This was to be a pm reply to Vortex but i'll put it here for the interest of others, perhaps other people here have experience with these STC chips?
Regarding the stc, as far as I could make out there's no way to dump it, so there's no code to examine, it's a case of writing a new firmware from scratch.
All it does is act as a small storage space for the cart, really just a glorified eeprom.
It stores soft-dip settings for each game (16 bytes per game, non-volatile) and current menu position (1 byte, volatile?)
It's connected to the cpld with a simple 8-bit bus (d0-d7, rd, wr, ale). There's also an INT line hooked up but I think it wasn't used?
There's 5 commands, rd game#, wr game#, rd softdips, wr softdips and some kind of verify/checksum which I never fully figured out.
It's easy to see the actual commands just by looking at the cart menu code.
I found a suitable free compiler -
SDCC
It didn't have a header file for the exact chip but that's easy to create from the datasheet (just defining register addresses etc.)
Also found a program tool -
STCGAL which uses any generic usb->ttl adapter (ft232 etc.) to flash the chip in-circuit.
I started writing some initial code, had it communicating with the menu code in Mame (created a
custom cart device with a 8752 core mcu) Never tried it on the real cart/chip although I did confirm STCGAL could communicate with the chip.
I'm going to go back through my old stuff and anything useful to Vortex i'll push to the Github repo. (Should have done that long ago )