I've got about a jillion security bits, but none are triangular.
I can usually unscrew the triangles by using two jeweler's screwdrivers- 1 that's just shorter than the edge of the triangle, and another smaller one in the middle to keep the first one in place. But I've run across a few screws that I couldn't get out that way.
I'm ashamed to say that I have used a Dremel cutoff wheel to cut slots on screws so I can use a flat-blade (cutting partially through the case, if need be).
Somehow, I've wound up with half-a-dozen of those Torx T10s, so no big loss. I used the ground-down one on Auto Race and Football 2 and it worked well on those two, but I'm sure the actual bits are best.
Speaking of opening games, I've been surprised at how many repaired games I've gotten off ebay. A few times it's been battery damaged traces that were repaired with wire jumpers, and there have been several that had broken plastic support pieces that were fixed to various degrees. Then again, I got a Mattel Basketball where the 9v battery clip had been pulled off and the wires were just twisted together- red to black and black to red! That game has 3 bare dies on the PCB, and one of them had melted all of its bond wires. But the ROM bits are still visible!
Coleco Electronic Quarterback has a TMS1100NLL MP3415 BSP 7823. I'm going to try dumping electronically again. It might take me a while, unless I get frustrated and torch it. Then again, I'm not sure die rev BSP is dumpable.
I had some luck with G&W Boxing- I can dump 1 page of 63 bytes. Just 43 more pages to go! (Or maybe 63 if it's an SM511). If I fiddle with some of the inputs right after reset, I can switch pages, but I haven't figured out the exact steps yet.
Gradius is pretty much just like Top Gun, TMNT and Contra. Tiger Marble Madness looks like it's an SM512 because there are a lot more segments.
Sounds promising You got Contra too, right? That would be a good case to see what data you're actually dumping, since we can assume we have the dump already via the patent(with some wrong/obscured bits)
My worry is that all the lines required to dump blobbed ROMs aren't bonded out. The ROM data comes out S1-S8, but after a quick look at Contra, I only see 5-6 traces for those signals coming out from under the blob. I'm guessing the other 2-3 aren't bonded, which means you'd have to remove the blob and use probes on the die pads to access that data.
Other LCD games might bond out all the signals and even have test pads to verify the ROM data, but I bet that by this time, yields and confidence were up, and full ROM verification was no longer done.
Given that brick actually accepts rs232 and has an unlock compare string, its probably a z80 or 6809 or a similar 'true' cpu in there, with an eprom or mask rom. (Unlock: send the brick "p<NUL>###Do you byte, when I knock?$$$" and it responds "###Just a bit off the block!$$$" and unlocks itself. The much later Lego RCX 1.0/2.0 brick, which is Hitachi H8 based (and dumped), uses a nearly identical unlock phrase.)
"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
I'm baaack. I finished the HDMI adapter and it's in production right now, so I am back on game duty for awhile.
The Allpro 88 adapter is almost done, I finished the PCB so now I have to check it and then get it made. This board plugs inside the Allpro 88, after removing the three existing power boards. It adds USB and 12V only power and basically turns it into a super powered chip dumping rig while removing most of the original bad hardware design.
This will allow dumping new chips without constantly making up hardware to do it like before. I can "import" the existing dumping stuff into the allpro relatively easily too.
As for dumps, I dumped most of the micros I could on the last round of games, and will take VFD pics and RE the pinout soon. I will let others vector them from now on I think, since it takes a huge amount of time to do this that I could spend REing and dumping stuff, and some people were complaining about the quality. Let's see if they can do better :-)
So the new protocol will be to dump the chip, photo the VFD, and trace it out like before except I will put the plate numbering on an actual picture instead of the vector version.
I will have to make some socket adapters to dump some of the chips because they are in different packages from what I natively support, but shouldn't be too difficult.
Re the last dumps, The two CPUs out of the Bandai Pair Match won't dump. It's odd, like the dumping stuff was slightly changed or something. I haven't poked around with it too much but they are some of the very last chips made going by date/mask number.
