Dumping games from integrated famiclone cartridge

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Dumping games from integrated famiclone cartridge

Post by krzysiobal »

I got this weird fami-clone with integrated 9999999 in 1 multicart (not a second cartridge inside, just a second blob, next to the Nes On Chip). I want to discuss a non-desctructive way of dumping it (unless it is already available). I can't even solder ~60 wires to all blob's PRG-A/D/CHR-A/D lines, because Nes on Chip will conflict with it.

Image Image

So maybe I should investigate how the console checks for the presence of main cartridge, then make a special-dumping cartridge with RS232/USB port, which will put its code into RAM and execute from here, then disable the main cartridge slot?


Why I want to dump it? Because it contains unique, modified popular games:
Tennins (Tennis Hack)
Mars (Star Force Hack)
Sky Invader (Sky Destroyer Hack)
Cow Boy (Wild Gunman Hack)
Forest Guard (Hogans Alley Hack)
Space 2050 (Duck Hunt Hack)
Ufo Race (F1 Hack)
Ufo Shoot (Duck Hunt Clay Shoot Hack)

Those hacks are really cool and unique - they changed the music, background and sprites (and maybe levels). Never seen that before.

Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Dumping games from integrated famiclone cartridge

Post by Fisher »

Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Dumping games from integrated famiclone cartridge

Post by krzysiobal »

Fisher wrote:Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.
Thanks. But I changed my mind, I will make flash cartridge that can be programmed by 6502. So the cartridge will copy the routine to RAM and execute from here. Ram routine will switch to internal multicart, read portion of data from here, switch to external multicart, program part of flash data, and so on. Then I will be able to read it back using kazzo.

Both VCC lines on main slot are not connected so probably Nes on Chip detects external cart presence using that - so just modified unrom with posibility to switch it will be ok.
User avatar
MWK
Posts: 15
Joined: Wed Apr 07, 2010 12:46 pm
Location: Poland
Contact:

Re: Dumping games from integrated famiclone cartridge

Post by MWK »

krzysiobal, are you sure you've checked all the dumps by Cah4e3?
I swear I've already seen Ufo Race and Ufo Shoot somewhere else.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Dumping games from integrated famiclone cartridge

Post by NewRisingSun »

The individual games are of course standard fare on a great number of different multicarts, many of which have been dumped by now. But the key thing to compare is the menu and which game is at which numbered position. I have never seen the particular menu depicted in krzysiobal's picture. I think those particular hacks were made by Inventor [1][2].
User avatar
Sumez
Posts: 919
Joined: Thu Sep 15, 2016 6:29 am
Location: Denmark (PAL)

Re: Dumping games from integrated famiclone cartridge

Post by Sumez »

Exactly these famiclones were actually sold in two major, country-wide supermarket chains around here, around ten years ago(!). I have absolely no idea how they found their way in there, and I'm pretty sure the retailers had absolutely no idea what they were selling. I have few of them, just ripped them up and played around with the hardware inside them, but I never tried dumping anything. :\ They did come with one additional 1-in-many multicart of similar amusing hacks, though, which is weird.

Not that that information is gonna help you, I just though it was interesting to see one here.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Dumping games from integrated famiclone cartridge

Post by krzysiobal »

Ok, I made a UNROM-like (512 kB) cartridge with flash memory that helped me dump it:
Image Image Image Image Image Image

The cartridge memory map is:

Code: Select all

Read:
  $8000-$bfff: switchable bank
  $c000-$ffff: fixed to last bank

Write:
 $8000-$bfff: used for programming flash memory
 $c000-$ffff: E--P PPPP
              |  | ||||
              |  +-++++- set switchable bank at $8000
              +--------- turn on (1) or off (0) internal memory
Console detects if pin 31 is VCC (disabled internal cartridge) or not.

First I dumped the $8000-$ffff and analyzed it:

Code: Select all

                                           Writes into										 
Name on list Original game       Size M  Hex   Bin
------------------------------------------------------------------
-Menu-                              ? ?  $8000 100000000 0 000 000
Tennis       Tennis                16 V  $8048 100000000 1 001 000
Mars         Star Force            16 V  $8052 100000000 1 010 010
Sky Invader  Sky Destroyer         16 H  $80db 100000001 1 011 011
Cow Boy      Wild Gunman           16 V  $8064 100000000 1 100 100
Forest Guard Hogans Alley          16 V  $806d 100000000 1 101 101
Space 2050   Duck Hunt             16 V  $8076 100000000 1 110 110
Ufo Race     F1 Race               16 V  $807f 100000000 1 111 111
                                                               
Ufo Shoot    Duck Hunt Clay Shoot  16 V  $8076 100000000 1 110 110
                                                       | | ||| |||
                                                       | | ||| +++- PRG bank
                                                       | | +++ ---- CHR bank
                                                       | + --- ---- mode (0=32K, 1=16K)
                                                       + - --- ---- mirroring (0=V, 1=H)
Then I dumped whole PRG + CHR. I dont searched if there is already mapper with same behaviour, so I assigned it new number.

Image

Quirks:
* after bringing pin 31 to VCC/GND, there has to be ~10 ms delay (so looks like the circuit for detecting state of pin 31 is not combinatorial or has filtering),
* reading first byte of PPU $0000 returns open bus
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Dumping games from integrated famiclone cartridge

Post by lidnariq »

That's mapper 58, according to FCEUX's source.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Dumping games from integrated famiclone cartridge

Post by krzysiobal »

I got another battery-powered console with built-in games.
Image Image Image Image Image

This time, consonle detects presence of cartridge by shorting pins of CIRAM/CE and PPU/A13 (CIRAM=VCC and PPU/A13 is probed).
Internal cartridge (1800-in-1) is a MMC3-based multicart, which is Mapper 45.

It took me some time to dump it cause writes to the internal register were ignored. I found out that 7th bit in Reg 3 needs to be 1, otherwise mapper ignores writes (except the lock bit, which can be set anytime)

Code: Select all

   Reg 3:  [ELAA AAAA]
           L = Lock Multicart regs (1=locked)
           A = Inverted PRG-AND
		   E = Enable (1=writes make any effect)
This cartridge contains modified versions of known games (I don't know original names of two games so maybe somebody can help)

Code: Select all

Modified game   |Original game
----------------+------------------------
Menu+Olympics   |Track & Field        
Ultimate Speed  |Ferrari - Grand Prix 
Fun Click       |?
Box World       |?
Soccer          |Soccer               
Tennis          |Tennis               
Forest Guard    |Hoogan's Alley       
Cowboy          |Wild Gunman          
Space 2050      |Duck Hunt            
Shoot Copter    |Duck Hunt            
Ufo Race        |F1 Race              
Sky Invader     |Sky Destroyer        
Bomb Helicopter |Raid on Bungeling Bay
Baseball        |Baseball             
Super Elf       |Circus Charlie       

Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image Image
User avatar
MrNorbert1994
Posts: 988
Joined: Tue May 06, 2014 1:50 pm
Location: Szeged, Hungary
Contact:

Re: Dumping games from integrated famiclone cartridge

Post by MrNorbert1994 »

By any chance... did you dumped this since then?
Deviljin88
Posts: 78
Joined: Thu Jan 31, 2019 7:20 am

Re: Dumping games from integrated famiclone cartridge

Post by Deviljin88 »

please send me multicart from picture please
Attachments
1069125800_1525302660.png
Post Reply