Cracking Mapper 185 Games

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
Great Hierophant
Posts: 780
Joined: Tue Nov 23, 2004 9:35 pm

Cracking Mapper 185 Games

Post by Great Hierophant »

Mapper 185 games are really just Mapper 0 games with a security check. All have either 16K/8K or 32K/8K of PRG-ROM/CHR-ROM. Mapper 3 in its Nintendo-canonical implementation can support four banks of 8KB of CHR-ROM.

The security check uses the Mapper 3 bankswitch register and checks to see that a "garbage bank" is loaded before a "correct bank". If it sees the "correct bank" first, it won't load the game. Only 9 Japanese Famicom games were released with this protection. Fortunately, the check only is done when the game is first loaded, and if passed, the rest of the game will work without further issue.

In order to fix these games, first we must change the mapper number in the iNES header from 185 to 3. Next, we must adjust the number of CHR-ROM banks in the header to match the number we will add to the ROM.

The more difficult issue is that you need to add dummy 8KB banks to your ROM. This can be done in a hex editor. The dummy bank should use nothing but FF, and must be $2000 in size. Some games only require 1 additional 8KB dummy bank, others require 3. You will need to insert them like so, depending on the game (always add $10 for the header) :

Bird Week

Add 1 CHR-ROM Bank, make the correct bank the 2nd 8KB :
$4010 - dummy
$6010 - correct

Seicross (v2)

Add 1 CHR-ROM Bank, make the correct bank the 1st 8KB :
$8010 - correct
$A010 - dummy


B-Wings
Mighty Bomb Jack


Add 1 CHR-ROM Bank, make the correct bank the 2nd 8KB :
$8010 - dummy
$A010 - correct


Othello
Sansuu 1 Nen
Sansuu 2 Nen
Sansuu 3 Nen
Spy vs Spy


Add 3 CHR-ROM Banks, make the correct bank the 3rd 8KB :
$8010 - dummy
$A010 - dummy
$C010 - correct
$E010 - dummy

When released in the U.S., Mighty Bomb Jack bypassed its own security code by doing exactly this in hardware. I do not fully understand how Mapper 185's security worked (and still don't :(, but the discussion Lidnariq and NewRisingSun had here : viewtopic.php?f=9&t=7912&p=207824&hilit ... ck#p207793 and the information on the NESdev wiki gave me enough information to figure out how to make these games work.

The Analogue Nt Mini's flash cart functionality does not work with any of these games except for B-Wings, and the NES PowerPak fails to load Seicross (v2). Ironically, Seicross is the easiest game to fix! Once fixed, the Nt Mini loaded all games and the NES PowerPak worked with Seicross.
User avatar
Myask
Posts: 965
Joined: Sat Jul 12, 2014 3:04 pm

Re: Cracking Mapper 185 Games

Post by Myask »

Is this the same problem that the new 185 submappers are supposed to fix?
Great Hierophant
Posts: 780
Joined: Tue Nov 23, 2004 9:35 pm

Re: Cracking Mapper 185 Games

Post by Great Hierophant »

Myask wrote:Is this the same problem that the new 185 submappers are supposed to fix?
Yes, but my solution would have to be adjusted for a hypothetical newly discovered Mapper 185 game.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: Cracking Mapper 185 Games

Post by lidnariq »

Probably better to remove the infinite loop using a 1-byte patch to PRG rather than add 8 to 24 KiB of padding in the CHR...
Post Reply