What's a long time Pasofami?HardWareMan wrote:CaH4e3 used a long time Pasofami. Simple shematic, suitable for most cartridges. In addition, all software are ready.
Simple one-time cartridge dumping...
Moderator: Moderators
I don't think that "cheap one-time cartridge dumping" exists... It's not like you can quickly build a device to do it using common household items. If you're very electronics-savvy you can make an EPROM reader with few parts, but you have to know what you're doing or you'll just get frustrated.
If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.
If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.
Allright. Thanks for the suggestions.tokumaru wrote:I don't think that "cheap one-time cartridge dumping" exists... It's not like you can quickly build a device to do it using common household items. If you're very electronics-savvy you can make an EPROM reader with few parts, but you have to know what you're doing or you'll just get frustrated.
If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.
Right now I've got two venues I might try. Either I'll build that LPT thing -- I think I sort of understand how it works now, or somewhat later, I'll see if I can make something useful with an Arduino board, which I plan to buy some day.
- marvelus10
- Posts: 243
- Joined: Fri Feb 09, 2007 5:01 pm
- Location: Nanaimo, BC Canada
- HardWareMan
- Posts: 209
- Joined: Mon Jan 01, 2007 11:12 am
- rainwarrior
- Posts: 8733
- Joined: Sun Jan 22, 2012 12:03 pm
- Location: Canada
- Contact:
Wow, I found my stash.
I knew I should have more than that which I showed previously, but it was packed away from my last move in a location I had not bothered to unpack.
(Back as a teenager, I used to salvage components from trashed electronics in hopes I could use them later in something. I also got some parts from friends as explained earlier.)
In the passing week or so, I ordered an Arduino Mega2560 board (or a clone thereof; it costs under 20 €, plus some extra for a breadboard). I have successfully used it to dump a 64 kilobyte 386sx PC ROM BIOS, as a proof of concept that it can be used as a makeshift EPROM reader. (I'll post a YouTube video about the process eventually.)
I have not yet figured out how to safely desolder the ROM chips from my cartridge (and initial attempts with an ISA bus proved that my attempts can damage the goods rather much; granted I don't have any particular desoldering equipment), so that project does not have an immediate solution in sight yet.
But now it turns out that I have many other EPROMs to dump, as well... Heh.
I knew I should have more than that which I showed previously, but it was packed away from my last move in a location I had not bothered to unpack.
(Back as a teenager, I used to salvage components from trashed electronics in hopes I could use them later in something. I also got some parts from friends as explained earlier.)
In the passing week or so, I ordered an Arduino Mega2560 board (or a clone thereof; it costs under 20 €, plus some extra for a breadboard). I have successfully used it to dump a 64 kilobyte 386sx PC ROM BIOS, as a proof of concept that it can be used as a makeshift EPROM reader. (I'll post a YouTube video about the process eventually.)
I have not yet figured out how to safely desolder the ROM chips from my cartridge (and initial attempts with an ISA bus proved that my attempts can damage the goods rather much; granted I don't have any particular desoldering equipment), so that project does not have an immediate solution in sight yet.
But now it turns out that I have many other EPROMs to dump, as well... Heh.
I also purchased a desoldering pump. Figured it's something I would eventually need anyway.
As a consequence, I was now able to successfully desolder both ROM chips from the cartridge.
I was also able to dump them using my Arduino program. There was a slight problem in doing so: The legs of the ROM chips are short, and if the ROM chip is inserted into a standard issue breadboard, the chip just does not make proper contact with the springs and it just pops out. So during the dumping I had to press hard on the chip with both thumbs to ensure it reads all bits properly. Even then, I had to dump it several times, because I saw missing bits / discrepancies between successive dumps. Finally, I added in the ROM dumper some code that reads the ROM several times and chooses the result that has most bits on (and indicates if there were discrepancies). Coincidentally, I finally got them both without discrepancies.
So now I have two 65536 byte files containing the respective ROM data from both chips.
([EDIT: The PRG ROM is actually 128 kilobytes, so 128+64 it should be. I underdumped. I figured this out and perfectly fixed it later. This is an older post.])
Now, I need to figure out what kind of mapper this board has. I mean, I can see it has two 74LS161As (4-bit binary counter) and one 74LS153 (dual 4-input multiplexer) (see photos in the first post), but that does not tell me much. I created a dummy test ROM by just putting a 16-byte header, the 65536-byte PRG ROM and the 65536-byte CHR ROM in a sequence and running through 256 iNES mapper numbers and seeing how they work in FCEU. From those tests (collectively), I was able to get a properly functioning main menu (with links leading nowhere), a properly working Urban Champion game, a properly working Legend of Kage with broken graphics, and a semi-properly working Galaxian with utterly broken graphics. Work in progress...
Taking the ROM page that has the main menu program only, and tracing it using my own emulator, I found out which memory writes it does when a game is chosen.
At reset: Byte $00 is written to $FF00, and $00 is written to $FF00 (again).
Choose game 0: Byte $00 is written to $FFA5, $00 to $FF00 and $E2 to $FF03.
Choose game 1: Byte $00 is written to $FFC8, $00 to $FF00 and $E2 to $FF03.
Choose game 2: Byte $00 is written to $FF10, $00 to $FF00 and $E2 to $FF03.
Choose game 3: Byte $00 is written to $FFED, $00 to $FF00 and $E2 to $FF03.
Choose game 4: Byte $00 is written to $FF03, $00 to $FF00 and $E2 to $FF03.
From this, it looks like it uses the address, rather than the data, to choose a function. (And indeed, the data lines from the ROM chips are directly wired into the cartridge's data lines without intervention if I read right.) However, what those functions are is so far a bit unclear. It looks like the low 4 bits choose VROM page and the next 4 might bits choose a ROM page, or vice versa, but this is mere guessing.
Also, what kind of mapping functions does it provide for the games themselves? I think at least Goonies ought to use more than one VROM page.
EDIT: I traced (some of) the pinouts on the cartridge to help figuring out what the mapper does.
As a consequence, I was now able to successfully desolder both ROM chips from the cartridge.
I was also able to dump them using my Arduino program. There was a slight problem in doing so: The legs of the ROM chips are short, and if the ROM chip is inserted into a standard issue breadboard, the chip just does not make proper contact with the springs and it just pops out. So during the dumping I had to press hard on the chip with both thumbs to ensure it reads all bits properly. Even then, I had to dump it several times, because I saw missing bits / discrepancies between successive dumps. Finally, I added in the ROM dumper some code that reads the ROM several times and chooses the result that has most bits on (and indicates if there were discrepancies). Coincidentally, I finally got them both without discrepancies.
So now I have two 65536 byte files containing the respective ROM data from both chips.
([EDIT: The PRG ROM is actually 128 kilobytes, so 128+64 it should be. I underdumped. I figured this out and perfectly fixed it later. This is an older post.])
Now, I need to figure out what kind of mapper this board has. I mean, I can see it has two 74LS161As (4-bit binary counter) and one 74LS153 (dual 4-input multiplexer) (see photos in the first post), but that does not tell me much. I created a dummy test ROM by just putting a 16-byte header, the 65536-byte PRG ROM and the 65536-byte CHR ROM in a sequence and running through 256 iNES mapper numbers and seeing how they work in FCEU. From those tests (collectively), I was able to get a properly functioning main menu (with links leading nowhere), a properly working Urban Champion game, a properly working Legend of Kage with broken graphics, and a semi-properly working Galaxian with utterly broken graphics. Work in progress...
Taking the ROM page that has the main menu program only, and tracing it using my own emulator, I found out which memory writes it does when a game is chosen.
At reset: Byte $00 is written to $FF00, and $00 is written to $FF00 (again).
Choose game 0: Byte $00 is written to $FFA5, $00 to $FF00 and $E2 to $FF03.
Choose game 1: Byte $00 is written to $FFC8, $00 to $FF00 and $E2 to $FF03.
Choose game 2: Byte $00 is written to $FF10, $00 to $FF00 and $E2 to $FF03.
Choose game 3: Byte $00 is written to $FFED, $00 to $FF00 and $E2 to $FF03.
Choose game 4: Byte $00 is written to $FF03, $00 to $FF00 and $E2 to $FF03.
From this, it looks like it uses the address, rather than the data, to choose a function. (And indeed, the data lines from the ROM chips are directly wired into the cartridge's data lines without intervention if I read right.) However, what those functions are is so far a bit unclear. It looks like the low 4 bits choose VROM page and the next 4 might bits choose a ROM page, or vice versa, but this is mere guessing.
Also, what kind of mapping functions does it provide for the games themselves? I think at least Goonies ought to use more than one VROM page.
EDIT: I traced (some of) the pinouts on the cartridge to help figuring out what the mapper does.
Code: Select all
ROM CHIP 1:
A15 1 IC1.PIN12 28 +5V
2 PRG A12 A14 27 IC1.PIN14
3 PRG A7 & IC1.PIN3 26 PRG A13
4 PRG A6 & IC1.PIN4 25 PRG A8
5 PRG A5 & IC1.PIN5 24 PRG A9
6 PRG A4 & IC1.PIN6 23 PRG A11
7 PRG A3 & IC2.PIN3 /OE 22 IC1.PIN13
8 PRG A2 & IC2.PIN4 21 PRG A10
9 PRG A1 & IC2.PIN5 /CE 20 IC1.PIN2
10 PRG A0 & IC2.PIN6 19 PRG D7
11 PRG D0 18 PRG D6
12 PRG D1 17 PRG D5
13 PRG D2 16 PRG D4
14 GND 15 PRG D3
Other:
Cart's PRG A14 = IC3.PIN3,4
where IC1, IC2 are GD74LS161A
IC3 is GD74LS153
And IC1.PIN2 -> IC2.PIN2
IC2.PIN10 -> IC3.PIN11
IC3.PIN13 -> IC3.PIN15
Plus many lines that go under the ICs and are thereby efficiently obscured.
ROM CHIP 2:
A15 1 IC2.PIN14 28 +5V
2 CHR A12 A14 27 IC2.PIN13
3 CHR A7 A13 26 IC2.PIN12
4 CHR A6 25 CHR A8
5 CHR A5 24 CHR A9
6 CHR A4 23 CHR A11 & IC3.PIN15
7 CHR A3 /OE 22 CHR /RD
8 CHR A2 21 CHR A10 & IC3.PIN12,10
9 CHR A1 /CE 20 CHR /A13
10 CHR A0 19 CHR D7
11 CHR D0 18 CHR D6
12 CHR D1 17 CHR D5
13 CHR D2 16 CHR D4
14 GND 15 CHR D3
Last edited by Bisqwit on Sat Oct 31, 2015 2:55 am, edited 2 times in total.
You might have underdumped the PRG; the 74'161's outputs only makes sense to be connected to pin 22 of the ROM if it's actually A16.
Independently tracing the PCB pictures you took, you've got an 8-bit mapper register, input from the address bus (A7..A0), loaded on writes to PRGROM. The capacitor and diode below IC1 cause both registers to reset to 0 on initial powerup.
The latched values written to:
A7..A5 somehow form the PRG bank select
A4 probably selects 16kB vs 32kB PRG, but I can't quite tell from your connectivity description
A3..A1 select a 8kB slice of CHR.
A0 seems to select Vertical vs Horizontal mirroring
Independently tracing the PCB pictures you took, you've got an 8-bit mapper register, input from the address bus (A7..A0), loaded on writes to PRGROM. The capacitor and diode below IC1 cause both registers to reset to 0 on initial powerup.
The latched values written to:
A7..A5 somehow form the PRG bank select
A4 probably selects 16kB vs 32kB PRG, but I can't quite tell from your connectivity description
A3..A1 select a 8kB slice of CHR.
A0 seems to select Vertical vs Horizontal mirroring
Yes, I also arrived to the same conclusion (from different observations), and in fact have now dumped also the second 64k portion. The second chip does have only 64k.lidnariq wrote:You might have underdumped the PRG; the 74'161's outputs only makes sense to be connected to pin 22 of the ROM if it's actually A16.
Incredible analysis that of yours!
Were you counting the pins funny? This makes more sense, and is what I see on your pictures:Bisqwit wrote:IC2.PIN10 -> IC3.PIN11
IC3.PIN13 -> IC3.PIN15
Code: Select all
IC2.PIN11 -> IC3.PIN14 (74'161.Q0 -> 74'153.S0)
Cartridge A11 -> IC3.PIN13 -> IC3.PIN11 (I3b -> I1b)
Cartridge A10 -> IC3.PIN12 -> IC3.PIN10 (I2b -> I0b)
Yes, you are correct at least for the first line. (That one you can see from the photo.)lidnariq wrote:Were you counting the pins funny? This makes more sense, and is what I see on your pictures:Code: Select all
IC2.PIN11 -> IC3.PIN14 (74'161.Q0 -> 74'153.S0) Cartridge A11 -> IC3.PIN13 -> IC3.PIN11 (I3b -> I1b) Cartridge A10 -> IC3.PIN12 -> IC3.PIN10 (I2b -> I0b)
The two others are impossible to tell for sure because they go under the ICs in question.
IC3.PIN2 goes somewhere underneath the chip, or nowhere at all.
IC3.PIN5,6 are interconnected. I don't know if they have other connections underneath the chip.
Same for pin 7: underneath the chip. Without desoldering the chip there's no way to see where it goes.