Sega Ferie
Tooling
Dumping with universal programmer
ROM pinout is compatible with the more common Atmel AT27C040 or AT27C080 (if you discard upper half), so it can be dumped with any programmer that supports it (e.g. XGecu T56).
Dumping with microcontroller board
I used a regular sized Arduino Mega 2560 along with my fork of cartreader (branch ferie), which is a minimal version that assumes ROM pins are connected directly via flying wires.
Follow the pinout spreadsheet for Sega Master System:
| Arduino | ATMega2560 | SMS |
|---|---|---|
| A0 | PF0 | A0 |
| A1 | PF1 | A1 |
| A2 | PF2 | A2 |
| A3 | PF3 | A3 |
| A4 | PF4 | A4 |
| A5 | PF5 | A5 |
| A6 | PF6 | A6 |
| A7 | PF7 | A7 |
| A8 | PK0 | A8 |
| A9 | PK1 | A9 |
| A10 | PK2 | A10 |
| A11 | PK3 | A11 |
| A12 | PK4 | A12 |
| A13 | PK5 | A13 |
| A14 | PK6 | A14 |
| D6 | PH3 | A15 |
| D9 | PH6 | OE/RD |
| D30 | PC7 | D7 |
| D31 | PC6 | D6 |
| D32 | PC5 | D5 |
| D33 | PC4 | D4 |
| D34 | PC3 | D3 |
| D35 | PC2 | D2 |
| D36 | PC1 | D1 |
| D37 | PC0 | D0 |
| D48 | PL1 | CE |
Additionally, to cover remaining address pins, connect these custom assignments:
| Arduino | ATMega2560 | SMS |
|---|---|---|
| D10 | PB4 | A16 |
| D11 | PB5 | A17 |
| D12 | PB6 | A18 |
| D13 | PB7 | A19 |
Don’t forget GND and VCC.
Use Arduino IDE to upload Cart_Reader_Ferie.ino, then connect a serial console (e.g. picocom -b 9600 /dev/ttyACM0). You should see a “START” message. Press any key to setup pins and then start dumping read bytes to serial output. The program waits for input at every 0x10000 dumped bytes, so that you can manually copy them. Alternatively, you can remove these waits and try logging to a file.
Test functions
AFAIK they are unused. Code exists to check string “TEST” at RAM address 0x70 after reset. But this address is only written to by mini-games, and none of them have any apparent way to write such bytes.
To load these functions on hardware, I patched the main screen in a flash ROM: Calculator function writes “TEST” in the expected memory address, and jumps to test code itself; Clock function only jumps to test code, and would likely be triggered just by resetting (since “TEST” is cleared by test code).
If “TEST” is found, we have a backup test with a hidden credits roll (enabled by pressing all 4 directional buttons + RET button at the same time; keeps playing in a loop).
If “TEST” is not found, we have another set of tests. You can tell my LCD screen is missing a vertical line, and also incorrectly draws 2 horizontal lines across the screen when drawing the rectangle.
Note that ROM test verifies contents against checksums at 0x7fff0. If any patching is done, these checksums must be updated as well (it’s just a count of set bits in a 0x10000 sized page, which can be computed with a script). Curiously, the last checksum is wrong, but the test actually skips its page (0x70000..0x7ffff).
For flash ROM, I used SST39SF040. It’s connected to Ferie via enameled wires soldered to an interposer board, with headers for conveniently connecting DuPont wires.
Note that SST39SF040’s pinout has a slight difference: pin 1 is A18, while pin 31 is WE. Therefore, pin 31 (A18) on Ferie must be connected to pin 1 on flash ROM. I’ve also used pin 32 (VCC) to pull-high WE with a 4.7k resistor.
PCB
Kitty / Toyo Suisan
- Model: A 028019 / 1994
- PCB Revision: SB1P01B / 171-6896 / 837-11123
- Mask ROM: MPR-17062-T
Puppy
- Model: E 035559 / 1995
- PCB Revision: MB-TPD338-1.0
- Mask ROM: Unknown (COBs only present in “E” models?)
By following GND + VCC, then all shared address + data lines between ROM and RAM, and figuring out other lines by relative positioning, I was able to verify that this ROM has the same pinout as packaged variants:
Luckly, there are vias for all required lines, so there’s no need to expose traces for soldering. To dump ROM in-circuit, programmers aren’t able to supply the needed power to the whole circuit, thus triggering their built-in overcurrent protection. In this case, the board needs to be externally powered (2 AA batteries).
My initial approach (left pic) was to hold reset at power-on. Unfortunately this wasn’t sufficient, since CPU still tried to access ROM, creating contention with programmer’s accesses. The only way to get reliable dumps was to cut CPU traces 😥 (right pic).
World Travel
- Model: C 019432 / 1995
- PCB Revision: SB1P02A
- Mask ROM: MPR-18080A
