It is currently Wed May 24, 2017 4:12 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 17 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Tue Mar 07, 2017 4:34 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
I purchased a cartridge of the homebrew game "The Legends of Owlia", and I really love it. I would like to make a personal backup of it, however, and I can't seem to get any data from it. As far as I know, it should be UNROM-512 or some similar variant, but no matter what I try PRG-ROM simple reads back as all 0's.

Does anyone have any experience backing up this particular game?

Edit:
Solved the issue. InfiniteNESLives suggested preventing the EXP0 pin from grounding, so I covered it with electrical tape and it worked. See page two of this thread for details! Thanks everyone!


Last edited by YoukaiCountry on Wed Mar 08, 2017 6:55 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Tue Mar 07, 2017 7:03 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 135
Location: Poland
Maybe it has a protection, for example - M2 must be toggled at 1.7 MHz, otherwise internal PRG-ROM is disabled?


Top
 Profile  
 
PostPosted: Tue Mar 07, 2017 8:00 pm 
Offline
User avatar

Joined: Sun Jan 22, 2012 12:03 pm
Posts: 5178
Location: Canada
I dumped Owlia with my CopyNES. I don't remember having a problem treating it like UNROM. Haven't tried with Kazzo.

Do you take bus conflicts into account? You should search the current bank for the byte you want to write and write on top of that byte.


Top
 Profile  
 
PostPosted: Tue Mar 07, 2017 8:28 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
Thanks for the replies!

krzysiobal wrote:
Maybe it has a protection, for example - M2 must be toggled at 1.7 MHz, otherwise internal PRG-ROM is disabled?


Copy protection is certainly a possibility, not sure if InfiniteNESLives does that to their boards or not. Is there any way with Kazzo to write to M2 at a given frequency, I wonder? I could probably try to build a custom breadboard that outputs pulses, but I'd rather not have to go that far :)

rainwarrior wrote:
I dumped Owlia with my CopyNES. I don't remember having a problem treating it like UNROM. Haven't tried with Kazzo.

Do you take bus conflicts into account? You should search the current bank for the byte you want to write and write on top of that byte.


Kazzo handling bus conflict differently than the NES is a good thought too!
So you mean in my dumping script, for each byte of PRG-ROM write a value to it and then try reading it directly after?


Top
 Profile  
 
PostPosted: Tue Mar 07, 2017 8:42 pm 
Offline
User avatar

Joined: Sun Jan 22, 2012 12:03 pm
Posts: 5178
Location: Canada
No, I mean when you write to the UxROM bankswitch register ($8000-$FFFF) you need to write your value on top of the same value to avoid a bus conflict.

Start at $8000 and just read bytes from the current bank until you hit the value you're trying to write, then write your value to that address.

Info here: https://wiki.nesdev.com/w/index.php/Bus_conflict


Top
 Profile  
 
PostPosted: Tue Mar 07, 2017 9:04 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
Ah, I see what you're saying. The problem is that no matter what, all I seem to read back are 0's, not a single byte is anything else. So unfortunately I don't think I can try this since I wouldn't be able to find an actually 0 value byte by polling.

What I could do is look at the beginning of the demo ROM and find a 0 value, then try writing the first bank switch (0 at $8000) to that address and hope the data in the actual cart is the same. I'll try that in a little bit.

Thanks for the idea!


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 2:51 am 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
I've tried a couple new things, to no avail:

1. Writing a bank number to an address that contains that value (at least in the demo ROM). Received all 0's
2. Without writing anything at all, reading from 0xC000 to 0xFFFF, which should be a fixed bank. Received all 0's

I'm beginning to suspect that it is in fact some sort of anti-copying lockout. Not once in the several hours I've spent trying things have I read any value other than 0 from the cartridge. It's very perplexing.
The cartridge works just fine in my NES! I've also made dumps of other cartridges since trying Owlia, just to make sure I didn't manage to smoke my Kazzo somehow, and it seems to be fine.


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 4:12 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 135
Location: Poland
Please attach photos of top and bottom side of cartridge's PCB.


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 12:20 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
Okay, I took some pictures of the PCB. Looks like it include a special thanks to NesDev on it :)


Attachments:
File comment: Back-side of the PCB.
back.jpg
back.jpg [ 428.84 KiB | Viewed 439 times ]
File comment: Front-side of the PCB.
front.jpg
front.jpg [ 539.93 KiB | Viewed 439 times ]
Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 1:01 pm 
Offline

Joined: Fri Jul 04, 2014 2:34 pm
Posts: 281
Location: Germany
Try dumping as mapper 11 (Color Dreams).

Looks like it's using a 74HCT377 instead of 74'161 and 74'32 like normal UxROM would.

Save this as colordreams.ad for Kazzo dumper:
Code:
/*
From http://forums.nesdev.com/
Used for dumping Color Dream, Wisdom Tree and Bunch games
*/

board <- {
  mappernum = 11,
  cpu_rom = {
    size_base = 0x10000, size_max = 1 * mega, banksize = 0x8000
  },
  ppu_rom = {
    size_base = 0x8000, size_max = 1 * mega, banksize = 0x2000
  },
  ppu_ramfind = false, vram_mirrorfind = true
};

function cpu_dump(d, pagesize, banksize) {
  for (local i = 0; i < pagesize; i += 1) {
    cpu_write(d, 0x8000, i);
    cpu_read(d, 0x8000, 0x4000);
    cpu_read(d, 0xc000, 0x4000);
  }
}

function ppu_dump(d, pagesize, banksize) {
  for (local i = 0; i < pagesize; i += 1) {
    cpu_write(d, 0x8000, i << 4);
    ppu_read(d, 0, 0x2000);
  }
}


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 1:54 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
Interestingly, when I tried that colordreams script, it still pulled 0x4000 bytes of 0's for PRG-ROM, but it got 0x2000 bytes of CHR, which is full of data... Something is definitely preventing me from reading PRG-ROM somehow.


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 2:07 pm 
Offline
User avatar

Joined: Sun Jan 22, 2012 12:03 pm
Posts: 5178
Location: Canada
It's not Colordreams. It's UxROM, just 512k. It can't use just a 161 because it's 512k. It needs at least 5 latch bits.

There's no CHR-ROM, it's RAM.

I don't really know anything about how the Kazzo works, but if you're getting all 0s I highly doubt it's from any kind of copy protection scheme. (I have the same board, but it dumped exactly as expected via CopyNES.) I think the problem is probably to do with the Kazzo somehow but I can't really speculate.


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 2:39 pm 
Offline
User avatar

Joined: Mon Apr 04, 2011 11:49 am
Posts: 1779
Location: WhereverIparkIt, USA
I'm guessing the issue is related to how EXP0 pin is used to control mapper/flash writes. If the original kazzo firmware grounds EXP0 pin then the /WE pin on the PRG-ROM is low which means you can't read data. Have you considered contacting Gradual Games directly?

_________________
If you're gonna play the Game Boy, you gotta learn to play it right. -Kenny Rogers


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 2:53 pm 
Offline
User avatar

Joined: Tue Mar 07, 2017 4:25 pm
Posts: 29
Location: Ohio, USA
infiniteneslives wrote:
I'm guessing the issue is related to how EXP0 pin is used to control mapper/flash writes. If the original kazzo firmware grounds EXP0 pin then the /WE pin on the PRG-ROM is low which means you can't read data. Have you considered contacting Gradual Games directly?


Thanks for the response!
If that is what is happening, then would it be safe to simply cover the EXP0 pin to keep it from being grounded?
I haven't contacted Gradual Games, but maybe I'll send them a message soon if I can't resolve it.


Top
 Profile  
 
PostPosted: Wed Mar 08, 2017 2:58 pm 
Offline
User avatar

Joined: Mon Apr 04, 2011 11:49 am
Posts: 1779
Location: WhereverIparkIt, USA
Can't hurt anything.

_________________
If you're gonna play the Game Boy, you gotta learn to play it right. -Kenny Rogers


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 17 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group