Dienstag, 27. Dezember 2016

MCU decapping

A basically very interesting arcade system is Quizard from TAB Austria. This CD-I based quiz-system uses an Standard CD-I Player and an external Jamma-PCB which is connected to the CD-I Player over the serial port on the back of the Player.
The Jamma PCB has an MCU (D8751H) as a copy protection on it and by starting the game, the CD-I player communicates over the serial port with the MCU.

There are 4 different CD-Versions for the Quizard (1, 2, 3 and 4) and a couple of different revisions for each version. For example version 1 got 8 different revisions (1.0 to 1.7).
To play a version you need the matching MCU for it! So to play any revision of version 1 you a need an MCU for version 1. The same goes for version 2, 3 and 4. So you can not play a version 1 CD with the MCU from version 4...

As it's an austrian System, and i'm austrian too, i got very soon interested in finding some CD's for it and to get it included in MAME. Thx to the help of harmony, it was also possible to play some the games very shortly after! (http://harmoniouscode.blogspot.co.at/2010/10/quizard-22-patch-free.html)

harmony got the Version 1 and 2 fully working, by hacking/patching the copy protection and without a dump of the MCU! Version 3 and 4 are bootable, but crash after you press START.
So we tought, that the copy protections from version 3 and 4 are more complex and the game needs some other values from the MCU to get it fully working...

6 years fast forward....CAPS0ff (Blog here) is doing fantastic work with decapping MCU's and other stuff! And i nearly look daily on their blog to see if new magic happened!
But i was also fascinated about the work they have done with the D8751 MCU's, and how it was possible to de-secure the lock bit!
I got so fascinated that i had to try it myself, as i have a couple of D8751's for the Version 4 here. So basically no big deal if one get's broken.

I used the following equipment:
- Galep5 Programmer (500eur)
- cheap digital Microscope (200x zoom) (25eur)
- Heat-Gun (30eur)
- cheap China Eprom UV-Eraser (15eur)

So basically cheap equipment...beside the programmer, but you can easily find cheaper ones which can also dump d8751's.

here's the mcu, before i did start:

so i heated the top of the chip at about 330° for about 20 seconds, and used a flat screwdriver to remove the top of the chip:

before i could erase the lock bit, i had to cover the eprom part with something, i did not have professional uv opaque material (like CAPS0ff), so i used electrical tape which i cut to the correct size. thx to the blog of CAPS0ff i basically knew were the lock bit is located...

so the chip was now ready for the uv eraser! 15 minutes later i tried dumping it and voila i got consistent reads! --> and yes, the chip was locked before, only giving FF's when reading...

let's hope this will get the games running in MAME! We will see soon!
For sure it's a good thing to have a dump of it, so basically now everyone can burn it's own MCU for version 4!

This was a fun challenge and it proofs that it's possible to do decaps with cheap materials and equipment! But please don't try this with EXPENSIVE and RARE games\chips!!! there's just to much risc for destroying them! leave them to professionals like the guys from CAPS0ff....

Thx again to CAPS0ff, who basically inspired me for doing this!

Donnerstag, 30. April 2015


some new stuff got dumped this month!

Sega Pico:

HPC-6038 - Choukou Senshi Changerion (Japan):

HPC-6054-00 - Pooh-san to Tanoshii Nakama-tachi (Japan):

[code]here's the japanese translation of the game...rare[/code]

HPC-6061 - Hajimema Series 2 - Hello Kitty no Tanoshii Butoukai (Japan):

just new scans..as the rom is the same as inside "HPC-6002", at least that is now confirmed!

HPC-6106 - ECC Junior no Hajimete Eigo Vol. 4 Patty Loves Animals - Doubutsu Daisuki, Patty-chan (Japan):

extremely rare cartridge! as this cartridge only got sold via mail-order!

HPC-6107 - ECC Junior no Hajimete Eigo Vol. 5 Merry Christmas, Patty! - Merry Christmas, Patty-chan (Japan):

extremely rare cartridge! as this cartridge only got sold via mail-order!

HPC-6108 - ECC Junior no Hajimete Eigo Vol. 6 Patty Goes to the Amusement Park - Patty-chan Yuuenchi ni Iku (Japan):

extremely rare cartridge! as this cartridge only got sold via mail-order!

HPC-6109 - o-Sewa Shimasho! Aka-chan Pico (Japan):

only PICO cartridge with Infrared-Connection!

HPC-6128 - Soreike! Anpanman Eigo to Nakayoshi 2 Tanoshii Carnival ~10th Anniversary Edition~ (Japan):

again, only new scans, as the rom-content is the same as of "HPC-6017", but i had to buy it for confirmation!

HPC-6136-01 - Disney Princesses - Princess ni Naritai (Japan) (Rev1):

new revision!

T-150210-00 - Sanou Kaihatsu Series 1 - Zukei Ninshiki (Japan):

new revision! the bad thing, i bought this cartridge inside a "Sanou Kaihatsu Series 5"-case (which is still undumped)...but so we got also a boxart-scan of "Sanou Kaihatsu Series 5"

Game King:
thx to SSJ who sent me a box with 16 GameKing cartridges, we got three new dumps and 13 verifications of the existing dumps! I also bought a 4in1 cartridge recently on ebay and dumped that too, so here we have the first 4in1 dump!

new Games:
- Seatercel

- Dino Adventure Legend (new Revision)

- Trojan Legend (new Revision)

- 4in1 No. 10

looking at the dump with the Graphics-Editor from Brian Provinciano:

SSJ also sent me two previously undumped GLUK exclusive cartridges:

- El Destructor:


- Tanque:

i could dump the internal rom of the Coolboy RS-1S console:


that's it for this month!

Mittwoch, 18. März 2015

What happened the last half year!

It's time to update this blog as alot of stuff happened the last six months.

Let's start with the SEGA PICO dumps. Nearly 30 new games got preserved.

DUMPING Sega Pico Cartridges:

837-11665-2 - Mikiwa Moheom-eul Ddeonayo (Korea):

Jeulgeo-oon Pati-leul Yeolja! (Korea):

837-11921 - Yosool Keure-paseu (Korea):

T-102021-08 - Ddoddo-rang Koko-rang (Korea):

HPC-6120-00 - MiniMoni. Shougakkou e Ikundapyon! (Japan)

T-133080-00 - Crayon Shin-chan o-Ekaki Note (Japan)

T-133280 - Shin Ultra Hero (Japan)

T-133320-00 - Unten Thomas Deluxe Set (Japan)

T133380-00 - Shin Ultraman Pico Ultraman Fighting Best (Japan)

HPC-6012 - Soreike! Anpanman Eigo to Nakayoshi Youchien de ABC (Japan):

HPC-6022-00 - Magic Knight-Rayearth Magic Knight Tanjou (Japan):

HPC-6052-00 - Keyboard Pico 2 Set with Sawattemiyou! Yoiko no Hajimete Keyboard (Japan):
not working with any emulator currently because of the missing Keyboard Emulation

HPC-6130 - Pooh-san no Ichi Nichi (Japan) (Rev 1) (10th anniversary):
used the same rom as "HPC-6019-01 - Pooh-san no Ichi Nichi (Japan) (Rev 1)"

HPC-6142 - Tottoko Hamtarou Tottoko Tanoshiku Aiueo - Maboroshin o Hikaru Tane o Mitsukeru no dah! (Japan):

T-103020 - Ougon Yuusha Goldran Himitsu Daihyakka (Japan):

T-133220-00 - Denji Sentai Megaranger (Japan):

T-170020 - Ultraman Kids - Tobidase! Space Picnic (Japan):
dump was already available from cowering, here are the scans

T-233010-00 - Satonaka Machiko no Tanoshii Origami (Japan):

T-255010 - Mickey no Tokyo Disneyland Stamp Rally (Japan) (REV 0):

MPR-18315 - Mickey - Viajando no Tempo (Brazil):

MPR-18318 - Ecco Jr. - No fundo do mar! (Brazil):

MPR-18319 - Cores Magicas (Brazil):

HPC-6048 - Paketto 2 Yukai na Nakama to Game de Kazu Asobi (Japan):

this one was really expensive, over 60EUR...but also one of the best graphical games for the PICO

HPC-6145 - Disney Princess Suteki ni Lesson! Hiragana-Katakana (Japan):

T-133460 - Soreike! Anpanman no Medalympic World 2 (Best Selection) (Japan):

the first "Best Selection" game, which really had a new code-revision inside!

T-133470 - Tokusou Sentai Dekaranger (Japan):

ECC Junior no Hajimete Eigo Vol. 1 Patty And Her Family - Patty-chan Family (Japan):

delete the old bad dump! this new dump is good and working in FUSION and MESS

ECC Junior no Hajimete Eigo Vol. 2 Patty Goes On A Picnic - Patty-chan no Picnic (Japan):

delete the old bad dump! this new dump is good and working in FUSION and MESS

Anpanman to PC Renshuu! (Japan):

needs emulation of the mouse

ECC Junior no Hajimete Eigo Vol. 3 Happy Birthday, Patty! - Patty-chan no o-Tanjoubi (Japan):

only working with PICODRIVE


you have maybe already seen it over at CaH4e3's Blog, but i also dumped some NES roms recently. I'm very proud of, as i firstly dumped the biggest NES rom which ever existed so far, the COOLBOY 400 in 1 cartridge. This cartridge contains 400 true games and has a size of 256mbit!

i also dumped the 138-in-1 CoolBaby internal rom, this handheld is also a great console for less than 12 USD.

for more infos about the above two dumps please visit CaH4e3's Blog LINK

DUMPING Tomy Pyuuta Cartridges:

i got borrowed 3 Pyuuta cartridges and bought 1 other undumped cartridge myself. So we also got four new dumps for this system.

Athletic Land:

Don Pan:


Marine Adventure:

All games work great with the current MESS version!

DUMPING VC4000 Cartridges:

I also got borrowed a box full of VC4000 cartridges, for redumping! This box also included three previously undumped games!

Come Come:

Munch & Crunch:

Crazy Crab:

All games work with MESS or WinArcadia.

It's always fun to secure software which is already more than 30 years old!


I wired a new adapter for the V.Smile System to dump it with my Arduino. That's why more than 50 new dumps for this system got preserved!

52-92160 - Scooby-Doo! - Funland Frenzy (US)
52-92280 - Dora The Explorer - Dora's Fix-It Adventure (US)
52-92300 - Bob the Builder - Bob's Busy Day (US)
52-92420 - Finding Nemo - Nemo's Ocean Discoveries (US)
52-92440 - Spongebob Squarepants - A Day In The Life Of A Sponge (US)
52-92660 - Cars - Rev It Up In Radiator Springs (US)
52-92860 - Shrek The Third - Arthur's School Day Adventure (US)
52-92920 - Partyland Park - A Carnival Of Play And Learn Fun (US)
Meine kleinen Tierfreunde (GERMAN) (V.Smile Baby)
52-92000 - Alphabet Park Adventure (US)
52-92240 - Cinderella - Cinderella's Magic Wishes (US)
52-67021 - V.Smile Tecknarstudio (SE)
52-84604 - Cinderella - Lernen im Märchenland (GE) (V.Smile Motion)
52-90154 - Min hunvalp (SE)
52-92073 - Peter Plys - Honningjagten (DK)
52-92074 - Nalle Puh - Honungsjakten (SE)
52-92094 - Musse Pigg - Musses magiska aeventyr (SE)
52-92173 - Scooby-Doo! - Sjov i forlystelsesparken (DK)
52-92174 - Scooby-Doo! - Tivoli-Tokerier (SE)
52-92244-104 - Cinderella - Lernen im Märchenland (REV 1) (GE)
52-92253 - Cinderella - Askepots magiske onsker (DK)
52-92254 - Cinderella - Askungens magiska oenskningar (SE)
52-92544-104 - Noddy - Detektiv für einen Tag (GE)
52-92604 - Shrek - Die Geschichte des Drachen (GE)
52-92673 - Biler - Raes i kolerkildekobing (DK)
52-92674 - Biler - Koer ikapp i kylarkoeping (SE)
52-92944 - Micky Maus - Wunderhaus (GE)
52-92954 - Mickey Mouse - Clubhouse (SE)
52-92113 - Lovernes Konge - Simbas store eventyr (DK)
52-92133 - Den Lille Havfrue - Ariels majestaetiske rejse! (DK)
52-92134 - Den Lilla Sjoejungfrun - Ariels majestaetiska resa! (SE)
52-92234 - Toy Story 2 - Operation-Raedda Woody! (SE)
52-92313 - Byggemand Bob - Bobs travle dag (DK)
52-92314 - Byggare Bob - Bobs stressiga dag (SE)
52-92854 - Wall-E (SE)
52-99034 - Nalle Puhs Aeventyr i Sjumilaskogen (SE) (V.Smile Baby)
Laer och upptaeck (V.Smile Baby)
52-92024 - Entdecke die Welt von Rotkaeppchen (GE)
52-92164 - Scooby-Doo! - Im Lernpark (GE)
52-92384 - Barney - Erlebnis-Reise (GE)
52-92264 - Elmos großes Abenteuer (GE)
52-92464 - Ernies + Berts Fantastisches Abenteuer (GE)
52-92524 - Spider-Man & Freunde - Wettkampf im Space-Labor (GE)
52-67004 - V.Smile - Zeichenatelier (GE)
52-90144 - Mein erster Hund (GE)
52-91324 - V.Smile - Lern- und Tanzmatte (GE)
52-92045 - Apprenti' Pilote (FR)
52-92065 - Winnie Rourson - La Chasse Du Miel De Winnie (FR)
52-92125 - La Petite Sirene - Ariel Devient Une Princesse (FR)
52-92145 - Spider-Man & Ses Amis - Missions Secretes (FR)
52-92165 - Scooby-Doo - Panique A Funland (FR)
52-92245 - Cendrillon - Le Reve Enchante De Cendrillon (FR)
52-92285 - Dora L'Exploratrice - Les Adventures De Dora Apprentie Mecano (FR)
52-92365 - Zezou - Notre Ami Venu D'Ailleurs (FR)
52-92585 - Les Melodilous - Les Explorateurs Vikings (FR)
52-92645 - Superman - A La Rescousse (FR)
52-92665 - Cars - Quatre Roues (FR)
52-494096 - Thomas & Friends - Tagen hjaelps at (SE)
52-9214(3) - Arielle die Meerjungfrau - Arielles aufregendes Abenteuer (GER)
52-92084 - Micky - Mickys magisches Abenteuer (GER)
52-92100(4) - The Lion King - Simba's Big Adventure (US)
52-92284-104 - Dora - Doras Reparatur-Abenteuer (GER)
52-92344-104 - Thomas & seine Freunde - Freunde halten zusammen (GER)
80-084124 - Kung Fu Panda - Der Weg des Panda (GER) (V.Smile Motion)

Some games also boot in MESS:

DUMPING Leapfrog Leapster:

A completely new system got also preserved the last few months! The LEAPSTER, a MXFlash-based handheld from LEAPFROG.

i preserved the bios and about 30 cartridges:

Cars (Germany)
Cars - Supercharged (USA)
Clifford - The Big Red Dog - Reading (USA)
Cosmic Math - Arcade-Style Learning! (USA)
Demo - Herbst 2004 II (Germany)
Digging for Dinosaurs (USA)
Disney Princess (USA)
Disney Prinzessinnen - Zauberhaftes Lernen (Germany)
Dora - Retter der Wildnis (Germany)
Findet Nemo (Germany)
Foster's Home for Imaginary Friends (USA)
Get Puzzled! (USA)
Grundschule 1 (Germany)
Grundschule 2 - Musik in Gefahr (Germany)
Lernen mit Leap (Germany)
Reading with Phonics - Mole's Huge Nose (USA)
SonicX (USA)
Spider-Man - Schachmatt den Schildersaboteuren! (Germany)
Spongebob Schwammkopf - Zeitreise durch das Wurmloch (Germany)
Spongebob Schwammkopf hat alles im Griff (Germany)
Star Wars - Jedi Math (USA)
The Backyardigans (USA)
The Batman - Multipliziere, dividiere und regiere (Germany)
Vorschule (Germany)
Wörterjäger - Lernen im Arcade-Stil! (Germany)
Weltraum-Mathe - Lernen im Arcade-Stil! (Germany)
Zahlenjäger - Lernen im Arcade-Stil! (Germany)

DUMPING GameKing Cartridges:

Porchy dumped 13 cartridges from this system already last year. I got interested for dumping the other undumped cartridges now and again wired an adapter for my Arduino.

here are the first three dumps i released on 16.03.2015:

F1-2004 Racing
Feichuan VII


It just scared me myself how many games i dumped the last 6 months. I really did not think that this post will get so long! That's about 130 games from 7 different systems.

Again, i should upate this blog in shorter periods.