It is currently Mon Jul 16, 2018 7:18 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 3 posts ] 
Author Message
PostPosted: Sat Dec 23, 2017 11:38 am 
Offline

Joined: Sat Dec 23, 2017 10:19 am
Posts: 2
Hey, i just imported a kazzo because i wanted to dump 2x (propably?) chinese bootleg modules, dumping process indeed is working - but i think i dont have the right scripts for a working dump, because i tested all available scripts from the here linked http://www.infiniteneslives.com/kazzo.php software/firmware package,all tested .nes file dumps could npt be played in nestopia or fceux ....

Could anyone help me out with this?
I opened the modules for a detailed view:

ImageImage

ImageImage

What i found out about the Dragon Ball module: It should be a Mapper 91 Card!


Top
 Profile  
 
PostPosted: Sat Dec 23, 2017 1:56 pm 
Online

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7307
Location: Seattle
I sat down and traced the Dragon Ball module, and found the following pin order for the mapper, the middle chip-on-board (clockwise, starting at 10 o'clock on the component side):

M2 D0 D1 D2 D3 D4 D5 D6 D7 A0 A1 /IRQ A2 A12 A13 A14 PPUA11 PPUA12 gnd R/W /ROMSEL PRGA13 PRGA14 PRGA15 PRG/OE CHRA11 CHRA12 CHRA13 CHRA14 CHRA15 CHRA16 CHRA17 PRG/CE +5V

I was going to say that I didn't know of any mappers that had a register mask of $F007, but...
mohle wrote:
What i found out about the Dragon Ball module: It should be a Mapper 91 Card!
Well, if so, you should be able to do something like this:

Code:
board <- {
  mappernum = 91,
  vram_mirrorfind = true,
  ppu_ramfind = false,
  cpu_rom = {
    size_base = 0x4000,
    size_max = 0x20000,
    banksize = 0x2000,
  },
  ppu_rom = {
    size_base = 0,
    size_max = 0x20000,
    banksize = 0x800,
  }
};

function cpu_dump(d, banks, bank_size)
{
  for (local i=0; i < banks-1; i++) {
    cpu_write(d, 0x7000, i);
    cpu_read(d, 0x8000, bank_size);
  }
  cpu_read(d, 0xE000, bank_size);
}

function ppu_dump(d, banks, bank_size)
{
  for (local i=0; i < banks; ++i) {
    cpu_write(d, 0x6000, i);
    ppu_read(d, 0x0000, bank_size);
  }
}
(caveat: don't have a kazzo, can't test above code)

In general, dumping carts with unknown mappers is hard. One usually has to start off with an NROM dump and load it in a debugging emulator and look for register writes, then try recapitulating those same writes to the hardware.

Sometimes the original authors made that harder with lots of misleading writes to memory that didn't actually do anything, and copying things from ROM to RAM and decrypting them; e.g. kevtris has a writeup about one that he actually had to single-step through execution using his CopyNES to find out how the hardware worked.


Top
 Profile  
 
PostPosted: Sat Dec 23, 2017 2:54 pm 
Offline

Joined: Sat Dec 23, 2017 10:19 am
Posts: 2
wow, thank you whole-hearted for your fast efforts!

About Mapper 91: i found out because there is actually a rum dump of this "Hummer Team" Bootleg Module, i checked it with "NES Mapper Reader" and it says 91 ...
i checked this document about mapper 91:

Code:
========================
=  Mapper 091          =
========================

Example Games:
--------------------------
Street Fighter III
Super Mario & Sonic 2


Notes:
---------------------------
Regs exist at $6000-7FFF, so this mapper has no SRAM.


Registers:
---------------------------

Range,Mask:   $6000-7FFF, $7003

  $6000-6003:  CHR Regs
  $7000-7001:  [.... PPPP]  PRG Regs

  $7002 [.... ....]  IRQ Stop
  $7003 [.... ....]  IRQ Start



CHR Setup:
---------------------------

      $0000   $0400   $0800   $0C00   $1000   $1400   $1800   $1C00
    +---------------+---------------+---------------+---------------+
    |     $6000     |     $6001     |     $6002     |     $6003     |
    +---------------+---------------+---------------+---------------+

PRG Setup:
---------------------------

      $8000   $A000   $C000   $E000 
    +-------+-------+-------+-------+
    | $7000 | $7001 | { -2} | { -1} |
    +-------+-------+-------+-------+


IRQs:
---------------------------

IRQs on this mapper seem to behave exactly like MMC3 -- except it's fixed so that it will only fire after 8
scanlines.  This is easily emulatable by using MMC3 logic.

Write to $7002/$7003 can translate directly to write(s) to the following MMC3 registers:

on $7002 write:
   a) write to $E000

on $7003 write:
   a) write $07 to $C000
   b) write to $C001
   c) write to $E001


For details on MMC3 IRQ operation, see mapper 004


unfortunately, with the script suggested by you it didnt work neither, it dumps, i get a 16,0KB file ...


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: Yahoo [Bot] and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group