Simple one-time cartridge dumping...

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

HardWareMan wrote:CaH4e3 used a long time Pasofami. Simple shematic, suitable for most cartridges. In addition, all software are ready.
What's a long time Pasofami?
tepples
Posts: 22708
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

I'd guess Engrish for "For a long time, CaH4e3 used Pasofami."
User avatar
teaguecl
Posts: 211
Joined: Thu Oct 21, 2004 4:02 pm
Location: San Diego

Post by teaguecl »

Bisqwit, maybe the easiest thing to do is to mail it to someone who has a dumper. Or drive it somewhere if you live near another forum member. I would think less than $10 US would get it shipped both ways safely.
User avatar
tokumaru
Posts: 12427
Joined: Sat Feb 12, 2005 9:43 pm
Location: Rio de Janeiro - Brazil

Post by tokumaru »

I don't think that "cheap one-time cartridge dumping" exists... It's not like you can quickly build a device to do it using common household items. If you're very electronics-savvy you can make an EPROM reader with few parts, but you have to know what you're doing or you'll just get frustrated.

If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.
Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

tokumaru wrote:I don't think that "cheap one-time cartridge dumping" exists... It's not like you can quickly build a device to do it using common household items. If you're very electronics-savvy you can make an EPROM reader with few parts, but you have to know what you're doing or you'll just get frustrated.

If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.
Allright. Thanks for the suggestions.

Right now I've got two venues I might try. Either I'll build that LPT thing -- I think I sort of understand how it works now, or somewhat later, I'll see if I can make something useful with an Arduino board, which I plan to buy some day.
User avatar
marvelus10
Posts: 243
Joined: Fri Feb 09, 2007 5:01 pm
Location: Nanaimo, BC Canada

Post by marvelus10 »

If you have an LTP port, couldnt you buy a cheap eprom programmer and wire jumpers to the pins on the chips without removing them them from the board, if your lucky the pins maybe long enough to be pinched by the slot on the programmer.
User avatar
HardWareMan
Posts: 209
Joined: Mon Jan 01, 2007 11:12 am

Post by HardWareMan »

tepples wrote:I'd guess Engrish for "For a long time, CaH4e3 used Pasofami."
Yes, it is. My fault.
SkinnyV
Posts: 427
Joined: Wed May 04, 2011 2:41 pm
Location: Montréal, Canada
Contact:

Post by SkinnyV »

Just get a willem off ebay, they're like 10 or 15$. Or check Farrid's post, he posted about an easy to build USB programmer not long ago.
User avatar
rainwarrior
Posts: 8733
Joined: Sun Jan 22, 2012 12:03 pm
Location: Canada
Contact:

Post by rainwarrior »

I can't think of something simpler or cheaper than mailing it so somebody who is already set up to dump carts.
Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

Wow, I found my stash.
I knew I should have more than that which I showed previously, but it was packed away from my last move in a location I had not bothered to unpack.
(Back as a teenager, I used to salvage components from trashed electronics in hopes I could use them later in something. I also got some parts from friends as explained earlier.)

Image

In the passing week or so, I ordered an Arduino Mega2560 board (or a clone thereof; it costs under 20 €, plus some extra for a breadboard). I have successfully used it to dump a 64 kilobyte 386sx PC ROM BIOS, as a proof of concept that it can be used as a makeshift EPROM reader. (I'll post a YouTube video about the process eventually.)
I have not yet figured out how to safely desolder the ROM chips from my cartridge (and initial attempts with an ISA bus proved that my attempts can damage the goods rather much; granted I don't have any particular desoldering equipment), so that project does not have an immediate solution in sight yet.
But now it turns out that I have many other EPROMs to dump, as well... Heh.
Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

I also purchased a desoldering pump. Figured it's something I would eventually need anyway.
As a consequence, I was now able to successfully desolder both ROM chips from the cartridge.

I was also able to dump them using my Arduino program. There was a slight problem in doing so: The legs of the ROM chips are short, and if the ROM chip is inserted into a standard issue breadboard, the chip just does not make proper contact with the springs and it just pops out. So during the dumping I had to press hard on the chip with both thumbs to ensure it reads all bits properly. Even then, I had to dump it several times, because I saw missing bits / discrepancies between successive dumps. Finally, I added in the ROM dumper some code that reads the ROM several times and chooses the result that has most bits on (and indicates if there were discrepancies). Coincidentally, I finally got them both without discrepancies.
Image Image

So now I have two 65536 byte files containing the respective ROM data from both chips.
([EDIT: The PRG ROM is actually 128 kilobytes, so 128+64 it should be. I underdumped. I figured this out and perfectly fixed it later. This is an older post.])
Image

Now, I need to figure out what kind of mapper this board has. I mean, I can see it has two 74LS161As (4-bit binary counter) and one 74LS153 (dual 4-input multiplexer) (see photos in the first post), but that does not tell me much. I created a dummy test ROM by just putting a 16-byte header, the 65536-byte PRG ROM and the 65536-byte CHR ROM in a sequence and running through 256 iNES mapper numbers and seeing how they work in FCEU. From those tests (collectively), I was able to get a properly functioning main menu (with links leading nowhere), a properly working Urban Champion game, a properly working Legend of Kage with broken graphics, and a semi-properly working Galaxian with utterly broken graphics. Work in progress...
Image Image Image


Taking the ROM page that has the main menu program only, and tracing it using my own emulator, I found out which memory writes it does when a game is chosen.

At reset: Byte $00 is written to $FF00, and $00 is written to $FF00 (again).
Choose game 0: Byte $00 is written to $FFA5, $00 to $FF00 and $E2 to $FF03.
Choose game 1: Byte $00 is written to $FFC8, $00 to $FF00 and $E2 to $FF03.
Choose game 2: Byte $00 is written to $FF10, $00 to $FF00 and $E2 to $FF03.
Choose game 3: Byte $00 is written to $FFED, $00 to $FF00 and $E2 to $FF03.
Choose game 4: Byte $00 is written to $FF03, $00 to $FF00 and $E2 to $FF03.
From this, it looks like it uses the address, rather than the data, to choose a function. (And indeed, the data lines from the ROM chips are directly wired into the cartridge's data lines without intervention if I read right.) However, what those functions are is so far a bit unclear. It looks like the low 4 bits choose VROM page and the next 4 might bits choose a ROM page, or vice versa, but this is mere guessing.
Also, what kind of mapping functions does it provide for the games themselves? I think at least Goonies ought to use more than one VROM page.

EDIT: I traced (some of) the pinouts on the cartridge to help figuring out what the mapper does.

Code: Select all

ROM CHIP 1:

  A15 1 IC1.PIN12                     28 +5V
      2 PRG A12                   A14 27 IC1.PIN14
      3 PRG A7 & IC1.PIN3             26 PRG A13
      4 PRG A6 & IC1.PIN4             25 PRG A8
      5 PRG A5 & IC1.PIN5             24 PRG A9
      6 PRG A4 & IC1.PIN6             23 PRG A11
      7 PRG A3 & IC2.PIN3         /OE 22 IC1.PIN13
      8 PRG A2 & IC2.PIN4             21 PRG A10
      9 PRG A1 & IC2.PIN5         /CE 20 IC1.PIN2
      10 PRG A0 & IC2.PIN6            19 PRG D7
      11 PRG D0                       18 PRG D6 
      12 PRG D1                       17 PRG D5
      13 PRG D2                       16 PRG D4
      14 GND                          15 PRG D3          

Other:
        Cart's PRG A14 = IC3.PIN3,4

where IC1, IC2 are GD74LS161A
           IC3 is GD74LS153

And IC1.PIN2 -> IC2.PIN2
    IC2.PIN10 -> IC3.PIN11
    IC3.PIN13 -> IC3.PIN15
Plus many lines that go under the ICs and are thereby efficiently obscured.

ROM CHIP 2:

  A15 1 IC2.PIN14                     28 +5V
      2 CHR A12                   A14 27 IC2.PIN13
      3 CHR A7                    A13 26 IC2.PIN12
      4 CHR A6                        25 CHR A8
      5 CHR A5                        24 CHR A9
      6 CHR A4                        23 CHR A11 & IC3.PIN15
      7 CHR A3                    /OE 22 CHR /RD
      8 CHR A2                        21 CHR A10 & IC3.PIN12,10
      9 CHR A1                    /CE 20 CHR /A13
      10 CHR A0                       19 CHR D7
      11 CHR D0                       18 CHR D6
      12 CHR D1                       17 CHR D5
      13 CHR D2                       16 CHR D4
      14 GND                          15 CHR D3
Last edited by Bisqwit on Sat Oct 31, 2015 2:55 am, edited 2 times in total.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Post by lidnariq »

You might have underdumped the PRG; the 74'161's outputs only makes sense to be connected to pin 22 of the ROM if it's actually A16.

Independently tracing the PCB pictures you took, you've got an 8-bit mapper register, input from the address bus (A7..A0), loaded on writes to PRGROM. The capacitor and diode below IC1 cause both registers to reset to 0 on initial powerup.

The latched values written to:
A7..A5 somehow form the PRG bank select
A4 probably selects 16kB vs 32kB PRG, but I can't quite tell from your connectivity description
A3..A1 select a 8kB slice of CHR.
A0 seems to select Vertical vs Horizontal mirroring
Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

lidnariq wrote:You might have underdumped the PRG; the 74'161's outputs only makes sense to be connected to pin 22 of the ROM if it's actually A16.
Yes, I also arrived to the same conclusion (from different observations), and in fact have now dumped also the second 64k portion. The second chip does have only 64k.

Incredible analysis that of yours!
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Post by lidnariq »

Bisqwit wrote:IC2.PIN10 -> IC3.PIN11
IC3.PIN13 -> IC3.PIN15
Were you counting the pins funny? This makes more sense, and is what I see on your pictures:

Code: Select all

IC2.PIN11 -> IC3.PIN14  (74'161.Q0 -> 74'153.S0)
Cartridge A11 -> IC3.PIN13 -> IC3.PIN11 (I3b -> I1b)
Cartridge A10 -> IC3.PIN12 -> IC3.PIN10 (I2b -> I0b)
I assume CIRAM A10 is connected to IC3.PIN9 (74'153.Zb) and Ground -> IC3.PIN15; can you find out what pins are connected to IC3.PIN2/5/6/7 (S1/I1a/I0a/Za) ?
Bisqwit
Posts: 249
Joined: Fri Oct 14, 2011 1:09 am

Post by Bisqwit »

lidnariq wrote:Were you counting the pins funny? This makes more sense, and is what I see on your pictures:

Code: Select all

IC2.PIN11 -> IC3.PIN14  (74'161.Q0 -> 74'153.S0)
Cartridge A11 -> IC3.PIN13 -> IC3.PIN11 (I3b -> I1b)
Cartridge A10 -> IC3.PIN12 -> IC3.PIN10 (I2b -> I0b)
Yes, you are correct at least for the first line. (That one you can see from the photo.)
The two others are impossible to tell for sure because they go under the ICs in question.

IC3.PIN2 goes somewhere underneath the chip, or nowhere at all.
IC3.PIN5,6 are interconnected. I don't know if they have other connections underneath the chip.
Same for pin 7: underneath the chip. Without desoldering the chip there's no way to see where it goes.
Post Reply