Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Hello.

I would like to dump a 1000 in 1 multi-game NES cartridge (which has never been dumped) with the INLretro cartridge dumper from infiniteneslives.

The game menu occupies more than 16 KB, so I think it must be on 32KB.
This cartridge contains UNROM games (Contra...) and other types.

I am attaching the photos of the PCB (front and back mirror).

Image
Image

Krzysiobal did an excellent work on this PCB but I don't know how to traduce it in an INLretro script to dump the cartridge.

Here is his work (Thank you Krzysiobal):

Image
Image

Code: Select all

There is one register built of 74273 and 74174 that latches A5..A0, D7..D0 (both chips share the same write signal).
All bits ale cleared on power-up.

   fedcba9876543210     76543210
A~[1??.......PPw???] D~[?mPPPppp]
             ||||||     |||||+++-- PRG A16..14 
             ||||||     ||+++----- PRG A19..17
             ||||||     |+-------- mirroring (0=V, 1=H)
             |||+++-----+--------- one of the bits needs to be PRG A13,
             |||                     other two need to distinguish between UNROM, NROM-32, NROM-16 and NROM-8,
             |||                     and one might be for locking writes to the regs (*)
             ||+------------------ CHR write protection (1=enabled)
             ++------------------- PRG A21..20
			 
(*)  locking might be only used in NROM-32/NROM-16 modes; NROM-8 mode might be used only for accessing CHR data when copying them to the CHR-ROM 
			 
Because I don't know how the PAL chips works, meaning of bits A2,A0,A1,D7 is unknown

You can disable the reset signal by shorting it to +5V (short left leg of the diode with +5V)
Can someone tell me how I can do to dump this cartridge?

NB: I specify that I am a beginner in the dump of cartridges.

Regards.
Attachments
sch.png
top-tracks.jpg
pcb1050in1-verso-miroir-8.jpg
pcb1050in1-recto-5.jpg
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

A significant portion of how this board works has been hidden inside the program inside the TIBPAL16L8. Assuming someone else doesn't specifically recognize this board, you'll need to ask the INLretro to dump it as though it were NROM, and hopefully there'll be enough information in that NROM dump to figure out how to dump the cartridge.

Additionally, this is a multicart that detects when the CPU is in reset with that resistor+diode+capacitor. You'll have to modify that to be able to dump the cartridge on anything less than a CopyNES.
nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Thank you for your answer.

I don't know which size of dump to use, so I have run these 2 commands and I have get these 2 files :

Code: Select all

./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 32 -y 8 -d 1000in1-nrom-PRG32kb-CHR8kb.nes
It generates the file : download/file.php?mode=view&id=23534

Code: Select all

./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 512 -y 512 -d 1000in1-nrom-PRG512kb-CHR512kb.nes
It generates the file : download/file.php?mode=view&id=23535
Attachments
1000in1-nrom-PRG512kb-CHR512kb.nes
(1 MiB) Downloaded 27 times
1000in1-nrom-PRG32kb-CHR8kb.nes
(40.02 KiB) Downloaded 24 times
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

Based on the code in the "-x 32" nrom dump, it looks like there's a register is at $Exxx. Based on the schematic, there's only one register.

Use this script ("decipher.lua") with "-x 4096". This dump will not work, but it will let us determine what the PAL is doing.

You must also short out this
pcb1050in1-capacitor-to-short.jpg
pcb1050in1-capacitor-to-short.jpg (22.18 KiB) Viewed 628 times
capacitor, or else this script will not work.
Attachments
decipher.zip
(1.35 KiB) Downloaded 15 times
nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

Thank you for your help.
So, I have short the capacitor with an electric wire (continuity is ok with a voltmeter) and I have replaced the nrom.lua script by the decipher.lua script that you give (in the scripts/nes directory of INLretro program).

The result is below :

Code: Select all

root@aaaaaa:~/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 4096 -y 8 -d 1000in1-nrom-PRG_4096kb-CHR_8kb-decipher.nes

Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x 
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length:  0       did not match expected: 1
firmware app ver request:       0
firmware is out of date, recommend updating

Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:23: bad argument #1 to 'char' (value out of range)
Fatal error encountered, exiting.
This command generates a 4 octets file that contains "NES." (hexa : 4E 45 53 1A).
So because of the error message, I try to put -x 2048.
The result is below :

Code: Select all

root@aaaaaa:~/INLRetro/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 2048 -y 8 -d 1000in1-nrom-PRG_2048kb-CHR_8kb-decipher.nes

Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x 
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length:  0       did not match expected: 1
firmware app ver request:       0
firmware is out of date, recommend updating

Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:49: attempt to perform bitwise operation on a nil value (local 'mapper')
Fatal error encountered, exiting.
It generates a 6 octets file that contains "NES " (hexa : 4E 45 53 1A 80 00).

I have tried to modify the inlretro2.lua script but i have get nothing better...
Do you know what is wrong ? Is it a firmware problem ? (I believe I have the most recent firmware (2.3.x)...)
Do you have a script (like inlretro2.lua) with a main function that work with your decipher.lua script ?
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

replace "-m nrom" with "-m decipher310331C". And "decipher.lua" probably has to be copied into the same directory as "nrom.lua" is in (in the dumper program)
nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

It was a little bit more difficult to solve the error messages, but I think it's OK now ;).

So, I have changed several things in the INLretro scripts for your script can work.

In the script scripts/app/nes.lua :
In the local function write_header(file, prgKB, chrKB, mapper, mirroring) :
I have replaced the line :

Code: Select all

		file:write(string.char(prgKB / 16))
by the line :

Code: Select all

		file:write(string.char(255))
(because 4096 / 16 = 256 => the value of a char goes from 0 to 255 => Error : bad argument #1 to 'char' (value out of range))

and I have added the line :

Code: Select all

		mapper=0
(because the value of the variable mapper was "nil" so it caused an error (mapper=0 is the value for nrom mapper))

In the script scripts/inlretro2.lua :
I have added a line to refer to the decipher.lua script in the variable that contains the list of mappers :

Code: Select all

	    local mappers = {
			...
        	decipher = require "scripts.nes.decipher",
	    }
Finally, I have run the command :

Code: Select all

./inlretro -s scripts/inlretro2.lua -c NES -m decipher -x 4096 -d 1000in1-decipher-PRG_4096kb.nes
The big dump file generated is below (I truncated it because it exceeded the size limit of 4Mb for the forum ;)) :
download/file.php?mode=view&id=23541

It seems to give a lot of new informations :)
Attachments
1000in1-decipher-PRG_4096kb-truncated.nes
(4 MiB) Downloaded 19 times
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

From Krzysiobal's schematic, the discrete logic on the PCB already does this following:

Code: Select all

A~[111x xxxx xxIH W???] D~[?MGF E???]
               || |         ||| |
               ++------------++-+---- Specify PRG A21 downto A17
                  |         +-------- H/V nametable arrangment
                  +------------------ CHR RAM write protect

Here's what I've learned from the above dump:

The PAL rounds out the behavior to the following:

Code: Select all

A~[111x xxxx xxIH WXmm] D~[AMGF EDCB]
               || ||||     |||| ||||
               ++----------+-++-++++- Specify A21("I") downto A13("A"), when appropriate
                  ||||      +-------- still H/V nametables
                  |+++--------------- 0,4: 32K PRG, 1: UNROM (128K), 2,6: 8K PRG (use "B" and "A" bits), 3,7: 16K PRG (use "B" bit), 
                  |                   5: stupid 32K mode (ignore ABCD, treat C and D as 1, pass through CPU A13 and CPU A14)
                  +------------------ still CHR RAM write protect
As such, the three attached dumping scripts should all produce the same result, each using a different way to ask for it.

The size to request is only 3MiB, "-x 3072". There is no CHR ROM, so you can leave out "-y".
Attachments
dump310331C.zip
(4.03 KiB) Downloaded 10 times
nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

For the INLretro program, the -x option must be non-zero power of 2, 16kb or greater.
So I have put -x 4096, and I have truncated the file to 16 (header) + 3072 x 1024 octets, and I have put char(192) in the header for the size of the PRG (192x16 = 3072 kb).

As you said, the 3 scripts has given the same result.
One of these 3 dump files is below :
download/file.php?mode=view&id=23547
Attachments
1000in1-dump310331C-16-PRG_3072kb.nes
(3 MiB) Downloaded 15 times
zxbdragon
Posts: 495
Joined: Mon Dec 12, 2011 8:15 pm

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by zxbdragon »

The data is valid for 512K, and it seems that 1024K data is missing
Attachments
32423434_002.png
32423434_002.png (6.83 KiB) Viewed 315 times
32423434_001.png
32423434_001.png (6.29 KiB) Viewed 315 times
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

... UGH I see one of my mistakes in my code, but I don't see the other.
I had

Code: Select all

                local datapart = (read_count & 7) << 1;
                local addrpart = 0xE000 | ((read_count << 1) & 0x30);
                dict.nes("NES_CPU_WR", addrpart, datapart)      --32KB @ CPU $8000
but I forgot to include all the bits.

That should have been:

Code: Select all

                local datapart = (read_count & 31) << 1;
                local addrpart = 0xE000 | ((read_count >> 1) & 0x30);
That said, I still don't see why the original dump repeated 6 times after 512K instead of 3 times after 1M.
nes356
Posts: 10
Joined: Sat Nov 19, 2022 10:11 am

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by nes356 »

I tried to modify the 2 lines that you suggest to correct in the script dump310331C-32.lua.

It appears that the mapper that work for this rom is the mapper 15, so I have put 15 in the header of the rom generated.

With the correction that you suggest, the game number 01 and 05 don't work anymore (in the precedent version of your script, it wasn't playable but we could see something).
In the same time, the game number 04 is not playable but show something now (in the precedent version of your script, there was nothing for this game).
[...]

The file generated is below :
download/file.php?mode=view&id=23557
Attachments
1000in1-dump310331C-32-2-PRG_3072kb-1.nes-mapper15.nes
(3 MiB) Downloaded 16 times
lidnariq
Posts: 11067
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by lidnariq »

The first 2MiB have unique content, but the third MiB is a copy of the first. I must still have some mistake in my code, but I am not entirely clear where...
User avatar
krzysiobal
Posts: 930
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by krzysiobal »

Looking at the font from main menu, I bet i saw something similar before.

After a few minutes I found out I rev-en something like that before:
I think this might be the same mapper.

viewtopic.php?p=222458

BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
Image My website: http://krzysiobal.com | Image My NES/FC flashcart: http://krzysiocart.com
Fiskbit
Posts: 559
Joined: Sat Nov 18, 2017 9:15 pm

Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro

Post by Fiskbit »

krzysiobal wrote: Fri Nov 25, 2022 12:31 pm BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
Unfortunately, because the archive is older than nesdev.org, Google treats it as the primary source and nesdev.org as the duplicate.
Post Reply