Speaking of LJN, here's a failed product that we don't emulate yet in MAME: There's a bare console one for $20 right now on ebay, if anyone wants to dump it. Or we could do the future generation a favour by making them forget this ever existed?
I only dumped it electronically. I got the same ROM contents at 7.5V, 9V and 12V, and all 8 bits dumped fine. I also dumped just the high bits by executing each byte and shifting out the PC, and those matched. The output O PLA I dumped is very similar to the other game, so I think it's correct, too.
The wiring is very similar to the other Championship Football, so I bet both were designed by ERS.
BTW I was looking through the IC list and related calculators on datamath.org, to see if there's interesting ones that aren't yet emulated. Long story short: a Canon Multi 8 from ebay is heading your way.
I had an interesting idea: for ROMs which won't dump the 8th bit electronically, can we dump said bit via power/current analysis?
I got this idea from someone l_oliveira mentioned about on the nesdev forums, who had a rom (rare?) which had a dead data line which would output zero always, but the data was still there. The rom was probably NMOS so it drew a different amount of current depending on whether the current bytes bits were 1s or 0s, so you could sum up the number of 0 and 1 bits, multiply each by a constant and get the amount of current it would draw at said address. Using that, plus the 7 readable bits, he was able to figure out what the 8th bit should be, and recover the data.
I think that same trick may work here, but you need a fairly accurate current probe on the VCC or GND pin.
LN
"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
BTW I was looking through the IC list and related calculators on datamath.org, to see if there's interesting ones that aren't yet emulated. Long story short: a Canon Multi 8 from ebay is heading your way.
That's a weird calc! I guess the chip is just a VFD TMS1000, so that will be easy enough.
I got a TI-1031, but it has a TP0311, which datamath.org says has a one-bit serial adder. So probably too much work.
I had an interesting idea: for ROMs which won't dump the 8th bit electronically, can we dump said bit via power/current analysis?
The problem with the TMS1x00s is the fu FET, which probably obscures any current differences. Also, the TMS1x00s dump the ROM bits serially, so the summing trick wouldn't work.
I think that there must be some way to turn off the fu FET; there are easier ways that they could have disabled ROM dumping. I've tried playing with timing and voltages, but haven't had any luck. And I know Kevin has looked into it, too.
even with the fet in place, the serial clock when that bit is dumped, should have a constant current put on it by the FU-fet, however the bit 'behind' it should still be discernable, even then. I think.
LN
"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
I've got some Rev E TMS1100s that I know the ROM contents, so I could try reading some bytes with the top bit cleared and some with it set to see if I can tell the difference. I need to figure out how to accurately sample the current.
I'd love to figure out how to read the top bits in TMS1000s and Rev E TMS1100s. Kevin's "execute each byte and shift out the PC" method works, but that Tandy Championship Football game that I dumped had 51 "ambiguous" bytes, where the bottom 6 bits were the same as the next LFSR PC, so I couldn't tell if they were jumps or not. Since the normal 8-bit dump worked, I could tell that only 4 of those were really jumps.
I have been unable to get my Output O PLA dumper to work on TMS1000s or Rev E TMS1100s, so some would still have to be decapped to get that.
