MAMEWorld >> EmuChat
View all threads Index   Threaded Mode Threaded  

Pages: 1

zhongtiao1
Monon Color Fan
Reged: 12/10/18
Posts: 6
Send PM


Continue Monon Color development?
#386792 - 06/22/20 07:59 PM


A couple years ago, I posted here asking for help to emulate a little system known as the Monon Color. Much to my surprise, David Haywood stepped up and said he would work on it. This led to what we currently have in mame as you can see here: https://github.com/mamedev/mame/blob/master/src/mame/drivers/monon_color.cpp

Unfortunately, he has not been able to continue working on it. Would anybody be willing to continue the progress made?

Here is the CPU Documentation: https://docplayer.net/52724058-Ax208-product-specification.html

I am willing to provide the game ROMs if needed. Here is the game list: https://github.com/mamedev/mame/blob/master/hash/monon_color.xml



MooglyGuy
Renegade MAME Dev
Reged: 09/01/05
Posts: 2258
Send PM


Re: Continue Monon Color development? new [Re: zhongtiao1]
#386793 - 06/22/20 08:10 PM


问候!

The problem with the Monon Color is that its main CPU has an embedded ROM inside of it, which handles the initial boot-up sequence. This ROM could possibly do anything, and without knowing what it is that the embedded code does, it is almost impossible to guess how the cartridge code should be booted.

The best thing that can be done right now is to try to figure out a way to "trojan" the contents of the AX208's internal ROM, so that it can be emulated fully.

The only alternative would be to have a Monon Color and at least one cartridge sent to someone who has a logic analyzer, who can then figure out what the boot ROM accesses in the cartridge ROM in order to boot the games themselves.



zhongtiao1
Monon Color Fan
Reged: 12/10/18
Posts: 6
Send PM


Re: Continue Monon Color development? new [Re: MooglyGuy]
#386794 - 06/22/20 08:14 PM


> 问候!
>
> The problem with the Monon Color is that its main CPU has an embedded ROM inside of
> it, which handles the initial boot-up sequence. This ROM could possibly do anything,
> and without knowing what it is that the embedded code does, it is almost impossible
> to guess how the cartridge code should be booted.
>
> The best thing that can be done right now is to try to figure out a way to "trojan"
> the contents of the AX208's internal ROM, so that it can be emulated fully.
>
> The only alternative would be to have a Monon Color and at least one cartridge sent
> to someone who has a logic analyzer, who can then figure out what the boot ROM
> accesses in the cartridge ROM in order to boot the games themselves.

I'm willing to send one (and maybe a non-dumped cart )

They only cost about $15 USD anyways. Shipping costs the most



MooglyGuy
Renegade MAME Dev
Reged: 09/01/05
Posts: 2258
Send PM


Re: Continue Monon Color development? new [Re: zhongtiao1]
#386796 - 06/22/20 08:46 PM


> I'm willing to send one (and maybe a non-dumped cart )
>
> They only cost about $15 USD anyways. Shipping costs the most

Do you have access to Discord? It would probably be the easiest way to contact a team member who can try to work out the details. If you do, the link to server is here.



Haze
Reged: 09/23/03
Posts: 5244
Send PM


Re: Continue Monon Color development? new [Re: MooglyGuy]
#386823 - 06/24/20 11:49 AM


> 问候!
>
> The problem with the Monon Color is that its main CPU has an embedded ROM inside of
> it, which handles the initial boot-up sequence. This ROM could possibly do anything,
> and without knowing what it is that the embedded code does, it is almost impossible
> to guess how the cartridge code should be booted.
>
> The best thing that can be done right now is to try to figure out a way to "trojan"
> the contents of the AX208's internal ROM, so that it can be emulated fully.
>
> The only alternative would be to have a Monon Color and at least one cartridge sent
> to someone who has a logic analyzer, who can then figure out what the boot ROM
> accesses in the cartridge ROM in order to boot the games themselves.

Fwiw, Peter still has the one that was already sent, but everything that happened with Morten kinda destroyed our rhythm.

There's no *obvious* way to get the data out of it, although we were informed of a test pin and readout method built into the chip by a security researcher looking at other chips in the family - he cannot however confirm that there is no read protection against that for this model, nor are we sure the pin in question is even available for us to access.

In terms of trojaning it out, the only CPU code in the ROMs is at the start - which is likely some kind of bytecode interpreter. It looks like this is copied into RAM on startup, with some kind of checksum (doesn't like being modified) which is logical because it's an SPI ROM, and executing direct from SPI is uncommon.

There are still things we'd like to try with the unit that was sent, but it's not an easy task. Also even once it is dumped we're talking about an enhanced 8051 instruction set on a device running at ~100Mhz with single cycle instructions and probably the most incredibly inefficient looking code in the world so it's probably going to run quite badly in MAME and recompilers aren't going to help on heavily banked 8-bit architectures.


Pages: 1

MAMEWorld >> EmuChat
View all threads Index   Threaded Mode Threaded  

Extra information Permissions
Moderator:  Robbbert, Tafoid 
0 registered and 148 anonymous users are browsing this forum.
You cannot start new topics
You cannot reply to topics
HTML is enabled
UBBCode is enabled
Thread views: 818