Fixing ROMs for EMS 64 GB Smart Card USB

Discussion of programming and development for the original Game Boy and Game Boy Color.
DMG-Patcher
Posts: 3
Joined: Sat Jul 06, 2019 12:10 pm

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by DMG-Patcher »

With the help of a very experienced specialist, I finally learned how to make the games on the flash card work.

I would like to share my results with you in this article.

Batman Forever (USA, Europe) FIX.ips
Bomberman GB (USA, Europe) (SGB Enhanced) FIX.ips
Ferrari Grand Prix Challenge (USA, Europe) FIX.ips
Fire Fighter (Europe) FIX.ips
Gargoyle's Quest (USA, Europe) FIX.ips
Solomon's Club (Europe) FIX.ips
Super Off Road (USA, Europe) FIX.ips
Wizards & Warriors Chapter X - The Fortress of Fear (USA, Europe) FIX.ips
Worms (Europe) FIX.ips


Download:
http://www.share-online.biz/dl/Q1KDFAUP07N
Attachments
Fixes By Tschisomat.zip
Batman Forever (USA, Europe) FIX.ips
Bomberman GB (USA, Europe) (SGB Enhanced) FIX.ips
Ferrari Grand Prix Challenge (USA, Europe) FIX.ips
Fire Fighter (Europe) FIX.ips
Gargoyle's Quest (USA, Europe) FIX.ips
Solomon's Club (Europe) FIX.ips
Super Off Road (USA, Europe) FIX.ips
Wizards & Warriors Chapter X - The Fortress of Fear (USA, Europe) FIX.ips
Worms (Europe) FIX.ips
(2.82 KiB) Downloaded 415 times
DMG-Patcher
Posts: 3
Joined: Sat Jul 06, 2019 12:10 pm

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by DMG-Patcher »

New Fix

Kid Icarus - Of Myths and Monsters (USA, Europe)
Attachments
Kid Icarus - Of Myths and Monsters (USA, Europe) FIX.zip
(510 Bytes) Downloaded 423 times
vigpail
Posts: 1
Joined: Thu Sep 12, 2019 1:04 pm

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by vigpail »

any chance of getting Final Fantasy Legend patched to initialize the save when started from Mottzilla's multirom menu?
neither Final Fantasy Legend, nor Final Fantasy Legend 2 seem to initialize the save when booted with this menu, however as stated in this topic, FFL2 will initialize the save if you select 'start a new game' and then back out to the title screen.

On my 64M cart I've been using a sketchy work around:
1) use Mottzilla's multimenu on side1 with a dummy rom to load the save
*I've been using Tennis with the header modified to the same cartridge type as FFL (06h-rom+mbc2+battery)
2) powering off/on to switch to side2
3) use the multimenu below (which doesn't manage saves) to play FFL
https://github.com/mikeryan/ems-flasher (menu.gb)
https://github.com/chastai/menugb (doesn't seem to exist anymore)

one thing I did notice while modifying headers was the Rom Entry Point for FFL & FFL2 was different than any other roms I had (don't know if this has anything to do with the issue)
frostywheel
Posts: 1
Joined: Sat Sep 12, 2020 6:34 pm

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by frostywheel »

Does anyone happen to have a fix for Mega Man V? The older uploads of it seem to be dead :(
chunkMommyIsles
Posts: 1
Joined: Tue Jan 25, 2022 8:53 am

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by chunkMommyIsles »

above link from 2020 are dead. Had luck with google and found this Japanese site hosting them:

https://m.blog.naver.com/zzamstop/221155403452
User avatar
Gilbert
Posts: 564
Joined: Sun Dec 12, 2010 10:27 pm
Location: Hong Kong
Contact:

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by Gilbert »

It's a Korean site, not Japanese.
AL771914
Posts: 1
Joined: Sat Jun 17, 2023 9:45 pm

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by AL771914 »

hello, I am looking for the following patches for game boy:

home alone 1
hook
indiana jones 3
Mcdonaldland
pagemaster
pinocchio
Simpson - Bart and the Beanstalk
Simpson - Bart vs the Juggernauts
Simpson - Escape From Camp Deadly
simpson - Krusty's Fun House
super mario land 2
wario blast

. best regards

following (gbc) ((patch bug fix)) :

harry potter 2
last bible 1
mickey racing
mr nutz gbc
spy vs spy gbc
star wars obi-wan adventures
terrifyng 911

hello, i am looking for invincible game genie code for robocop (gb) or ips file.
Last edited by AL771914 on Sat Aug 26, 2023 11:32 pm, edited 3 times in total.
nitro2k01
Posts: 252
Joined: Sat Aug 28, 2010 9:01 am

Re: Fixing ROMs for EMS 64 GB Smart Card USB

Post by nitro2k01 »

I've produced patches as per the previous poster's requests. I've also added some notes for each game. These are mostly my internal notes, but maybe they're useful for someone. If you want clarification about anything said below, please ask.

I created the patched ROMs using BGB and a hex editor for some of the edits. In general, the idea is to remove writes to the banking registers that can cause problems for a nonstandard "MBC" like the one in the EMS 64M USB. These include writes to nonstandard addresses, and writing a value of 0 when intending to select bank 1. The former seems to possibly be a deliberate strategy to mess with the pirate multicarts of the time, as writes to other addresses could do things like selecting a different game or causing a reset.

For example, using $3FFF for selecting the ROM bank was a common technique. This works on a real MBC which only decodes the top, what is it, 3 bits. But might cause problems elsewhere.

I wanted to get rid of any and all writes to nonexistant/nonstandard MBC register addresses. For a game with no save capability, that for example meant any writes except writes to $2000. My strategy in general has been to put access breakpoints in place for anything but desired writes, and then work toward patching out any other writes.

Example of such access breakpoints for a game with no saving:

Code: Select all

0000-1FFF    W
2001-7FFF    W
2000      00 W
Or for a game with saving, Super Mario Land 2 in this case:

Code: Select all

0001-1FFF    W
2001-3FFF    W
4001-7FFF    W
2000      00 W
Here, the registers for enabling and selecting the SRAM bank was added as "holes" in the forbidden address set.

Home Alone (U) [!].gb

Writes to weird xfff addresses. 1fff,3fff,5fff,7fff.
Patched out unused writes. Only a few ROM bank writes.

Hook (E) [!].gb

Relies on 00 from memory init. Probably no other 0 writes. Optimized the memmory clear routine to fit writing 1 to $C08D.

Indiana Jones and the Last Crusade (UE) [!].gb

rst 28 is bank switch. Writes to 3fff, also writes 00.

McDonaldland (U) [!].gb

Bizarre bank switching routine. Why? Mess with pirate multicart I'm guessing. I worry that this code is checked against tampering later in the game so the game stops working after some level or something.

Code: Select all

ld   c,a
ld   b,$00
ld   hl,$3B97
add  hl,bc
ld   [hl],a
Pagemaster, The (U) [S][!].gb

Scratchpad notes for copy/paste into BGB's inline assembler.

Code: Select all

or a
rst 30
nop

jr nz,1
inc a
ld [2000],a
ret
Pinocchio (U) (1995).gb and Pinocchio (U) (1996) [!].gb

Code: Select all

0169:
ld [$0043],a
ld [$ff43],a
ld [$ff43],a
Appears to be a typo/copypasted code? Testing out using the ld [$FF00+C],A opcode but wrong syntax? Intends to write SCX thrice? Should be harmless regardless (would at worst disable SRAM if cart has it) but weird.

Simpsons, The - Bart & the Beanstalk (U).gb

Sneaky writes to 1C00. Not sure if this is a bug, or a stealthy way to once again mess up multicarts, in a way that seems inconspicuous at first glance in a disassembler.

Code: Select all

03E5:
    ld   hl,$FF80
    ld   bc,$007F
    call MemClear
    ld   hl,$C008
    ld   bc,$12FC
    call MemClear
    ld   hl,$1C00
    ld   bc,$1000
    call MemClear
    ret  
MemClear:
    ld   e,$00
:   ld   [hl],e
    inc  hl
    dec  bc
    ld   a,b
    or   c
    jr   nz,:-
    ret  
Seems to do nothing?

Code: Select all

1baa: ld [$221A],A
34c7: Reads cc64-cc65 as hl dest pointer. Also, holy moly that's a lot of unrolled copy loops...

Writes a total of $550 bytes on the first round. More in later rounds.

Code: Select all

Fix: 3f7:
ld a,$98
ld [$cc65],a
Will put some junk on the map, but this should be overwritten and invisible.

Simpsons, The - Bart vs the Juggernauts (U) [!].gb

Is using writes to $2100.
0387: Has builtin null check, nice!
Has current bank stored at 4000.

Simpsons, The - Escape from Camp Deadly (U) [!].gb

Has sample playback!

0bc4 init
0bf5 writes in the wrong order... c698 is ROM bank shadow here.
2ede

Simpsons, The - Krusty's Fun House (U) [!].gb

Has sample playback!

I did a sweeping search and replace for ea0021. Hope nothing else got trashed in the process.

Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!].gb

Selects bank 0 right after init because the "last bank" variable was cleared when WRAM was initalized. Harmless. The bank is set properly right afterwards.

It's using a combination of $2100 and $3000 for selecting the bank. $A24E, $A258, $A265 are last ROM bank variables.

Patch approach: replace EA4EA2EA0021 (ld [$a24e],a / ld [$2100],a) with EA4EA2EA0020 (ld [$a24e],a / ld [$2000],a). 195 replacements.

Replace EA4EA2EA0030 (ld [$a24e],a / ld [$3000],a) with EA4EA2EA0020 (as above). 22 replacements.

$25E0 reads from a table. It seems all valid entries are nonzero.
$261A same.

$030A1A (0C:4A1A) contains a bank switch. This would be unsafe if called from bank 1 except this is probably copied to WRAM.
$068561 (1A:4562) same.
$0685D5 (1A:45D5) same.
etc

Final validation:
Search for a2ea0021 and a2ea0030 (Read/write from $a2xx followed by write to ROM bank register.) Nothing left at this point.

Search for ea0021 and ea0030 (Write to $2100 or $3000.) A couple of one-off writes to $2100 with fixed bank.

Running game with assert access breakpoints:
$037E writes to $6000, MBC1 mode selection register. This write wouldn't matter either way on a real MBC1 cartridge 512 kiB ROM and 8 kiB SRAM. nop this out.

Should now be free from problematic MBC access, except the initial harmless bank 0 selection.

Just as expected, SML2 was the biggest and most complicated of the bunch to patch.

Wario Blast Featuring Bomberman! (U) [S][!].gb

$3BF0: Looks like a little patch of some kind. Makes two writes to fixed banks using $2000. Non-problematic.

$0AA3: ROM bank select using writes to $3FFF.

There are bank 0 writes that are probably harmless but I'm patching them anyway... Patching the $AA3 routine, since the other two seem to be using the RAM value written by that one.

$08E7, $0927, $0AA6

Hashes

This is a list of sha1 hashes for the source file I used, and the expected output after patching. Using the patch with wrong ROM revision may not work.

Code: Select all

a3142c83f391eda6f445226f2d49bd8a384be411  Home Alone (U) [!].gb
ee9ef0940e6d8109d75cf6ce1af9ae50785eed83  Home Alone (U) [!] patch.gb
0e0784c238b8a16666157e1ac99cee17feb52c63  Hook (E) [!].gb
969135705ea46ea884bbdab8af66b85db54b9819  Hook (E) [!] patch.gb
b656ba6c03d0cb5c81c2ed8c5c64ea8e36660aaa  Indiana Jones and the Last Crusade (UE) [!].gb
6c125aa07391e06be0dacd5f4a058ad084c78129  Indiana Jones and the Last Crusade (UE) [!] patch.gb
fd11d61f961a7e3c69e272ef19eb243b7df89833  McDonaldland (U) [!].gb
6155fdd221aae22874ecfe2fbea9690a2074cc1d  McDonaldland (U) [!] patch.gb
9b3063350581cec9cf595a78faa8d415b75be399  Pagemaster, The (U) [S][!].gb
d5ace4e03430328f45248f843027c4962075c2c7  Pagemaster, The (U) [S][!] patch.gb
7716809645e00be2fdbbbfd05823a14856f01183  Pinocchio (U) (1995).gb
8c2ff7af35e92e909882f64fb1a3820d7ce95bfa  Pinocchio (U) (1995) patch.gb
98a2d90717d8c9f7feb2d7653aaab6faa0f3ee64  Simpsons, The - Bart & the Beanstalk (U).gb
abdcfd21708056e753503c005e27f566632c3ee4  Simpsons, The - Bart & the Beanstalk (U) patch.gb
95d60b87862fccd914446e0581146142d19c76bd  Simpsons, The - Bart vs the Juggernauts (U) [!].gb
817e01b39a58a05ad516c8dab5b48e9002a676a3  Simpsons, The - Bart vs the Juggernauts (U) [!] patch.gb
89b7b2d4684d703ea5d323e3aaf4910dcdbc47d3  Simpsons, The - Escape from Camp Deadly (U) [!].gb
0478f0e595cb2929c7af6526f5f12881ba5c594b  Simpsons, The - Escape from Camp Deadly (U) [!] patch.gb
e61039c52c053a8ae1bdfffa3f694934569bb570  Simpsons, The - Krusty's Fun House (U) [!].gb
824dab1ab2b1bf77eb32cdaf724567e82a016f2f  Simpsons, The - Krusty's Fun House (U) [!] patch.gb
d11d94fa3c36b9f72e925070b66bb4f16d31001e  Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!].gb
f5b9cbac431bddb7863af00a5f43f50a1bcdec48  Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!] patch.gb
279fb0223e362db553b739b1b8f9c18b81d92413  Wario Blast Featuring Bomberman! (U) [S][!].gb
e85e76b00db2ea9cbea4ab01446b8955b2a95f7a  Wario Blast Featuring Bomberman! (U) [S][!] patch.gb
These patches should be considered beta quality and I've not dug up my EMS 64M to test them. Feedback welcome.
Attachments
patches for AL771914.zip
(3.29 KiB) Downloaded 38 times
Post Reply