This might be a good idea to once again mention that I'm working on a flasher on my own, which will have features the existing "Polish student" flasher doesn't.
The pirate cart probably needs special commands, to switch to a different ROM, which the flasher cannot give, as it only supports a standard MBC. These commands would normally be given by the menu ROM. My flasher could do this easily, of course. I think 12ianma's idea was to stick a big cap on the cartridge so it would retain the choice from the menu and then move the cartridge to the flasher.
It's strange that dumping the ROM gives Barbie and not the menu. Maybe the ROM starts with something that is the Barbie ROM with a small boot strap to select the menu ROM, which doesn't work after you've dumped the ROM and starts the actual Barbie ROM instead. The changes could also have to do with a completely non-standard memory controller. Would you mind sharing what you have dumped? And maybe if you want loan me the cartridge for experiments.
The soldered jumper is interesting. I'm thinking that the ROM might be a programmable memory, but probably one time programmable at best. If this is the case, the jumper might be for the programming voltage or a write pulse for the memory. Another thing it might be is a game selection, so that removing the solder turns it into a different multicart. (Cheaper to make a single mas ROM and use for different products.)
But where is it even connected? It seems to ust be a via, which is extended down a little on the bottom side. The solder blob is near a line which goes off to the /RD line (not /WR) but I think that's not even connected to the solder blob. So it seems to be connecting two points on the chip, unless one is a sneaky ground.
Edit: Also, don't be fooled by the flash manufacturer/chip ID values printed there. Those are just bytes read from the ROM. Normally, you would detect a flash chip by writing a certain command sequence to the flash chip and then read out the values at certain memory locations. This flasher is dumb and reads the values without making an effort to check whether they are actually from the flash chip or just bytes from the ROM. My flasher, that I mentioned above, does do this.
