Extract ROMs from AtGames Genesis Classic

[arpruss]

I've been trying to think how to extract ROMs from an AtGames Genesis classic, largely for kicks rather than for any practical purpose (I already have most of the ROMs from the Steam and Amazon Appstore Android Sega collections). This is one of the super-cheap old units that have a composite TV out. The ROMs are presumably on the MSP55LV512 flash chip, but the chip is BGA so there is no easy to hook up leads to it to read data from it without desoldering it. And the processor is under an epoxy blob.

 

I am thinking about this: The unit has a functional cartridge slot, and the cartridge slot exposes the (emulated or real?) 68000's address and data lines. I checked with an oscilloscope, and indeed the address and data lines are active while the unit is running. I am wondering if there is some way to exploit these to dump the data from an emulated game cartridge while the game is running (e.g., using a microcontroller or a Raspberry PI). But I can't think of a good way.

 

Here are some things I've thought of, but none of them are adequate:

1. Monitor the address and data lines, and save the data as it comes in. But one would have to literally play the entire game to make sure one had all the data. And one would need a microcontroller with 4mb of RAM (or use a PI, but one would need some gpio extenders, and that might not be fast enough).

2.Find some way to inject code to the 68000, say by overriding the data lines, and then force the 68000 into a loop that just reads all of memory, and record the data as it comes in over the data lines. But I don't know how to override the data lines.

3. Put the processor in a halt state and then override the address lines to read through memory sequentially. But I have no idea how to access the (emulated or real?) 68000's HALT line. And even if I did, I am not sure I would know how to override the address lines without shorting things out.

 

And I want to do this nondestructively.

 

There is also an unlabeled 8 pin IC which is a 24x series i2c eeprom, but I dumped it and the contents look like the backup RAM for Phantasy Star II and Shining Force, so that's unhelpful.