Hello, so this takes a dive into hardware level. There's a website retrocircuits.com that makes repros and even custom menus, might save you a LOT of time. You can see an example of the board design required to do this here
Maybe you could repurpose a NP flash cartridge
So I've never done this stuff before, and this is only ideas that I have. You'll need to do more research to find all the information you need, and there's plenty of cartridge making websites and diagrams to look up.
The guys over at nesdev are the crazy hardware type, they have a reproduction forum with lots of cartridge hardware questions. The SNES communicates with the cartridge (special chips, SRAM etc) all through the cartridge bus. There's 2 main types, HiROM and LoROM, I'll be referring to LoROM because it's a little easier. Check out the LoROM memory image attached on this post
So lots of carts have a memory address decoder chip (MAD-1 for example), that is connected to the address bus, and converts addresses to a signal. Check out the image here
. So my idea is to take a LoROM cart with SRAM and 139, and use the ROM enable pin from the 139 to communicate with a microcontroller. In the image you see address lines A20, A21, and A22 attached to the 139 chip in the middle. When those three address lines are high (011100000000000000000000) that's address $70:0000 which is SRAM, regardless of read or write pins. When the 139 senses this address, it turns off the chip enable signal to the ROM (sets it high) and sends a low signal through a transistor and enables the SRAM, described very well here
. I wouldn't tap into the transistor pin, it may drain the battery from the microcontroller when it's off.
So I'm thinking tap the ROM enable pin 0Y0, the microcontroller would see a 1 as ROM disabled/SRAM enabled. This pin will also go high when reading various other addresses, so you'll have the microcontroller waiting for a specific series of 1s and 0s (an unlock command), and assemble that into a command to send an output to enable the correct ROM chip. On the SNES side would be easy, just a loop sending the 1s and 0s by reading $70:0000 (send 1), then other ROM accesses would be 0. You could also tap into 0Y1 and 0Y2 and WR pin. Writing $20:8000 would set 0Y1 low, writing $40:0000 would set 0Y2 low, and writing $60:0000 would set both low. The CART pin has to be enabled (low) so you need addresses in the range of (00-3F,80-BF:8000-FFFF, 40-7D,C0-FF:0000-FFFF) according to fullsnes. You could hook 0Y1 or 0Y2 with WR to an AND gate and that into an interrupt pin on the microcontroller, should be a surefire way to send the first signal. This way you don't have to worry about messing with the address and data lines. But it's just a one way direction to the cartridge, no way for the cart to signal the SNES this way. Maybe the microcontroller can trigger the IRQ pin and do a system interrupt? Maybe it can raise the reset pin for a few miliseconds to reset the snes?
Maybe you could tap into the data pins when the read pin is enabled (not when write is enabled because the snes would control the data pins.) You would only send data to the snes after the unlock sequence is activated. Otherwise a game reading SRAM would read your data instead of the SRAM chip.