This turned up over on chipmusic.org - an eBay seller has 4,285 of these for sale at $5.95 each:
http://www.ebay.com/itm/370549655915...found some more information, and it looks like the cart is reprogrammable:
http://www.oocities.org/grinara/I think it would be fun to have a simple dial-up terminal on there, a possible starting point might be:
http://ewen.mcneill.gen.nz/programs/cpc/ansiterm/Apparently the cart requires activation before it will do anything making it fairly useless without any modification:
"For those of you considering the purchase of a Shark MX, be advised that since the sale of Gameshark (from Interact to Madcatz), there is no longer any support for this device, nor the proprietary email service (Gameshark BBS). The toll free# on the 30min activation card has been disconnected, and Madcatz has been of little assistance. (Apparently Madcatz only purchased the website and software rights to Gameshark, and not the "technology" portion.)
Without the MX cart first being "activated" with a factory issued REG CODE (via toll free#), the cart will not function at all, rendering it completely useless. I find it odd that Interact would have locked up the entire cart in this manner, as the PDA functions are not in any way linked to the email functions (ie, address book not linked to email composer).
If you're a collector of odds/ends GB carts, it would be a unique buy. It is a cool gizmo. Don't plan on any serious usage of the device though. Good luck with your purchase. 7/2003"
Wow. Kind of a blast from the past. I wanted one of these when I was young and this was actually in stores. My parents thought it was silly. Of course they were right.
I could get one for nostalgia's sake... but if it's totally locked even for offline stuff, and I have to go through trouble to get around this I may have to pass. Even for six dollars.
$6 shipped even. Who's to say someone won't RE it and figure out how to activate it and perhaps reprogram the cart for other useful things?
Eh, what the heck. Why not. Could be interesting.
I'm really interested by the fact that it is able to replace the Nintendo logo at boot time with its own logo. I thought that was impossible because the GB wouldn't boot without the correct logo in the ROM header. That's definitely something I'll have to look into when I get mine.
The DMG bootrom verifies the logo after it loads it. So if you are watching the address lines, you can switch the data after it has been read the first time.
See the
DMG bootrom disassembly, you can see how it loads it before it verifies it.
And the timing for replacing the logo differs on the Game Boy, the Super Game Boy, and the Game Boy Color.
I hadn't heard about Super GB being mentioned in any incompatibility with the Logo Hacks, but I had heard that they don't work on the CGB due to the different process of reading. I do remember reading that the Super GB checks the header checksum and possibly the logo on the SNES side rather than the GB side.
Sorry for necro-posting but thought this would be of some use to someone...
http://gameshark-mx.blogspot.com.au/It seems someone has cracked the Gameshark Mx email cart registration code and has even made a code generator for it!
Links to a hacked ROM and code generator are supposedly coming soon
Hi there!
So it turns out, the MX card although old, and arguably useless, IS reprogrammable and DOES contain a primitive uart (serial port)
So if you've been after that cheap ($10) flash cart (256kbyte) with a serial port for MIDI?? grab yourself one from Ebay NOW!
It seems the only people still interested in flash carts are those wanting to turn the gameboy into a synth, and they seem to want a midi interface. It has no SRAM but it is a flash cart! so you can write to the flash in operation. No battery issues. Anyway, Take a look at
http://www.bennvenn.com/mx.html if you're interested in how it works.
Ben
Do we have a full set of registers in the Datel MBC? At the very least, we know there's a UART and a bank control register...
Hi lidnariq,
I've mapped out a few registers. Check
www.bennvenn.com/Datel_MBC1.htm for info.
Ben
Nifty.
It's fascinating that the Si2400's power line (pin 4) is switchable by the MBC: I wouldn't have thought that powering the modem would have been a big enough amount of power. I guess it's easier to just depower it rather than bothering to write ATSxx=yy to the serial port.
Any idea why Cart D7 is disconnected from Flash D7? (Flash programming?) Are Flash D0..D6 directly connected to Cart D0..D6?
Cart D7 is connected to Flash D7. I must have made a typo writing that up. All 8 data lines go into the MBC. Thinking about it, it must have internal ROM too, as it feeds the gameboy a correct logo during its bootrom checksum then switches out the custom logo. I wonder what triggers the logo swapping. maybe a certain number of clock cycles on the clk pin?? Unless the real logo is located in the flash elsewhere and it just bankswitches automatically?
BennVenn wrote:
Unless the real logo is located in the flash elsewhere and it just bankswitches automatically?
Well, that's easy to check, no? I don't see the bytes 0xCE 0xED 0x66 anywhere.
BennVenn wrote:
I wonder what triggers the logo swapping.
I'd guess it switches after reading the last byte of the logo (0x0133) ... and then I'm not certain exactly what triggers swapping back. Maybe the same thing.
If something requires an authentic Game Pak to be locked on in order to boot, it can switch to the logo on the inserted Game Pak.
So the logo is in the MBC. I've erased my flash and the Gameboy still boots with the correct logo. Also found out that a read to address 0150 deactivates the MBC's internal ROM. Sanqui's 2048 would not boot on my MX cart due to no jump to 0150 at startup. Sanqui added a jump to 0150 and now the ROM plays fine.
CLK is not connected so the MBC is more than likely watching the bus for a certain address read. Cant seem to replicate it with my cart reader though. Might try step through the gameboy's boot rom via my cart reader to see what activates the initial ROM swap.
I have also cut down my MX cart to fit inside a standard gamecart, however now i cant get the original MX ROM to boot. I'll double check my address lines have not detached from the sawing of the board. Odd because MegaMan2 (256kybte) runs fine in its entirety. My replacements should arrive after the easter break so i'll continue investigating then.
AND!
I now have 10 spare Gamecart Reader/Writers available if anyone is interested. Get yourself one, and a Shark MX and you have your self a cheap Development Kit! Custom flash carts are in the works. Check out
http://www.bennvenn.com for details.
[/quote]I'd guess it switches after reading the last byte of the logo (0x0133) ... and then I'm not certain exactly what triggers swapping back. Maybe the same thing.[/quote]
Just tried a read of a blank cart, before and after a read from 0x0133. Still reading 0xFF's. Even after a few consecutive cart dumps, still 0xFF's. So its looking for a particular sequence of events. OR perhaps a defined delay between one read and another (The MBC does have a xtal strapped to the side of it) Which i just noticed has lost a leg!
Edit:
Replaced the 4mhz xtal with a 4.9152 xtal borrowed from the si2400 IC. And this is the result!
Half Flash Logo header, and half the MBC's Nintendo header... Must have in internal counter activated at the first bus RD, swapping in the Legit ROM at a number of cycles. Cool
Random thoughts that come to mind:
Have you tried dumping the MBC1's internal boot ROM? Is there anything interesting in it? (Or just the Nintendo logo?)
Do writes to any address below 0x3F00 do anything?
Given that the logo is half-and-half, it's gotta be timed from something earlier than the first fetch from 0x104, because 4MHz vs 5MHz isn't big enough. But to calculate how far back the timing should be, I'd have to understand how the logo is compressed...
Haven't tried dumping the internal ROM. I'd need to write some code on my reader to find out the timing specifics. I'd say its just the Logo stored on it though. What is interesting is that when booted on my GB pocket, even less of the GBMail logo is displayed. Looks like maybe 4 or 5 tiles from top left running right. This must mean the pocket runs a different boot rom. Must take up more clock cycles before it gets around to interrogating the cart.
Any writes below 0x3F00 are passed directly through the MBC to the Flash. Not to say that it isn't modifying any internal registers, but there is no sign of any output from the MBC.
is a read from 0x0104 the first time the cart bus is accessed?
I wonder if I force a reset via the RST line while the cart is on, if i'll get the same messed up logo or purely a Nintendo Logo.
BennVenn wrote:
is a read from 0x0104 the first time the cart bus is accessed?
In the original DMG, yes. Everything before that in the DMG bootstrap is clearing VRAM and sound registers. (0x0104 is the first byte of the copyright-used-as-licensing logo.) I can't trivially find anyone else's analysis of the later bootstraps, though, to compare.
Kinda fun to build your own replacement logo, although how much of it shows depends on which exact GB you're using.
I was just reading though the dump of the GB's ROM. looks like right from the start there is a write to $9FFF. Correct me if I'm wrong (haven't investigated) but this should be apparent on the Cart Bus? Or at least the /WR activity? looks like a good point to start an internal timer.
The original MX cart with the 4mhz Xtal booted fine on GB, GB pocket and GBC. Need to go find a 4mhz smd xtal to restore it to the way i found it...
Looks like I'm going to try dump the GB Pokects boot rom...
BennVenn wrote:
Correct me if I'm wrong (haven't investigated) but this should be apparent on the Cart Bus? Or at least the /WR activity? looks like a good point to start an internal timer.
Well, it writes to the entire area from $8000-$9fff. But I don't know what the protection register does: it could be as simple as just disabling the /RD strobe as seen by the cartridge... but it has to disable the data bus also, otherwise we wouldn't have needed to glitch it to get the bootstrap ROM out.
Good news is i've ripped the bootstrap ROM from the MGB - and it only took an afternoon!
Bad news is that it is almost identical to the DMG ROM, with the exception of the final write to 0xFF50.
http://www.bennvenn.com/MGB.ROMSo if that is not the reason behind the difference between the two consoles, What is?
BennVenn wrote:
So if that is not the reason behind the difference between the two consoles, What is?
The only remaining variable I can think of is things like power-on-reset timers... if the DMG starts executing the bootstrap a little earlier than the MGB (relative to when the 4MHz crystal's counter starts), then it will get just enough further into uploading the graphics before it's disabled.
ill piggyback a cap onto the reset line to see if it makes a difference
Edit:
And it does, 10uf begins to reverse the effect, we have 3 tiles nintendo, and the bulk of it GBMAIL. So simply timing bank swapping from the /RST line is enough to fool the Boot ROM.
While my DMG is open, might try to get the ROM out of that too
Edit again:
Well that was easy, within seconds, DMG Bootstrap ROM...
And then
Sega v. Accolade destroyed Nintendo's little scheme. By early 1993, such circumventions of the
trademark security system were no longer strictly necessary in the USA. Besides, the "Nintendo" logo is shown on the box. This would leave the reasonable user to believe that the logo identifies the maker of the
hardware. It took until the 2004 release of the Nintendo DS for Nintendo to come up with something with slightly more legal teeth.