TapeDump v1.0 - a tool to dump carts without extra hardware

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems. See the NESdev wiki for more information.

Moderator: Moderators

Post Reply
ccovell
Posts: 1045
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell »

For 300-1200 bps you have to save the recording as 22050 Hz, 8-bit. Make sure it's never 16-bit. Only for 2400 bps is the recording supposed to be saved as 44100 Hz.
User avatar
Guyver2011
Posts: 11
Joined: Sat Nov 19, 2011 9:30 pm
Location: CCCP
Contact:

Post by Guyver2011 »

Win7. 1200bps setting in TapeDump.
Kcs.bat: KCS -B2 -G2 -F10 record.wav game.nes

44100Hz Mono WAV 8bits - errors... no iNes header and 0 or 1 or < 16kB
22050Hz Mono WAV 8bits - OK
My Email: veroh@yandexDOTru
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

As for the Rockman multi dump getting cut off early, are you sure TapeDump supports this mapper?
User avatar
thefox
Posts: 3134
Joined: Mon Jan 03, 2005 10:36 am
Location: 🇫🇮
Contact:

Post by thefox »

jpx72 wrote:PS When dumping the cartridge mentioned above, I'm getting sound from Famicom for some 6:35 minutes, then sound stops. That can't be the whole cart, it has all the Rockman games on it.
You won't get the full dump when dumping it as NROM. That would be just used to dump the menu part, which you/somebody would then need to reverse engineer to find out how the menu selects different games, and then write add support to TapeDump based on that.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

Thanks everybody for identifying the problem. I forgot about the 22000 AND 8-bit requirement, I'll re-record it and upload the working (menu) rom somewhere. [there shouldn't be anything illegal about pirate menu system dump being released]
By the way, why do you suggest -F10 ? Is this offset specification needed?
ccovell
Posts: 1045
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell »

-F10 is not necessarily needed for 1200 bps, but it may be for 2400 and 5200. After I record at a lower bps, I usually remove any pops at the beginning of dumping and then normalize the waveform to maximum volume. Thus, adjusting the offset (DC bias, really) is not necessary. Anyway, for 5200 bps, the waveform is much more rounded and misshapen, any kind of massaging can help KCS to decode it.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

Nice! i have tried it two times and every time I got exactly the same file (compared in hexeditor)! Now for the harder part - is there somebody who will have the time and knowledge to look at THIS dumped file to discover the mapper system of this (Rockman 1-6 Multi) cartridge? It'll be great if someone can do this... Thank you!

EDIT: I have flipped the mirroring switch on my tapedump cartridge and recorded the thing again, now I got a smaller file...??? Here's the decoded FILE.
EDIT2: although on second try, I got the same file as I got before switching the mirroring. This second file must be some mistake.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

post deleted
Last edited by jpx72 on Sat Nov 26, 2011 10:16 am, edited 2 times in total.
User avatar
thefox
Posts: 3134
Joined: Mon Jan 03, 2005 10:36 am
Location: 🇫🇮
Contact:

Post by thefox »

jpx72 wrote:EDIT: I have flipped the mirroring switch on my tapedump cartridge and recorded the thing again, now I got a smaller file...??? Here's the decoded FILE.
EDIT2: although on second try, I got the same file as I got before switching the mirroring. This second file must be some mistake.
You are getting different results semi-randomly because the lower bank registers of the mapper start at random values. For figuring out the mapper this doesn't matter, only the last 8K of the ROM matters in this case, so both ROMs are fine. As for why the graphics are garbled, the CHR banking regs are random at startup as well. This also doesn't matter for this task.

I'll see if I can find time to take a look at this later.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

Thank you for the explanation! It would be great if you can look at it further!
User avatar
MottZilla
Posts: 2837
Joined: Wed Dec 06, 2006 8:18 pm

Post by MottZilla »

I think it's as speculated before, a MMC3 with master bank registers.

Looks like it has atleast 3 control registers, 5010, 5011, 5012.

This is a data table of the values written when loading games. The first value goes to $A000, then to the 50xx in order. It writes these registers from a small code segment loaded into the 2K WRAM which then clears RAM, resets various registers, and does a JMP ($FFFC).

Code: Select all

$A000,$5010,$5011,$5012
XX,00,00,20, Menu, CHRROM?, 8K PRG?,8K CHR?
00,22,10,55, Rockman, CHRRAM, 128K PRG
80,21,20,AA, Rockman 2, CHRRAM, 256K PRG
00,11,30,20, Rockman 3, CHRROM, 256K PRG & 128K CHR
80,20,40,55, Rockman 4, CHRRAM, 512K PRG
00,01,00,00, Rockman 5, CHRROM, 256K PRG & 256K CHR
80,20,60,AA, Rockman 6, CHRRAM, 512K PRG
And it seems the games are in order they appear on the menu. So to read any game, the MBR can be set to these values, and then you read all the banks as though they are MMC3 games most likely.

The most interesting thing about this being dumped will be seeing the MMC3 hacked Rockman 1 and 2 since the rest of the games all use MMC3.

Update: I added some info next to the table incase anyone wants to speculate what the values written likely do.

$20 to $5010 seems likely to enable CHRRAM. The lower nibble could be related to PRG Block size, x0 being 512k, x1 256K, x2 128K.

Not sure what the deal with $A000 is since that is the MMC3 mirroring register and they only write clear or set of the highest bit.

If you are using TampDump via PowerPAK you can edit the TxROM plugin and remove something not needed, like detecting Mirroring since we know it'll be mapper controlled, and add in code then to set the MBR (5010,5011,5012, and maybe A000) and then have the plugin try dumping each game normally as if its TxROM.

---

$5011 could be selecting a block of a large PRG-ROM if they mirror Rockman 1 to 256K I think. $5012 maybe CHRROM page with junk values for the CHR-RAM games?
Last edited by MottZilla on Wed Nov 30, 2011 11:19 pm, edited 1 time in total.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

Thanks MottZilla! That is an impressive ammount of work! Unfortunatelly that's where my participation ends, because I don't understand anything from that, except the first line.
Anyway I don't have a PowerPak, I'm using custom NROM cartridge made of pirate NROM board. So I cannot edit anything. I would need the TapeDump software to be edited with these specifications, so I can burn it to my devcart.
ccovell
Posts: 1045
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell »

TapeDump comes with its own source, and the mapper files come with their own assembler, so there's nothing stopping you from assembling your own version of the ROM; Powerpak or no Powerpak.
User avatar
jpx72
Posts: 178
Joined: Tue Sep 28, 2010 3:27 am
Location: Slovakia
Contact:

Post by jpx72 »

ccovell wrote:TapeDump comes with its own source, and the mapper files come with their own assembler, so there's nothing stopping you from assembling your own version of the ROM; Powerpak or no Powerpak.
Yes, thank you I am now aware of that and I'm thankful that you released those. Nevertheless I must try to find someone who will help me edit them, because I simply don't understand that. All I want is to dump this pirate for anyone who's interested.
User avatar
MottZilla
Posts: 2837
Joined: Wed Dec 06, 2006 8:18 pm

Post by MottZilla »

If I get some time I can try editing it. But I still don't full understand the registers and what they are doing on a hardware level. But as I said before we know enough to dump each game on the cart. RM1&2 will be most interesting since they were most likely hacked to MMC3.
Post Reply