TMSS Disassembly

Discussion in 'Technical Discussion' started by theocas, Jul 5, 2012.

  1. theocas


    Tech Member
    So things have been relatively slow for me recently, so I decided to take a day off of hacking the shit out of Sonic 1 and sharpen my disassembly skills. I started by disassembling something simple - the TMSS. It's the thing in later Model 1's and all Model 2 and 3's that pops up this screen:

    I've tried to label everything accurately and correctly, as well as commenting things that might've needed commenting. I think I've got them all, but if not, do tell me and I'll be glad to update the disassembly. I didn't split out the font since I didn't see much value in splitting out one little chunk of data - it's at the end of the ROM anyways, but feel free to split it if you'd like.

    The way the TMSS works is that it'll check for either " SEGA" or "SEGA" at $100 in the cartridge header. The cartridge is put on the bus by setting bit 0 of $A14101, whereas clearing it puts the TMSS back on the bus. The initialisation code seems EXTREMELY similar to Sonic 1's and even (for some odd reason, I suspect it to be leftovers) checks the hardware revision and writes "SEGA" to the security register multiple times, when only needed once to activate the VDP. The TMSS loads the actual code to display the screen and swap the ROM back on the bus to RAM, but gets it's data from ROM, presumably to not clobber more RAM than needed, and probably to reduce time it takes for the screen to come up.

    An interesting thing I've noticed is that the font used also includes four light blue, stylised "SEGA" characters that are never used, possibly due to time constraints or simply because programmers forgot to write code to handle them:


    That's really it about the TMSS. I have tested this in Kega as a replacement for the usual TMSS ROM (Has a datestamp from '96 and is 16 KB, even though the actual TMSS is only 4 KB) and it worked flawlessly, but due to obvious reasons I wasn't able to test this on hardware. (Sega wouldn't let me order a custom 315-5433 with this as the TMSS ROM mask :V) This is a disassembly of the US version of the TMSS, in case you're wondering about that.


    So yeah, go wild, do whatever. Do tell me what you think about the style or anything you feel should be changed.
  2. TmEE


    Master of OPL3-SA2/3 Tech Member
    Estonia, Rapla City
    T-04YBSC-A !
    This has been done I think 3 times now :P
  3. It is good practise though! Nice work.