ems.py is a utility script that currently allows unidirectional communication with the GB USB smart card 64M. Currently you can read the header and save the ROMS in bank 0 and 1 to disk.
I wrote it to better understand how the cart worked and may extend it later for writting functionality. It's experimental at best so use it at your own risk.
The GB USB smart card 64M is a very simple flash rom based cartridge sold by various distributors. It has two banks of 32M that can save a combination of various GameBoy rom formats. While the cart can save multiple roms within its two 32M pages, the SRAM is shared between both pages causing an overwrite whenever a ROM decides to save its SRAM
Communicating with the cart is fairly straightfoward as all communications can be done through USB bulk transfers. Bidrectional communication is possible once the device is claimed using the proper vendor and product id's
VENDOR = 0x4670 PRODUCT = 0x9394
Communicaton with the cart consists of sending 9 byte messages similar to
\xff\x00\x00\x00\x00\x00\x00\x02\x00
All commands conform the the following format
+---------------------+-----------+------------+ | 1byte | 4byte | 4byte | +---------------------+-----------+------------+ |READ/WRITE (ROM/SRAM)| Address | Value | +---------------------+-----------+------------+
Thus the command above breaks down to the following which reads the cartridge header
- '0xFF' - Read
- '0x0' - Cart location 0x0 [4byte padded]
- 'x00\x00\x02\x00' - ?
Available commands include
- '0xFF' - Read ROM
- '0x57' - Write ROM
- '0x6d' - Read SRAM
- '0x4d' - Write SRAM
- E28F640J3A-120 - INTEL FLASH STORAGE (64M)
- ICE65L84F L - SiliconBlue FPGA
- PL-8810 - EagleTech Technology USB controller (or variants mc9508jm8 cld 1m61j ctap0946e)
- CR 1220 - Removable 3V Lithium Battery
Big thanks to Mike Ryan & co. at https://lacklustre.net/projects/ems-flasher/ for doing all the heavy lifting to reverse engineering this cart