How to program a NINTENDO POWER Cartridge ?

[nocash]

That aren't sector protect bytes. It's read via different custom flash commands, not via the official "get sector protect" command.

[Near]

Oh, you mentioned sector protect earlier. Then stuff about Satellaview having the same thing by a different name. It's very difficult to follow this thread.

So in that case, there are two special hidden areas that aren't part of the main flash memory pool. And so far, only one of them seems to be important.

At any rate, it's hidden data that's not part of the standard memory dump of a flash cart. So the question is, how would one go about including that data with NP images? Mostly a theoretical exercise because I don't see anyone doing this, or anyone besides you and maybe me emulating this at all.

[skaman]

More mapping stuff. Rest of the carts that I have available right now. I should be getting a few more carts with HiROM games coming within the next week or so.

Code: Select all

Jikkyou World Soccer 2 - Fighting Eleven  (with menu):
(Duplicate game that nocash has on hand)
 C0FF00      03 11 AA 22 AA 97 00 12 
 C0FF08      15 20 29 11 4A 39 10 37
 C0FF10..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

Sim City (with menu):
 C0FF00      03 11 AA 53 AA 97 00 11 
 C0FF08      02 21 29 18 4A 21 10 34 
 C0FF10..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF 
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 
 E0FFB0..FF  FF-filled

Kawa Nushi no Tsuri 2 + Super Mario Collection (with menu):
MENU PROGRAM-KAWA2+SMAS
 C0FF00      03 11 AA 34 AA 98 00 09 
 C0FF08      09 30 29 11 4A 30 10 12 
 C0FF10      0D FF 29 FF 4A FF 44 FF 
 C0FF18..7E  FF-filled
 C0FF7F      00 
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF 
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 
 E0FFB0..FF  FF-filled

Chou Makaimura + Kiwame 3 + Super Bomberman 3 (with menu):
MENU PROGRAM-CM+KIWAME3+SPRBMB3
 C0FF00      03 11 AA 47 AA 97 00 11 
 C0FF08      07 14 AA 14 AA 53 10 05 
 C0FF10      05 FF 29 FF 4A FF 30 FF 
 C0FF18      4B FF AA FF AA FF 54 FF 
 C0FF20..7F  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF 
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 
 E0FFC0..FF  FF-filled

Super Puyo Puyo + Super Momotarou Dentetsu 2 + Kiwame 3 (with menu):
MENU PROGRAM-PUYO+MOMO+KIWAME3
 C0FF00      03 11 AA C5 AA 98 00 04 
 C0FF08      07 29 AA 10 AA 39 10 33 
 C0FF10      05 FF 29 FF 4A FF 30 FF 
 C0FF18      05 FF 29 FF 4A FF 54 FF  
 C0FF20..7F  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF 
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 
 E0FFB0      FF FF FF FF FF FF 00 00 FF FF FF FF FF FF FF FF 
 E0FFC0..FF  FF-filled

I redumped DKC3 and got different data. Maybe this makes more sense?

Code: Select all

DKC3 (no menu):
 C0FF00     5C 11 61 42 A5 97 00 11 
 C0FF08     FF 17 FF 10 FF 22 FF 05
 E0FF90     FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF 
 E0FFA0     FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF 

[sanni]

Menu + Umi no Nushi Tsuri(LoROM Sram: 64 Kb Size: 16 Mb) + Otogiriso(LoROM Sram: 64 Kb Size: 8 Mb)

Code: Select all

0xC0FF00 03 11 aa 85 aa 97 00 11 0d 11 29 15 4a 51 10 42 
0xC0FF10 05 ff 29 ff 4a ff 54 ff ff ff ff ff ff ff ff ff 
0xC0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF90 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFA0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFB0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

0xE0FF00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF90 ff ff 55 00 ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFA0 ff ff ff ff ff ff 55 00 ff ff ff ff ff ff ff ff 
0xE0FFB0 ff ff ff ff ff ff 55 00 ff ff ff ff ff ff ff ff 
0xE0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

Menu + Harvest Moon(LoROM Sram: 64 Kb Size: 16 Mb) + Umi no Nushi Tsuri 2 (LoRom Sram 64Kb Size: 16Mb)

Code: Select all

0xC0FF00 03 11 aa 67 aa 97 00 10 0d 24 29 12 4a 03 10 13 
0xC0FF10 09 ff 29 ff 4a ff 54 ff ff ff ff ff ff ff ff ff 
0xC0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF90 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFA0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFB0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

0xE0FF00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF80 aa 00 48 00 ff ff ff ff ff ff aa 00 46 00 aa 00 
0xE0FF90 ff ff 55 00 ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFA0 ff ff 55 00 ff ff 55 00 ff ff ff ff ff ff ff ff 
0xE0FFB0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

Menu + Super Mario World(LoROM Sram: 64 Kb Size: 24 Mb) + Doraemon 4(LoROM Sram: 0 Kb Size: 12 Mb) + Dragon Slayer II (HiROM Sram: 64 Kb Size: 12 Mb)

Code: Select all

0xC0FF00 03 11 aa 74 aa 97 00 12 00 08 29 15 4a 12 10 01 
0xC0FF10 0b ff aa ff aa ff 21 ff 49 ff 61 ff a5 ff 51 ff 
0xC0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FF90 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFA0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFB0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xC0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

0xE0FF00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF10 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF20 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF30 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF50 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF60 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF70 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FF90 ff ff 55 00 ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFA0 ff ff ff ff ff ff 55 00 ff ff ff ff ff ff ff ff 
0xE0FFB0 ff ff ff ff ff ff 55 00 ff ff ff ff ff ff ff ff 
0xE0FFC0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFD0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFE0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 
0xE0FFF0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 

[nocash]

Thanks for the new dumps! As far as I can see, all bytes are matching up with the theories on date/time serial number, and port 2404h-2407h meanings.
New findings are that the "xx" in the "11-xx-YY-MM-DD-HH-MM-SS" can be non-BCD (spotted in the Super Puyo Puyo cart). And the values for port 2405h/2406h are always one of these three sets, apparently related to SRAM mapping:
29,4A for Lorom with SRAM
61,A5 for Hirom with SRAM
AA,AA for Lorom/Hirom without SRAM
The redumped DKC3 values are making more sense (the old dump had bit4 set in all bytes).

Here's a copy of the new values from skaman and sanni (with titles, mapping, and ROM/SRAM sizes (as listed at superfamicom.org) added next to each entry):

Code: Select all

;------------------
More dumps from skaman...
;------------------
Jikkyou World Soccer 2 - Fighting Eleven  (with menu):
(Duplicate game that nocash has on hand)
 C0FF00      03 11 AA 22 AA 97 00 12  ;Menu (512Kbyte Lorom)
 C0FF08      15 20 29 11 4A 39 10 37  ;Fighting Eleven (3072Kbyte Lorom, 8Kbyte SRAM)
 C0FF10..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

Sim City (with menu):
 C0FF00      03 11 AA 53 AA 97 00 11  ;Menu (512Kbyte Lorom)
 C0FF08      02 21 29 18 4A 21 10 34  ;Sim City (512Kbyte Lorom, 32Kbyte SRAM)
 C0FF10..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0..FF  FF-filled

Kawa Nushi no Tsuri 2 + Super Mario Collection (with menu):
MENU PROGRAM-KAWA2+SMAS
 C0FF00      03 11 AA 34 AA 98 00 09  ;Menu (512Kbyte Lorom)
 C0FF08      09 30 29 11 4A 30 10 12  ;Kawa no Nushi Tsuri 2 (1.5Mbyte Lorom, 8Kbyte SRAM)
 C0FF10      0D FF 29 FF 4A FF 44 FF  ;Super Mario Collection (2Mbyte Lorom, 8Kbyte SRAM)
 C0FF18..7E  FF-filled
 C0FF7F      00
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0..FF  FF-filled

Chou Makaimura + Kiwame 3 + Super Bomberman 3 (with menu):
MENU PROGRAM-CM+KIWAME3+SPRBMB3
 C0FF00      03 11 AA 47 AA 97 00 11  ;Menu (512Kbyte Lorom)
 C0FF08      07 14 AA 14 AA 53 10 05  ;Chou Makaimura (1Mbyte Lorom, no SRAM)
 C0FF10      05 FF 29 FF 4A FF 30 FF  ;Pro Mahjong Kiwame 3 (1Mbyte Lorom, 8Kbyte SRAM)
 C0FF18      4B FF AA FF AA FF 54 FF  ;Super Bomberman 3 (1.5Mbyte Hirom, no SRAM)
 C0FF20..7F  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

Super Puyo Puyo + Super Momotarou Dentetsu 2 + Kiwame 3 (with menu):
MENU PROGRAM-PUYO+MOMO+KIWAME3
 C0FF00      03 11 AA C5 AA 98 00 04  ;Menu (512Kbyte Lorom)  ;C5h = non-BCD (!)
 C0FF08      07 29 AA 10 AA 39 10 33  ;Super Puyo Puyo (1Mbyte Lorom, no SRAM)
 C0FF10      05 FF 29 FF 4A FF 30 FF  ;Super Momotarou Dentetsu 2 (1Mbyte Lorom, 8Kbyte SRAM)
 C0FF18      05 FF 29 FF 4A FF 54 FF  ;Pro Mahjong Kiwame 3 (1Mbyte Lorom, 8Kbyte SRAM)
 C0FF20..7F  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 00 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

I redumped DKC3 and got different data. Maybe this makes more sense?
DKC3 (no menu):
 C0FF00      5C 11 61 42 A5 97 00 11  ;Donkey Kong Country 3 (4Mbyte Hirom, 2Kbyte SRAM)
 C0FF08      FF 17 FF 10 FF 22 FF 05  ;unused
 C0FF10..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0..FF  FF-filled
;------------------
More dumps from sanni...
;------------------
Menu + Umi no Nushi Tsuri(LoROM Sram: 64 Kb Size: 16 Mb) + Otogiriso(LoROM Sram: 64 Kb Size: 8 Mb)
 C0FF00      03 11 AA 85 AA 97 00 11  ;Menu (512Kbyte Lorom)
 C0FF08      0D 11 29 15 4A 51 10 42  ;Umi no Nushi Tsuri (2Mbyte Lorom, 8Kbyte SRAM)
 C0FF10      05 FF 29 FF 4A FF 54 FF  ;Otogiriso (1Mbyte Lorom, 8Kbyte SRAM)
 C0FF18..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

Menu + Harvest Moon(LoROM Sram: 64 Kb Size: 16 Mb) + Umi??? no Nushi Tsuri 2 (LoRom Sram 64Kb Size: 16Mb???)
 C0FF00      03 11 AA 67 AA 97 00 10  ;Menu (512Kbyte Lorom)
 C0FF08      0D 24 29 12 4A 03 10 13  ;Harvest Moon (Bokujou Monogatari) (2Mbyte Lorom, 8Kbyte SRAM)
 C0FF10      09 FF 29 FF 4A FF 54 FF  ;Kawa no Nushi Tsuri 2 (1.5Mbyte Lorom, 8Kbyte SRAM)
 C0FF18..FF  FF-filled
 E0FF00..7F  FF-filled
 E0FF80      AA 00 48 00 FF FF FF FF FF FF AA 00 46 00 AA 00
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF 55 00 FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0..FF  FF-filled

Menu + Super Mario World(LoROM Sram: 64 Kb??? (=16Kbit) Size: 24 Mb??? (=4Mbit)) + Doraemon 4(LoROM Sram: 0 Kb Size: 12 Mb) + Dragon Slayer II (HiROM Sram: 64 Kb Size: 12 Mb)
 C0FF00      03 11 AA 74 AA 97 00 12  ;Menu (512Kbyte Lorom)
 C0FF08      00 08 29 15 4A 12 10 01  ;Super Mario World (512Kbyte Lorom, 2Kbyte SRAM)
 C0FF10      0B FF AA FF AA FF 21 FF  ;Doraemon 4 (1.5Mbyte Lorom, no SRAM)
 C0FF18      49 FF 61 FF A5 FF 51 FF  ;Dragon Slayer II (1.5Mbyte Hirom, 8Kbyte SRAM)
 C0FF20..FF  FF-filled
 E0FF00..8F  FF-filled
 E0FF90      FF FF 55 00 FF FF FF FF FF FF FF FF FF FF FF FF
 E0FFA0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFB0      FF FF FF FF FF FF 55 00 FF FF FF FF FF FF FF FF
 E0FFC0..FF  FF-filled

[nocash]

More Satellaview stuff...

First of, writing "last-byte-twice" is also done in Satellaview BIOS, so that stuff isn't totally uncommon (although it doesn't seem to be documented anywhere in official Macronix datasheets for normal FLASH chip).

Then I came accross an uncommon FLASH command in Satellaview BIOS, as far as I remember, it's been documented as "upload status bits" in some datasheet. So I just checked back for more info... I've still no clue what that "upload status bits" command is about - but alongsides I came accross some documents talking about "vendor info" and "page buffer" commands, which seem to be resembling the nintendo power hidden data commands:
http://wiki.superfamicom.org/snes/show/ ... k+Commands - satellaview info (see "vendor info")
http://www.mw-elisra.com/MICROEL-ELISRA ... V-Reg].pdf - some datasheet (see "page buffer")
http://www.donat.org/ti92/016suht1.pdf - some other datasheet (see "page buffer" on page 15)

Haven't yet tried, but with that info, it might be easy to figure out how to rewrite the mapping data without too much guessing.
The "page buffers" seem to be temporary RAM (unlike as the hidden FLASH/EEPROM in nintendo power carts), but the overall command descriptions might be still helpful to understand what's going on.

EDIT: Clicking the second link doesn't work out due to the square brackets in "[12V-Reg]", just copy the link manually:
mw-elisra.com/MICROEL-ELISRA/pdf/Flash/MEF1M32[12V-Reg].pdf

[LuigiBlood]

Just updated the Satellaview Flash commands wiki page mentioning ikari_01 and that they were tested on real hardware.

I figured it's good information. (It's not like I was asked about it.)

I guess for Nintendo Power carts, there was no reason to not use the same kind of thing.

[sanni]

Is there more info available on how to get the Block Lock Status Bit in the Page Status Register from 0 (Locked for Erase/Write) to 1(Unlocked for Erase/Write) with the Satellaview cart's flash?
Is the register itself writable or is there a special command that does unlock the protection? Like "0x77D0 = Lock Page" just the other way around.

[nocash]

Mind that the Satellaview supports 4 different FLASH types (probably from different manufacturers). See here for details,
http://problemkaputt.de/fullsnes.htm#sn ... ontype1234

The Nintendo Power Macronix chips seem to be resembling Satellaview Type 2, so many of the Satellaview Type 1/3/4 commands are probably unsupported on Nintendo Power carts.

But, at least, commands 38h,D0h,71h,72h,75h should be supported on all types. Or more or less supported: I've tried to use the "toggle" command (72h) on Nintendo Power, and it doesn't actually seem to toggle anything (nethertheless it seems to be required to write that command number).

Either I did something wrong, or the Macronix chip is only mimmicking Sharp-like commands, without actually fully implementing them the way as described in Sharp datasheets.

I've also tried writing via command 74h, but it didn't work on my Nintendo Power cart (although it sounds as if it worked for ikari_01 on Satellaview Type 1/3/4 carts).

[Near]

> Mind that the Satellaview supports 4 different FLASH types (probably from different manufacturers)

One interesting thing is that I have around 10 BS-X packs from Matthew Callis. Every single one is the exact same type (forget which one it was, though x.x)

Also never seen any different sizes: they're all 8mbit.

Pretty sure that the Town BIOS was written to allow for the option of releasing different capacities / flash types in the future, but in the real world ... you only ever have to worry about one type of cart.

[LuigiBlood]

Pretty sure that the Town BIOS was written to allow for the option of releasing different capacities / flash types in the future, but in the real world ... you only ever have to worry about one type of cart.

xFD0-xFD3 in the header of EACH program is the Allocation Block Flags. 1 bit = 1M. There are 32 bits of those flags.
32M was supported but instead nope, just 8M.

Not to mention the japanese Satellaview patents was talking about Hard Drive support via the Satellaview addon... (Yes, that's what the EXT port was supposed to be used for)

Everyone should look at these patents. It's filled with very technical tidbits.

[nocash]

That are japanese patents (not english)? Then, no thanks.
Though, english patents are so hard to read that the language won't matter too much ;- )

---

I am trying to sort out the extra flash commands. Going by the datasheets, the sharp/elisra chips are having two "page buffers", intended for faster writing, ie. allow the cpu to write to one buffer at the same time when the chip is writing the other buffer to actual FLASH memory.
Normally, that would be probably done via E0,lo,hi,<data bytes> (write to page buffer) followed by 0C,lo,hi (forward page buffer to FLASH), probably to be followed by whatever status read (to see if the forwarding has finished).
Unfortunately, the datasheets are real crap and don't explain that stuff very well. Reading between the lines, it sounds as if the byte count (the "lo,hi" bytes) should contain the number of bytes minus 1 (it doesn't exactly say that anywhere, but it says that 0000h means 1 byte, and says that the count must be in range 0000h..00FFh even when writing 256 bytes, hence it sounds like count=num_bytes-1).
The other page buffer commands (72h, 74h, 75h) were probably mainly intended for testing purposes.

The customized nintendo chips are adding one extra command (38h, plus D0h for confirmation), that seems to transfer the hidden sector to page buffer (so it could be read via command 75h), on a "real" Sharp chip this would probably take some clock cycles (hence the status=ready check after 38h,D0h), the Macronix chips seem to be only mimmicking the transfer (hence instantly seeing status=ready).
And supposedly there's also some unknown command for directly writing to the hidden sector, or maybe more likely, for forwarding the page buffer to the hidden sector. If 38h,D0h is reading, then the opposite direction might be 39h,D0h or 28h,D0h or the like. Or if 0C,lo,hi is writing to normal flash, then something like 3C,lo,hi might be writing to hidden flash.
But considering that Macronix chips seem to be only mimmicking those commands, it doesn't look to inviting to guess that stuff on Macronix chips, without first testing how it's working on actual Sharp chips.

For the satellaview, the only photo of the hardware appears to be this poor picture: http://www.dforce3000.de/index.php?p=fdsingle&uid=412 which doesn't really tell if it's a Sharp chip or not. The only interesting detail is the PCB name which looks like BSMC-AF-01 or so (=clearly different as BSMC-CR-01, which is also rumored to exist).

And the satellaview wiki page: it looks like some mixup of actual hardware tests on some unspecified chip type, plus info extracted from official datasheets (though renaming the "page buffer" to "vendor info" for some weird reason). The most interesting (=confusing) part is this: 0x0807 = copy vendor information block to current page which isn't mentioned in any known datasheets (and doesn't seem to be used in any existing software either). The 'current page' might be referring to the write address (ie. maybe meant to mean to write one of the bytes to Cxxxxxh rather than C00000h). If so, then it would be similar to the official 0C,lo,hi command - maybe using only an 8bit byte count instead of the 16bit lo,hi values - so 08,07 could mean to write "07+1" bytes from page buffer to FLASH.
Or whatever, hard to tell without having a satellaview flashcart for testing.

[Near]

> 32M was supported but instead nope, just 8M.

Right. A talented engineer could make a 32M pack, and we can easily make them for emulators, but no official ones exist. Same goes for the other two types of flash that the BS-X BIOS supported.

> Not to mention the japanese Satellaview patents was talking about Hard Drive support via the Satellaview addon... (Yes, that's what the EXT port was supposed to be used for)

Shit! Just out of the blue, just like that!

I've been trying forever to figure out what that EXT port was for. My best guess was that it was for developers.

That makes a lot of sense, given the recessed area that's in that compartment. Would still be a tiny hard drive, but since everything Nintendo is proprietary, that's no problem.

I wonder if the BS-X Town cart has support for the protocol that thing speaks, or if they were just planning to release a BS-X Town 2.0 cart with the hard drive.

I've tried tracing the continuity on the pins, but all I see are Vcc and GND being passed between it and the 28-pin connector. So it obviously has its own register set.

Given there's no way to execute code off it directly, one would imagine it'd be a "long-term storage" situation where it had to use the 4mbit PSRAM to load games back. So if BS-X Town supported it, it wouldn't work with 8mbit games. Of course, a 2.0 cart could have had 8mbit PSRAM.

> clearly different as BSMC-CR-01, which is also rumored to exist

BSMC-CR-01 most certainly exists. I have three of them. They're MaskROM versions that don't respond to the flash commands like the vendor readout mode at all.

This incompatibility actually makes it impossible for the Satellaview service to have offered downloadable character data for Same Game, and possibly for SD Gundam G-Next as well (haven't debugged the code in the latter.) A bit of a shame, because the Tengai Makyou pack is psychotically rare (I've only ever seen two for sale, they go for $400+). Of course the MaskROM would still be expensive, but having a few dozen FlashROM downloads floating around would have allowed more people to enjoy it.

[tepples]

Given there's no way to execute code off [a hypothetical hard drive] directly, one would imagine it'd be a "long-term storage" situation where it had to use the 4mbit PSRAM to load games back. So if BS-X Town supported it, it wouldn't work with 8mbit games.

Unless the 8 Mbit game is reprogrammed to load more data at runtime through the expansion port. Case in point: Nintendo changed the Super Mario Bros. engine to load extra 4-world blocks of level data from the disk drive at various points in Super Mario Bros. 2. It's not quite as big as the 6 Mbit in the Sega CD, but hard disks are still a lot faster than the 1x CD-ROM drives of the time.

[nocash]

Uh, the imaginary satellaview harddisk is getting a bit offtopic. Stuff that would be more interesting would be:

• 1) getting a photo of the satellaview PCB and FLASH chip and eventually finding a matching datasheet for it
  2) dumping the values stored in the satellaview FLASH chip's custom/extra area & finding out which capacity it has
  3) finding out how to use the page buffer feature to write to the normal satellaview FLASH memory
  4) finding out how if it's also possible to write to the custom/extra satellaview memory

Step 4 might be impossible if the extra satellaview memory is read-only, but if it would work, then it would be worth trying the same thing on nintendo power carts. If Step 2 would reveal a hidden serial number in the extra memory, then that would imply that Step 4 would be also possibly. Step 1-3 should be relative simple, but I doubt that such stuff will happen in next some years.

Best other approach might be writing variations of the known Macronix/Sharp commands to the nintendo power flash chips, hoping that some command will write or erase the mapping data. I've tried some hundreds of command variations, but without luck yet (that is, a handful of variantions with command/bytes ranging from 0 to 255).