So I just finished reviewing the menu ROM of one of my carts (the other one is missing the G-MMC1 chip…) and as dreadfully expected, the stupid MX15002 (G-MMC1) is actually an SoC by Megachips (they call them LSI for I guess Large Scale Integration). So pretty much proprietary SoC/ASIP with proprietary software – great -_-”
So yeah, registers are mapped into ROM space. The menu cart has a little test program that can be activated by editing WRAM: set 0:C239 to 0xFF and 0:C000 to <>0x55. It will test the register map, start-up data (0xA8 0x00 0x00, which must somehow contain ROM bank/size, RAM bank/size, Mapper?), see if all mapped ROM banks can be accessed, see if single and double speed access are ok by checking the ROM check sum. If all checks are OK, it tries to boot the menu (which fails on emulators). I’ll cover the command sequences on the wiki when I find some free time to do so.
The menu comes in four different flavors: DMG, SGB, CGB, and an unused CGB + PocketPrinter flavor. SGB mode is DMG mode with better sound, CGB mode is colorful. Apparently, the menu would detect when the PocketPrinter was connected and show this background instead of the usual background. Code, graphics and tilemap are there, but it’s never used. Haven’t dug much into whether any PocketPrinter code is still present, but I looked at most of the code and nothing stood out too much…
So yeah, probably going to check next if the G-MMC1 will let me write to flash directly or if it will prevent that ;).