Need help dumping SA1 Chip games

[skaman]

IIRC, sanni added some CLK configuration options to the PCB so you'll need to bridge/jumper the correct pads on the shield.

I haven't tested any of sanni's recent SNES sketches for the latest PCB. I'll try to test out the SNES sketches on one of the original PCB shields later tonight.

EDIT: I'm getting GAMEPAK ERROR on the SA-1 carts using the PCB version with the latest sketch.

Please check your messages.

[Tamanegi_taro]

Hi skaman,

Thank you for your advice.
Sorry, I couldn't find any bridge/Jumper in sanni's hardware nor software.
Besides, I used Wire.h and my own I2C clockgen configuration which is confirmed to be working on hongkong dumper and confirmed some clock coming out from CLK0 and CLK2 so I don't think bridge/Jumper is problem.

I need to take a look at waveforms from snesCIC and clock gen but I don't have access to oscilloscope for this week.
Will also try various timing for clock enabling and snesCIC enabling.

Or maybe I'm only one who is having problem because people in this forum use Non Japanese games and I use Japanese games...

Here is original configuration for CLK0 and CLK2.

Code: Select all

//Register map for use with AN428 (JumpStart)
//http://www.silabs.com/clocks 
//Copyright 2014 Silicon Laboratories
//**************************************************
//C-Code File version = 1
//#BEGIN_HEADER
//Date = Thursday, April 28, 2016 12:35 PM
//File version = 3
//Software Name = Si5351 ClockBuilder Desktop
//Software version = 6.5
//Software date = June 4, 2015
//Chip = Si5351A
//Part Number = Si5351A-x-GT
//#END_HEADER
//I2C address = 0x60
/*
#XTAL (MHz) = 25.000000000
#Mode = Automatic
#PLL A
# Input Frequency (MHz) = 25.000000000
# F divider = 1
# PFD (MHz) = 25.000000000
# VCO Frequency (MHz) =  724.992000000
# Feedback Divider = 28  3124/3125
# Internal Load Cap (pf) = 8
# SSC disabled
#PLL B
# Input Frequency (MHz) = 25.000000000
# F divider = 1
# PFD (MHz) = 25.000000000
# VCO Frequency (MHz) =  687.272704000
# Feedback Divider = 27  191761/390625
# Pull Range (±ppm) = 0.0
#Output Clocks
#Channel 0
# Output Frequency (MHz) = 10.738636000
# Multisynth Output Frequency (MHz) = 10.738636000
# Multisynth Divider = 64
# R Divider = 1
# PLL source = PLLB
# Initial phase offset (ns) = 0.000
# Error (ppm) = 0.0000
# Powered = On
# Inverted = No
# Drive Strength = b11
# Disable State = Low
# Clock Source = b11
#Channel 1
# Powered = Off
#Channel 2
# Output Frequency (MHz) = 3.072000000
# Multisynth Output Frequency (MHz) = 3.072000000
# Multisynth Divider = 236
# R Divider = 1
# PLL source = PLLA
# Initial phase offset (ns) = 0.000
# Error (ppm) = 0.0000
# Powered = On
# Inverted = No
# Drive Strength = b11
# Disable State = Low
# Clock Source = b11
#Channel 3
# Powered = Off
#Channel 4
# Powered = Off
#Channel 5
# Powered = Off
#Channel 6
# Powered = Off
#Channel 7
# Powered = Off
#
*/

#define NUM_REGS_MAX 100

typedef struct Reg_Data{
   unsigned char Reg_Addr;
   unsigned char Reg_Val;
} Reg_Data;

Reg_Data const Reg_Store[NUM_REGS_MAX] = {
{ 15,0x00},
{ 16,0x6F},
{ 17,0x80},
{ 18,0x4F},
{ 19,0x80},
{ 20,0x80},
{ 21,0x80},
{ 22,0x80},
{ 23,0x80},
{ 24,0x00},
{ 25,0x00},
{ 26,0x0C},
{ 27,0x35},
{ 28,0x00},
{ 29,0x0C},
{ 30,0x7F},
{ 31,0x00},
{ 32,0x0B},
{ 33,0xB5},
{ 34,0xF5},
{ 35,0xE1},
{ 36,0x00},
{ 37,0x0B},
{ 38,0xBE},
{ 39,0x54},
{ 40,0xFC},
{ 41,0x02},
{ 42,0x00},
{ 43,0x01},
{ 44,0x00},
{ 45,0x1E},
{ 46,0x00},
{ 47,0x00},
{ 48,0x00},
{ 49,0x00},
{ 50,0x00},
{ 51,0x00},
{ 52,0x00},
{ 53,0x00},
{ 54,0x00},
{ 55,0x00},
{ 56,0x00},
{ 57,0x00},
{ 58,0x00},
{ 59,0x01},
{ 60,0x00},
{ 61,0x74},
{ 62,0x00},
{ 63,0x00},
{ 64,0x00},
{ 65,0x00},
{ 66,0x00},
{ 67,0x00},
{ 68,0x00},
{ 69,0x00},
{ 70,0x00},
{ 71,0x00},
{ 72,0x00},
{ 73,0x00},
{ 74,0x00},
{ 75,0x00},
{ 76,0x00},
{ 77,0x00},
{ 78,0x00},
{ 79,0x00},
{ 80,0x00},
{ 81,0x00},
{ 82,0x00},
{ 83,0x00},
{ 84,0x00},
{ 85,0x00},
{ 86,0x00},
{ 87,0x00},
{ 88,0x00},
{ 89,0x00},
{ 90,0x00},
{ 91,0x00},
{ 92,0x00},
{149,0x00},
{150,0x00},
{151,0x00},
{152,0x00},
{153,0x00},
{154,0x00},
{155,0x00},
{156,0x00},
{157,0x00},
{158,0x00},
{159,0x00},
{160,0x00},
{161,0x00},
{162,0x00},
{163,0x00},
{164,0x00},
{165,0x00},
{166,0x00},
{167,0x00},
{168,0x00},
{169,0x00},
{170,0x00},
};
//End of file

Thanks!
Tamanegi

[sanni]

I did have some success(1L3B-01 PCB works but 1L5B-20 PCB is finicky) with skaman's enhanced code, which I modified to use the pinout of my current shield pcb.

[skaman]

I've got the SA-1 working with a small code change to the current sketch V9G running on the original PCB shield.

There needs to be a delay after setting cicrstPin LOW in setup_Snes().

I stuck a delay(1000) before calling checkcart() and now the SA-1 produces a valid header.

Carts appear to dump okay but I didn't do extensive testing.

Good Luck!

[Tamanegi_taro]

Hi sanni and skaman,

Thanks!
Neither of methods worked for me...
I guess problem on my dumper is different from others.
I need to check my waveform and circuit connections again.

Thanks,
Tamanegi

[Tamanegi_taro]

I think that 3.3V output of Arduino Mega 2560 is not good enough to drive 3.3V clock gen slewrate.
I will check waveform next week and add 5V to 3.3V LDO to see if it helps.

Thanks,
Tamanegi

[zzattack]

I've got the SA-1 working with a small code change to the current sketch V9G running on the original PCB shield.
There needs to be a delay after setting cicrstPin LOW in setup_Snes().

I'll try this tonight. I've done a lot of trial and error and eventually gave up on SA-1 dumping.
Things that didn't help included:
- adding capacitance on power pins
- regulator replacements on arduino
- genuine vs. china arduino
- lowering base clock (21.28 / 2, 21.28 / 4 etc.)
- different kinds of CIC firmware
- using a dedicated 3.072MHz and 21.28MHz crystal oscillators instead of the clockgen shield

Vanilla carts had maybe 5% success rate. Carts modified with a 29L3211 eeprom never worked. Carts modified with a 27C322 and a lot of capacitance maybe ~10%.

[Tamanegi_taro]

My current Arduino sketch doesn't work with SA-1 at all.
I think it's the menu's fault where you select between the different Nintendo systems, the SA-1 will lock up before you can select Super Nintendo.

I don't think so.
For hong kong dumper, I have physical switch attached to IC to enable snesCIC and clock gen CLK0 and CLK2.
If I read ROM data before enabling them using physical switch, I get corrupt data.
Once I flip physical switch, I get access to the ROM.
So I think timing to start enabling modules might not be problem.

But I'm sure that timing after enabling modules need to be in valid window.
If I release snesCIC reset 1ms after enabling CLK0 and CLK2, there is more chance I get corrupt data.
Once I remove 1ms delay, CIC unlocked almost every time.

[sanni]

With skaman's delay(1000) fix I was now able to dump both of my SA-1 games with my Cart Reader V9H.
It still took around 10 tries to unlock the Mini Yonku Shining Scorpion cartridge but in the end it dumped fine.

[Near]

If you have the ability to produce hardware of that caliber, is there no chance you can make a 21fx board using defparam's open source schematics / gerber files / etc?

It's a much better device that dumps SA-1 games 100% of the time. It uses the genuine CIC inside the SNES to unlock the genuine one inside the SA1, so it works beautifully every time.

We could actually really use a hand in finding someone who's able to make a batch of 20 - 50 of these for various people that are interested in buying this device, so you could stand to make some money too for your time.

Once you have the device working, I could supply you with the software side for actually dumping these games.

[Tamanegi_taro]

Hi byuu!

If you have the ability to produce hardware of that caliber, is there no chance you can make a 21fx board using defparam's open source schematics / gerber files / etc?

It look very awesome. Sorry I don't have any experience to make device like this...
Is there anybody who sell this device?

Hi sanni and skaman!
Since I didn't have any display nor SD card module to store ROM data, developed USB Serial GUI for Nintendo Cart Reader V9.

Here is binary and source code:

update July 7th 2016
http://www.speedyshare.com/6Dv6D/Ninten ... Latest.rar
I also modified some of the codes such as HiROM SRAM read address.

Thanks,
Tamanegi

[Tamanegi_taro]

I tried adding 1s delay after enabling snesCIC, added 3.3V LDO, add 12F629 snesCIC trigger IC(Which is working on HK dumper), and added delay between setting address and read D pins.
None of them worked.

As sanni's advince, I will go buy and add DC 9V or 12V power supply to Arduino.
I'm still wondering why Arduino UNO and 12F629 can unlock CIC but Arduino MEGA2560 can't.

Thanks,
Tamanegi

[sanni]

Does anyone know how to read/write Sram from/to SA-1 games?

[Tamanegi_taro]

Hello sanni,

I got my Arduino MEGA2560 Nintendo dumper sucessfully read SA1 chip carts.

I tried using 12V external power supply - didn't work.
Desoldered 1000uF big capacitor from console and attached right next to the cart socket - didn't work.
Desoldered cables connected to PA0 - PA7, CPUCLK, PARD, PAWR, WRAM, REFRESH, EXPAND, IRQ - did work.

So, as my conclusion, I think you must have certain high/low condition for these pins in order to get SA1 chip to work correctly.
Its very random in your environment because I guess these pins are high impedance and random when read.
I can't investigate correct pin conditions until I solder all cables back

[sanni]

Thanks for the feedback, I wrote a little test program that just prints the cart's name and info over the Serial Monitor:
https://dl.dropboxusercontent.com/u/209 ... ES_SA1.zip

Key features:
- sets PA0 - PA7, CPUCLK, PARD, PAWR, WRAM, REFRESH, EXPAND to output (which defaults to outputting a low signal)
- sets IRQ to input
- outputs a 4Mhz clock signal to both cic and SA-1 clk pin.
- sets reset to high

I think it has a good unlock rate so far. Things that could be changed to test if it improves:
- // Wait for CIC reset delay(2000); <-- maybe delay(1000) or delay(500) would work too
- __asm__("nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t""nop\n\t"); <-- additional "nop\n\t" seem to help too
- // Pullups //PORTC = 0xFF; <-- the pull-up resistors for the data lines could be activated
- clockgen.set_freq(400000000ULL, SI5351_PLL_FIXED, SI5351_CLK0); <-- different SA-1 clocks could be tested
- clockgen.set_freq(268465900ULL, SI5351_PLL_FIXED, SI5351_CLK1); <-- maybe output a clock signal to cpuclk instead of just putting it low like I do it right now
- clockgen.set_freq(400000000ULL, SI5351_PLL_FIXED, SI5351_CLK2); <-- different cic clocks could be tested
- pins like refresh could be pulled high instead of low

But knowing that stupid SA-1 chip my program probably stopped working the minute I wrote this post , will do more testing tomorrow.