So it’s been a while. akubi sent me some of her games that contain interesting PCBs — the most outstanding being DMG-Z01-01 followed by DMG-KECN-SP. Still no idea why they put an extra transistor on the latter tho… The former has some weird ROM where Sharp combined 2x 16Mbit in one package (LH5S5WTI).
Still working on figuring out the PALCE16V8 on SA8MBT6-2 used by Gedou Zhenlue 2002. I found the programming algorithm in some obscure Indonesian thesis. Now I need to build a cheep-ass programmer, then see if the security bits can be fooled by reversing the power sequencing for programming (some forum posts claim that’s how you do it).
Notwithstanding that I don’t have time for much of anything right now, I couldn’t refrain from spending some money on eBay. I’m now a proud owner of a DMG-QLA-01… err… a 4-Player adapter for the original DMG. I originally bought one in Japan, but it was literally in the only package that managed to get lost — with a copy of Rockman & Forte for WSC and some DMG games no less 🙁 Of course, there’s a little Motorola MC68HC05P71)I shamelessly stole the CPU info from Jeff Frohwein; not sure how he determined it, but pinout matches. in there (actually, it’s quite a neat CPU) which is still undumped as far as I can tell. I always wanted to do some hobo decapping, just need the right tools and the right incentive. Still not sure if it’s such a great idea to use chemicals that can burn my lungs away, but… YOLO 😀
Anyway, shelled out some money for an official rumble dev cart, DMG-B03-11 (no pre-release game on it tho…). Operation isn’t as straightforward as one might have hoped, but I’m getting there. I already figured out how to access SRAM (yeah, it needed figuring out) and read the manufacturer information from the flash chip. Reading the actual game was no problem at all (kind of obvious, though). Made a schematic and marked down some preliminary findings about MBC5-D, the development version of the MBC5.
Then I got a Bung Exchanger and a 64M flash cart (actually, a “Mr. Flash” cartridge; the exchanger is unmarked, but has Bung chips on it) for cheap. Gathered some software from back in the day. Now I just need a printer port. Probably going to see if I can get one for dirt cheap that’s still reliable. Then I spent even more euros and acquired a GBDSO2)Game Boy Digital Sampling Oscilloscope and an ELV GBD 13)ELV Game Boy Datalogger 1 [German].
I managed to break the GBD 1 while undoing the casing — in case you need to open it, too: Don’t put a knife under either of the bottom sides of the case. You’ll catch on the inductances and break their legs off. It should be straightforward to fix though. It did work before my opening the case, so go figure 😛
Well, so much for now, I guess. I just barely managed to fix my GB dumper — yet again. Apparently, the FTDI chip’s clock input lead is having a hard time staying connected to its clock line, so the baud rates don’t match up anymore. Of course, I changed the original 187500 baud used by Kraku & Chroost to 750000 baud, because I hate waiting on my dumps. 32Mbit take long as is. Might look into a nicer solution as a redesign of my VUE Cart Reader design. Basically, pop in the other GEC, nix two DFF8s and it should work at breezing speeds. DFU over USB included. But I’m somewhat tight on time right now, so maybe I’ll think about it “next week”-ish.
| ↑1 | I shamelessly stole the CPU info from Jeff Frohwein; not sure how he determined it, but pinout matches. |
|---|---|
| ↑2 | Game Boy Digital Sampling Oscilloscope |
| ↑3 | ELV Game Boy Datalogger 1 [German] |
so did you manage to crack the palce16v8’s?
I bought some on the cheap thinking I’d be able to look up the programming algo … but it didn’t work that way. I tried the old galblast stuff but it didn’t seem to be working, so I did some more googlefishing. Then I saw comments about “doesnt work for AMD” although other programmers seemed to accommodate them. The German blog seems to say what you said — just reverse the order between Vpp and Vcc … so I am going to try that this evening but I’m not too confident. This has become an exercise in web-archaeology as everything is so old (and I am not set up to run on DOS anymore etc etc).
I have some EP610s as well, which seem to be even more of a mystery than the 16V8s. Ok I could go a more modern route i.e. full CPLD / FPGA but that takes the simplicity out of it (just like sometimes prefering PIC12F when I have STM32F4 lying around as well). My programmer setup uses an MCP23017 across the middle I/O pins so in principle I could directly verify the circuit on test vectors as well.
Hi kr,
Did not manage to do something definite with the palce16v8 so far, as I did not want to mess with the only one I had. However, I did manage to find the link where I got my info from the classiccmp mailing list.
Basically, if my translation is correct, it boils down to:
HV is high voltage, HV1 is 9.25 V, HV2 I have no idea about, but I suspect either 9.25, too, or 5V. You’ll have to check out the actual PDF to read about the row addressing though.