Hacked Famicom Cartridge cart - Need info for dump

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems.

Moderator: Moderators

lidnariq
Posts: 9765
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by lidnariq » Wed Nov 01, 2017 11:40 am

labatt24 wrote:I have some difficulty using the PM system (mails stuck in the Outbox).
Messages stay in the outbox until the recipient reads them; then they move automatically to "Sent"
It seems it did the work! Now I can play games. The ROM size in the ZIP is 2MB. The odd thing here is the cart is 700-in-1 and actually I have 210-in-1 BUT in a working condition. The 700-in-1 is exactly the same thing than the golden game 260-in-1 but without a music menu and without visual (only a black background, purple color menu and the mention 700-in-1 center upper.)

It is possible the cart is using a different mapper ?
No, given Nestopia's source I'm pretty certain what you have is (pedantically) mapper 235.

However, mapper 235 is a bit of a mess. The 74xxx ICs seem to be always the same, as we've said ... but each of the four ROM slots can vary. Slot "0" has to be populated, but the other 3 could be, or could not be. So there's eight different variants, assuming it's just using 1 MiB ROMs. (One with one ROM, one with four ROMs, and three each with two or three ROMs)

This is one of those situations where the iNES / NES2.0 format shows how it's a bit of a bad match. Both UNIF and MAME's encoding would instead store the separate ROMs as separate blocks, and the emulator could just know whether each of the four slots had a ROM without the file needing explicit padding.

labatt24
Posts: 26
Joined: Thu Oct 05, 2017 5:20 am

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by labatt24 » Thu Nov 02, 2017 4:46 am

lidnariq wrote:
labatt24 wrote:I have some difficulty using the PM system (mails stuck in the Outbox).
Messages stay in the outbox until the recipient reads them; then they move automatically to "Sent"
It seems it did the work! Now I can play games. The ROM size in the ZIP is 2MB. The odd thing here is the cart is 700-in-1 and actually I have 210-in-1 BUT in a working condition. The 700-in-1 is exactly the same thing than the golden game 260-in-1 but without a music menu and without visual (only a black background, purple color menu and the mention 700-in-1 center upper.)

It is possible the cart is using a different mapper ?
No, given Nestopia's source I'm pretty certain what you have is (pedantically) mapper 235.

However, mapper 235 is a bit of a mess. The 74xxx ICs seem to be always the same, as we've said ... but each of the four ROM slots can vary. Slot "0" has to be populated, but the other 3 could be, or could not be. So there's eight different variants, assuming it's just using 1 MiB ROMs. (One with one ROM, one with four ROMs, and three each with two or three ROMs)

This is one of those situations where the iNES / NES2.0 format shows how it's a bit of a bad match. Both UNIF and MAME's encoding would instead store the separate ROMs as separate blocks, and the emulator could just know whether each of the four slots had a ROM without the file needing explicit padding.
Understood for the PM system.

The most important is we did a correct dump of this cart!

Since I don't have skill with those scripts, I don't know what to search on the net.

If you find something just tell me!

If you think I can do something, again there tell me!

Thanks you,

Guy

lidnariq
Posts: 9765
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by lidnariq » Thu Nov 02, 2017 12:21 pm

I quicky cross-referenced the broken dump (the first half of each 32 KiB contained a copy of the second half, i.e. "PRG A14 was kept high during dumping") you'd sent me against everything in GoodNES, and found:

* The first 2 MiB are a perfect match for the first 2 MiB of what's called "260-in-1 [p1][!]"
* The first 1 MiB is ALSO a perfect match for what's called "150-in-1 (Mapper 43) [p1][!]" and "150-in-1 [a1][p1][!]" — clearly the "MK008" ROM
* The last 16 KiB are a match for a random subset of what's called "Super Mario Bros 2J + SMB1 Chars (Hack)" (starting at PRG offset 0x70000)

labatt24
Posts: 26
Joined: Thu Oct 05, 2017 5:20 am

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by labatt24 » Fri Nov 03, 2017 8:13 pm

lidnariq wrote:I quicky cross-referenced the broken dump (the first half of each 32 KiB contained a copy of the second half, i.e. "PRG A14 was kept high during dumping") you'd sent me against everything in GoodNES, and found:

* The first 2 MiB are a perfect match for the first 2 MiB of what's called "260-in-1 [p1][!]"
* The first 1 MiB is ALSO a perfect match for what's called "150-in-1 (Mapper 43) [p1][!]" and "150-in-1 [a1][p1][!]" — clearly the "MK008" ROM
* The last 16 KiB are a match for a random subset of what's called "Super Mario Bros 2J + SMB1 Chars (Hack)" (starting at PRG offset 0x70000)
Seems logic. So there is 1 MiB somewhere that is not included in the .nes rom? It is a limitation of Kazzo scripts? Sorry for my ignorance!

lidnariq
Posts: 9765
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by lidnariq » Fri Nov 03, 2017 8:48 pm

Of the 4 MiB of the partial dump you sent me, the first 2 MiB are accounted for; the next 1 MiB is what Kazzo sees as open bus ($FF), and the last MiB are the UVEPROM repeated to fill 1 MiB.

Unfortunately(?) I only have 16 KiB of the contents of the UVEPROM, and unlike the existing dumps of MK008/MK009, it's weirdly aligned (i.e. the 16 KiB I see, despite coming from a region where A14 is high, correspond to a previous dump in a ROM where A14 is low), so I don't actually have any guess what's in the half that I haven't received.

BUT: I wouldn't be surprised if it turns out that the 27C256 actually contains two copies of the same 16 KiB of source data.

labatt24
Posts: 26
Joined: Thu Oct 05, 2017 5:20 am

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by labatt24 » Sat Nov 04, 2017 10:19 am

lidnariq wrote:Of the 4 MiB of the partial dump you sent me, the first 2 MiB are accounted for; the next 1 MiB is what Kazzo sees as open bus ($FF), and the last MiB are the UVEPROM repeated to fill 1 MiB.

Unfortunately(?) I only have 16 KiB of the contents of the UVEPROM, and unlike the existing dumps of MK008/MK009, it's weirdly aligned (i.e. the 16 KiB I see, despite coming from a region where A14 is high, correspond to a previous dump in a ROM where A14 is low), so I don't actually have any guess what's in the half that I haven't received.

BUT: I wouldn't be surprised if it turns out that the 27C256 actually contains two copies of the same 16 KiB of source data.
Do you think that thing could affect the dump? It seems connected to the 27C256.
Attachments
Capture.JPG

lidnariq
Posts: 9765
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by lidnariq » Sat Nov 04, 2017 11:48 am

labatt24 wrote:Do you think that thing could affect the dump? It seems connected to the 27C256.
The orange thing in the red circle is a capacitor; it's there for the 74'174s. Any connections should only be to the power supply pins (14 and 28).

I mean, I only have the bad dump, but given that the first 2 MiB of the dump you have now works and the bad dump you sent me doesn't, I have to assume that whatever you have right now is a good dump of the 27C256 also.

wang_80919ms
Posts: 2
Joined: Fri Apr 19, 2019 1:50 pm

Re: Hacked Famicom Cartridge cart - Need info for dump

Post by wang_80919ms » Tue Apr 23, 2019 12:39 am

try this code

Code: Select all

board <- {
   mappernum = 235,
   cpu_rom = {
      size_base = 0x4000, size_max = 4194304, banksize = 0x4000
   }, 
   ppu_rom = {
      size_base = 0, size_max = 0, banksize = 0
   },
   ppu_ramfind = false, vram_mirrorfind = true
};

function cpu_dump(d, pagesize, banksize) {
	local RomIndex = 0;
	local RomUpLow = 0;
	local ReadAddr = 0x4000;
	local pageindex = 0;
	for(local i = 0; i < pagesize; i += 1){
		pageindex = i / 2; //or  just i ?
		//http://wiki.nesdev.com/w/index.php/INES_Mapper_235
		if ((i / 4) == 0){
			RomIndex = 0;
		} else if ((i / 4) == 1){
			RomIndex = 2;
		} else if ((i / 4) == 2){
			RomIndex = 1;
		} else if ((i / 4) == 3){
			RomIndex = 3;
		};
		if ((i % 2) == 0) {
			ReadAddr = 0x8000;
			RomUpLow = 0;
		}else{
			ReadAddr = 0xC000;
			RomUpLow = 1;
		};
		//http://forums.nesdev.com/viewtopic.php?f=2&t=16551
		//cpu_write(d, 0xF800 | (pageindex & 31) | ((pageindex << 3) & 0x300, pageindex);
		cpu_write(d, 0xF800 | ((RomUpLow << 13) & 0x1000) | ((RomIndex << 8) & 0x0300) | (pageindex & 0x1F), 0);
		if ((i % 2) == 0) {
			cpu_read(d, 0x8000, banksize);
		}else{
			cpu_read(d, 0xC000, banksize);
		};
	}
}

Post Reply