[TmEE]

Method is :

Hooking up a LPT cable between PC and unit, then running some software on a flashcart to dump the BIOS and send it over the cable to PC... this way, some bytes in the BIOS are not shadowed by some register settings. And desoldering the chip and dumping it with a EPROM burner showed same results so I can say the cable is good enough for dumping, if it weren't, one of my programs that relies on the cable operation would not work :P

And I will get the part numbers tomorrow (technically today) after getting some sleep. wondermega nad Xeye both have custom programmed OTP EPROM chips in them not mask ROMs so no part number for them.

I'll dump TMSS of my units soon, but I think there's no difference between them.


And all put together a list of hardware stuff that I should check.

EDIT: and someone please delete the post before it, I have no idea how that happened......

This post has been edited by TmEE: 26 June 2009 - 06:25 PM

[Puto]

I can't solder cables for shit nor do I have easy access to a PC with a parallel port, so I'm not dumping my MCD's bios. Sorry guys.

[SpinelSun]

Method is :

Hooking up a LPT cable between PC and unit, then running some software on a flashcart to dump the BIOS and send it over the cable to PC... this way, some bytes in the BIOS are not shadowed by some register settings. And desoldering the chip and dumping it with a EPROM burner showed same results so I can say the cable is good enough for dumping, if it weren't, one of my programs that relies on the cable operation would not work :P

Uhhh... so you are saying your dumps match exactly whats on the physical ROM? I'm not so sure of that. For 1, the X'eye has no physical seperate ROM I could find(its hidden in a SEGA custom 315-xxxx chip I believe) so you couldn't dump it using a EPROM burner/reader. You could dump the MCD1/2 this way though, if thats what you ment.

I dumped mine using MoD's cable and software. Although I did not dump it with the "CD BIOS Dump option" as that will have location 0x72 as RAM. I inserted a cart and put a piece of paper over pin B32 (!CART_IN). And did a "Cart Dump", but the exact second I started the "Cart Dump" I removed the paper covering B32. This no longer dumps from the cart slot but instead the sega cd bios.
I also dumped my Sega CD 2 using a EPROM reader/burner and it matched exactly byte for byte to the ROM I dumped using the above method. So thats how I KNOW my X'eye dump is the good one.

Also, I dumped my TMSS using the above method. With B32 enabled instead of doing a "Cart dump" for the sega cd BIOS, I did a "CD BIOS Dump" which will dump the TMSS when !CART_IN is enabled. The TMSS from my Genesis 1, Genesis 2 and my X'eye were byte exact. and matched exactly the dump already on the net.

The fact that your dumps have FFFF instead of FD0C or any other data at 0x72 shows without a doubt that yours are not 1:1 byte exact whats on the physical ROM. Mine is correct.

This post has been edited by SpinelSun: 26 June 2009 - 08:16 PM

[TmEE]

There is a physical ROM in Xeye, its a small surface mount ROM chip in SO package, IC104 in the Xeye I have, a custom programmed 1Mbit 120ns OTP EPROM chip labelled TC531024F-120. I desoldered that and dumped it, and it showed exact same results as what cable does, even after successive dumps to verifiy correctness of things.

AND if you dump from MCD using the CD, some vectors in the address space where BIOS is, gets shadowed by contents of certian registers in the setup and that is what is going on in your case, the FD0C is not original contents of the ROM. You have to do some overdumping, the mirrors of the ROM are having FFFF not FD0C. You can ask Nemesis about it, he'll say that what I described is what is going on.

Using cartridge to transfer the ROM will not have this in effect since MCD side is not active and you can get a clean dump.

Which range are you dumping the BIOS from out of curiosity? I found when I was dumping my BIOS files, if I dumped from the base range where the BIOS was mapped, something was masking some of the interrupt vectors from the vector table at the start of the ROM. I could only get a "clean" dump of the bios when I dumped from a higher mirrored address. There are some BIOS files marked as bad dumps in the goodgen set that have these vectors masked IIRC. Something to check if you haven't noticed. Do a dump of the entire 4MB range and compare some of the mirrors with the first copy. In my case, I was dumping from the MegaCD via a modified version of MoD's rom dumping tool though, so you might not have this problem when the MegaCD is inactive.

http://gendev.spritesmind.net/forum/viewtopic.php?t=428

This post has been edited by TmEE: 26 June 2009 - 09:45 PM

[SpinelSun]

There is a physical ROM in Xeye, its a small surface mount ROM chip in SO package, IC104 in the Xeye I have, a custom programmed 1Mbit 120ns OTP EPROM chip labelled TC531024F-120. I desoldered that and dumped it, and it showed exact same results as what cable does, even after successive dumps to verifiy correctness of things.

I must've missed that chip when I was identifying my X'eye chips. can you confirm that the Wondermega also uses the LC89513K CDC like the X'eye? The normal sega-cd uses LC89515.

AND if you dump from MCD using the CD, some vectors in the address space where BIOS is, gets shadowed by contents of certian registers in the setup and that is what is going on in your case, the FD0C is not original contents of the ROM. You have to do some overdumping, the mirrors of the ROM are having FFFF not FD0C. You can ask Nemesis about it, he'll say that what I described is what is going on.

Using cartridge to transfer the ROM will not have this in effect since MCD side is not active and you can get a clean dump.

Right, I know that and already had a discussion about that with Mask of Destiny some years ago when he first released his software.
And Thats EXACTLY what I did too. When !CART_IN is enabled, the segacd gets disabled and the CD BIOS and TMSS switch places in memory. I did a "Cart Dump" with !CART_IN enabled which dumps the sega cd BIOS when the Genesis is enabled and sega cd disabled. Doing that gave me a 32Mbit file of the 1Mbit BIOS. In the first 1Mbit is FFFF at 0x72, the mirror copies (which come straight off ROM have FD0C).

I do not mean to be slightly and ass here, but It sounds to me like your info is slightly mixed up possibly? and the dumps you provided were the shadow overlay memory dumps, and not the overdump mirror copy or dumped straight from the chip.

Because I am 100% sure that FD0C is the correct ROM contents and FFFF is the shadow overlay contents.

This post has been edited by SpinelSun: 26 June 2009 - 10:02 PM

[TmEE]

And wondermega uses some other CDC, the only Sanyo chip is a LC8951, there are more chips on the 2nd board: HD4074019FS, CDX2500A0 and CXA13720.... Wondermega is a bitch setup since the board is covered with noon transparent stuff on one side and all research is severly complicated :/
...and Wondermega uses same OTP EPROM chips as Xeye BTW

The FFFF/FD0C this is interesting.... I'll do some more overdumping.... this is fun... today is busy day, I haven't got around to sleeping....
Shadowing should not be the case in my dumps since MCD is in inactive state and I did dumps of the chips themselves (but I cannot be sure that I actually compared the file off the chip not the file off the cable........... I'll be sure today when I do more fun). I'm seriously going to do a nice facepalm when the case in ( ) is true.....

This post has been edited by TmEE: 26 June 2009 - 10:32 PM

[Sik]

What if there are two different revisions but are so minimalistic that the version number wasn't changed at all? =P

*slapped*

:(

[SpinelSun]

And wondermega uses some other CDC, the only Sanyo chip is a LC8951, there are more chips on the 2nd board: HD4074019FS, CDX2500A0 and CXA13720.... Wondermega is a bitch setup since the board is covered with noon transparent stuff on one side and all research is severly complicated :/
...and Wondermega uses same OTP EPROM chips as Xeye BTW

So the wondermega uses the same Toshiba TC531024F-12? (you said TC531024F-120.. ) Yours is the SEGA Wondermega right? Not the Victor one? If its SEGA, did the Wondermega mainboard contain SEGA or Victor markings? and did the BIOS ROM in the wondermega have a label with a SEGA MPR or OPR part number?
the Sega CD 1 uses the LC8951, Sega CD2 use LC89515 which are both compatible IIRC but the LC89513K is not 100% compatible with LC8951 IIRC... but I could be wrong.

The FFFF/FD0C this is interesting.... I'll do some more overdumping.... this is fun... today is busy day, I haven't got around to sleeping....
Shadowing should not be the case in my dumps since MCD is in inactive state and I did dumps of the chips themselves (but I cannot be sure that I actually compared the file off the chip not the file off the cable........... I'll be sure today when I do more fun). I'm seriously going to do a nice facepalm when the case in ( ) is true.....

Alright cool. I await your results.
Because I have Personally dumped my Sega CD 2 (2.11X BIOS) with a ROM reader and ROM contents at 0x72 had FD0C and main memory copy had FFFF overlay (mirror overdump had FD0C also). Also the guy from gamesx dumped his 1.02 US and 1.02 JP Laseractive SEGA PAC BIOS chips directly with a ROM reader and his dumps have FD0C, same with the person who dumped the 1.04 US laseractive, FD0C.

Also, the first byte in your dumps (0x00) have F4FF, but chip dumps have FFFF. Main memory shadow overlay copy AND mirror overdump copies both have FFFF. could there be a bug in your dump program? Because I have never seen F4FF at 0x00 in memory or chip dumps...

This post has been edited by SpinelSun: 26 June 2009 - 11:00 PM

[TmEE]

The change is about a thing that is "don't care".... all other bytes are same in the dumps.

[SpinelSun]

The change is about a thing that is "don't care".... all other bytes are same in the dumps.

Not quite sure I understand...

I think what you're trying to say is that the bytes that are different between mine and your dumps, don't matter at all, it will work fine with "wrong" data there, right? I know that already

However I am an extreme perfectionist. When dumping something, I should be exactly sure that the data is 1:1 whats on the chip, if it's being dumped from memory. Which is why dumping the chip directly is preferable, if it all possible.

[TmEE]

I just pointed that out to Sik, I myself am a bit perfectionistic too and I'm going to find out if my dumps are good or not.... and it seems I'm not going to bed today anyway....
direct dumping is always possible, you just need some equipment and de/soldering skills and I've got all of it :3

EDIT: I just redumped all the BIOSes, this time the whole range they're mirrored in, and they all had $FFFFFFFF in the shadowed vector part.

I'll be getting down to desoldering one chip later on, and the MPR for my MCD2s will come in a moment, I forgot to take that piece of paper with me.

EDIT2 : The BIOS chips in my MCD2s have MPR-15512-T (and 5M62-15-L661) written on them.

This post has been edited by TmEE: 27 June 2009 - 01:46 AM

[SpinelSun]

EDIT2 : The BIOS chips in my MCD2s have MPR-15512-T (and 5M62-15-L661) written on them.

Which Country/bios version did MPR-15512-T come from? both MCD2s had the same BIOS version then?

and what model was your Wondermega? the Victor RG-M1 or the Sega HWM-5000/HWM-5010?

[TmEE]

So the wondermega uses the same Toshiba TC531024F-12? (you said TC531024F-120.. ) Yours is the SEGA Wondermega right? Not the Victor one? If its SEGA, did the Wondermega mainboard contain SEGA or Victor markings? and did the BIOS ROM in the wondermega have a label with a SEGA MPR or OPR part number?
the Sega CD 1 uses the LC8951, Sega CD2 use LC89515 which are both compatible IIRC but the LC89513K is not 100% compatible with LC8951 IIRC... but I could be wrong.

The last 0 is always omitted from (Flash(E(P)))ROM chips, 12 means 120ns, which is a normal value.
The BIOS is a OTP EPROM with no MPR/OPR markings. Same Toshiba chip as in Xeye is used in the Wondermega.
Only things with Sega markings on the boards are the ASICs or rebraded chips by Sega, all else is JVC. I cannot wait to get a working camera...

Alright cool. I await your results.
Because I have Personally dumped my Sega CD 2 (2.11X BIOS) with a ROM reader and ROM contents at 0x72 had FD0C and main memory copy had FFFF overlay (mirror overdump had FD0C also). Also the guy from gamesx dumped his 1.02 US and 1.02 JP Laseractive SEGA PAC BIOS chips directly with a ROM reader and his dumps have FD0C, same with the person who dumped the 1.04 US laseractive, FD0C.

Its getting more fun and fun...anyway, direct chip dumps I will do reveal all wether MCD side is doing fun with certain locations or not.... in my cases, with cable dumps using MD side with cartboot, mirrors had still FFFFFFFF in the vector of interest....
I need to dig out my heatgun...

Also, the first byte in your dumps (0x00) have F4FF, but chip dumps have FFFF. Main memory shadow overlay copy AND mirror overdump copies both have FFFF. could there be a bug in your dump program? Because I have never seen F4FF at 0x00 in memory or chip dumps...

Ok, seems the MCD is not totally inactive or something, the mirrors have the first bytes FF not F4...... fun stuff...

bug is highly unlikely, since the programs that do dumps are not doing any real data manipulation other tan splitting a byte into nibbles, I just read a byte from $400000 and send it to PC which will store it, and the process repeats until desired amount it read...

Which Country/bios version did MPR-15512-T come from? both MCD2s had the same BIOS version then?

and what model was your Wondermega? the Victor RG-M1 or the Sega HWM-5000/HWM-5010?

MCD2s are both European ones, BIOS ver 2.00 , Wondermega is a Sega HWM-5010.


And here's the cable overdumps : http://www.fileden.com/files/2008/4/21/1876835/BIOSES.RAR

I'm starting to think that dumps from MCD using MD side won't be that effective.... now I'm wondering what happens if I put couple of dummy send/recives into the programs.... data corruption is highly unlikely, I use same routines in one other program that cannot work with data corruption and it works perfectly...

[SpinelSun]

MCD2s are both European ones, BIOS ver 2.00

Just to confirm, both of your MCD2s have the same 2.00 with the same MPR-15512-T number? Your original post made it sound like both of your MCD2s each had a different version BIOS?

I'm starting to think that dumps from MCD using MD side won't be that effective.... now I'm wondering what happens if I put couple of dummy send/recives into the programs.... data corruption is highly unlikely, I use same routines in one other program that cannot work with data corruption and it works perfectly...

Yeah, it just could be that reading the shadow address bios location will always read as FFFF in all mirror locations when the sega cd is completely off/disabled. Cause when the Sega CD is powered on/enabled main reads FFFF and mirror reads FD0C, and FD0C is what's been shown to be in the physical ROM.

This post has been edited by SpinelSun: 27 June 2009 - 03:25 AM

[SegaLoco]

And here's the cable overdumps : http://www.fileden.com/files/2008/4/21/1876835/BIOSES.RAR

Sooo.. which versions should be on the tables, this new file?