About MMC3

[tokumaru]

For emulator CPU address $6000-7FFF, I decide to create one RAM no matter if it will be used.

Yes, that's how most emulators work, but the point is that this one game, Low G Man, will not work if it finds RAM at $6000-$7FFF. It's a rudimentary form of copy protection or something like that.

[zzo38]

For emulator CPU address $6000-7FFF, I decide to create one RAM no matter if it will be used. If ROMs contain a battery, save RAM to file when game exit or load saved file (if any) to RAM when game launch.

The NES 2.0 header can tell you whether or not it has RAM, and how much, if it is less than 8K. Therefore you can tell if it is RAM or not. For older iNES headers, it could be chosen based on which mappers have PRG RAM, and/or to always put RAM if the battery bit is set, since that bit otherwise won't do anything; or you can require Low G Man to be converted to NES 2.0 headers before they will work.

[tepples]

Does Low G Man write to the WRAM protection register? I know a lot of emulators that don't support NES 2.0 will ignore writes to the WRAM protection register so that they can support MMC6 games (StarTropics and StarTropics 2).

[lidnariq]

Does Low G Man write to the WRAM protection register?

Yes, but with a nonsensical value (0x01).
At address $F43A (file offset 0x1f44a):

Code: Select all

        ldx     #$00
        stx     $2005
        stx     $2005
        stx     $E000
        stx     $4010
        inx
        stx     $A000
        lda     #$0F
        sta     $4015
        lda     #$40
        sta     $4017
        stx     $A001

This is the only location in PRG that matches the regexp '[\x8C-\x8E]\x01\xA0'.

[tepples]

Based on how I understand PRG RAM protection, that value isn't nonsensical. Any value in $00-$7F should disable the PRG RAM entirely. Emulators that don't respond are probably applying a hack to run StarTropics without CRCs and without NES 2.0.

[lidnariq]

This is part of the power-on reset code. By proximity, there's no reason to have written 1 instead of 0 (or $15, or $40)...

But, in any case, Low G Man works correctly if I disable nestopia's hash and have it treat the game as TSROM instead of TLROM.

This is actually in Disch's notes.

[Boolean]

For emulator CPU address $6000-7FFF, I decide to create one RAM no matter if it will be used. If ROMs contain a battery, save RAM to file when game exit or load saved file (if any) to RAM when game launch.

The NES 2.0 header can tell you whether or not it has RAM, and how much, if it is less than 8K. Therefore you can tell if it is RAM or not. For older iNES headers, it could be chosen based on which mappers have PRG RAM, and/or to always put RAM if the battery bit is set, since that bit otherwise won't do anything; or you can require Low G Man to be converted to NES 2.0 headers before they will work.

Sounds good.I should learn about NES 2.0

[Boolean]

For emulator CPU address $6000-7FFF, I decide to create one RAM no matter if it will be used.

Yes, that's how most emulators work, but the point is that this one game, Low G Man, will not work if it finds RAM at $6000-$7FFF. It's a rudimentary form of copy protection or something like that.

Does the game write $6000-7FFF, then read and compare read value with written value?

[Boolean]

Does Low G Man write to the WRAM protection register?

Yes, but with a nonsensical value (0x01).
At address $F43A (file offset 0x1f44a):

Code: Select all

        ldx     #$00
        stx     $2005
        stx     $2005
        stx     $E000
        stx     $4010
        inx
        stx     $A000
        lda     #$0F
        sta     $4015
        lda     #$40
        sta     $4017
        stx     $A001

This is the only location in PRG that matches the regexp '[\x8C-\x8E]\x01\xA0'.

1. What is the meaning of regexp '[\x8C-\x8E]\x01\xA0' ?
2. This code only write $A001 with $01. Both bit 7 and bit 6 are 0, so write protection will not be triggered.
7 bit 0
---- ----
RWxx xxxx
||
|+-------- Write protection (0: allow writes; 1: deny writes)
+--------- Chip enable (0: disable chip; 1: enable chip)

[Boolean]

Does Low G Man write to the WRAM protection register?

Yes, but with a nonsensical value (0x01).
At address $F43A (file offset 0x1f44a):

Code: Select all

        ldx     #$00
        stx     $2005
        stx     $2005
        stx     $E000
        stx     $4010
        inx
        stx     $A000
        lda     #$0F
        sta     $4015
        lda     #$40
        sta     $4017
        stx     $A001

This is the only location in PRG that matches the regexp '[\x8C-\x8E]\x01\xA0'.

1. What is the meaning of regexp '[\x8C-\x8E]\x01\xA0' ?
2. This code only write $A001 with $01. Both bit 7 and bit 6 are 0, so write protection will not be triggered.
7 bit 0
---- ----
RWxx xxxx
||
|+-------- Write protection (0: allow writes; 1: deny writes)
+--------- Chip enable (0: disable chip; 1: enable chip)

I understand question 2. Bit 7 is 0, chip is not available.

[Jarhmander]

1. What is the meaning of regexp '[\x8C-\x8E]\x01\xA0' ?

regexp (or regex) is short for regular expression (Chinese). The [\x8C-\x8E]\x01\xA0 regex means, in english, "Match a byte that has a value from 0x8C to 0x8E that is followed by 0x01 and 0xA0". Regexes are normally used for text string search but they can be used to find a binary string.

[Boolean]

1. What is the meaning of regexp '[\x8C-\x8E]\x01\xA0' ?

regexp (or regex) is short for regular expression (Chinese). The [\x8C-\x8E]\x01\xA0 regex means, in english, "Match a byte that has a value from 0x8C to 0x8E that is followed by 0x01 and 0xA0". Regexes are normally used for text string search but they can be used to find a binary string.

Thank you.But it seems ...
[\x8C-\x8E]\x01\xA0 stands for 0x8C 0x01 0xA0 or 0x8D 0x01 0xA0 or 0x8E 0x01 0xA0.
To MMC3, only stx $E000(x == 0), stx $A000(x == 1) and stx $A001(x == 1) instructions are useful.
What is the relation between [\x8C-\x8E]\x01\xA0 and the instructions?

[lidnariq]

What is the relation between [\x8C-\x8E]\x01\xA0 and the instructions?

To the 6502, the instructions STY abs, STA abs, and STX abs are represented by the bytes sequence starting with $8C, $8D, and $8E respectively.
That is, 0x8E 0x01 0xA0 = STX $A001

[Boolean]

What is the relation between [\x8C-\x8E]\x01\xA0 and the instructions?

To the 6502, the instructions STY abs, STA abs, and STX abs are represented by the bytes sequence starting with $8C, $8D, and $8E respectively.
That is, 0x8E 0x01 0xA0 = STX $A001

Thank you.