In reference to the original Chinese version; quotes from ROM sites:
"Terrifying 911. What an interesting cart. Certainly the most advanced bootleg i've seen. I dumped the cart and fixed up a few lines of code that were triggering bank switching at the wrong time. Attached the ROM. Edit: Bounced back from your email server, I'll upload it some place.
Not sure if you tried to dump with my Joey but the cart header says its only 64kbytes so thats all that gets dumped. If you dump under the BV cart it'll do a full 8mbyte dump. Look in a hex editor for a repeat of the header and crop the ROM. In this case it was 2mbytes.
Fixed up the header, it clearly has an MBC, I selected MBC5 which makes sense with the bank switching at address 0x2000/0x2001
It still wouldn't boot so I trapped all writes to the carts MBCs. I found two rouge writes at around 0x2500. I nop'd these two writes and we're good to go!"
"The original cart utilizes a custom mapper which is not an MBC5 as the header states. What Ben has done is dumped the first 32Kb and placed code breaks at mapper calls in an emulator, then replaced the custom addresses with MBC5 addresses. By doing this, he was able to dump each 32Kb bank one-by-one until we have this complete ROM. Now the cart will run in emulators and on real hardware."
"Their protection is almost identical to BBD's, but they make much better use of it (they switch modes while the game is running, while BBD just sets one at the beginning and that's it; also the cart initialises in a mode that prevents the entire ROM from being read, similar to VF's GBA games), so it's not so easy to hack out. Hence why only Li Cheng ever did it, I guess. So, for now, these games will only run in
hhugboy v1.1.8 and up."