It is currently Thu Dec 14, 2017 4:05 pm

All times are UTC - 7 hours



Forum rules


Related:



Post new topic Reply to topic  [ 197 posts ]  Go to page 1, 2, 3, 4, 5 ... 14  Next
Author Message
PostPosted: Tue Jul 22, 2014 5:32 am 
Offline

Joined: Mon Jul 21, 2014 9:17 pm
Posts: 2
Hello there,
I bought a NINTENDO POWER Cartridge and try to program other game into it.
The original game in NINTENDO POWER Cartridge is Derby Stallion .
I programmed the Fire Emblem: Thracia 776 to the flash but the game is only black screen of death .
Did someone else have had this problem and know a way to fix this?
Does the the Fire Emblem: Thracia 776's rom has been revised for emulator ?


Attachments:
1689412810318114782.jpg
1689412810318114782.jpg [ 29.76 KiB | Viewed 7527 times ]


Last edited by nintendopower on Tue Jul 22, 2014 6:21 am, edited 1 time in total.
Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 5:44 am 
Offline

Joined: Fri Jul 04, 2014 2:34 pm
Posts: 296
Location: Germany
I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..


Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 6:44 am 
Offline

Joined: Mon Jul 21, 2014 9:17 pm
Posts: 2
Ice Man wrote:
I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..

But some Games are only release in NP,like :[Genjuu Ryodan],[Super Famicom Wars]...etc.
these games has not HiRom/LoRom etc.


Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 7:48 am 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 19345
Location: NE Indiana, USA (NTSC)
You're supposed to be able to tell whether a game is LoROM or HiROM from a byte in the game's internal header.
For LoROM, byte $7FD5 will have a value of $20 or $30 and byte $7FFD will be $80-$FF.
For HiROM, byte $FFD5 will have a value of $21 or $31 and byte $FFFD will be $80-$FF.
Add $0200 to each if your image has a (redundant) floppy copier header.


Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 12:01 pm 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 538
nintendopower wrote:
I programmed the Fire Emblem: Thracia 776 to the flash but the game is only black screen of death .

How did you manage to write to Nintendo Power cartridges ???
I was thinking that it would be impossible to write anything to the FLASH chips without first sending some some secret unlocking commands to the MX15001 chip...
Did somebody figure out how to do that? Or is there no such protection at all? Or did you simply bypass that protection by doing some hardware mods... like desoldering the FLASH chips? Or do you have one of the official store/kiosk programming stations at home?


Last edited by nocash on Thu Jul 24, 2014 3:32 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 12:28 pm 
Offline

Joined: Mon Jul 02, 2012 7:46 am
Posts: 760
I just managed to pick up one of the NP SFC carts on Ebay for $20US. I'll play around with it when it arrives and let you know what I find out.


Top
 Profile  
 
PostPosted: Tue Jul 22, 2014 3:40 pm 
Offline

Joined: Mon Mar 27, 2006 5:23 pm
Posts: 1339
I'm almost certain he programmed the FlashROM directly. You probably don't *have* to desolder the chip to do this (example), but it probably makes it a whole lot easier if you do.

Nintendo Power carts are not just individual games: there's a boot menu in there that also handles all the mapping for the games. If you don't copy that (and likely, modify it for the game you want to run), then the mapper doesn't set anything up and it won't work. Your best bet would be to image a real Thracia 776 NP cart and then burn that image verbatim.

I'm glad this thread exists. I've stated that I am unwilling to collect and/or dump any flash carts (BSX/NP) because they are basically USB sticks with a weird connector and raw file system. Now I have a link to show people.

If nintendopower pulls this off, he can flip $20 eBay NP carts for $400 Wizardry 1-2-3 carts until the market catches on and all NP carts lose all their value, if he were so inclined. We already have eBay sellers reprogramming NSS carts thanks to nocash's info, so this is inevitable I suppose.

I say we go ahead and do it. Reflashed NP would make a nice boot loader for my serial port controller, I keep wiping the SRAM on my current devcart and having to break out the Super UFO to rewrite it. (I guess I could dual-purpose quertymodo's Cx4 devcart though too.)

As far as reprogramming a cart through SNES code ... the actual programming of the flash chips is almost certainly the usual 0xaa55-style commands for BS-X and GBA RAM. The flash vendor interfaces are usually very similar to each other, with a few minor tweaks. But there's probably some extra catch like a "write enable" register/sequence that the NP reprogramming stations performed via running its own boot ROM instead of booting directly off the cart. Unlikely it's anything super complicated like special voltages applied to pins that a regular SNES console can't do, to turn on reprogramming mode, although I guess we can't rule that out.

Best bet to learn how to do this through cart swapping + reprogramming, would be to emulate the actual NP menu and memory mapping chip. Get a good idea of the register space involved, look for gaps in the register table, and start experimenting. Use the usual GBA RAM rewrite command style on it as you brute-force any kind of enable handshake.

But hell, it may have no enable required at all. I don't think anyone's actually tried a straight up cart swap GBA-style reprogram before.


Top
 Profile  
 
PostPosted: Wed Jul 23, 2014 4:12 pm 
Offline

Joined: Fri Jul 04, 2014 2:34 pm
Posts: 296
Location: Germany
nintendopower wrote:
Ice Man wrote:
I usually use normal cartridges to program NP games. Did you make sure, if the game/cartridge are actually matching? HiRom/LoRom, SRAM, etc..

But some Games are only release in NP,like :[Genjuu Ryodan],[Super Famicom Wars]...etc.
these games has not HiRom/LoRom etc.

EVERY SNES game has a mapper, whether it be LoRom or HiRom.

As for the cartridge itself. I used simple SHVC-1AxM-xx (LoRom) or SHVC-1JxM-xx (HiRom) donor boards from sports games and the like. Programmed the EPROMS (usually 27c801 or 27c322 with a few other decoders) and replaced the original MaskROM.

That way I have made Genjuu Ryudan, Power Lode Runner and other NP games, like the Picross series. Not for sale though!

I never had a NP Cartridge in my hands yet but I might buy one just to see how it works. :P


Top
 Profile  
 
PostPosted: Thu Jul 24, 2014 2:18 pm 
Offline
User avatar

Joined: Wed Dec 06, 2006 8:18 pm
Posts: 2806
Ice Man wrote:
EVERY SNES game has a mapper, whether it be LoRom or HiRom.


This is not true. LoROM and HiROM are not "mappers". They are terms we use for two different memory models. Nintendo refers to them as "Mode ##". They are not memory mappers in the sense like NES or SA-1/SDD-1 because they aren't capable of mapping anything on the fly. They are just a static setup of how the memory is mapped.

Take Killer Instinct for example. This game consists of only two chips on a very small PCB. One 32 Megabit MaskROM and the Lockout/CIC chip. The game is "HiROM". But there is no mapper involved. The game is "HiROM" because of what signals on the MaskROM connect to what signals on the cartridge port.


Top
 Profile  
 
PostPosted: Fri Jul 25, 2014 12:10 pm 
Offline

Joined: Fri Jul 04, 2014 2:34 pm
Posts: 296
Location: Germany
My bad, "mapper" was indeed a wrong expression. HiRom/LoRom is determined whether Pin 40 is connected to A15 or not.


Top
 Profile  
 
PostPosted: Fri Jul 25, 2014 9:32 pm 
Offline

Joined: Sun Dec 02, 2012 8:17 am
Posts: 483
Location: East Texas
So why is there 7 numbers on the front? Can it hold 7 games? I didn't even know these existed until this thread! How would they program?


Top
 Profile  
 
PostPosted: Sat Jul 26, 2014 10:31 pm 
Offline
User avatar

Joined: Wed Dec 06, 2006 8:18 pm
Posts: 2806
Yes it can hold 7 games if they are small enough to fit into the memory space given. These cartridges where programmed at stores by a Nintendo Power writer machine. Think Famicom Disk System writer, but instead it's SNES and using Flash Memory.


Top
 Profile  
 
PostPosted: Tue Jul 29, 2014 12:20 pm 
Offline

Joined: Sun Dec 02, 2012 8:17 am
Posts: 483
Location: East Texas
Interesting! Is there any write-ups on the specs for this cart? What it can and can't do? I assume it won't do any special chip games....

Does anyone here have one of the programming machines?


Top
 Profile  
 
PostPosted: Tue Jul 29, 2014 7:23 pm 
Offline

Joined: Sun Dec 02, 2012 8:17 am
Posts: 483
Location: East Texas
I picked up a few of these NP carts and they are interesting....

It appears there is a menu to select from (albeit in Japanese).

I have a DK3 and street fighter 2 hyper fighting. The cart inside has the potential of 3 16mbit flash chips but only 2 of the flash roms are installed. So it would seem that whatever can be programmed, couldn't be any bigger than 48mbits or total more than 48mbits. DKC3 is a 32mbit game so that completely occupies the 2 flash roms on the cart.


Top
 Profile  
 
PostPosted: Wed Jul 30, 2014 6:26 am 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 538
There are three chapters about Nintendo Power carts in fullsnes.htm, http://problemkaputt.de/fullsnes.htm#sn ... rflashcard
The I/O port chapter is essentially a long list of unknown details, ie. just a list of unsolved problems.
The FLASH directory chapter is more or less complete (some details about SRAM/HiROM allocation are missing), but it's unknown if the cartridge is using that directories for ROM/SRAM allocation at all - it's also possinle that there is a second directory stored inside of the MX15001 chip, and that the per-game memory mapping is initialized based on that info (so the FLASH directory would be merely used for GUI purposes, such like displaying the game title bitmaps).

Some things that would be interesting...

One simple thing: Dumps of more FLASH directories: That would help to figure out if there's any SRAM/HiROM allocation info in the directory.

More difficult: Somehow confirming if there is a second directory (in the MX15001 chip) or if there is none such.
Ie. doing something like desoldering the FLASH chips from one cartridge, and installing them in a different cartridge (one with differently mapped games). If that is working, then there would be apparently only one single directory (in one of the FLASH chips) (technically, that might be possible: the MX15001 chip might be able to take control of the databus during /RESET, so it might be able to read the directory info from the FLASH chip, and then map the selected game accordingly) (of course that theory won't work for bigger 4Mbyte games which come up without any menu/directory).
Being pessimistic, I would suspect that swapping the FLASH chips won't work, and that the whole (de)-soldering work would just result in crashing right after selecting a game from the menu. And even if it would work: It wouldn't really on learning how to reprogram the cartridges without soldering.

The only way to learn how to reprogram the carts is probably hacking one of the offical programming stations. As by now there seems to be little known about them. Photos of their PCBs/chipset would be nice, and one would also need dumps of their storage memory, whatever they've been using there... ROM, EPROM, FLASH, HDDs?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 197 posts ]  Go to page 1, 2, 3, 4, 5 ... 14  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group