Apart from the spreading of rom part of this topic, most of the information is actually quite interesting (at least for those who likes AMD flashes).

Taking the bait: I happen to be an openMSX developer with an original Ink cartridge. Thank you.

Btw, I'm also both an emulator developer and a proud owner of the INK cartridge

/me hi5s with dvik

Yes, fair chance that other Matra cartridges use the same mapper.

viejo: If that dump spreads further and the source points back to me I'll take the blame, I apologize for that it's possible to happen. It's more likely though that someone who owns the game will dump it himself to play it on an emulator (eg. for savestates, MSX2 differences), send it to a friend, etc, etc.

Quote:

It's more likely though that someone who owns the game will dump it himself to play it on an emulator (eg. for savestates, MSX2 differences),

which, afaik, is perfectly legal

Quote:

send it to a friend, etc, etc.

This, however, is not. Even if the friend (or trusted openMSX developer ) also has the original cartridge.

hap: hmm, the game also works with a plain mapper... Or am I missing something?

The flash is checked on some levels, first is level 6 I think (right hap?)

It will loop from level 2 to 1. If you circumvent that with a ROM hack, it'll loop from level 6 to 5.

E321: DD 21 65 87 ld ix,8765h
E325: FD 21 BA 84 ld iy,84BAh
E329: 11 F0 FD    ld de,0FDF0h
E32C: DD 19       add ix,de
E32E: FD 19       add iy,de
E330: 21 44 88    ld hl,8844h
E333: 11 11 22    ld de,2211h
E336: 19          add hl,de
E337: DD 74 00    ld (ix+00h),h      (ix=8555, iy=82aa, hl=aa55)
E33A: FD 75 00    ld (iy+00h),l
E33D: DD 36 00 90 ld (ix+00h),90h
E341: ED 5B 00 AB ld de,(0AB00h)     (de!=a401?->fail)
E345: 3E F0       ld a,0F0h
E347: DD 77 00    ld (ix+00h),a
E34A: DD 74 00    ld (ix+00h),h
E34D: FD 75 00    ld (iy+00h),l
E350: DD 36 00 A0 ld (ix+00h),0A0h
E354: AF          xor a
E355: 32 FF BF    ld (0BFFFh),a      (if bfff becomes 0->fail)

Quote:

Even if the sector is protected you can get the "auto select mode". THe protection only prevents writes and erases. I can't remember what happens to the status bits when you try to erase or write to a write protected AMD flash.

Yes, the command will work. But my point is that the flash answers that the sector is unprotected. So it is rewritable.
As I said before, the cartridge probably uses the /RD signal to address a different sector when reading that when writing. So all the flash command goes to a different sector.
I.e.:
READ -> Access sector 0 (where the game ROM is stored)
WRITE -> Access sector 1, 2 or 4 (assuming /RD is connected to A16, A17 or A18)

<SPAM>
emulator? buy the game!

http://www.hardcore-gamer.net/tienda/product_info.php/cPath/28_336/products_id/5288
</SPAM>

hm, I bought the cart... I'm happy if its emulated, so I can use it properly in emulators....

Surprise, "erase chip" function worked!
Here's INK, naked (I don't have a voltmeter):
http://home.planet.nl/~haps/crap/ink_front_red.jpg
http://home.planet.nl/~haps/crap/ink_back_red.jpg
reference: http://home.planet.nl/~haps/crap/ink_amdchip.jpg

Quote:

Surprise, "erase chip" function worked!

Sounds like a quite sad surprise. So now the cart is more or less permanently broken (well you can remove the write protection if you have the tools to do it)

Erase chip worked because it doesn't depend on the sector you write it. It affects to the whole flash.

Checking the images you can see /RD signal (slot pin 14) is connected to A18 (flash pin1 ). When you read the ROM, flash address line 18 is 0. When you write, it is 1, so it select a different 64k flash sector.
To fix it just "change" the solder jumper (in the upper-right part) to connect A18 to VCC. Then you should be able to write the cartridge again. BTW, you can flash any ROM up to 64k

But bear in mind that after writing the ROM again, it is now in sector 4 (A18 = 1) and not sector 0 (A18 = 0). To revert the cartridge to its original state you have to write the ROM into sector 0 and to do so you have to connect A18 to GND.

I hope it helps.