The cart just needs to have a header similar to the CD header, and the BIOS will jump to it (IIRC, the entry offset is 0xF00 in A-Bus CS1 space, which I can't remember the base address of right now). The way that the AR boots Saturn games is a bit trickier, and I'm not familiar with the details (AFAIK it actually runs the BIOS CD booting code, but interrupts it with the User Break Controller in order to patch the region code and load the cheat routine). Firmware images are available in the upgrade/tools packages from Datel and EMS. Despite the fact that they distribute the firmware images themselves, there's "protection" against dumping the firmware using the standard commlink protocol commands, so if you want to back up the firmware on your cart you'll either need to write your own dumping program (not hard) or a program that patches the in-RAM copy of the firmware to bypass the protection (I think one of Charles MacDonald's docs shows the relevant chunk of asm).