Dumping a multigames 1050 in 1 NES Cartridge with INLretro
Moderator: Moderators
Dumping a multigames 1050 in 1 NES Cartridge with INLretro
How to dump this multi-games NES cartridge with the INLretro cartridge dumper ?
The game menu occupies more than 16 KB, so probably 32KB.
This cartridge contains UNROM games (Contra...) and other types.
It contains the game Bubble Bobble.
Photos of the PCB (front and back mirror) :
Recent technical datas :
http://krzysiobal.com/carts/?action=view&id=12
The game menu occupies more than 16 KB, so probably 32KB.
This cartridge contains UNROM games (Contra...) and other types.
It contains the game Bubble Bobble.
Photos of the PCB (front and back mirror) :
Recent technical datas :
http://krzysiobal.com/carts/?action=view&id=12
- Attachments
-
- 120in1-contra-1992.nes
- (512.02 KiB) Downloaded 50 times
Last edited by nes356 on Mon Mar 27, 2023 9:23 am, edited 3 times in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
A significant portion of how this board works has been hidden inside the program inside the TIBPAL16L8. Assuming someone else doesn't specifically recognize this board, you'll need to ask the INLretro to dump it as though it were NROM, and hopefully there'll be enough information in that NROM dump to figure out how to dump the cartridge.
Additionally, this is a multicart that detects when the CPU is in reset with that resistor+diode+capacitor. You'll have to modify that to be able to dump the cartridge on anything less than a CopyNES.
Additionally, this is a multicart that detects when the CPU is in reset with that resistor+diode+capacitor. You'll have to modify that to be able to dump the cartridge on anything less than a CopyNES.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Code: Select all
./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 32 -y 8 -d 1000in1-nrom-PRG32kb-CHR8kb.nes
- Attachments
-
- 1000in1-nrom-PRG32kb-CHR8kb.nes
- (40.02 KiB) Downloaded 88 times
Last edited by nes356 on Thu Jan 19, 2023 10:43 am, edited 2 times in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Based on the code in the "-x 32" nrom dump, it looks like there's a register is at $Exxx. Based on the schematic, there's only one register.
Use this script ("decipher.lua") with "-x 4096". This dump will not work, but it will let us determine what the PAL is doing.
You must also short out this capacitor, or else this script will not work.
Use this script ("decipher.lua") with "-x 4096". This dump will not work, but it will let us determine what the PAL is doing.
You must also short out this capacitor, or else this script will not work.
- Attachments
-
- decipher.zip
- (1.35 KiB) Downloaded 51 times
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
By shorting the capacitor with an electric wire (continuity is ok with a voltmeter) and replacing the nrom.lua script by the decipher.lua script that you give (in the scripts/nes directory of INLretro program), the result is :
Code: Select all
root@a:~/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 4096 -y 8 -d 1000in1-nrom-PRG_4096kb-CHR_8kb-decipher.nes
Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length: 0 did not match expected: 1
firmware app ver request: 0
firmware is out of date, recommend updating
Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:23: bad argument #1 to 'char' (value out of range)
Fatal error encountered, exiting.
Code: Select all
root@a:~/INLRetro/INL-retro-progdump-master/host# ./inlretro -s scripts/inlretro2.lua -c NES -m nrom -x 2048 -y 8 -d 1000in1-nrom-PRG_2048kb-CHR_8kb-decipher.nes
Successfully found and connected to INL retro-prog
Device firmware version: 2.3.x
Permitted Error with opcode: GET_APP_VER operand: 0 misc: 0 device error code: 138
WARNING!! Device's return data length: 0 did not match expected: 1
firmware app ver request: 0
firmware is out of date, recommend updating
Dumping PRG-ROM...
[ERROR] (source/inlprog.c:370: errno: Resource temporarily unavailable) cannot run config. file: ./scripts/app/nes.lua:49: attempt to perform bitwise operation on a nil value (local 'mapper')
Fatal error encountered, exiting.
Last edited by nes356 on Thu Jan 19, 2023 10:52 am, edited 1 time in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
replace "-m nrom" with "-m decipher310331C". And "decipher.lua" probably has to be copied into the same directory as "nrom.lua" is in (in the dumper program)
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Several things have been changed in the INLretro scripts for the decipher.lua script can work :
In the local function write_header(file, prgKB, chrKB, mapper, mirroring) of the script scripts/app/nes.lua :
has been replaced by :
(NB : 4096 / 16 = 256 => the value of a char goes from 0 to 255 => Error : bad argument #1 to 'char' (value out of range))
and the line below has been added :
(NB : the value of the variable mapper was "nil" so it caused an error (mapper=0 is the value for nrom mapper))
In the script scripts/inlretro2.lua :
A line to refer to the decipher.lua script has been added in the variable that contains the list of mappers :
Finally :
generated the dump file below (it has been truncated because it exceeded the size limit of 4Mb for attachments on this forum) :
In the local function write_header(file, prgKB, chrKB, mapper, mirroring) of the script scripts/app/nes.lua :
Code: Select all
file:write(string.char(prgKB / 16))
Code: Select all
file:write(string.char(255))
and the line below has been added :
Code: Select all
mapper=0
In the script scripts/inlretro2.lua :
A line to refer to the decipher.lua script has been added in the variable that contains the list of mappers :
Code: Select all
local mappers = {
...
decipher = require "scripts.nes.decipher",
}
Code: Select all
./inlretro -s scripts/inlretro2.lua -c NES -m decipher -x 4096 -d 1000in1-decipher-PRG_4096kb.nes
- Attachments
-
- 1000in1-decipher-PRG_4096kb-truncated.nes
- (4 MiB) Downloaded 71 times
Last edited by nes356 on Thu Jan 19, 2023 11:08 am, edited 2 times in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
From Krzysiobal's schematic, the discrete logic on the PCB already does this following:
Here's what I've learned from the above dump:
The PAL rounds out the behavior to the following:
As such, the three attached dumping scripts should all produce the same result, each using a different way to ask for it.
The size to request is only 3MiB, "-x 3072". There is no CHR ROM, so you can leave out "-y".
Code: Select all
A~[111x xxxx xxIH W???] D~[?MGF E???]
|| | ||| |
++------------++-+---- Specify PRG A21 downto A17
| +-------- H/V nametable arrangment
+------------------ CHR RAM write protect
Here's what I've learned from the above dump:
The PAL rounds out the behavior to the following:
Code: Select all
A~[111x xxxx xxIH WXmm] D~[AMGF EDCB]
|| |||| |||| ||||
++----------+-++-++++- Specify A21("I") downto A13("A"), when appropriate
|||| +-------- still H/V nametables
|+++--------------- 0,4: 32K PRG, 1: UNROM (128K), 2,6: 8K PRG (use "B" and "A" bits), 3,7: 16K PRG (use "B" bit),
| 5: stupid 32K mode (ignore ABCD, treat C and D as 1, pass through CPU A13 and CPU A14)
+------------------ still CHR RAM write protect
The size to request is only 3MiB, "-x 3072". There is no CHR ROM, so you can leave out "-y".
- Attachments
-
- dump310331C.zip
- (4.03 KiB) Downloaded 50 times
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Code: Select all
INLretro program error : the -x option must be non-zero power of 2, 16kb or greater.
Code: Select all
./inlretro -s scripts/inlretro3.lua -c NES -m dump310331c -x 4096 -d 1000in1-dump310331C-16-PRG_4096kb.nes
cp 1000in1-dump310331C-16-PRG_4096kb.nes 1000in1-dump310331C-16-PRG_3072kb.nes
truncate -s 3145744 1000in1-dump310331C-16-PRG_3072kb.nes
#### NB : 16 (header) + 3 MB (3072 x 1024) = 3145744 bytes
As anticipated, the 3 scripts has given the same result :
- Attachments
-
- 1000in1-dump310331C-16-PRG_3072kb.nes
- (3 MiB) Downloaded 70 times
Last edited by nes356 on Thu Jan 19, 2023 12:47 pm, edited 5 times in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
The data is valid for 512K, and it seems that 1024K data is missing
- Attachments
-
- 32423434_002.png (6.83 KiB) Viewed 3335 times
-
- 32423434_001.png (6.29 KiB) Viewed 3335 times
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
... UGH I see one of my mistakes in my code, but I don't see the other.
I had but I forgot to include all the bits.
That should have been:
That said, I still don't see why the original dump repeated 6 times after 512K instead of 3 times after 1M.
I had
Code: Select all
local datapart = (read_count & 7) << 1;
local addrpart = 0xE000 | ((read_count << 1) & 0x30);
dict.nes("NES_CPU_WR", addrpart, datapart) --32KB @ CPU $8000
That should have been:
Code: Select all
local datapart = (read_count & 31) << 1;
local addrpart = 0xE000 | ((read_count >> 1) & 0x30);
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
By running the script with the 2 corrective lines suggested and setting the mapper to 15 (the only that seems to work) in the header, the dump file generated is :
- Attachments
-
- 1000in1-dump310331C-32-2-PRG_3072kb-1.nes-mapper15.nes
- (3 MiB) Downloaded 78 times
Last edited by nes356 on Thu Jan 19, 2023 12:52 pm, edited 8 times in total.
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
The first 2MiB have unique content, but the third MiB is a copy of the first. I must still have some mistake in my code, but I am not entirely clear where...
- krzysiobal
- Posts: 1037
- Joined: Sun Jun 12, 2011 12:06 pm
- Location: Poland
- Contact:
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Looking at the font from main menu, I bet i saw something similar before.
After a few minutes I found out I rev-en something like that before:
I think this might be the same mapper.
viewtopic.php?p=222458
BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
After a few minutes I found out I rev-en something like that before:
I think this might be the same mapper.
viewtopic.php?p=222458
BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.
My website: http://krzysiobal.com | My NES/FC flashcart: http://krzysiocart.com
Re: Dumping a multigame 1000 in 1 NES Cartridge with INLretro
Unfortunately, because the archive is older than nesdev.org, Google treats it as the primary source and nesdev.org as the duplicate.krzysiobal wrote: ↑Fri Nov 25, 2022 12:31 pm BTW. Why google stopped indexing forums.nesdev.org so well after moving from .com to .org?
After entering "250-in-1 multicart / similar to Contra 168-in-1/100-in 1" it shows only one result from archive.nes.science and nothing from this site.