Fixing ROMs for EMS 64 GB Smart Card USB
-
- Posts: 3
- Joined: Sat Jul 06, 2019 12:10 pm
Re: Fixing ROMs for EMS 64 GB Smart Card USB
With the help of a very experienced specialist, I finally learned how to make the games on the flash card work.
I would like to share my results with you in this article.
Batman Forever (USA, Europe) FIX.ips
Bomberman GB (USA, Europe) (SGB Enhanced) FIX.ips
Ferrari Grand Prix Challenge (USA, Europe) FIX.ips
Fire Fighter (Europe) FIX.ips
Gargoyle's Quest (USA, Europe) FIX.ips
Solomon's Club (Europe) FIX.ips
Super Off Road (USA, Europe) FIX.ips
Wizards & Warriors Chapter X - The Fortress of Fear (USA, Europe) FIX.ips
Worms (Europe) FIX.ips
Download:
http://www.share-online.biz/dl/Q1KDFAUP07N
I would like to share my results with you in this article.
Batman Forever (USA, Europe) FIX.ips
Bomberman GB (USA, Europe) (SGB Enhanced) FIX.ips
Ferrari Grand Prix Challenge (USA, Europe) FIX.ips
Fire Fighter (Europe) FIX.ips
Gargoyle's Quest (USA, Europe) FIX.ips
Solomon's Club (Europe) FIX.ips
Super Off Road (USA, Europe) FIX.ips
Wizards & Warriors Chapter X - The Fortress of Fear (USA, Europe) FIX.ips
Worms (Europe) FIX.ips
Download:
http://www.share-online.biz/dl/Q1KDFAUP07N
- Attachments
-
- Fixes By Tschisomat.zip
- Batman Forever (USA, Europe) FIX.ips
Bomberman GB (USA, Europe) (SGB Enhanced) FIX.ips
Ferrari Grand Prix Challenge (USA, Europe) FIX.ips
Fire Fighter (Europe) FIX.ips
Gargoyle's Quest (USA, Europe) FIX.ips
Solomon's Club (Europe) FIX.ips
Super Off Road (USA, Europe) FIX.ips
Wizards & Warriors Chapter X - The Fortress of Fear (USA, Europe) FIX.ips
Worms (Europe) FIX.ips - (2.82 KiB) Downloaded 421 times
-
- Posts: 3
- Joined: Sat Jul 06, 2019 12:10 pm
Re: Fixing ROMs for EMS 64 GB Smart Card USB
New Fix
Kid Icarus - Of Myths and Monsters (USA, Europe)
Kid Icarus - Of Myths and Monsters (USA, Europe)
- Attachments
-
- Kid Icarus - Of Myths and Monsters (USA, Europe) FIX.zip
- (510 Bytes) Downloaded 427 times
Re: Fixing ROMs for EMS 64 GB Smart Card USB
any chance of getting Final Fantasy Legend patched to initialize the save when started from Mottzilla's multirom menu?
neither Final Fantasy Legend, nor Final Fantasy Legend 2 seem to initialize the save when booted with this menu, however as stated in this topic, FFL2 will initialize the save if you select 'start a new game' and then back out to the title screen.
On my 64M cart I've been using a sketchy work around:
1) use Mottzilla's multimenu on side1 with a dummy rom to load the save
*I've been using Tennis with the header modified to the same cartridge type as FFL (06h-rom+mbc2+battery)
2) powering off/on to switch to side2
3) use the multimenu below (which doesn't manage saves) to play FFL
https://github.com/mikeryan/ems-flasher (menu.gb)
https://github.com/chastai/menugb (doesn't seem to exist anymore)
one thing I did notice while modifying headers was the Rom Entry Point for FFL & FFL2 was different than any other roms I had (don't know if this has anything to do with the issue)
neither Final Fantasy Legend, nor Final Fantasy Legend 2 seem to initialize the save when booted with this menu, however as stated in this topic, FFL2 will initialize the save if you select 'start a new game' and then back out to the title screen.
On my 64M cart I've been using a sketchy work around:
1) use Mottzilla's multimenu on side1 with a dummy rom to load the save
*I've been using Tennis with the header modified to the same cartridge type as FFL (06h-rom+mbc2+battery)
2) powering off/on to switch to side2
3) use the multimenu below (which doesn't manage saves) to play FFL
https://github.com/mikeryan/ems-flasher (menu.gb)
https://github.com/chastai/menugb (doesn't seem to exist anymore)
one thing I did notice while modifying headers was the Rom Entry Point for FFL & FFL2 was different than any other roms I had (don't know if this has anything to do with the issue)
-
- Posts: 1
- Joined: Sat Sep 12, 2020 6:34 pm
Re: Fixing ROMs for EMS 64 GB Smart Card USB
Does anyone happen to have a fix for Mega Man V? The older uploads of it seem to be dead
Re: Fixing ROMs for EMS 64 GB Smart Card USB
sc_ghfix patches
http://blogattach.naver.net/70e56cdfc49 ... _ghfix.zip
sc_mzfix patches
http://blogattach.naver.net/f164ed584c7 ... _mzfix.zip
sc_mzmenu flasher
http://blogattach.naver.net/d84dc477643 ... lasher.zip
http://blogattach.naver.net/70e56cdfc49 ... _ghfix.zip
sc_mzfix patches
http://blogattach.naver.net/f164ed584c7 ... _mzfix.zip
sc_mzmenu flasher
http://blogattach.naver.net/d84dc477643 ... lasher.zip
-
- Posts: 1
- Joined: Tue Jan 25, 2022 8:53 am
Re: Fixing ROMs for EMS 64 GB Smart Card USB
above link from 2020 are dead. Had luck with google and found this Japanese site hosting them:
https://m.blog.naver.com/zzamstop/221155403452
https://m.blog.naver.com/zzamstop/221155403452
Re: Fixing ROMs for EMS 64 GB Smart Card USB
It's a Korean site, not Japanese.
Re: Fixing ROMs for EMS 64 GB Smart Card USB
hello, I am looking for the following patches for game boy:
home alone 1
hook
indiana jones 3
Mcdonaldland
pagemaster
pinocchio
Simpson - Bart and the Beanstalk
Simpson - Bart vs the Juggernauts
Simpson - Escape From Camp Deadly
simpson - Krusty's Fun House
super mario land 2
wario blast
. best regards
following (gbc) ((patch bug fix)) :
harry potter 2
last bible 1
mickey racing
mr nutz gbc
spy vs spy gbc
star wars obi-wan adventures
terrifyng 911
hello, i am looking for invincible game genie code for robocop (gb) or ips file.
home alone 1
hook
indiana jones 3
Mcdonaldland
pagemaster
pinocchio
Simpson - Bart and the Beanstalk
Simpson - Bart vs the Juggernauts
Simpson - Escape From Camp Deadly
simpson - Krusty's Fun House
super mario land 2
wario blast
. best regards
following (gbc) ((patch bug fix)) :
harry potter 2
last bible 1
mickey racing
mr nutz gbc
spy vs spy gbc
star wars obi-wan adventures
terrifyng 911
hello, i am looking for invincible game genie code for robocop (gb) or ips file.
Last edited by AL771914 on Sat Aug 26, 2023 11:32 pm, edited 3 times in total.
Re: Fixing ROMs for EMS 64 GB Smart Card USB
I've produced patches as per the previous poster's requests. I've also added some notes for each game. These are mostly my internal notes, but maybe they're useful for someone. If you want clarification about anything said below, please ask.
I created the patched ROMs using BGB and a hex editor for some of the edits. In general, the idea is to remove writes to the banking registers that can cause problems for a nonstandard "MBC" like the one in the EMS 64M USB. These include writes to nonstandard addresses, and writing a value of 0 when intending to select bank 1. The former seems to possibly be a deliberate strategy to mess with the pirate multicarts of the time, as writes to other addresses could do things like selecting a different game or causing a reset.
For example, using $3FFF for selecting the ROM bank was a common technique. This works on a real MBC which only decodes the top, what is it, 3 bits. But might cause problems elsewhere.
I wanted to get rid of any and all writes to nonexistant/nonstandard MBC register addresses. For a game with no save capability, that for example meant any writes except writes to $2000. My strategy in general has been to put access breakpoints in place for anything but desired writes, and then work toward patching out any other writes.
Example of such access breakpoints for a game with no saving:Or for a game with saving, Super Mario Land 2 in this case:Here, the registers for enabling and selecting the SRAM bank was added as "holes" in the forbidden address set.
Home Alone (U) [!].gb
Writes to weird xfff addresses. 1fff,3fff,5fff,7fff.
Patched out unused writes. Only a few ROM bank writes.
Hook (E) [!].gb
Relies on 00 from memory init. Probably no other 0 writes. Optimized the memmory clear routine to fit writing 1 to $C08D.
Indiana Jones and the Last Crusade (UE) [!].gb
rst 28 is bank switch. Writes to 3fff, also writes 00.
McDonaldland (U) [!].gb
Bizarre bank switching routine. Why? Mess with pirate multicart I'm guessing. I worry that this code is checked against tampering later in the game so the game stops working after some level or something.
Pagemaster, The (U) [S][!].gb
Scratchpad notes for copy/paste into BGB's inline assembler.
Pinocchio (U) (1995).gb and Pinocchio (U) (1996) [!].gb
Appears to be a typo/copypasted code? Testing out using the ld [$FF00+C],A opcode but wrong syntax? Intends to write SCX thrice? Should be harmless regardless (would at worst disable SRAM if cart has it) but weird.
Simpsons, The - Bart & the Beanstalk (U).gb
Sneaky writes to 1C00. Not sure if this is a bug, or a stealthy way to once again mess up multicarts, in a way that seems inconspicuous at first glance in a disassembler.
Seems to do nothing?
34c7: Reads cc64-cc65 as hl dest pointer. Also, holy moly that's a lot of unrolled copy loops...
Writes a total of $550 bytes on the first round. More in later rounds.
Will put some junk on the map, but this should be overwritten and invisible.
Simpsons, The - Bart vs the Juggernauts (U) [!].gb
Is using writes to $2100.
0387: Has builtin null check, nice!
Has current bank stored at 4000.
Simpsons, The - Escape from Camp Deadly (U) [!].gb
Has sample playback!
0bc4 init
0bf5 writes in the wrong order... c698 is ROM bank shadow here.
2ede
Simpsons, The - Krusty's Fun House (U) [!].gb
Has sample playback!
I did a sweeping search and replace for ea0021. Hope nothing else got trashed in the process.
Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!].gb
Selects bank 0 right after init because the "last bank" variable was cleared when WRAM was initalized. Harmless. The bank is set properly right afterwards.
It's using a combination of $2100 and $3000 for selecting the bank. $A24E, $A258, $A265 are last ROM bank variables.
Patch approach: replace EA4EA2EA0021 (ld [$a24e],a / ld [$2100],a) with EA4EA2EA0020 (ld [$a24e],a / ld [$2000],a). 195 replacements.
Replace EA4EA2EA0030 (ld [$a24e],a / ld [$3000],a) with EA4EA2EA0020 (as above). 22 replacements.
$25E0 reads from a table. It seems all valid entries are nonzero.
$261A same.
$030A1A (0C:4A1A) contains a bank switch. This would be unsafe if called from bank 1 except this is probably copied to WRAM.
$068561 (1A:4562) same.
$0685D5 (1A:45D5) same.
etc
Final validation:
Search for a2ea0021 and a2ea0030 (Read/write from $a2xx followed by write to ROM bank register.) Nothing left at this point.
Search for ea0021 and ea0030 (Write to $2100 or $3000.) A couple of one-off writes to $2100 with fixed bank.
Running game with assert access breakpoints:
$037E writes to $6000, MBC1 mode selection register. This write wouldn't matter either way on a real MBC1 cartridge 512 kiB ROM and 8 kiB SRAM. nop this out.
Should now be free from problematic MBC access, except the initial harmless bank 0 selection.
Just as expected, SML2 was the biggest and most complicated of the bunch to patch.
Wario Blast Featuring Bomberman! (U) [S][!].gb
$3BF0: Looks like a little patch of some kind. Makes two writes to fixed banks using $2000. Non-problematic.
$0AA3: ROM bank select using writes to $3FFF.
There are bank 0 writes that are probably harmless but I'm patching them anyway... Patching the $AA3 routine, since the other two seem to be using the RAM value written by that one.
$08E7, $0927, $0AA6
Hashes
This is a list of sha1 hashes for the source file I used, and the expected output after patching. Using the patch with wrong ROM revision may not work.
These patches should be considered beta quality and I've not dug up my EMS 64M to test them. Feedback welcome.
I created the patched ROMs using BGB and a hex editor for some of the edits. In general, the idea is to remove writes to the banking registers that can cause problems for a nonstandard "MBC" like the one in the EMS 64M USB. These include writes to nonstandard addresses, and writing a value of 0 when intending to select bank 1. The former seems to possibly be a deliberate strategy to mess with the pirate multicarts of the time, as writes to other addresses could do things like selecting a different game or causing a reset.
For example, using $3FFF for selecting the ROM bank was a common technique. This works on a real MBC which only decodes the top, what is it, 3 bits. But might cause problems elsewhere.
I wanted to get rid of any and all writes to nonexistant/nonstandard MBC register addresses. For a game with no save capability, that for example meant any writes except writes to $2000. My strategy in general has been to put access breakpoints in place for anything but desired writes, and then work toward patching out any other writes.
Example of such access breakpoints for a game with no saving:
Code: Select all
0000-1FFF W
2001-7FFF W
2000 00 W
Code: Select all
0001-1FFF W
2001-3FFF W
4001-7FFF W
2000 00 W
Home Alone (U) [!].gb
Writes to weird xfff addresses. 1fff,3fff,5fff,7fff.
Patched out unused writes. Only a few ROM bank writes.
Hook (E) [!].gb
Relies on 00 from memory init. Probably no other 0 writes. Optimized the memmory clear routine to fit writing 1 to $C08D.
Indiana Jones and the Last Crusade (UE) [!].gb
rst 28 is bank switch. Writes to 3fff, also writes 00.
McDonaldland (U) [!].gb
Bizarre bank switching routine. Why? Mess with pirate multicart I'm guessing. I worry that this code is checked against tampering later in the game so the game stops working after some level or something.
Code: Select all
ld c,a
ld b,$00
ld hl,$3B97
add hl,bc
ld [hl],a
Scratchpad notes for copy/paste into BGB's inline assembler.
Code: Select all
or a
rst 30
nop
jr nz,1
inc a
ld [2000],a
ret
Code: Select all
0169:
ld [$0043],a
ld [$ff43],a
ld [$ff43],a
Simpsons, The - Bart & the Beanstalk (U).gb
Sneaky writes to 1C00. Not sure if this is a bug, or a stealthy way to once again mess up multicarts, in a way that seems inconspicuous at first glance in a disassembler.
Code: Select all
03E5:
ld hl,$FF80
ld bc,$007F
call MemClear
ld hl,$C008
ld bc,$12FC
call MemClear
ld hl,$1C00
ld bc,$1000
call MemClear
ret
MemClear:
ld e,$00
: ld [hl],e
inc hl
dec bc
ld a,b
or c
jr nz,:-
ret
Code: Select all
1baa: ld [$221A],A
Writes a total of $550 bytes on the first round. More in later rounds.
Code: Select all
Fix: 3f7:
ld a,$98
ld [$cc65],a
Simpsons, The - Bart vs the Juggernauts (U) [!].gb
Is using writes to $2100.
0387: Has builtin null check, nice!
Has current bank stored at 4000.
Simpsons, The - Escape from Camp Deadly (U) [!].gb
Has sample playback!
0bc4 init
0bf5 writes in the wrong order... c698 is ROM bank shadow here.
2ede
Simpsons, The - Krusty's Fun House (U) [!].gb
Has sample playback!
I did a sweeping search and replace for ea0021. Hope nothing else got trashed in the process.
Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!].gb
Selects bank 0 right after init because the "last bank" variable was cleared when WRAM was initalized. Harmless. The bank is set properly right afterwards.
It's using a combination of $2100 and $3000 for selecting the bank. $A24E, $A258, $A265 are last ROM bank variables.
Patch approach: replace EA4EA2EA0021 (ld [$a24e],a / ld [$2100],a) with EA4EA2EA0020 (ld [$a24e],a / ld [$2000],a). 195 replacements.
Replace EA4EA2EA0030 (ld [$a24e],a / ld [$3000],a) with EA4EA2EA0020 (as above). 22 replacements.
$25E0 reads from a table. It seems all valid entries are nonzero.
$261A same.
$030A1A (0C:4A1A) contains a bank switch. This would be unsafe if called from bank 1 except this is probably copied to WRAM.
$068561 (1A:4562) same.
$0685D5 (1A:45D5) same.
etc
Final validation:
Search for a2ea0021 and a2ea0030 (Read/write from $a2xx followed by write to ROM bank register.) Nothing left at this point.
Search for ea0021 and ea0030 (Write to $2100 or $3000.) A couple of one-off writes to $2100 with fixed bank.
Running game with assert access breakpoints:
$037E writes to $6000, MBC1 mode selection register. This write wouldn't matter either way on a real MBC1 cartridge 512 kiB ROM and 8 kiB SRAM. nop this out.
Should now be free from problematic MBC access, except the initial harmless bank 0 selection.
Just as expected, SML2 was the biggest and most complicated of the bunch to patch.
Wario Blast Featuring Bomberman! (U) [S][!].gb
$3BF0: Looks like a little patch of some kind. Makes two writes to fixed banks using $2000. Non-problematic.
$0AA3: ROM bank select using writes to $3FFF.
There are bank 0 writes that are probably harmless but I'm patching them anyway... Patching the $AA3 routine, since the other two seem to be using the RAM value written by that one.
$08E7, $0927, $0AA6
Hashes
This is a list of sha1 hashes for the source file I used, and the expected output after patching. Using the patch with wrong ROM revision may not work.
Code: Select all
a3142c83f391eda6f445226f2d49bd8a384be411 Home Alone (U) [!].gb
ee9ef0940e6d8109d75cf6ce1af9ae50785eed83 Home Alone (U) [!] patch.gb
0e0784c238b8a16666157e1ac99cee17feb52c63 Hook (E) [!].gb
969135705ea46ea884bbdab8af66b85db54b9819 Hook (E) [!] patch.gb
b656ba6c03d0cb5c81c2ed8c5c64ea8e36660aaa Indiana Jones and the Last Crusade (UE) [!].gb
6c125aa07391e06be0dacd5f4a058ad084c78129 Indiana Jones and the Last Crusade (UE) [!] patch.gb
fd11d61f961a7e3c69e272ef19eb243b7df89833 McDonaldland (U) [!].gb
6155fdd221aae22874ecfe2fbea9690a2074cc1d McDonaldland (U) [!] patch.gb
9b3063350581cec9cf595a78faa8d415b75be399 Pagemaster, The (U) [S][!].gb
d5ace4e03430328f45248f843027c4962075c2c7 Pagemaster, The (U) [S][!] patch.gb
7716809645e00be2fdbbbfd05823a14856f01183 Pinocchio (U) (1995).gb
8c2ff7af35e92e909882f64fb1a3820d7ce95bfa Pinocchio (U) (1995) patch.gb
98a2d90717d8c9f7feb2d7653aaab6faa0f3ee64 Simpsons, The - Bart & the Beanstalk (U).gb
abdcfd21708056e753503c005e27f566632c3ee4 Simpsons, The - Bart & the Beanstalk (U) patch.gb
95d60b87862fccd914446e0581146142d19c76bd Simpsons, The - Bart vs the Juggernauts (U) [!].gb
817e01b39a58a05ad516c8dab5b48e9002a676a3 Simpsons, The - Bart vs the Juggernauts (U) [!] patch.gb
89b7b2d4684d703ea5d323e3aaf4910dcdbc47d3 Simpsons, The - Escape from Camp Deadly (U) [!].gb
0478f0e595cb2929c7af6526f5f12881ba5c594b Simpsons, The - Escape from Camp Deadly (U) [!] patch.gb
e61039c52c053a8ae1bdfffa3f694934569bb570 Simpsons, The - Krusty's Fun House (U) [!].gb
824dab1ab2b1bf77eb32cdaf724567e82a016f2f Simpsons, The - Krusty's Fun House (U) [!] patch.gb
d11d94fa3c36b9f72e925070b66bb4f16d31001e Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!].gb
f5b9cbac431bddb7863af00a5f43f50a1bcdec48 Super Mario Land 2 - 6 Golden Coins (UE) (V1.2) [!] patch.gb
279fb0223e362db553b739b1b8f9c18b81d92413 Wario Blast Featuring Bomberman! (U) [S][!].gb
e85e76b00db2ea9cbea4ab01446b8955b2a95f7a Wario Blast Featuring Bomberman! (U) [S][!] patch.gb
- Attachments
-
- patches for AL771914.zip
- (3.29 KiB) Downloaded 40 times