Locking System RAM to certain values DEMO!

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems.

Moderator: Moderators

Post Reply
Zack S
Posts: 55
Joined: Mon Jan 02, 2006 12:45 am
Location: Orlando, FL

Locking System RAM to certain values DEMO!

Post by Zack S » Tue Mar 21, 2006 8:39 am

Hi guys, I don't know if this has been done or not. I'm developing a cheat system that will allow you to control all of the WRAM in the NES. It will enable you to lock any bit or byte in ram to a value you set.

I whipped up a quick demo board tonight and got it working. The finished product is going to be somewhat different but work the same way. I recorded a quick clip of punch out with it locking the health variables. you can see my health regenerate as Mike beats the living shit out of little mac. And no this is not some pc video. I have this working on the real deal. Would anyone be intrested in this kind of modification to thier NES?

http://www.geocities.com/rndlogic/Movie.wmv
http://www.geocities.com/rndlogic/DSCF1153.JPG
http://www.geocities.com/rndlogic/DSCF1155.JPG
http://www.geocities.com/rndlogic/DSCF1158.JPG
http://www.geocities.com/rndlogic/DSCF1166.JPG

More pics to come when I have more time. For now Enjoy theese.

pragma
Posts: 53
Joined: Mon Jan 02, 2006 6:30 pm

Post by pragma » Tue Mar 21, 2006 8:45 am

Zack, it looks like your geocities site tanked. Might I reccomend hosting those images on flickr or imageshack instead? :)

ccovell
Posts: 1006
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell » Tue Mar 21, 2006 9:17 am

It's interesting, but something similar already exists in the form of the Action Replay, both for (European) NES and Japanese Famicom. But, good luck on your project!

Zack S
Posts: 55
Joined: Mon Jan 02, 2006 12:45 am
Location: Orlando, FL

Post by Zack S » Wed Mar 22, 2006 5:50 pm

I reposted the photos here:
http://img384.imageshack.us/img384/7492/dscf11539zi.jpg
http://img135.imageshack.us/img135/6146/dscf11557zz.jpg
http://img135.imageshack.us/img135/5416/dscf11584yi.jpg
http://img135.imageshack.us/img135/5825/dscf11669bm.jpg
It's interesting, but something similar already exists in the form of the Action Replay, both for (European) NES and Japanese Famicom. But, good luck on your project!
I couldn't find much info on what it actually does. I don't see how an attachment would be able to change RAM values though.

pragma
Posts: 53
Joined: Mon Jan 02, 2006 6:30 pm

Post by pragma » Wed Mar 22, 2006 6:03 pm

I couldn't find much info on what it actually does. I don't see how an attachment would be able to change RAM values though.
Well, I'm no EE, but there might be a hack-ish way to override what the WRAM outputs via the cartridge if you eavesdrop on the address bus - do the address lines to the PRG RAM also reflect what's happening inside the NES as well? Say if I write a whole bunch of stuff to the zero-page, would those address bits show up on the A0-A15 lines? Maybe that's what the "action replay" does. ::shrug::

Anyway, I see what you're doing. Its kind of like a ROMulator only for RAM, so it has some very serious dev-platform potential. :)

Zack S
Posts: 55
Joined: Mon Jan 02, 2006 12:45 am
Location: Orlando, FL

Post by Zack S » Thu Mar 23, 2006 2:42 am

pragma wrote:Well, I'm no EE, but there might be a hack-ish way to override what the WRAM outputs via the cartridge if you eavesdrop on the address bus - do the address lines to the PRG RAM also reflect what's happening inside the NES as well? Say if I write a whole bunch of stuff to the zero-page, would those address bits show up on the A0-A15 lines? Maybe that's what the "action replay" does. ::shrug::
I'm not an EE yet but I'm working on it. All the address lines are shared, however the cart has no way to access the Output Enable Pin on the RAM. So if tried to put it's own values on the data bus I would think it would cause bus contention and possibly damage some of the circut.

I read somewhere that it would allow you to save the game anywhere. That could be done by running it's own code and using the 6502 to transfer data in and out of the RAM. I don't think this method would work in real time though because it would add extra CPU cycles.

Glad to see you think it has Dev-platform potential. As soon as I get a programmable one that is universal I will start to add info on it to the Wiki. When I get back to the U.S. I might try to develop a PCB that will fit inside the NES console.

dvdmth
Posts: 354
Joined: Wed Mar 22, 2006 8:00 am

Post by dvdmth » Thu Mar 23, 2006 1:39 pm

The way Pro Action Replay works is by hijacking the NMI routine. It has special RAM at $5000 in which a special NMI handler is placed. The handler simply writes five values to different RAM addresses (set up by the codes inserted), then executes JMP ($FFFA). Apparently the hardware is detecting an NMI interrupt and giving the NES the address $500C (that's where the code is placed) instead of the value in the attached ROM.

Obviously, this won't work with all games, including MMC5 games that use $5xxx addresses for registers, as well as any game that performs cycle-timed operations from NMI or that need the entire VBlank time for VRAM updating.

Zack S
Posts: 55
Joined: Mon Jan 02, 2006 12:45 am
Location: Orlando, FL

Post by Zack S » Thu Mar 23, 2006 2:48 pm

That's great to know dvdmth. I was wondering if my project was duplicating something that already existed, but with what you wrote I can see that's definitely not the case. My device will work with all games because it is invisible to the rest of the system.

Hijacking the NMI routine has some serious drawbacks. You can't control variables that are changed inside the NMI. When you consider that most of the game code is inside the NMI routine, it's very limiting. I don't see the PAR being much more useful than a game genie.

tepples
Posts: 21755
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples » Thu Mar 23, 2006 3:23 pm

Zack S wrote:I don't see the PAR being much more useful than a game genie.
It is if one method is patented and the other isn't.

ccovell
Posts: 1006
Joined: Sun Mar 19, 2006 9:44 pm
Location: Japan
Contact:

Post by ccovell » Sat Mar 25, 2006 4:34 pm

Zack S wrote:Hijacking the NMI routine has some serious drawbacks. You can't control variables that are changed inside the NMI. When you consider that most of the game code is inside the NMI routine, it's very limiting. I don't see the PAR being much more useful than a game genie.
Considering most variables that we want to affect are things like lives left, money, life, etc., the PAR is very useful. These variables are kept from NMI to NMI.

Post Reply