Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I've got about a jillion security bits, but none are triangular.

I can usually unscrew the triangles by using two jeweler's screwdrivers- 1 that's just shorter than the edge of the triangle, and another smaller one in the middle to keep the first one in place. But I've run across a few screws that I couldn't get out that way.

I'm ashamed to say that I have used a Dremel cutoff wheel to cut slots on screws so I can use a flat-blade (cutting partially through the case, if need be).

Somehow, I've wound up with half-a-dozen of those Torx T10s, so no big loss. I used the ground-down one on Auto Race and Football 2 and it worked well on those two, but I'm sure the actual bits are best.

Speaking of opening games, I've been surprised at how many repaired games I've gotten off ebay. A few times it's been battery damaged traces that were repaired with wire jumpers, and there have been several that had broken plastic support pieces that were fixed to various degrees. Then again, I got a Mattel Basketball where the 9v battery clip had been pulled off and the wires were just twisted together- red to black and black to red! That game has 3 bare dies on the PCB, and one of them had melted all of its bond wires. But the ROM bits are still visible!

Coleco Electronic Quarterback has a TMS1100NLL MP3415 BSP 7823. I'm going to try dumping electronically again. It might take me a while, unless I get frustrated and torch it. Then again, I'm not sure die rev BSP is dumpable.

Touch and Tell is on the way.

I had some luck with G&W Boxing- I can dump 1 page of 63 bytes. Just 43 more pages to go! (Or maybe 63 if it's an SM511). If I fiddle with some of the inputs right after reset, I can switch pages, but I haven't figured out the exact steps yet.

Gradius is pretty much just like Top Gun, TMNT and Contra. Tiger Marble Madness looks like it's an SM512 because there are a lot more segments.

Sounds promising
You got Contra too, right? That would be a good case to see what data you're actually dumping, since we can assume we have the dump already via the patent(with some wrong/obscured bits)

My worry is that all the lines required to dump blobbed ROMs aren't bonded out. The ROM data comes out S1-S8, but after a quick look at Contra, I only see 5-6 traces for those signals coming out from under the blob. I'm guessing the other 2-3 aren't bonded, which means you'd have to remove the blob and use probes on the die pads to access that data.

Other LCD games might bond out all the signals and even have test pads to verify the ROM data, but I bet that by this time, yields and confidence were up, and full ROM verification was no longer done.

I received G&W Donkey Kong II pcb yesterday, it looks in good condition, it's on its way to you now.

It is 'guess the MCU' tiem!

1: Lego Technic Control Center, used in
set 8094 from 1990 http://technicopedia.com/8094.html
set 8485 from 1995 http://technicopedia.com/8485.html
I assume both are the same. I remember the 1st one from toy magazines, the 2nd one looks much better tho! =)

2: Nintendo R.O.B, a silly NES peripheral, MCU is 16-pin DIP labeled Nintendo. I assume it's an old Sharp MCU like the 10NES CIC(lockout chip).

*edit* https://www.youtube.com/watch?v=9CRVd3jk0q4

Guess the mcu/cpu as well for the Lego DACTA Control Lab '2954' block:
http://www.bricklink.com/PL/2954.gif
http://lgauge.com/technic/LEGOInterfaceB/9751.htm for more information

Given that brick actually accepts rs232 and has an unlock compare string, its probably a z80 or 6809 or a similar 'true' cpu in there, with an eprom or mask rom. (Unlock: send the brick "p<NUL>###Do you byte, when I knock?$$$" and it responds "###Just a bit off the block!$$$" and unlocks itself. The much later Lego RCX 1.0/2.0 brick, which is Hitachi H8 based (and dumped), uses a nearly identical unlock phrase.)

Lego Dacta? Never heard of that until today =)
I googled around a bit to learn about it, interesting educational 'branch' of Lego

The one you linked is interface B. Interface A info is over here:
http://lukazi.blogspot.nl/2014/07/lego-legos-first-programmable-product.html

*edit* The interface brick connects to a PC(software control happens there), so I assume the interface only has a serial controller and no CPU on it.

also, pcb pics of the Control Center here http://freggelweb.de/technic-controlCenter.html

I'm baaack. I finished the HDMI adapter and it's in production right now, so I am back on game duty for awhile.

The Allpro 88 adapter is almost done, I finished the PCB so now I have to check it and then get it made. This board plugs inside the Allpro 88, after removing the three existing power boards. It adds USB and 12V only power and basically turns it into a super powered chip dumping rig while removing most of the original bad hardware design.

This will allow dumping new chips without constantly making up hardware to do it like before. I can "import" the existing dumping stuff into the allpro relatively easily too.

As for dumps, I dumped most of the micros I could on the last round of games, and will take VFD pics and RE the pinout soon. I will let others vector them from now on I think, since it takes a huge amount of time to do this that I could spend REing and dumping stuff, and some people were complaining about the quality. Let's see if they can do better :-)

So the new protocol will be to dump the chip, photo the VFD, and trace it out like before except I will put the plate numbering on an actual picture instead of the vector version.

I will have to make some socket adapters to dump some of the chips because they are in different packages from what I natively support, but shouldn't be too difficult.

Re the last dumps, The two CPUs out of the Bandai Pair Match won't dump. It's odd, like the dumping stuff was slightly changed or something. I haven't poked around with it too much but they are some of the very last chips made going by date/mask number.