Dumping games from integrated famiclone cartridge

Dumping games from integrated famiclone cartridge
by krzysiobal on 2018-04-12 (#216791)

I got this weird fami-clone with integrated 9999999 in 1 multicart (not a second cartridge inside, just a second blob, next to the Nes On Chip). I want to discuss a non-desctructive way of dumping it (unless it is already available). I can't even solder ~60 wires to all blob's PRG-A/D/CHR-A/D lines, because Nes on Chip will conflict with it.

So maybe I should investigate how the console checks for the presence of main cartridge, then make a special-dumping cartridge with RS232/USB port, which will put its code into RAM and execute from here, then disable the main cartridge slot?

Why I want to dump it? Because it contains unique, modified popular games:
Tennins (Tennis Hack)
Mars (Star Force Hack)
Sky Invader (Sky Destroyer Hack)
Cow Boy (Wild Gunman Hack)
Forest Guard (Hogans Alley Hack)
Space 2050 (Duck Hunt Hack)
Ufo Race (F1 Hack)
Ufo Shoot (Duck Hunt Clay Shoot Hack)

Those hacks are really cool and unique - they changed the music, background and sprites (and maybe levels). Never seen that before.

Re: Dumping games from integrated famiclone cartridge
by Fisher on 2018-04-13 (#216814)

Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.

Re: Dumping games from integrated famiclone cartridge
by krzysiobal on 2018-04-13 (#216818)

Fisher wrote:

Maybe TapeDump can help.
I'm not sure if the source is available.
You probably will need to change some stuff.

Thanks. But I changed my mind, I will make flash cartridge that can be programmed by 6502. So the cartridge will copy the routine to RAM and execute from here. Ram routine will switch to internal multicart, read portion of data from here, switch to external multicart, program part of flash data, and so on. Then I will be able to read it back using kazzo.

Both VCC lines on main slot are not connected so probably Nes on Chip detects external cart presence using that - so just modified unrom with posibility to switch it will be ok.

Re: Dumping games from integrated famiclone cartridge
by MWK on 2018-04-14 (#216858)

krzysiobal, are you sure you've checked all the dumps by Cah4e3?
I swear I've already seen Ufo Race and Ufo Shoot somewhere else.

Re: Dumping games from integrated famiclone cartridge
by NewRisingSun on 2018-04-14 (#216860)

The individual games are of course standard fare on a great number of different multicarts, many of which have been dumped by now. But the key thing to compare is the menu and which game is at which numbered position. I have never seen the particular menu depicted in krzysiobal's picture. I think those particular hacks were made by Inventor [1][2].

Re: Dumping games from integrated famiclone cartridge
by Sumez on 2018-04-15 (#216906)

Exactly these famiclones were actually sold in two major, country-wide supermarket chains around here, around ten years ago(!). I have absolely no idea how they found their way in there, and I'm pretty sure the retailers had absolutely no idea what they were selling. I have few of them, just ripped them up and played around with the hardware inside them, but I never tried dumping anything. :\ They did come with one additional 1-in-many multicart of similar amusing hacks, though, which is weird.

Not that that information is gonna help you, I just though it was interesting to see one here.

Re: Dumping games from integrated famiclone cartridge
by krzysiobal on 2018-05-02 (#217903)

Ok, I made a UNROM-like (512 kB) cartridge with flash memory that helped me dump it:

The cartridge memory map is:

Code:

Read:
  $8000-$bfff: switchable bank
  $c000-$ffff: fixed to last bank

Write:
 $8000-$bfff: used for programming flash memory
 $c000-$ffff: E--P PPPP
              |  | ||||
              |  +-++++- set switchable bank at $8000
              +--------- turn on (1) or off (0) internal memory

Console detects if pin 31 is VCC (disabled internal cartridge) or not.

First I dumped the $8000-$ffff and analyzed it:

Code:

                                           Writes into                               
Name on list Original game       Size M  Hex   Bin
------------------------------------------------------------------
-Menu-                              ? ?  $8000 100000000 0 000 000
Tennis       Tennis                16 V  $8048 100000000 1 001 000
Mars         Star Force            16 V  $8052 100000000 1 010 010
Sky Invader  Sky Destroyer         16 H  $80db 100000001 1 011 011
Cow Boy      Wild Gunman           16 V  $8064 100000000 1 100 100
Forest Guard Hogans Alley          16 V  $806d 100000000 1 101 101
Space 2050   Duck Hunt             16 V  $8076 100000000 1 110 110
Ufo Race     F1 Race               16 V  $807f 100000000 1 111 111
                                                               
Ufo Shoot    Duck Hunt Clay Shoot  16 V  $8076 100000000 1 110 110
                                                       | | ||| |||
                                                       | | ||| +++- PRG bank
                                                       | | +++ ---- CHR bank
                                                       | + --- ---- mode (0=32K, 1=16K)
                                                       + - --- ---- mirroring (0=V, 1=H)

Then I dumped whole PRG + CHR. I dont searched if there is already mapper with same behaviour, so I assigned it new number.

Quirks:
* after bringing pin 31 to VCC/GND, there has to be ~10 ms delay (so looks like the circuit for detecting state of pin 31 is not combinatorial or has filtering),
* reading first byte of PPU $0000 returns open bus

Re: Dumping games from integrated famiclone cartridge
by lidnariq on 2018-05-02 (#217904)

That's mapper 58, according to FCEUX's source.

Re: Dumping games from integrated famiclone cartridge
by krzysiobal on 2018-10-20 (#227878)

I got another battery-powered console with built-in games.

This time, consonle detects presence of cartridge by shorting pins of CIRAM/CE and PPU/A13 (CIRAM=VCC and PPU/A13 is probed).
Internal cartridge (1800-in-1) is a MMC3-based multicart, which is Mapper 45.

It took me some time to dump it cause writes to the internal register were ignored. I found out that 7th bit in Reg 3 needs to be 1, otherwise mapper ignores writes (except the lock bit, which can be set anytime)

Code:

   Reg 3:  [ELAA AAAA]
           L = Lock Multicart regs (1=locked)
           A = Inverted PRG-AND
         E = Enable (1=writes make any effect)

This cartridge contains modified versions of known games (I don't know original names of two games so maybe somebody can help)

Code:

Modified game   |Original game
----------------+------------------------
Menu+Olympics   |Track & Field        
Ultimate Speed  |Ferrari - Grand Prix 
Fun Click       |?
Box World       |?
Soccer          |Soccer               
Tennis          |Tennis               
Forest Guard    |Hoogan's Alley       
Cowboy          |Wild Gunman          
Space 2050      |Duck Hunt            
Shoot Copter    |Duck Hunt            
Ufo Race        |F1 Race              
Sky Invader     |Sky Destroyer        
Bomb Helicopter |Raid on Bungeling Bay
Baseball        |Baseball             
Super Elf       |Circus Charlie       