Makaron WIP (2010/07/19) - 模擬器

http://dknute.livejournal.com/34139.html

Some time ago a person contacted me and asked, among other things, how to
dump a NAOMI cart. We exchanged a few emails but for some strange reason I
kept forgetting to actually explain that properly. Eventually we got to that
topic again though :)

The cart in question was supposed to be Club Kart - so nothing real fancy.
But for NAOMI 1 - which raised an eyebrow as it's a NAOMI 2 game. I was sent
the EPROM dump for verification and it turned out to be a control program for
a hopper hardware. It's meant to be used as a networked slave (as in it runs
on another NAOMI unit), has additional PCB plugged into the cart slot to
expand the I/O capability of the unit. That PCB however doesn't have a room
for program code so yet another cart is needed as the EPROM carrier. Basicaly
the assembly consists of two PCBs stacked togeter, one that looks like a
regular game cart and one being that I/O thing:



Since the hopper control program is pretty simple it can be easily run on
NAOMI 1, and that explains a few things. The same module is being used by
several games (usually with "Prize" being added in the title) so depending on
which one you got it from it's easy to mistake it for the game itself.
However, since we got that far, I also asked for some photos of the PCBs in
question. And imagine my surprise when I saw the "carrier" cart (EPROM
removed):



For a simple code I was expecting a simple hardware, but the cart PCB... it
has tons of mask ROMs on it. And the program EPROM is a 27C322 type (it's 4MB
one) but only about 10% or so of the space is used. Things like that require
investigating :) This could be someone's bright idea of reusing a dead or
broken game cart, but no, turns out SEGA did it on purpose. This is a Virtua
Fighter 4 Evolution game right there, just the EPROM got replaced to serve a
different purpose.

Why? No idea. Could be that the manufacturing costs of a new cart would be
higher than making a bigger batch of another game, complete with the data
ROMs, and just replacing the program. Maybe it was a last minute call and
they simply had to sacrifice a batch of carts, now why this game and not
something cheaper is again a mystery. We are probably never going to find out
but the good news is you can buy this cart cheap and just reprogram the EPROM
to get a working game. I asked Andy to check it out and he confirmed my
findings. You can see the results here.

Now, I'm not saying all the carts will work as VF4E, there might have been a
reason for this switch (a bad batch or something). So far it all seems fine
though so get yours fast, as I suspect the price is going to rise now :)

PS. Photos courtesy of my contact :)


EDIT: I forgot to point out that this is the very type of cart I wrote about
in my earlier post, one using M1 data protection. The big chip is the FPGA
that does everything here, including DMA and decryption. Chips on the left
are mask ROMs that hold the game data - there are equally as many on the
other side of the PCB as well.
Differences to "normal" carts also include SPI-based EEPROM that stores game
serial number (instead of secure FLASH, though FPGA provides protocol
emulation), only one 32k x8 SRAM (instead of two for M3 buffer) and a
dual-port (read and write) 256 x8 hardware FIFO.

--