So... I started poking through the ROM for Megaman X (V1.1) and noticed some copy protection.
Some key points:
- Some of the copy protection routines check for SRAM and will aggressively screw with the game when it is detected.
- The original MMX cartridge PCB used a 74LS00 chip, which caused some data to be mirrored (show up in the memory map in a couple locations). The game checks to make sure the data is mirrored, but never actually uses the data from mirrored locations.
- The game checks to see if the copy protection routines are modified. There are also a couple more checks that attempt to detect if these same detection routines have been modified.
To avoid the protection routines, I simply JMP over each routine. More information and source code here.