MAMEWorld Forums - EmuChat - Re: Continue Monon Color development?

> 问候!
>
> The problem with the Monon Color is that its main CPU has an embedded ROM inside of
> it, which handles the initial boot-up sequence. This ROM could possibly do anything,
> and without knowing what it is that the embedded code does, it is almost impossible
> to guess how the cartridge code should be booted.
>
> The best thing that can be done right now is to try to figure out a way to "trojan"
> the contents of the AX208's internal ROM, so that it can be emulated fully.
>
> The only alternative would be to have a Monon Color and at least one cartridge sent
> to someone who has a logic analyzer, who can then figure out what the boot ROM
> accesses in the cartridge ROM in order to boot the games themselves.

Fwiw, Peter still has the one that was already sent, but everything that happened with Morten kinda destroyed our rhythm.

There's no *obvious* way to get the data out of it, although we were informed of a test pin and readout method built into the chip by a security researcher looking at other chips in the family - he cannot however confirm that there is no read protection against that for this model, nor are we sure the pin in question is even available for us to access.

In terms of trojaning it out, the only CPU code in the ROMs is at the start - which is likely some kind of bytecode interpreter. It looks like this is copied into RAM on startup, with some kind of checksum (doesn't like being modified) which is logical because it's an SPI ROM, and executing direct from SPI is uncommon.

There are still things we'd like to try with the unit that was sent, but it's not an easy task. Also even once it is dumped we're talking about an enhanced 8051 instruction set on a device running at ~100Mhz with single cycle instructions and probably the most incredibly inefficient looking code in the world so it's probably going to run quite badly in MAME and recompilers aren't going to help on heavily banked 8-bit architectures.