (You may have seen some of it's content already at Haze's 2020 preview-blogpost. All GameKing-carts were dumped a couple of days ago.

Also included in this package was this Casio Loopy - Video Seal Wordprocessort XK-700 device. Mostly known as MAGICAL SHOP. A pretty rare device, more infos about could be read here.

It has an internal rom and is completely undumped!

Pictures of the internal hardware:






The rom got desoldered and dumped directly!
Afterwards i did give it a try in MAME (knowing that the emulation of the Loopy is still very primary) and we got this:






Another great and rare item preserved.

Now i will get to the next piece inside the SSJ's package...stay tuned!

Saturday, November 30, 2019

Lexibook JG7415 - Are they crazy?



The Lexibook JG7415 is an 120in1 games- console, which just used the popularity of the WII to get sold as much as possible.
I bought this console locally here just to see if these games are also Sunplus based.

When i opened the console i was surprised that the case was 90% empty. The complete pcb of the console would have easily fit inside one controller.

But what was more surprisingly is the marking Zone 100 110728 v2.1 on the board! Zone is known for it's own Multigame-Consoles, like Zone40 and Zone60, which are both also already emulated in MAME.
So this console was likely be an emulation-target for MAME too.



Next step was to dump this rom!
As the Zone60 (which has 60 games) has a 64mb rom, i was pretty sure that this console (which has 120 games) will have a 128mb rom.
But the rom has A0-A26, which would indicate a 256mb rom!

As this is nothing you can just desolder and put in your programmer for reading, some soldering had to be done.
Luckily the ArduinoMega is an amazing tool for this.


Soldering everything together and checking all connections just took about 1,5 hours.
The only problem with the Arduino, dumping a 256mb rom with it takes about 3,5hours!

First dump was done over night and i sent the dump to Haze for checking! The games booted, but the interesting fact was that only 128mb (split up over the complete romarea) of the 256mb were used.
To verify the dump it was needed to at least dump it one more time...so we had to wait another 3,5hours for verification.
Sad thing, the dumps did not match!
So i dumped it another time, which took another 3,5hours!

While i dumped it the third time, Haze sent me the following message, as he was thinking, that they used known faulty flashroms for this console. And that's why they used 256mb flashroms and only used 128mb of it:

if you divide the ROM into 8MB chunks this is how it maps in terms of used / unused
if the bad bytes are in the not selectable or unused blocks then there's probably nothing to worry about, might even be just bad ROM they used on purpose

0x0000000 0x07fffff - used
0x0800000 0x0ffffff - used
0x1000000 0x17fffff - not selectable, unused
0x1800000 0x1ffffff - not selectable, unused
0x2000000 0x27fffff - not selectable, unused
0x2800000 0x2ffffff - not selectable, unused
0x3000000 0x37fffff - used
0x3800000 0x3ffffff - used
0x4000000 0x47fffff - used
0x4800000 0x4ffffff - used
0x5000000 0x57fffff - not selectable, unused
0x5800000 0x5ffffff - not selectable, unused
0x6000000 0x67fffff - not selectable, unused
0x6800000 0x6ffffff - not selectable, unused
0x7000000 0x77fffff - used
0x7800000 0x7ffffff - used

0x8000000 0x87fffff - used
0x8800000 0x8ffffff - used
0x9000000 0x97fffff - not selectable, unused
0x9800000 0x9ffffff - not selectable, unused
0xa000000 0xa7fffff - not selectable, unused
0xa800000 0xaffffff - not selectable, unused
0xb000000 0xb7fffff - used
0xb800000 0xbffffff - used
0xc000000 0xc7fffff - used
0xc800000 0xcffffff - selectable but unused
0xd000000 0xd7fffff - not selectable, unused
0xd800000 0xdffffff - not selectable, unused
0xe000000 0xe7fffff - not selectable, unused
0xe800000 0xeffffff - not selectable, unused
0xf000000 0xf7fffff - selectable but unused
0xf800000 0xfffffff - selectable but unused
 
I rechecked this with my (now three) dumps and guess what! All three dumps matched exactly in these area's :
0x0000000 0x07fffff - used
0x0800000 0x0ffffff - used

0x1000000 0x17fffff - not selectable, unused
0x1800000 0x1ffffff - not selectable, unused
0x2000000 0x27fffff - not selectable, unused
0x2800000 0x2ffffff - not selectable, unused
0x3000000 0x37fffff - used
0x3800000 0x3ffffff - used
0x4000000 0x47fffff - used
0x4800000 0x4ffffff - used

0x5000000 0x57fffff - not selectable, unused
0x5800000 0x5ffffff - not selectable, unused
0x6000000 0x67fffff - not selectable, unused
0x6800000 0x6ffffff - not selectable, unused
0x7000000 0x77fffff - used
0x7800000 0x7ffffff - used

0x8000000 0x87fffff - used
0x8800000 0x8ffffff - used

0x9000000 0x97fffff - not selectable, unused
0x9800000 0x9ffffff - not selectable, unused
0xa000000 0xa7fffff - not selectable, unused
0xa800000 0xaffffff - not selectable, unused
0xb000000 0xb7fffff - used
0xb800000 0xbffffff - used
0xc000000 0xc7fffff - used
0xc800000 0xcffffff - selectable but unused

0xd000000 0xd7fffff - not selectable, unused
0xd800000 0xdffffff - not selectable, unused
0xe000000 0xe7fffff - not selectable, unused
0xe800000 0xeffffff - not selectable, unused
0xf000000 0xf7fffff - selectable but unused
0xf800000 0xfffffff - selectable but unused


Which mean's ALL used (selectable) area's are GOOD dumped and ALL unused (not selectable) area's are BAD dumped and were different between all three dumps!

Most likely they got the faulty 256mb roms for a very cheap price and just programmed the games around the not working area's!

Without Haze and the working emulation of the Sunplus system, we would have never been able to see this and most likely would have thought that the dumps are BAD. I would have also invested hours of work and checking if my dumping rig has faults are something like that, just because they used bad flashroms in their product's. ==> Are they crazy! ;-)

The rom is already added and the games are working with the next release of MAME, here are shots of it running in MAME:


















Another challenge for me and another perfect teamwork with Haze!