Taking a couple of days off to see my pinball fanatic buddy Stuart in the UK. I want to make a pinball #fpga mashup! We're going to try and intercept ram writes and figure out when the high score is broken! 
On the train to the airport I will test my verilog model of the SRAM against the real thing and see if I can read and write to it.
Installed the SRAM adapter board and then machine wouldn't start! Fairly terrifying! After an hour of debugging traced to a blown fuse and dodgy socket... Phew! 😌
Now showing the address on the LEDs. Next step, power off machine and try to dump the SRAM to my pc for inspection.
first output of the SRAM dump! Now I have to find the high score (550,000). Which is 0x86470, so should be stored probably in 4 consecutive bytes.
hmm, if I dump the SRAM twice I get different checksums for each dump - so I have something wrong with the verilog that controls the SRAM. Perhaps timing?
Looking at the schematics, SRAM is backed up by a coin cell via a diode. So with machine off (so I can read the SRAM with FPGA), perhaps levels are too low.
Right, not getting anywhere - taking a break. What do people think of this assumption: default high score gets written to SRAM after reset. Max score is 999999, so stored in 4 bytes. So if I look for 0x00_08_64_70 I should find the address of the high score in SRAM. Right?
Ps. M6800 processor is big endian.
good progress this morning thanks to the tip from @micko_mame and @anachrocomputer! Instead of searching for the hex value of the score, I searched for the packed BCD: 55 00 00. Address 1149 looks promising - so I checked the same address after getting a fake high score...
@micko_mame @anachrocomputer So I'm looking for 80 39 50. Get this instead. Funny byte ordering. Then I wrote that Score value back to a reset SRAM chip and get 503950! So getting closer!
Looks like it's not packed BCD, but lowest 4 bits in each byte from address 0x1148. Don't know what the upper 4 bits are 4, any ideas? After writing these values I can update the high score to the old one!
And after writing 00010000 to 0x1148 I can reset the high score to 10,000 and that makes it easy to beat. So next step is snoop the bus while the machine is playing and whenever those addresses are read - store the data lines as it means a new high score is set.
Snooper was easy, just listen to chip enable, address and data lines and when the SRAM is read at the high score address store it for later retreival over serial! Works! Final (pointless) step is to auto tweet it.
And auto tweeter straight forward - just had to reset the high score to something lower so I could beat it!
And here's the repo if you're interested in the Verilog. github.com/mattvenn/ds260…
And here's the repo if you're interested in the Verilog. github.com/mattvenn/ds260…
