I purchased a cartridge of the homebrew game "The Legends of Owlia", and I really love it. I would like to make a personal backup of it, however, and I can't seem to get any data from it. As far as I know, it should be UNROM-512 or some similar variant, but no matter what I try PRG-ROM simple reads back as all 0's.
Does anyone have any experience backing up this particular game?
Edit:
Solved the issue. InfiniteNESLives suggested preventing the EXP0 pin from grounding, so I covered it with electrical tape and it worked. See page two of this thread for details! Thanks everyone!
Maybe it has a protection, for example - M2 must be toggled at 1.7 MHz, otherwise internal PRG-ROM is disabled?
I dumped Owlia with my CopyNES. I don't remember having a problem treating it like UNROM. Haven't tried with Kazzo.
Do you take bus conflicts into account? You should search the current bank for the byte you want to write and write on top of that byte.
Thanks for the replies!
krzysiobal wrote:
Maybe it has a protection, for example - M2 must be toggled at 1.7 MHz, otherwise internal PRG-ROM is disabled?
Copy protection is certainly a possibility, not sure if InfiniteNESLives does that to their boards or not. Is there any way with Kazzo to write to M2 at a given frequency, I wonder? I could probably try to build a custom breadboard that outputs pulses, but I'd rather not have to go that far
rainwarrior wrote:
I dumped Owlia with my CopyNES. I don't remember having a problem treating it like UNROM. Haven't tried with Kazzo.
Do you take bus conflicts into account? You should search the current bank for the byte you want to write and write on top of that byte.
Kazzo handling bus conflict differently than the NES is a good thought too!
So you mean in my dumping script, for each byte of PRG-ROM write a value to it and then try reading it directly after?
No, I mean when you write to the UxROM bankswitch register ($8000-$FFFF) you need to write your value on top of the same value to avoid a bus conflict.
Start at $8000 and just read bytes from the current bank until you hit the value you're trying to write, then write your value to that address.
Info here:
https://wiki.nesdev.com/w/index.php/Bus_conflict
Ah, I see what you're saying. The problem is that no matter what, all I seem to read back are 0's, not a single byte is anything else. So unfortunately I don't think I can try this since I wouldn't be able to find an actually 0 value byte by polling.
What I could do is look at the beginning of the demo ROM and find a 0 value, then try writing the first bank switch (0 at $8000) to that address and hope the data in the actual cart is the same. I'll try that in a little bit.
Thanks for the idea!
I've tried a couple new things, to no avail:
1. Writing a bank number to an address that contains that value (at least in the demo ROM). Received all 0's
2. Without writing anything at all, reading from 0xC000 to 0xFFFF, which should be a fixed bank. Received all 0's
I'm beginning to suspect that it is in fact some sort of anti-copying lockout. Not once in the several hours I've spent trying things have I read any value other than 0 from the cartridge. It's very perplexing.
The cartridge works just fine in my NES! I've also made dumps of other cartridges since trying Owlia, just to make sure I didn't manage to smoke my Kazzo somehow, and it seems to be fine.
Please attach photos of top and bottom side of cartridge's PCB.
Okay, I took some pictures of the PCB. Looks like it include a special thanks to NesDev on it
Try dumping as mapper 11 (Color Dreams).
Looks like it's using a 74HCT377 instead of 74'161 and 74'32 like normal UxROM would.
Save this as colordreams.ad for Kazzo dumper:
Code:
/*
From http://forums.nesdev.com/
Used for dumping Color Dream, Wisdom Tree and Bunch games
*/
board <- {
mappernum = 11,
cpu_rom = {
size_base = 0x10000, size_max = 1 * mega, banksize = 0x8000
},
ppu_rom = {
size_base = 0x8000, size_max = 1 * mega, banksize = 0x2000
},
ppu_ramfind = false, vram_mirrorfind = true
};
function cpu_dump(d, pagesize, banksize) {
for (local i = 0; i < pagesize; i += 1) {
cpu_write(d, 0x8000, i);
cpu_read(d, 0x8000, 0x4000);
cpu_read(d, 0xc000, 0x4000);
}
}
function ppu_dump(d, pagesize, banksize) {
for (local i = 0; i < pagesize; i += 1) {
cpu_write(d, 0x8000, i << 4);
ppu_read(d, 0, 0x2000);
}
}
Interestingly, when I tried that colordreams script, it still pulled 0x4000 bytes of 0's for PRG-ROM, but it got 0x2000 bytes of CHR, which is full of data... Something is definitely preventing me from reading PRG-ROM somehow.
It's not Colordreams. It's UxROM, just 512k. It can't use just a 161 because it's 512k. It needs at least 5 latch bits.
There's no CHR-ROM, it's RAM.
I don't really know anything about how the Kazzo works, but if you're getting all 0s I highly doubt it's from any kind of copy protection scheme. (I have the same board, but it dumped exactly as expected via CopyNES.) I think the problem is probably to do with the Kazzo somehow but I can't really speculate.
I'm guessing the issue is related to how EXP0 pin is used to control mapper/flash writes. If the original kazzo firmware grounds EXP0 pin then the /WE pin on the PRG-ROM is low which means you can't read data. Have you considered contacting Gradual Games directly?
infiniteneslives wrote:
I'm guessing the issue is related to how EXP0 pin is used to control mapper/flash writes. If the original kazzo firmware grounds EXP0 pin then the /WE pin on the PRG-ROM is low which means you can't read data. Have you considered contacting Gradual Games directly?
Thanks for the response!
If that is what is happening, then would it be safe to simply cover the EXP0 pin to keep it from being grounded?
I haven't contacted Gradual Games, but maybe I'll send them a message soon if I can't resolve it.
Solved!
Covering the EXP0 pin so that it wasn't grounded was exactly it. Thank you everyone for the help!
For anyone else who ever runs into this problem, all I did was cut a small piece of electrical tape and cover the EXP0 pin with it. I carefully put it in the Kazzo and used the UNROM-512 script.
I've attached a picture for fun.
That's good to know. I wonder if it would be worthwhile modding the Kazzo with a switch to disconnect EXP0 when not using it for flashing...
All this effort
for nothing.