04-06-2012, 05:54 AM
Hey, thanks 
You're probably right. Maybe they didn't intend to rewrite the flash, but used it over mask roms to save the costs of the extra parts they would need for save game features..
As well as the temporary unprotect method, which uses 12V on the reset pin, there is another method which switches all blocks to unprotected permanantly... It says (page 17):
CHIP UNPROTECT
The MX29LV081 also features the chip unprotect mode,
so that all sectors are unprotected after chip unprotect is
completed to incorporate any changes in the code. It is
recommended to protect all sectors before activating
chip unprotect mode.
To activate this mode, the programming equipment must
force VID on control pin OE and address pin A9. The CE
pins must be set at VIL. Pins A6 must be set to VIH.
Refer to chip unprotect algorithm and waveform for the
chip unprotect algorithm. The unprotection mechanism
begins on the falling edge of the WE pulse and is
terminated on the rising edge.
It is also possible to determine if the chip is unprotected
in the system by writing the Read Silicon ID command.
Performing a read operation with A1=VIH, it will produce
00H at data outputs(Q0-Q7) for an unprotected sector.
It is noted that all sectors are unprotected after the chip
unprotect algorithm is completed.
I looked at the NGPC pin out, and it looks like it would work without physically modifying the cart... if the chips used by SNK have this feature.
I have no idea why the temporary unprotect method killed Crush Roller, but I have no experience with this kind of thing. The only thing I can think of is that maybe the chip doesn't like the reset pin to be floating, and it needs to go from VCC or GND to 12V and back again, or that the voltage of the 12V supply was higher than the 12.5V maximum limit when no load was attached to it
You're probably right. Maybe they didn't intend to rewrite the flash, but used it over mask roms to save the costs of the extra parts they would need for save game features..
As well as the temporary unprotect method, which uses 12V on the reset pin, there is another method which switches all blocks to unprotected permanantly... It says (page 17):
CHIP UNPROTECT
The MX29LV081 also features the chip unprotect mode,
so that all sectors are unprotected after chip unprotect is
completed to incorporate any changes in the code. It is
recommended to protect all sectors before activating
chip unprotect mode.
To activate this mode, the programming equipment must
force VID on control pin OE and address pin A9. The CE
pins must be set at VIL. Pins A6 must be set to VIH.
Refer to chip unprotect algorithm and waveform for the
chip unprotect algorithm. The unprotection mechanism
begins on the falling edge of the WE pulse and is
terminated on the rising edge.
It is also possible to determine if the chip is unprotected
in the system by writing the Read Silicon ID command.
Performing a read operation with A1=VIH, it will produce
00H at data outputs(Q0-Q7) for an unprotected sector.
It is noted that all sectors are unprotected after the chip
unprotect algorithm is completed.
I looked at the NGPC pin out, and it looks like it would work without physically modifying the cart... if the chips used by SNK have this feature.
I have no idea why the temporary unprotect method killed Crush Roller, but I have no experience with this kind of thing. The only thing I can think of is that maybe the chip doesn't like the reset pin to be floating, and it needs to go from VCC or GND to 12V and back again, or that the voltage of the 12V supply was higher than the 12.5V maximum limit when no load was attached to it