How to convert Mapper 1 to Mapper 4?

FARID · Post by **FARID** » Mon Jun 13, 2011 9:59 am

I have a game which is Mapper 1. I want to convert it to Mapper 4. Is it possible? How can I do it?

MottZilla · Post by **MottZilla** » Mon Jun 13, 2011 10:16 am

It depends on the game but it can probably be done. I can't explain it in full. Basically you need to read through the program code (breakpoints help) and change all MMC1 program code to instead use the MMC3. This is not for beginners. If you don't know 6502 assembly, don't bother.

Post by **tepples** » Mon Jun 13, 2011 10:23 am

I can think of only two things that would interfere with a conversion from mapper 1 to mapper 4:

PRG bank modes other than fixed-$C000
Raster effects that depend on cycle-timed bankswitching of CHR ROM

FARID · Post by **FARID** » Mon Jun 13, 2011 11:06 am

I have a game which originally is Mapper 1.
I found a Pirate ROM which includes this game as Mapper 4!
So practically it is possible to do it!
I have to do some reverse engineering to learn it!
Can someone help me to disassemble their code?
It seems about 200 bytes had been rewritten :

http://up.iranblog.com/images/fu9axbyy52ns8bdbx6.zip

cpow · Post by **cpow** » Mon Jun 13, 2011 11:09 am

FARID wrote:I have a game which originally is Mapper 1.
I found a Pirate ROM which includes this game as Mapper 4!
So practically it is possible to do it!
I have to do some reverse engineering to learn it!
Can someone help me to disassemble their code?
It seems about 200 bytes had been rewritten :

http://up.iranblog.com/images/fu9axbyy52ns8bdbx6.zip

Hm. Spyware/Malware sayeth the grand McAfee.

Dwedit · Post by **Dwedit** » Mon Jun 13, 2011 11:19 am

The nice thing about MMC1 games is that they generally don't inline the bankswitching, they usually call a routine to do it. So that's one thing you need to change.

FARID · Post by **FARID** » Mon Jun 13, 2011 12:34 pm

Very nice tool for disassembling PRG :

6502 Disassembler v2.0 by Cortez Ralph

qbradq · Post by **qbradq** » Mon Jun 13, 2011 1:23 pm

Another thing that will trip you up is if the game uses one-screen mirroring at all. MMC3 does not support this.

If the cycle times for bank swapping are causing problems, you can always throw in some do-nothing instructions in the bank swapping routine to make the cycle counts match.

Dwedit · Post by **Dwedit** » Mon Jun 13, 2011 1:51 pm

If you need one-screen mirroring, mapper hack it to use NES Play Action Football's mapper. (TLSROM, #118)

tokumaru · Post by **tokumaru** » Mon Jun 13, 2011 1:54 pm

FARID, there is no need to disassemble the whole game. What you need to do is run the game in FCEUX, open its debugger and set up breakpoints for writes in the range $8000-$FFFF. Once you identify where in the code those writes occur, you have to replace those with equivalent MMC3 writes.

If you don't have much knowledge about the architecture of the NES and never programmed 6502 before, you probably won't be able to do this.

MottZilla · Post by **MottZilla** » Mon Jun 13, 2011 1:57 pm

Just curious, why do you want to hack this game from mapper 1 to 4?

Post by **tepples** » Mon Jun 13, 2011 2:01 pm

qbradq wrote:MMC3 does not support this.

Mapper 4 doesn't, but a quick rewire turns it into mapper 118.

If the cycle times for bank swapping are causing problems, you can always throw in some do-nothing instructions in the bank swapping routine to make the cycle counts match.

It appears switching an entire 4 KiB as a unit takes longer on the MMC3 or FME-7 than on the MMC1.

Code: Select all

mmc1_switch1000:
  sta $E000
  lsr a
  sta $E000
  lsr a
  sta $E000
  lsr a
  sta $E000
  lsr a
  sta $E000
  rts

Code: Select all

; Clobbers X
mmc3_switch1000:
  asl a
  asl a
  ldx #2
  stx $8000
  sta $8001
  inx
  eor #%0001
  stx $8000
  sta $8001
  inx
  eor #%0011
  stx $8000
  sta $8001
  inx
  eor #%0001
  stx $8000
  sta $8001
  rts

I guess if the game uses mid-frame bankswitches on the $1000-$1FFF bank, it could be run with swapped $0000/$1000.

Code: Select all

; Clobbers X
mmc3_switch1000alt:
  asl a
  asl a
  ora #%10000000
  ldx #0
  stx $8000
  sta $8001
  inx
  eor #%0010
  stx $8000
  sta $8001
  rts

But in practice, I doubt that a dodgeball game uses such tightly timed bankswitching. It's more something that would be seen in a driving game.

cpow · Post by **cpow** » Mon Jun 13, 2011 2:24 pm

tokumaru wrote:What you need to do is run the game in FCEUX, open its debugger and set up breakpoints for writes in the range $8000-$FFFF. Once you identify where in the code those writes occur, you have to replace those with equivalent MMC3 writes.

This will work as long as he plays through the whole game or at least enough of it to ensure it's switched in all of the banks it's going to switch in that might have their own "bankswitch" routines in them. I suppose that's why disassembling would be quicker...but then again that disassembly would have to be smart enough to know it's disassembling code and not data as "code"...which brings you back to wanting to run it with an emulator that can give you a CDL...but then you'd need to run through the whole thing. Ugh. I'm in a loop.

Post by **tepples** » Mon Jun 13, 2011 2:26 pm

I guess one could try running a few TAS videos in fast-forward to get some coverage for the CDL. What problems would that have, other than that TAS videos rely on FCEUX timing quirks?

FARID · Post by **FARID** » Tue Jun 14, 2011 3:20 am

Dodgeball Mapper 1 :

Code: Select all

00007D6A:	8DFFDF	STA $DFFF

00007D81:	8DFFBF	STA $BFFF

00007FA0:	00	BRK
00007FA1:	00	BRK
00007FA2:	00	BRK
00007FA3:	00	BRK
00007FA4:	00	BRK
00007FA5:	00	BRK
00007FA6:	00	BRK
00007FA7:	00	BRK
00007FA8:	00	BRK
00007FA9:	00	BRK
00007FAA:	00	BRK
00007FAB:	00	BRK
00007FAC:	00	BRK
00007FAD:	00	BRK
00007FAE:	00	BRK
00007FAF:	00	BRK
00007FB0:	00	BRK
00007FB1:	00	BRK
00007FB2:	00	BRK
00007FB3:	00	BRK
00007FB4:	00	BRK
00007FB5:	00	BRK
00007FB6:	00	BRK
00007FB7:	00	BRK
00007FB8:	00	BRK
00007FB9:	00	BRK
00007FBA:	00	BRK
00007FBB:	00	BRK
00007FBC:	00	BRK
00007FBD:	00	BRK
00007FBE:	00	BRK
00007FBF:	00	BRK
00007FC0:	00	BRK
00007FC1:	00	BRK
00007FC2:	00	BRK
00007FC3:	00	BRK
00007FC4:	00	BRK
00007FC5:	00	BRK
00007FC6:	00	BRK
00007FC7:	00	BRK
00007FC8:	00	BRK
00007FC9:	00	BRK
00007FCA:	00	BRK
00007FCB:	00	BRK
00007FCC:	00	BRK
00007FCD:	00	BRK
00007FCE:	00	BRK
00007FCF:	00	BRK
00007FD0:	00	BRK
00007FD1:	00	BRK
00007FD2:	00	BRK
00007FD3:	00	BRK
00007FD4:	00	BRK
00007FD5:	00	BRK
00007FD6:	00	BRK
00007FD7:	00	BRK
00007FD8:	00	BRK
00007FD9:	00	BRK
00007FDA:	00	BRK
00007FDB:	00	BRK
00007FDC:	00	BRK
00007FDD:	00	BRK


0001FE9F:	A569	LDA $69
0001FEA1:	8DFF9F	STA $9FFF
0001FEA4:	4A	LSR A
0001FEA5:	8DFF9F	STA $9FFF
0001FEA8:	4A	LSR A
0001FEA9:	8DFF9F	STA $9FFF
0001FEAC:	4A	LSR A
0001FEAD:	8DFF9F	STA $9FFF
0001FEB0:	4A	LSR A
0001FEB1:	8DFF9F	STA $9FFF
0001FEB4:	68	PLA
0001FEB5:	85FF	STA $FF
0001FEB7:	8D0020	STA $2000
0001FEBA:	58	CLI
0001FEBB:	60	RTS
0001FEBC:	8569	STA $69
0001FEBE:	78	SEI
0001FEBF:	A5FF	LDA $FF
0001FEC1:	48	PHA
0001FEC2:	208AFE	JSR $FE8A
0001FEC5:	A569	LDA $69
0001FEC7:	8DFFBF	STA $BFFF
0001FECA:	4A	LSR A
0001FECB:	8DFFBF	STA $BFFF
0001FECE:	4A	LSR A
0001FECF:	8DFFBF	STA $BFFF
0001FED2:	4A	LSR A
0001FED3:	8DFFBF	STA $BFFF
0001FED6:	4A	LSR A
0001FED7:	8DFFBF	STA $BFFF
0001FEDA:	68	PLA
0001FEDB:	85FF	STA $FF
0001FEDD:	8D0020	STA $2000
0001FEE0:	58	CLI
0001FEE1:	60	RTS
0001FEE2:	8569	STA $69
0001FEE4:	78	SEI
0001FEE5:	A5FF	LDA $FF
0001FEE7:	48	PHA
0001FEE8:	208AFE	JSR $FE8A
0001FEEB:	A569	LDA $69
0001FEED:	8DFFDF	STA $DFFF
0001FEF0:	4A	LSR A
0001FEF1:	8DFFDF	STA $DFFF
0001FEF4:	4A	LSR A
0001FEF5:	8DFFDF	STA $DFFF
0001FEF8:	4A	LSR A
0001FEF9:	8DFFDF	STA $DFFF
0001FEFC:	4A	LSR A
0001FEFD:	8DFFDF	STA $DFFF
0001FF00:	68	PLA
0001FF01:	85FF	STA $FF
0001FF03:	8D0020	STA $2000
0001FF06:	58	CLI
0001FF07:	60	RTS
0001FF08:	48	PHA
0001FF09:	78	SEI
0001FF0A:	A5FF	LDA $FF
0001FF0C:	297F	AND #$7F
0001FF0E:	8D0020	STA $2000
0001FF11:	68	PLA
0001FF12:	8D0301	STA $0103
0001FF15:	A5FF	LDA $FF
0001FF17:	48	PHA
0001FF18:	297F	AND #$7F
0001FF1A:	85FF	STA $FF
0001FF1C:	AD0301	LDA $0103
0001FF1F:	8DFFFF	STA $FFFF
0001FF22:	4A	LSR A
0001FF23:	8DFFFF	STA $FFFF
0001FF26:	4A	LSR A
0001FF27:	8DFFFF	STA $FFFF
0001FF2A:	4A	LSR A
0001FF2B:	8DFFFF	STA $FFFF
0001FF2E:	4A	LSR A
0001FF2F:	8DFFFF	STA $FFFF
0001FF32:	68	PLA
0001FF33:	85FF	STA $FF
0001FF35:	8D0020	STA $2000
0001FF38:	58	CLI
0001FF39:	60	RTS


0001FF61:	78	SEI
0001FF62:	A910	LDA #$10
0001FF64:	8D0020	STA $2000
0001FF67:	85FF	STA $FF
0001FF69:	D8	CLD
0001FF6A:	A906	LDA #$06
0001FF6C:	85FE	STA $FE
0001FF6E:	8D0120	STA $2001
0001FF71:	A202	LDX #$02
0001FF73:	AD0220	LDA $2002
0001FF76:	10FB	BPL $FB
0001FF78:	CA	DEX
0001FF79:	D0F8	BNE $F8
0001FF7B:	86FD	STX $FD
0001FF7D:	86FC	STX $FC
0001FF7F:	86FB	STX $FB
0001FF81:	8E1640	STX $4016
0001FF84:	A9FF	LDA #$FF
0001FF86:	85F9	STA $F9
0001FF88:	A940	LDA #$40
0001FF8A:	8D1740	STA $4017
0001FF8D:	A90F	LDA #$0F
0001FF8F:	8D1540	STA $4015
0001FF92:	A2FF	LDX #$FF
0001FF94:	9A	TXS
0001FF95:	A91E	LDA #$1E
0001FF97:	2096FE	JSR $FE96
0001FF9A:	A9C0	LDA #$C0
0001FF9C:	8D0001	STA $0100
0001FF9F:	A950	LDA #$50
0001FFA1:	8D0101	STA $0101
0001FFA4:	AD0201	LDA $0102
0001FFA7:	C935	CMP #$35
0001FFA9:	D017	BNE $17
0001FFAB:	AD0301	LDA $0103
0001FFAE:	C953	CMP #$53
0001FFB0:	F009	BEQ $09
0001FFB2:	C9AC	CMP #$AC
0001FFB4:	D00C	BNE $0C
0001FFB6:	A953	LDA #$53
0001FFB8:	8D0301	STA $0103
0001FFBB:	20DFFC	JSR $FCDF
0001FFBE:	58	CLI
0001FFBF:	4C36F0	JMP $F036
0001FFC2:	A900	LDA #$00
0001FFC4:	A2F8	LDX #$F8
0001FFC6:	9D0000	STA $0000,X
0001FFC9:	CA	DEX
0001FFCA:	D0FA	BNE $FA
0001FFCC:	EA	NOP
0001FFCD:	EA	NOP
0001FFCE:	EA	NOP
0001FFCF:	EA	NOP
0001FFD0:	EA	NOP
0001FFD1:	EA	NOP
0001FFD2:	EA	NOP
0001FFD3:	EA	NOP
0001FFD4:	EA	NOP
0001FFD5:	EA	NOP
0001FFD6:	A900	LDA #$00
0001FFD8:	85FD	STA $FD
0001FFDA:	85FC	STA $FC
0001FFDC:	4CBEFF	JMP $FFBE
0001FFDF:	00	BRK
0001FFE0:	00	BRK
0001FFE1:	00	BRK
0001FFE2:	00	BRK
0001FFE3:	00	BRK
0001FFE4:	00	BRK
0001FFE5:	00	BRK
0001FFE6:	00	BRK
0001FFE7:	00	BRK
0001FFE8:	EEF1FF	INC $FFF1
0001FFEB:	EA	NOP
0001FFEC:	EA	NOP
0001FFED:	EA	NOP
0001FFEE:	4C61FF	JMP $FF61
0001FFF1:	EA	NOP
0001FFF2:	80	.DB $80
0001FFF3:	EF	.DB $EF
0001FFF4:	9F	.DB $9F
0001FFF5:	EF	.DB $EF
0001FFF6:	D9EF36	CMP $36EF,Y
0001FFF9:	F03A	BEQ $3A
0001FFFB:	FF	.DB $FF
0001FFFC:	E8	INX
0001FFFD:	FF	.DB $FF
0001FFFE:	9E	.DB $9E
0001FFFF:	EF	.DB $EF

**********************************************************

Dodgeball Mapper 4 :

Code: Select all

00007D6A:	4CB6BF	JMP $BFB6

00007D81:	4CA0BF	JMP $BFA0

00007FA0:	A000	LDY #$00
00007FA2:	0A	ASL A
00007FA3:	0A	ASL A
00007FA4:	8C0080	STY $8000
00007FA7:	8D0180	STA $8001
00007FAA:	C8	INY
00007FAB:	0902	ORA #$02
00007FAD:	8C0080	STY $8000
00007FB0:	8D0180	STA $8001
00007FB3:	4C06BF	JMP $BF06
00007FB6:	A002	LDY #$02
00007FB8:	0A	ASL A
00007FB9:	0A	ASL A
00007FBA:	8C0080	STY $8000
00007FBD:	8D0180	STA $8001
00007FC0:	C8	INY
00007FC1:	0901	ORA #$01
00007FC3:	8C0080	STY $8000
00007FC6:	8D0180	STA $8001
00007FC9:	C8	INY
00007FCA:	4903	EOR #$03
00007FCC:	8C0080	STY $8000
00007FCF:	8D0180	STA $8001
00007FD2:	C8	INY
00007FD3:	0901	ORA #$01
00007FD5:	8C0080	STY $8000
00007FD8:	8D0180	STA $8001
00007FDB:	4C06BF	JMP $BF06


0001FE9F:	A569	LDA $69
0001FEA1:	2901	AND #$01
0001FEA3:	8D00A0	STA $A000
0001FEA6:	A900	LDA #$00
0001FEA8:	8D0080	STA $8000
0001FEAB:	8D01A0	STA $A001
0001FEAE:	8D00E0	STA $E000
0001FEB1:	8D00E0	STA $E000
0001FEB4:	68	PLA
0001FEB5:	85FF	STA $FF
0001FEB7:	8D0020	STA $2000
0001FEBA:	78	SEI
0001FEBB:	60	RTS
0001FEBC:	8669	STX $69
0001FEBE:	A210	LDX #$10
0001FEC0:	8E0020	STX $2000
0001FEC3:	A200	LDX #$00
0001FEC5:	0A	ASL A
0001FEC6:	0A	ASL A
0001FEC7:	8E0080	STX $8000
0001FECA:	8D0180	STA $8001
0001FECD:	E8	INX
0001FECE:	0902	ORA #$02
0001FED0:	8E0080	STX $8000
0001FED3:	8D0180	STA $8001
0001FED6:	A6FF	LDX $FF
0001FED8:	8E0020	STX $2000
0001FEDB:	A669	LDX $69
0001FEDD:	60	RTS
0001FEDE:	00	BRK
0001FEDF:	205860	JSR $6058
0001FEE2:	8669	STX $69
0001FEE4:	A210	LDX #$10
0001FEE6:	8E0020	STX $2000
0001FEE9:	A202	LDX #$02
0001FEEB:	0A	ASL A
0001FEEC:	0A	ASL A
0001FEED:	8E0080	STX $8000
0001FEF0:	8D0180	STA $8001
0001FEF3:	E8	INX
0001FEF4:	0901	ORA #$01
0001FEF6:	8E0080	STX $8000
0001FEF9:	8D0180	STA $8001
0001FEFC:	E8	INX
0001FEFD:	4903	EOR #$03
0001FEFF:	8E0080	STX $8000
0001FF02:	8D0180	STA $8001
0001FF05:	4C2BFF	JMP $FF2B
0001FF08:	8E0301	STX $0103
0001FF0B:	A210	LDX #$10
0001FF0D:	8E0020	STX $2000
0001FF10:	A206	LDX #$06
0001FF12:	0A	ASL A
0001FF13:	8E0080	STX $8000
0001FF16:	8D0180	STA $8001
0001FF19:	E8	INX
0001FF1A:	0901	ORA #$01
0001FF1C:	8E0080	STX $8000
0001FF1F:	8D0180	STA $8001
0001FF22:	A6FF	LDX $FF
0001FF24:	8E0020	STX $2000
0001FF27:	AE0301	LDX $0103
0001FF2A:	60	RTS
0001FF2B:	E8	INX
0001FF2C:	0901	ORA #$01
0001FF2E:	4CD0FE	JMP $FED0
0001FF31:	FF	.DB $FF
0001FF32:	68	PLA
0001FF33:	85FF	STA $FF
0001FF35:	8D0020	STA $2000
0001FF38:	58	CLI
0001FF39:	60	RTS


0001FF61:	78	SEI
0001FF62:	A910	LDA #$10
0001FF64:	8D0020	STA $2000
0001FF67:	85FF	STA $FF
0001FF69:	D8	CLD
0001FF6A:	A906	LDA #$06
0001FF6C:	85FE	STA $FE
0001FF6E:	8D0120	STA $2001
0001FF71:	A202	LDX #$02
0001FF73:	AD0220	LDA $2002
0001FF76:	10FB	BPL $FB
0001FF78:	CA	DEX
0001FF79:	D0F8	BNE $F8
0001FF7B:	86FD	STX $FD
0001FF7D:	86FC	STX $FC
0001FF7F:	86FB	STX $FB
0001FF81:	8E00E0	STX $E000
0001FF84:	A9FF	LDA #$FF
0001FF86:	85F9	STA $F9
0001FF88:	A940	LDA #$40
0001FF8A:	8D1740	STA $4017
0001FF8D:	A90F	LDA #$0F
0001FF8F:	8D1540	STA $4015
0001FF92:	A2FF	LDX #$FF
0001FF94:	9A	TXS
0001FF95:	A91E	LDA #$1E
0001FF97:	2096FE	JSR $FE96
0001FF9A:	A9C0	LDA #$C0
0001FF9C:	8D0001	STA $0100
0001FF9F:	A950	LDA #$50
0001FFA1:	8D0101	STA $0101
0001FFA4:	AD0201	LDA $0102
0001FFA7:	C935	CMP #$35
0001FFA9:	D017	BNE $17
0001FFAB:	AD0301	LDA $0103
0001FFAE:	C953	CMP #$53
0001FFB0:	F009	BEQ $09
0001FFB2:	C9AC	CMP #$AC
0001FFB4:	D00C	BNE $0C
0001FFB6:	A953	LDA #$53
0001FFB8:	8D0301	STA $0103
0001FFBB:	20DFFC	JSR $FCDF
0001FFBE:	78	SEI
0001FFBF:	4C36F0	JMP $F036
0001FFC2:	A900	LDA #$00
0001FFC4:	A2F8	LDX #$F8
0001FFC6:	9D0000	STA $0000,X
0001FFC9:	CA	DEX
0001FFCA:	D0FA	BNE $FA
0001FFCC:	EA	NOP
0001FFCD:	EA	NOP
0001FFCE:	EA	NOP
0001FFCF:	EA	NOP
0001FFD0:	EA	NOP
0001FFD1:	EA	NOP
0001FFD2:	EA	NOP
0001FFD3:	EA	NOP
0001FFD4:	EA	NOP
0001FFD5:	EA	NOP
0001FFD6:	A900	LDA #$00
0001FFD8:	85FD	STA $FD
0001FFDA:	85FC	STA $FC
0001FFDC:	4CBEFF	JMP $FFBE
0001FFDF:	00	BRK
0001FFE0:	2C0220	BIT $2002
0001FFE3:	4C3AFF	JMP $FF3A
0001FFE6:	00	BRK
0001FFE7:	00	BRK
0001FFE8:	EEF1FF	INC $FFF1
0001FFEB:	EA	NOP
0001FFEC:	EA	NOP
0001FFED:	EA	NOP
0001FFEE:	4C61FF	JMP $FF61
0001FFF1:	EA	NOP
0001FFF2:	80	.DB $80
0001FFF3:	EF	.DB $EF
0001FFF4:	9F	.DB $9F
0001FFF5:	EF	.DB $EF
0001FFF6:	D9EF36	CMP $36EF,Y
0001FFF9:	F0E0	BEQ $E0
0001FFFB:	FF	.DB $FF
0001FFFC:	61FF	ADC ($FF,X)
0001FFFE:	9E	.DB $9E
0001FFFF:	EF	.DB $EF