I am still trying to reverse engineer that mystery cartridge. I did have xrays taken, but unfortunately there wasn’t enough detail to see any device markings. However, the cell structure itself looked like a normal memory, so I am assuming that it is just a normal flash memory.
I hooked it up to the logic analyzer again and did a few raw captures to check my logic for what I think the pin functions are for. When I was certain that I found the chip select line, I triggered on that. I see one line that appears to operate like a clock, but it is not always regular. It could be an OE line. Then there are four lines which appear to be data. Looking through my various captures, the pin that I label D0 is the only pin that toggles when CS is not active. I think this means it is likely a serial data input coming from the microcontroller.
I am attaching a screenshot of the logic analyzer output for what appears to be one cycle. I am hoping that someone can look at it and help me figure out how to start reading it. The thing that is really got me is that there are only 7 clock pulses in the cycle.
I set some cursors on what looks like important points. If my pin functions are correct, I am seeing that the data lines are being set 100ns before the clock is pulsed high. This would indicate to me that this cycle was likely created by the CPU and not the memory.
Any sharp members out there able to look at this and figure out exactly how it works? The data that I would expect to be encoded on here is sound and motor movement information. There are 3 motors in the product. If that information is useful.