I am trying to copy ROM from cartridge. There was a 32kB RAM, but i dissoldered it.
After copying 32kB and disassembling i found that:
00007F70: 48 PHA
00007F71: 29FC AND #$FC
00007F73: 4A LSR A
00007F74: 4A LSR A
00007F75: 8D0248 STA $4802
00007F78: 68 PLA
00007F79: 2903 AND #$03
00007F7B: 0A ASL A
00007F7C: 8D0148 STA $4801
00007F7F: 60 RTS
It is copied to internal RAM and called after LDA #$0F. Probably it switches memory, but i don't know what it does.
What exactly happens on cartridge connector when writing to $4801 or $4802?
I assume you mean 32kb of ROM? Whats the black glop top? It could be some sort of memory mapper. $4801 and $4802 could only be for hardware in that cartridge cause the NES itself won't respond to that.
I'm guessing this cartridge is some sort of pirate cartridge you're trying to dump? You're going to have to figure out how the mapper works yourself most likely.
$4801 and $4802 are not a standard nes register, they must be something to do with that pirate glop chip on the cart.
You could use a copynes and use the built in debugger and bank checker to figure out where the banking registers live. Kevtris did this for the ewj2 cart, theres a text file about it on his site or blog.
LN
Interesting that there's only 2 chips. If there is a mapper (seems to be the case, unless that is ripped code), that seems unusual. Normally there needs to be 2 memory chips.
You could check if the code is writing to CHR-RAM ($0000-$1FFF in VRAM), if that is the case and that glop-top is a RAM+mapper then you may have dumped everything already.
Whatever it is, the cart seems to be doing something clever.
Memblers wrote:
Whatever it is, the cart seems to be doing something clever.
It is possible it is just disassembled data. Especially if it is a single-chip cart.
I dumped that from the glop top visible on the photo, not from dissoldered RAM (there is nothing on it). The device I built is connected with cartridge through connector. This black thing is probably PRG ROM with mapper. The RAM was acting as CHR.
32kB from it:
http://www.sendspace.pl/file/KSk8MzdG/
I think I know what is it doing. The question is how is it doing this, so I can do the same thing to switch memory and dump the rest - by applying proper pin configuration on the connector.
edit:
The writes are done by console, so it doesn't matter what is on the cartridge.
Well, probably there is PRG ROM and mapper under the epoxy blob, and the CHR RAM was the other dissoldered chip. The $48xx should be mapper writes, but unless you know exactly how the mapper works, it's impossible to tell.
I seem to remember one version of CopyNES having a built-in 6502 emulator, so that kevtris could step through the protection of Earthworm Jim 2 and see how to get the game to boot.
What's the game? Those registers would also be FDS expansion sound registers. Is it an FDS port?
Educational Computer 2000 (completely another than Russian one). Uses keyboard and mouse. It doesn't seem to be FDS port.
There is an information in the rom:
000070F3: Copyrigt 2000-2004 SZbrave, Tel:0755-3822630e-mail:szbrave@szonline.net
Maybe I'll try using /CE as /A15 and see what happens.
Their website
http://szbrave.com is still around.
The address lines for $4801 are A14, A11, and A0 high, all others low. /A15 should be high. The PRG R/W pin should be low for writing, and I believe it should all take effect when the M2 (Phi2) pin goes from low to high.
$4802 is the same, but with A1 high and A0 low. They must be seperate latches for PRG and CHR.
You answered right after i figured it out myself. Thanks anyway.
The LPT thing I made can't handle writes. Too bad the cartridge doesn't fit to put directly into PCI socket - there is too many grounds. I'll need to find some broken PCI device.
Maybe this will work.
Failure. I damaged the cartridge.
I had no working cartridge socket, so I tried to solder wires directly to cartridge and burned two address connectors.
