Broken cartridge dump helper

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
krzysiobal
Posts: 731
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Broken cartridge dump helper

Post by krzysiobal » Thu Jun 25, 2020 5:07 am

Use case
Let's say that you are in possesion of some rare game/hack that nobody ever dumped but unfortunately your cartrige is broken and does not work (for example - mapper chip is damaged). Or you have some non-working cartridge but want to figure out what game was that. For example - this one weirdo:
Image Image Image

I desoldered the PRG-ROM chip, dumped it externally, tried to add iNES header (with MMC3 mapper as sthis is the most popular one) but game did not work. Then I tried to find its content agains known ROMs database but no close matches were found.

Next step was to analyze the PCB to find out what exactly the mapper is and what are the connections. The middle one is indeed MMC3, but address lines to PRG & CHR-ROM were randomly schuffled to fool the dumpers.
Image

After shuffling byte order in dumped ROM, the ROM still did not worked in emu. The closest compare match was "Street Fighter VI 12 Peoples [!].nes" but with over 80000 bytes different in PRG are (which is more than a half in this 128KB PRG-ROM game)
Image

One reason why it did not work might be that game relied on some bytes read from CHR-ROM (wchich was not dumped yet) or sprite 0 hit, but dubugger did not show any request for CPU to reads bytes from PPU pattern table region and the CPU code seemed to show bad opcodes after first jump to $8000-$bfff region.

Then I carefully analyzed the MMC3 connection and found another surprise, which explained why it did not work.
Image

After defining "new" mapper for that case, game started to work (despite such a lot of different bytes). GFX was garbled of course because of no CHR-ROM dumped yet.
Image

Next step was to dump CHR, but mapper blob did not work (around 0.5V on all its outputs) and I was not going to
drive the CHR-A17..CHR-A10 with each combination of 00000000..11111111 manually and read PPU $0000-$03FF afterwards, so here is the reason for this topic
Image

Dump helper
It is just a pass-through adapter for all cartridge lines with additional features:
a) 8-bit latch that latches any data write to $8000-$ffff whose are then available on pin header
b) additional PRG-/CE (low for CPU reads from $8000-$ffff) which is available on pin header
c) additional CHR-/CE (low for PPU reads from $0000-$1fff) which is available on pin header
Image Image

Now, after removing broken blob from the subjected PCB, I inserted it into adapter and solderet outputs of the latch to inputs of CHR-A lines.
If that were for example VRC-board, CHR/CE line would be controlled by (broken) chip and I would've need to control it through adapter too.
This adapter can even be used if the mapper blob is not removed - that's why the protection resistor. And because it is present in whole $8000-$ffff range, one can choose for dumping single address that not coincide with banking.
Image

After dumping CHR of the subjected game, it turned out to be.. Fighter V
Image

Later I found this dump as `Street Fighter V (20 peoples) (Unl) (Pirate Original).NES` in cah4e3 database, but his version is normal MMC3 with $8000/$8001 writes, while mine uses $8000/$8002

NewRisingSun
Posts: 1199
Joined: Thu May 19, 2005 11:30 am

Re: Broken cartridge dump helper

Post by NewRisingSun » Thu Jun 25, 2020 6:37 am

Regarding the $8000.2 stuff, this seems like one variant of Mapper 196.

Post Reply