SuperCIC Lock for ripping SA1 ROMs outside of console?

[waterbury]

I recently built a homemade SNES Cartridge reader using MCP23017 expander chips for the Raspberry Pi:
http://familab.org/blog/2012/12/snes-su ... ed-system/

I have broken out the IO from the center 46-pin connector, and have read write access to all of the lines with the exception of the CIC pins.

I am aware that the CIC lock is needed for SA1 games. I have the desire to use the Super CIC lock chip, but I have no idea how it will behave outside of an actual SNES. Does the SNES provide the Super CIC with a clock source I'd have to emulate outside of the console? Anyone with experience would be greatly appreciated!

[SkinnyV]

It theory it should be possible but I think that the SA-1 would also require certain clock signal from the SNES in order to unlock. I do not think it will only be a matter of hooking up the SuperCIC to the cart. I remember talking to the guy behind the Retrode about implementing the SuperCIC in his future hardware revision and he told me he couldn't manage it even after exchanging a few e-mail with Ikari.

[nocash]

Is that SuperCIC able to act as both Lock and Key? In cartridges you'd need a "key", but in your case you'd need a "lock".

And, theoretically, you might be able to dump those carts without a CIC. What I mean is:

The cartridge and console CICs are microprocessors, exchanging data with each other, and drag P10=LOW if the exchanged data is wrong.

Now, if you don't supply the 3.072MHz clock to the CIC, then the CIC can't run, can't exchange any data, can't sense errors, and can't drag P10=LOW on errors.

Only problem might be that the CIC might initially set P10=LOW on power up, in that case you could try to let it run for a couple of clock cycles (so it can initialize P10=HIGH) and then stop the clock (before it gets a chance to verify exchanged data). Somehow like so:
- Issue a short HIGH pulse on SNES.Cart.Pin25 to reset the CIC
- Issue some dozens (or maybe some hundreds) clocks on SNES.Cart.Pin56

The goal would be to get P10=HIGH (pin9 on a 16-pin DIP-package CIC chip). If you reach that state (best test that with a regular SNES cartridge), then it should be theoretically also working with SA-1 cartridges (assuming that they do internally use a signal similar to the P10 pin).

Don't know if that's really working, but maybe worth a try. Oh, and one caution: I am not sure if the above P10 levels are correct (after gazing at my docs... I am almost sure that they are inverse of what I've said above).
PS. Some overview on what is happening in CICs: http://nocash.emubase.de/fullsnes.htm#s ... ockoutchip

[Near]

Just noting that the CIC is inside the SA-1 on these carts, and it has a lot of added protections like not falling for key+key=disable CIC. It may not be so simple to trick it.

I am genuinely curious how people dumped SA-1 games in the past. I use a SuperCIC-modded SNES, myself. I presume people were dumping the ROM chips directly after removing them from the game boards?

[MottZilla]

I think that the Super WildCard DX had some kind of advanced mode that could be used to dump cartridges with coprocessors. But otherwise the SA-1 boards have standard pinouts so it wouldn't be too unlikely someone might have removed them to dump them directly.

[SkinnyV]

The Super Wild Card DX2 couldn't dump SA-1 cart that's for sure. I tried it myself when I was a teenager(I even tried to draw schematic to connect the CIC to the cart directly lol).

[MottZilla]

I don't mean normally. Again, I recall reading something about a special method of dumping with the SWC DX1 or 2. You couldn't just use the standard dump option.

[SkinnyV]

I remember someone made a special ROM for dumping non-standard cart but I'm fairly certain it didn't apply to SA-1 carts.

[MottZilla]

Well again, I'm just recalling something from long ago. You say you too remember something for dumping "special" carts. Perhaps that was it. It's not too far fetched that to dump SA-1 games someone would have just removed the chips and directly read them with a programming device. The pinout is standard I believe.

[SkinnyV]

That's most likely how they did it as it would be pretty trivial to read them as 27c322 with minimal change to the pin-out.

[Overload]

The Super Wild Card DX2 couldn't dump SA-1 cart that's for sure. I tried it myself when I was a teenager(I even tried to draw schematic to connect the CIC to the cart directly lol).

I dumped all my SA-1 carts on a Super Wild Card DX2 (unmodified).

Occasionally the SA-1 willl come out of reset and you are able the dump the ROM (there is even an option in Ucon64 for doing so). The best bet for dumping is to remove the DX2 from the SNES, play the SA-1 game for a number of minutes, switch off the machine (holding reset at the same time). Place the DX2 back on the SNES with the SA-1 cart in the cart slot. Switch SNES on dump ROM via parallel port. Didn't work every time, (some SA-1 carts seemed more problematic than others)

[SkinnyV]

I stand corrected, I was never aware of such a trick and never saw anyone mention it on the old Red #9 board. I remember many kept trying to find way to dump them and never suceeding.