It is currently Mon Dec 10, 2018 4:48 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 9 posts ] 
Author Message
PostPosted: Thu Apr 12, 2018 11:20 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 446
Location: Poland
I got this weird fami-clone with integrated 9999999 in 1 multicart (not a second cartridge inside, just a second blob, next to the Nes On Chip). I want to discuss a non-desctructive way of dumping it (unless it is already available). I can't even solder ~60 wires to all blob's PRG-A/D/CHR-A/D lines, because Nes on Chip will conflict with it.

Image Image

So maybe I should investigate how the console checks for the presence of main cartridge, then make a special-dumping cartridge with RS232/USB port, which will put its code into RAM and execute from here, then disable the main cartridge slot?


Why I want to dump it? Because it contains unique, modified popular games:
Tennins (Tennis Hack)
Mars (Star Force Hack)
Sky Invader (Sky Destroyer Hack)
Cow Boy (Wild Gunman Hack)
Forest Guard (Hogans Alley Hack)
Space 2050 (Duck Hunt Hack)
Ufo Race (F1 Hack)
Ufo Shoot (Duck Hunt Clay Shoot Hack)

Those hacks are really cool and unique - they changed the music, background and sprites (and maybe levels). Never seen that before.

Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image


Top
 Profile  
 
PostPosted: Fri Apr 13, 2018 7:11 am 
Online
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 840
Location: -29.794229 -55.795374
Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.


Top
 Profile  
 
PostPosted: Fri Apr 13, 2018 8:40 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 446
Location: Poland
Fisher wrote:
Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.


Thanks. But I changed my mind, I will make flash cartridge that can be programmed by 6502. So the cartridge will copy the routine to RAM and execute from here. Ram routine will switch to internal multicart, read portion of data from here, switch to external multicart, program part of flash data, and so on. Then I will be able to read it back using kazzo.

Both VCC lines on main slot are not connected so probably Nes on Chip detects external cart presence using that - so just modified unrom with posibility to switch it will be ok.


Top
 Profile  
 
PostPosted: Sat Apr 14, 2018 8:15 am 
Offline
User avatar

Joined: Wed Apr 07, 2010 12:46 pm
Posts: 15
Location: Poland
krzysiobal, are you sure you've checked all the dumps by Cah4e3?
I swear I've already seen Ufo Race and Ufo Shoot somewhere else.

_________________
ContraBanda.eu


Top
 Profile  
 
PostPosted: Sat Apr 14, 2018 9:05 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 708
The individual games are of course standard fare on a great number of different multicarts, many of which have been dumped by now. But the key thing to compare is the menu and which game is at which numbered position. I have never seen the particular menu depicted in krzysiobal's picture. I think those particular hacks were made by Inventor [1][2].


Top
 Profile  
 
PostPosted: Sun Apr 15, 2018 3:13 am 
Offline
User avatar

Joined: Thu Sep 15, 2016 6:29 am
Posts: 819
Location: Denmark (PAL)
Exactly these famiclones were actually sold in two major, country-wide supermarket chains around here, around ten years ago(!). I have absolely no idea how they found their way in there, and I'm pretty sure the retailers had absolutely no idea what they were selling. I have few of them, just ripped them up and played around with the hardware inside them, but I never tried dumping anything. :\ They did come with one additional 1-in-many multicart of similar amusing hacks, though, which is weird.

Not that that information is gonna help you, I just though it was interesting to see one here.


Top
 Profile  
 
PostPosted: Wed May 02, 2018 4:17 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 446
Location: Poland
Ok, I made a UNROM-like (512 kB) cartridge with flash memory that helped me dump it:
Image Image Image Image Image Image

The cartridge memory map is:
Code:
Read:
  $8000-$bfff: switchable bank
  $c000-$ffff: fixed to last bank

Write:
 $8000-$bfff: used for programming flash memory
 $c000-$ffff: E--P PPPP
              |  | ||||
              |  +-++++- set switchable bank at $8000
              +--------- turn on (1) or off (0) internal memory


Console detects if pin 31 is VCC (disabled internal cartridge) or not.

First I dumped the $8000-$ffff and analyzed it:

Code:
                                           Writes into                              
Name on list Original game       Size M  Hex   Bin
------------------------------------------------------------------
-Menu-                              ? ?  $8000 100000000 0 000 000
Tennis       Tennis                16 V  $8048 100000000 1 001 000
Mars         Star Force            16 V  $8052 100000000 1 010 010
Sky Invader  Sky Destroyer         16 H  $80db 100000001 1 011 011
Cow Boy      Wild Gunman           16 V  $8064 100000000 1 100 100
Forest Guard Hogans Alley          16 V  $806d 100000000 1 101 101
Space 2050   Duck Hunt             16 V  $8076 100000000 1 110 110
Ufo Race     F1 Race               16 V  $807f 100000000 1 111 111
                                                               
Ufo Shoot    Duck Hunt Clay Shoot  16 V  $8076 100000000 1 110 110
                                                       | | ||| |||
                                                       | | ||| +++- PRG bank
                                                       | | +++ ---- CHR bank
                                                       | + --- ---- mode (0=32K, 1=16K)
                                                       + - --- ---- mirroring (0=V, 1=H)


Then I dumped whole PRG + CHR. I dont searched if there is already mapper with same behaviour, so I assigned it new number.

Image

Quirks:
* after bringing pin 31 to VCC/GND, there has to be ~10 ms delay (so looks like the circuit for detecting state of pin 31 is not combinatorial or has filtering),
* reading first byte of PPU $0000 returns open bus


Top
 Profile  
 
PostPosted: Wed May 02, 2018 4:59 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7802
Location: Seattle
That's mapper 58, according to FCEUX's source.


Top
 Profile  
 
PostPosted: Sat Oct 20, 2018 4:28 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 446
Location: Poland
I got another battery-powered console with built-in games.
Image Image Image Image Image

This time, consonle detects presence of cartridge by shorting pins of CIRAM/CE and PPU/A13 (CIRAM=VCC and PPU/A13 is probed).
Internal cartridge (1800-in-1) is a MMC3-based multicart, which is Mapper 45.

It took me some time to dump it cause writes to the internal register were ignored. I found out that 7th bit in Reg 3 needs to be 1, otherwise mapper ignores writes (except the lock bit, which can be set anytime)
Code:
   Reg 3:  [ELAA AAAA]
           L = Lock Multicart regs (1=locked)
           A = Inverted PRG-AND
         E = Enable (1=writes make any effect)


This cartridge contains modified versions of known games (I don't know original names of two games so maybe somebody can help)
Code:
Modified game   |Original game
----------------+------------------------
Menu+Olympics   |Track & Field       
Ultimate Speed  |Ferrari - Grand Prix
Fun Click       |?
Box World       |?
Soccer          |Soccer               
Tennis          |Tennis               
Forest Guard    |Hoogan's Alley       
Cowboy          |Wild Gunman         
Space 2050      |Duck Hunt           
Shoot Copter    |Duck Hunt           
Ufo Race        |F1 Race             
Sky Invader     |Sky Destroyer       
Bomb Helicopter |Raid on Bungeling Bay
Baseball        |Baseball             
Super Elf       |Circus Charlie       



Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group