nesdev.com
http://forums.nesdev.com/

TapeDump v1.0 - a tool to dump carts without extra hardware
http://forums.nesdev.com/viewtopic.php?f=2&t=7978
Page 6 of 12

Author:  ccovell [ Thu Nov 24, 2011 4:06 pm ]
Post subject: 

For 300-1200 bps you have to save the recording as 22050 Hz, 8-bit. Make sure it's never 16-bit. Only for 2400 bps is the recording supposed to be saved as 44100 Hz.

Author:  Guyver2011 [ Thu Nov 24, 2011 4:11 pm ]
Post subject: 

Win7. 1200bps setting in TapeDump.
Kcs.bat: KCS -B2 -G2 -F10 record.wav game.nes

44100Hz Mono WAV 8bits - errors... no iNes header and 0 or 1 or < 16kB
22050Hz Mono WAV 8bits - OK

Author:  tepples [ Thu Nov 24, 2011 5:34 pm ]
Post subject: 

As for the Rockman multi dump getting cut off early, are you sure TapeDump supports this mapper?

Author:  thefox [ Thu Nov 24, 2011 7:23 pm ]
Post subject: 

jpx72 wrote:
PS When dumping the cartridge mentioned above, I'm getting sound from Famicom for some 6:35 minutes, then sound stops. That can't be the whole cart, it has all the Rockman games on it.

You won't get the full dump when dumping it as NROM. That would be just used to dump the menu part, which you/somebody would then need to reverse engineer to find out how the menu selects different games, and then write add support to TapeDump based on that.

Author:  jpx72 [ Thu Nov 24, 2011 10:52 pm ]
Post subject: 

Thanks everybody for identifying the problem. I forgot about the 22000 AND 8-bit requirement, I'll re-record it and upload the working (menu) rom somewhere. [there shouldn't be anything illegal about pirate menu system dump being released]
By the way, why do you suggest -F10 ? Is this offset specification needed?

Author:  ccovell [ Fri Nov 25, 2011 6:52 am ]
Post subject: 

-F10 is not necessarily needed for 1200 bps, but it may be for 2400 and 5200. After I record at a lower bps, I usually remove any pops at the beginning of dumping and then normalize the waveform to maximum volume. Thus, adjusting the offset (DC bias, really) is not necessary. Anyway, for 5200 bps, the waveform is much more rounded and misshapen, any kind of massaging can help KCS to decode it.

Author:  jpx72 [ Sat Nov 26, 2011 7:57 am ]
Post subject: 

Nice! i have tried it two times and every time I got exactly the same file (compared in hexeditor)! Now for the harder part - is there somebody who will have the time and knowledge to look at THIS dumped file to discover the mapper system of this (Rockman 1-6 Multi) cartridge? It'll be great if someone can do this... Thank you!

EDIT: I have flipped the mirroring switch on my tapedump cartridge and recorded the thing again, now I got a smaller file...??? Here's the decoded FILE.
EDIT2: although on second try, I got the same file as I got before switching the mirroring. This second file must be some mistake.

Author:  jpx72 [ Sat Nov 26, 2011 8:40 am ]
Post subject: 

post deleted

Author:  thefox [ Sat Nov 26, 2011 9:19 am ]
Post subject: 

jpx72 wrote:
EDIT: I have flipped the mirroring switch on my tapedump cartridge and recorded the thing again, now I got a smaller file...??? Here's the decoded FILE.
EDIT2: although on second try, I got the same file as I got before switching the mirroring. This second file must be some mistake.

You are getting different results semi-randomly because the lower bank registers of the mapper start at random values. For figuring out the mapper this doesn't matter, only the last 8K of the ROM matters in this case, so both ROMs are fine. As for why the graphics are garbled, the CHR banking regs are random at startup as well. This also doesn't matter for this task.

I'll see if I can find time to take a look at this later.

Author:  jpx72 [ Sat Nov 26, 2011 10:17 am ]
Post subject: 

Thank you for the explanation! It would be great if you can look at it further!

Author:  MottZilla [ Sat Nov 26, 2011 12:08 pm ]
Post subject: 

I think it's as speculated before, a MMC3 with master bank registers.

Looks like it has atleast 3 control registers, 5010, 5011, 5012.

This is a data table of the values written when loading games. The first value goes to $A000, then to the 50xx in order. It writes these registers from a small code segment loaded into the 2K WRAM which then clears RAM, resets various registers, and does a JMP ($FFFC).

Code:
$A000,$5010,$5011,$5012
XX,00,00,20, Menu, CHRROM?, 8K PRG?,8K CHR?
00,22,10,55, Rockman, CHRRAM, 128K PRG
80,21,20,AA, Rockman 2, CHRRAM, 256K PRG
00,11,30,20, Rockman 3, CHRROM, 256K PRG & 128K CHR
80,20,40,55, Rockman 4, CHRRAM, 512K PRG
00,01,00,00, Rockman 5, CHRROM, 256K PRG & 256K CHR
80,20,60,AA, Rockman 6, CHRRAM, 512K PRG


And it seems the games are in order they appear on the menu. So to read any game, the MBR can be set to these values, and then you read all the banks as though they are MMC3 games most likely.

The most interesting thing about this being dumped will be seeing the MMC3 hacked Rockman 1 and 2 since the rest of the games all use MMC3.

Update: I added some info next to the table incase anyone wants to speculate what the values written likely do.

$20 to $5010 seems likely to enable CHRRAM. The lower nibble could be related to PRG Block size, x0 being 512k, x1 256K, x2 128K.

Not sure what the deal with $A000 is since that is the MMC3 mirroring register and they only write clear or set of the highest bit.

If you are using TampDump via PowerPAK you can edit the TxROM plugin and remove something not needed, like detecting Mirroring since we know it'll be mapper controlled, and add in code then to set the MBR (5010,5011,5012, and maybe A000) and then have the plugin try dumping each game normally as if its TxROM.

---

$5011 could be selecting a block of a large PRG-ROM if they mirror Rockman 1 to 256K I think. $5012 maybe CHRROM page with junk values for the CHR-RAM games?

Author:  jpx72 [ Mon Nov 28, 2011 1:28 am ]
Post subject: 

Thanks MottZilla! That is an impressive ammount of work! Unfortunatelly that's where my participation ends, because I don't understand anything from that, except the first line.
Anyway I don't have a PowerPak, I'm using custom NROM cartridge made of pirate NROM board. So I cannot edit anything. I would need the TapeDump software to be edited with these specifications, so I can burn it to my devcart.

Author:  ccovell [ Mon Nov 28, 2011 7:11 am ]
Post subject: 

TapeDump comes with its own source, and the mapper files come with their own assembler, so there's nothing stopping you from assembling your own version of the ROM; Powerpak or no Powerpak.

Author:  jpx72 [ Mon Nov 28, 2011 10:18 am ]
Post subject: 

ccovell wrote:
TapeDump comes with its own source, and the mapper files come with their own assembler, so there's nothing stopping you from assembling your own version of the ROM; Powerpak or no Powerpak.


Yes, thank you I am now aware of that and I'm thankful that you released those. Nevertheless I must try to find someone who will help me edit them, because I simply don't understand that. All I want is to dump this pirate for anyone who's interested.

Author:  MottZilla [ Mon Nov 28, 2011 10:55 am ]
Post subject: 

If I get some time I can try editing it. But I still don't full understand the registers and what they are doing on a hardware level. But as I said before we know enough to dump each game on the cart. RM1&2 will be most interesting since they were most likely hacked to MMC3.

Page 6 of 12 All times are UTC - 7 hours
Powered by phpBB® Forum Software © phpBB Group
http://www.phpbb.com/