Anybody with Irem M72 board expertise?

[Asure]

So, i've got this Dragon Breed M72 board, and heard that it can take other rom sets. I did a little digging around, and the security PAL's for the games / mobo seem universal for at least these games:

Mainboard: M72-8L & M72-9L same for:
Air Duel, Mr.Heli/Battle Chopper, Dragon Breed, Hammering Harry, Image Fight, Legend of Hero Tonma, Ninja Spirit, X-Multiply.

(Also M72-8L and M72-9L PALS are compatible with M81-9L and M81-9P.)

Each game comes with a PAL on the game board, C3F, but they appear to be the same. For example, Mr.Heli has MH-C3F, and Dragon Breed DB-C3F but they apparently are the exact same PAL. (as seems to be confirmed by the C3F single file in the GAL version available)

It's also confirmed that one can rom swap Mr.Heli with Ninja Spirit. And, one can play X-Multiply, without placing anything on the bottom board, using Dragon Breed main board.

What i don't know, and am looking for info on for making rom kits for my personal use:
- Eprom type & size + Jumper settings for A & C
- High res pics of M72 pcb's

I can share jumper settings for Mr.Heli, and Eproms type/size+Jumper settings for Dragon Breed if anybody wants them.

 

[Asure]

Protection device: Intel 8751
DB-C-PR

EPROMs for Dragon Breed M72-C-A board:
DB-C-H3 - 27C101G (@IC43)
DB-C-H0 - 27C512-20 (@IC41)
DB-C-LO - 27C512-20 (@IC37)
DB-C-L3 - ? (@IC34) (most likely 27C101G)
DB-C-V0 - ? (@IC44) (most likely 27C101G)

MASKROMS (All are TC531000CP, 1M BIT 128K WORD x 8 BIT CMOS MASK ROMs)
DB-C-30 aka K803
DB-C-20 aka K802
DB-C-10 aka K801
DB-C-00 aka K800

M72-B-D Bottom board, all mask roms again, TC531000CP

DB-A2 aka K806
DB-A0 aka K804
DB-A1 aka K805
DB-A3 aka K807
DB-B3 aka K807
DB-B2 aka K806
DB-B0 aka K804
DB-B1 aka K805
(A rom compare from the MAME set indicates some of these roms are identical, seems the bottom board holds duplicate roms..?!)

The dump does not include the 8751 protection device.

 

[Asure]

Regarding the MCU, from the m72.c driver it appears:
- Calls a subroutine at b0000, which has to be provided by the mcu.
- It should jump directly to the game entry point.
- The routine should also write some bytes here and there in RAM (different in every game)
- To do the ROM test the program asks the mcu to provide the correct values.
- This is done only in service, so doesn't seem to be much of a protection. (i.e. we don't care about it..)

Looking at running X-Multiply on a Ninja Spirit board, both romsets are supposedly protected by the MCU. It's confirmed running on this board, see youtube.
- We have the Ninja Spirit MCU running..
- X-Multiply entry jump: 0xea,0x30,0x02,0x00,0x0e // jmp 0e00:$0230
- Ninja Spirit entry jump: 0xea,0x00,0x00,0x40,0x00 // jmp 0040:$0000
- How can this work?
- Image Fight has the same entry as Ninja Spirit: 0xea,0x00,0x00,0x40,0x00 // jmp 0040:$0000

Edit:

8751 MCU dumps are available for Ninja Spirit, X-Multiply, Legend of Hero Tonma and Image Fight, so i think the vids on youtube were made with an actual burned 8751 MCU on the board..
Gallop should run as well, it's not protected. Possibly, some M82/84 titles might run on an M72 board as well, maybe in need of some small patches.