How to program a NINTENDO POWER Cartridge ?

Discussion of hardware and software development for Super NES and Super Famicom. See the SNESdev wiki for more information.

Moderator: Moderators

Forum rules
  • For making cartridges of your Super NES games, see Reproduction.
Post Reply
nintendopower
Posts: 2
Joined: Mon Jul 21, 2014 9:17 pm

How to program a NINTENDO POWER Cartridge ?

Post by nintendopower »

Hello there,
I bought a NINTENDO POWER Cartridge and try to program other game into it.
The original game in NINTENDO POWER Cartridge is Derby Stallion .
I programmed the Fire Emblem: Thracia 776 to the flash but the game is only black screen of death .
Did someone else have had this problem and know a way to fix this?
Does the the Fire Emblem: Thracia 776's rom has been revised for emulator ?
Attachments
1689412810318114782.jpg
Last edited by nintendopower on Tue Jul 22, 2014 6:21 am, edited 1 time in total.
Ice Man
Posts: 547
Joined: Fri Jul 04, 2014 2:34 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by Ice Man »

I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..
nintendopower
Posts: 2
Joined: Mon Jul 21, 2014 9:17 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by nintendopower »

Ice Man wrote:I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..
But some Games are only release in NP,like :[Genjuu Ryodan],[Super Famicom Wars]...etc.
these games has not HiRom/LoRom etc.
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Re: How to program a NINTENDO POWER Cartridge ?

Post by tepples »

You're supposed to be able to tell whether a game is LoROM or HiROM from a byte in the game's internal header.
For LoROM, byte $7FD5 will have a value of $20 or $30 and byte $7FFD will be $80-$FF.
For HiROM, byte $FFD5 will have a value of $21 or $31 and byte $FFFD will be $80-$FF.
Add $0200 to each if your image has a (redundant) floppy copier header.
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: How to program a NINTENDO POWER Cartridge ?

Post by nocash »

nintendopower wrote:I programmed the Fire Emblem: Thracia 776 to the flash but the game is only black screen of death .
How did you manage to write to Nintendo Power cartridges ???
I was thinking that it would be impossible to write anything to the FLASH chips without first sending some some secret unlocking commands to the MX15001 chip...
Did somebody figure out how to do that? Or is there no such protection at all? Or did you simply bypass that protection by doing some hardware mods... like desoldering the FLASH chips? Or do you have one of the official store/kiosk programming stations at home?
Last edited by nocash on Thu Jul 24, 2014 3:32 am, edited 1 time in total.
qwertymodo
Posts: 775
Joined: Mon Jul 02, 2012 7:46 am

Re: How to program a NINTENDO POWER Cartridge ?

Post by qwertymodo »

I just managed to pick up one of the NP SFC carts on Ebay for $20US. I'll play around with it when it arrives and let you know what I find out.
Near
Founder of higan project
Posts: 1553
Joined: Mon Mar 27, 2006 5:23 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by Near »

I'm almost certain he programmed the FlashROM directly. You probably don't *have* to desolder the chip to do this (example), but it probably makes it a whole lot easier if you do.

Nintendo Power carts are not just individual games: there's a boot menu in there that also handles all the mapping for the games. If you don't copy that (and likely, modify it for the game you want to run), then the mapper doesn't set anything up and it won't work. Your best bet would be to image a real Thracia 776 NP cart and then burn that image verbatim.

I'm glad this thread exists. I've stated that I am unwilling to collect and/or dump any flash carts (BSX/NP) because they are basically USB sticks with a weird connector and raw file system. Now I have a link to show people.

If nintendopower pulls this off, he can flip $20 eBay NP carts for $400 Wizardry 1-2-3 carts until the market catches on and all NP carts lose all their value, if he were so inclined. We already have eBay sellers reprogramming NSS carts thanks to nocash's info, so this is inevitable I suppose.

I say we go ahead and do it. Reflashed NP would make a nice boot loader for my serial port controller, I keep wiping the SRAM on my current devcart and having to break out the Super UFO to rewrite it. (I guess I could dual-purpose quertymodo's Cx4 devcart though too.)

As far as reprogramming a cart through SNES code ... the actual programming of the flash chips is almost certainly the usual 0xaa55-style commands for BS-X and GBA RAM. The flash vendor interfaces are usually very similar to each other, with a few minor tweaks. But there's probably some extra catch like a "write enable" register/sequence that the NP reprogramming stations performed via running its own boot ROM instead of booting directly off the cart. Unlikely it's anything super complicated like special voltages applied to pins that a regular SNES console can't do, to turn on reprogramming mode, although I guess we can't rule that out.

Best bet to learn how to do this through cart swapping + reprogramming, would be to emulate the actual NP menu and memory mapping chip. Get a good idea of the register space involved, look for gaps in the register table, and start experimenting. Use the usual GBA RAM rewrite command style on it as you brute-force any kind of enable handshake.

But hell, it may have no enable required at all. I don't think anyone's actually tried a straight up cart swap GBA-style reprogram before.
Ice Man
Posts: 547
Joined: Fri Jul 04, 2014 2:34 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by Ice Man »

nintendopower wrote:
Ice Man wrote:I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..
But some Games are only release in NP,like :[Genjuu Ryodan],[Super Famicom Wars]...etc.
these games has not HiRom/LoRom etc.
EVERY SNES game has a mapper, whether it be LoRom or HiRom.

As for the cartridge itself. I used simple SHVC-1AxM-xx (LoRom) or SHVC-1JxM-xx (HiRom) donor boards from sports games and the like. Programmed the EPROMS (usually 27c801 or 27c322 with a few other decoders) and replaced the original MaskROM.

That way I have made Genjuu Ryudan, Power Lode Runner and other NP games, like the Picross series. Not for sale though!

I never had a NP Cartridge in my hands yet but I might buy one just to see how it works. :P
User avatar
MottZilla
Posts: 2837
Joined: Wed Dec 06, 2006 8:18 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by MottZilla »

Ice Man wrote: EVERY SNES game has a mapper, whether it be LoRom or HiRom.
This is not true. LoROM and HiROM are not "mappers". They are terms we use for two different memory models. Nintendo refers to them as "Mode ##". They are not memory mappers in the sense like NES or SA-1/SDD-1 because they aren't capable of mapping anything on the fly. They are just a static setup of how the memory is mapped.

Take Killer Instinct for example. This game consists of only two chips on a very small PCB. One 32 Megabit MaskROM and the Lockout/CIC chip. The game is "HiROM". But there is no mapper involved. The game is "HiROM" because of what signals on the MaskROM connect to what signals on the cartridge port.
Ice Man
Posts: 547
Joined: Fri Jul 04, 2014 2:34 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by Ice Man »

My bad, "mapper" was indeed a wrong expression. HiRom/LoRom is determined whether Pin 40 is connected to A15 or not.
Markfrizb
Posts: 607
Joined: Sun Dec 02, 2012 8:17 am
Location: East Texas

Re: How to program a NINTENDO POWER Cartridge ?

Post by Markfrizb »

So why is there 7 numbers on the front? Can it hold 7 games? I didn't even know these existed until this thread! How would they program?
User avatar
MottZilla
Posts: 2837
Joined: Wed Dec 06, 2006 8:18 pm

Re: How to program a NINTENDO POWER Cartridge ?

Post by MottZilla »

Yes it can hold 7 games if they are small enough to fit into the memory space given. These cartridges where programmed at stores by a Nintendo Power writer machine. Think Famicom Disk System writer, but instead it's SNES and using Flash Memory.
Markfrizb
Posts: 607
Joined: Sun Dec 02, 2012 8:17 am
Location: East Texas

Re: How to program a NINTENDO POWER Cartridge ?

Post by Markfrizb »

Interesting! Is there any write-ups on the specs for this cart? What it can and can't do? I assume it won't do any special chip games....

Does anyone here have one of the programming machines?
Markfrizb
Posts: 607
Joined: Sun Dec 02, 2012 8:17 am
Location: East Texas

Re: How to program a NINTENDO POWER Cartridge ?

Post by Markfrizb »

I picked up a few of these NP carts and they are interesting....

It appears there is a menu to select from (albeit in Japanese).

I have a DK3 and street fighter 2 hyper fighting. The cart inside has the potential of 3 16mbit flash chips but only 2 of the flash roms are installed. So it would seem that whatever can be programmed, couldn't be any bigger than 48mbits or total more than 48mbits. DKC3 is a 32mbit game so that completely occupies the 2 flash roms on the cart.
nocash
Posts: 1405
Joined: Fri Feb 24, 2012 12:09 pm
Contact:

Re: How to program a NINTENDO POWER Cartridge ?

Post by nocash »

There are three chapters about Nintendo Power carts in fullsnes.htm, http://problemkaputt.de/fullsnes.htm#sn ... rflashcard
The I/O port chapter is essentially a long list of unknown details, ie. just a list of unsolved problems.
The FLASH directory chapter is more or less complete (some details about SRAM/HiROM allocation are missing), but it's unknown if the cartridge is using that directories for ROM/SRAM allocation at all - it's also possinle that there is a second directory stored inside of the MX15001 chip, and that the per-game memory mapping is initialized based on that info (so the FLASH directory would be merely used for GUI purposes, such like displaying the game title bitmaps).

Some things that would be interesting...

One simple thing: Dumps of more FLASH directories: That would help to figure out if there's any SRAM/HiROM allocation info in the directory.

More difficult: Somehow confirming if there is a second directory (in the MX15001 chip) or if there is none such.
Ie. doing something like desoldering the FLASH chips from one cartridge, and installing them in a different cartridge (one with differently mapped games). If that is working, then there would be apparently only one single directory (in one of the FLASH chips) (technically, that might be possible: the MX15001 chip might be able to take control of the databus during /RESET, so it might be able to read the directory info from the FLASH chip, and then map the selected game accordingly) (of course that theory won't work for bigger 4Mbyte games which come up without any menu/directory).
Being pessimistic, I would suspect that swapping the FLASH chips won't work, and that the whole (de)-soldering work would just result in crashing right after selecting a game from the menu. And even if it would work: It wouldn't really on learning how to reprogram the cartridges without soldering.

The only way to learn how to reprogram the carts is probably hacking one of the offical programming stations. As by now there seems to be little known about them. Photos of their PCBs/chipset would be nice, and one would also need dumps of their storage memory, whatever they've been using there... ROM, EPROM, FLASH, HDDs?
Post Reply