> If there's a cartridge slot, and it can run code that has access to internal ROM then
> it's the type of thing where we can trojan it out. A cartridge dump is vital tho, as
> Peter's technique involves faking a known device being connected and modifying the
> code with an FPGA in realtime. If not, things are much more difficult.
This is the technique I think is most likely to work with the M68HC05 games. Many microcontrollers (particularly EPROM/OTP types) have a protection option which disables access to internal ROM when executing from external memory, but the datasheet for the (mask-programmed) MC68HC05L7 and MC68HC05L9 mentions no such thing. (I've narrowed the MCU type down to these two in part because so few other members of the M68HC05 family are even capable of executing external memory.)
As of this latest batch of dumps, all systems in geniusjr.cpp have cartridge dumps that contain valid M68HC05 code. (This includes the Genius Leader Select, which is otherwise entirely undumped.) I haven't confirmed this at all, but it seems as if the cartridges can replace the onboard external ROM entirely.
|
Previous 
Index 
Next 
Flat 
Re: DU: Final Ketchup
Reply
