Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Dumping Wii VC SMS titles

Reply to topic Goto page 1, 2, 3  Next
Author Message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Dumping Wii VC SMS titles
Post Posted: Sun May 04, 2008 10:29 pm
I've been poking around using some shady tools. The ROM seems not to be stored in cleartext, and there are virtual filesystems inside lots of the files I've got. For example, there's a virtual file called "patch" containing the text
>0x7ff0      string      "TMR SEGA"
>>0x7ffc   belong      0x5250024f

0x0007b8:
   byte   0xc9      # boss defeat flash skip

...which tells us they seem to be storing the ROM unpatched, and then removing the flashing (c9 = ret, have you memorised that yet?) due to stupid Americans who sue Ni****do when their epileptic kid sees something flashing. But I'm having no luck finding the ROM. Has anyone else tried?

Contact me privately if you feel it's appropriate.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 1:51 am
Last edited by Maxim on Mon May 05, 2008 10:19 am; edited 1 time in total
Well, this is the ROM, in a mystery compression format. The first 2 bytes seem to be the same in all compressed files, but apart from that, I have no idea.

Edit: removed file.
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Mon May 05, 2008 3:43 am
http://www.groupsrv.com/science/about176335.html
Could this be the answer you're looking for?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 8:34 am
Dammit, I thought I'd ruled that out...

A suitable decompressor is here:

http://www.zlib.net/zpipe.c

The ROM is a pure clean dump. I now (probably) know enough to inject any ROM into an SMS VC game, as has been done with other systems already, but I'm not planning to try it because it'd be easy for Ni****do to ban my console.

Is there anyone who'd like to help verify the same holds for Wonder Boy, or any other non-European releases? You'll need an SD card with lots of space and a copy of Z***a.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 10:11 am
One more thing...

Manual

Nothing very interesting but I spent ages getting it.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8644
  • Location: Paris, France
Reply with quote
Post Posted: Mon May 05, 2008 10:52 am
Nice! Funny how the manual is much bigger than the ROM itself.
Would be good to confirm that their various releases are known ROM dumps and list their hack. I would however stay rather low profile since this could attract unwanted attention.
  View user's profile Send private message Visit poster's website
  • Joined: 04 Nov 2004
  • Posts: 273
Reply with quote
Post Posted: Mon May 05, 2008 11:17 am
Funny how they call the German pages noe instead of deu or ger :)
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 11:54 am
So does anyone have Wonder Boy, an SD card and Z***a TP? I'm not about to spend 500 Wii points on every release. I can provide a guide and all software/files needed.
  View user's profile Send private message Visit poster's website
  • Joined: 23 Feb 2007
  • Posts: 18
Reply with quote
emulator ?
Post Posted: Mon May 05, 2008 1:17 pm
You could also use the SMS Plus port running on wii, I've heard it was working pretty well ;)

btw, how did you managed to dump the manual ?

SMS and Genny roms are known to be compressed in aproprietary format (and I don't think it's something as common as zlib), where as SNES and NES ones are not, which explain the recent released snes/nes pirated vc titles(sega is smarter than Ni****do, we already knew :) )
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 2:15 pm
Well, this ROM is zlib-compressed. I don't have a Mega Drive ROM to play with, so I can only vouch for Fantasy Zone, but the structure is:

00000005.APP is a U8 archive (unpacker on Wiibrew) containing a single file called data.ccf.
CCF is a TAR-like format with a directory in the format:
Header: "CCF" at 0x0000, number of files at 0x0014
followed by n directory entries:
name: 20 bytes, 0-padded
offset: i32, multiply by 32 to get the real offset
size: i32
decompressed size: i32
...followed by the data, 0-padded to multiples of 32 bytes. If the decompressed size does not equal the size, it is zlib-compressed and can be decompressed by feeding it to zlib's deflate(), or through the zpipe utility I linked to above. There seems to be no CCF unpackers on the net yet, so I just pulled the bits out by hand.

The files are:
FantasyZone1_JUE_02. [filename cut off] - ROM
Opera.arc - I guess a mini Opera for reading the manual
config - says country="eu"\nromfile="FantasyZone1_JUE_02.SMS"
home.csv - a bunch of tab-separated Unicode strings for the Home menu, interestingly there's Chinese and Korean in there
man.arc - U8 archive of the manual
misc.ccf - looks like graphics data mostly, maybe the save icon
patch - I posted it in the first post
  View user's profile Send private message Visit poster's website
  • Joined: 23 Feb 2007
  • Posts: 18
Reply with quote
Post Posted: Mon May 05, 2008 2:24 pm
interesting, I didn't read anything about that anywhere else (even on wiibrew)
thanks maxim

PS: I'm sure the SMSPlus port is better than the official emulator used in VC titles...;)
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Mon May 05, 2008 2:39 pm
I posted the details to Wiibrew just now. Let the piracy commence... and may Ni****do blacklist your MAC if you do it.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 295
  • Location: Pangea
Reply with quote
Post Posted: Tue May 13, 2008 11:28 pm
Martin wrote
Funny how they call the German pages noe instead of deu or ger :)


Yeah, I noticed that when cleaning my German PAL Super NES. Anyone got a clue on what it means ?

- "Nazis on Extacy" would be my guess. =P
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8644
  • Location: Paris, France
Reply with quote
Post Posted: Wed May 14, 2008 5:17 am
It means Ni****do of Europe.
As opposed to Ni****do of America and Ni****do of Japan.
They have their european headquarter in germany.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 295
  • Location: Pangea
Reply with quote
Post Posted: Wed May 14, 2008 6:30 pm
D'oh!
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jan 2005
  • Posts: 77
Reply with quote
Post Posted: Thu May 15, 2008 8:09 pm
Hmmm, does opera open these manuals? Not sure if I've ever seen a .arc file, so I dunno.

-Rob
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu May 15, 2008 8:11 pm
ARC is a Ni****do archive format. It's used on the GC and DS among other places.

This thread is getting very off-topic.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Sun Aug 17, 2008 10:47 am
Last edited by Maxim on Mon Aug 18, 2008 8:20 am; edited 4 times in total
NTSC and PAL Wonder Boy: both contain known Wonder Boy ROM as WonderBoy1_JUE.SMS, no patches.
NTSC Sonic: contains known Sonic 1 ROM as Sonic1_UE.SMS, no patches.

Anyone who can help getting access to the data of Sega 8-bit VC titles, please contact me.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Jul 2007
  • Posts: 716
  • Location: Melbourne, Australia
Reply with quote
Post Posted: Sun Aug 17, 2008 12:50 pm
Don't mean to throw this further off topic, but is that to mean they are using existing ROM dumps? Or have they simply followed the same naming structure?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Sun Aug 17, 2008 1:13 pm
It means their ROM images match the cartridges we've dumped.
  View user's profile Send private message Visit poster's website
  • Joined: 23 Feb 2007
  • Posts: 18
Reply with quote
Post Posted: Tue Aug 19, 2008 7:47 am
Maxim, check here, someone is building a CCF tool to extract roms from VC titles

http://gbatemp.net/index.php?showtopic=100556


to dump VC titles from your Wii internal meory, you could use this application:

http://wiibrew.org/wiki/Homebrew_apps/fs_browser
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Tue Aug 19, 2008 8:24 am
I'm glad someone's finally made a CCF tool (no doubt based on my documentation), although it takes all of 30 seconds to do it by hand. I'm already aware of how to dump the titles, I just don't want to pay for all of them (and besides, I can't access other regions). I only want to dump them for historical reasons, to see what, if anything, is changed.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Alex Kidd in Miracle World (US)
Post Posted: Sat Sep 06, 2008 5:28 pm
= Alex Kidd in Miracle World [v0] (US)
The config seems to be mapping the buttons in the more "usual" way (the original has punch, jump "backwards").
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Sun Sep 07, 2008 5:44 am
Riceball or Hamburger?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Sun Sep 07, 2008 8:34 am
Rice ball. They even warn about it in the Wii shop description.
  View user's profile Send private message Visit poster's website
lCEknight
  • Guest
Reply with quote
Post Posted: Thu Sep 11, 2008 10:09 pm
Maxim wrote
Dammit, I thought I'd ruled that out...

A suitable decompressor is here:

zlib.net/zpipe.c

The ROM is a pure clean dump. I now (probably) know enough to inject any ROM into an SMS VC game, as has been done with other systems already, but I'm not planning to try it because it'd be easy for Ni****do to ban my console.

Is there anyone who'd like to help verify the same holds for Wonder Boy, or any other non-European releases? You'll need an SD card with lots of space and a copy of Z***a.
I can verify Wonder Boy, but I'd need an executable of that decompressor.

I can't work with .C files over here.
 
  • Joined: 03 Apr 2001
  • Posts: 601
  • Location: Asturias
Reply with quote
Post Posted: Thu Sep 11, 2008 10:13 pm
Oops, sorry for that previous post, I couldn't read the newer messages for some reason.

I just got that CCF tool program and it works wonders.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Fantasy Zone (US)
Post Posted: Fri Dec 12, 2008 1:36 pm
is identical to the EU version, see above.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Space Harrier (US)
Post Posted: Fri Dec 12, 2008 1:46 pm
ROM filename is "SpaceHarrier_JU.SMS" which is known to us as
SMS beddf80e 0AEA3665ABDB3AB1 Space Harrier [50-60 Hz]/COUNTRY=JP,US/PRODUCT_NO=G-1310,7080
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
SMS Virtual Console games
Post Posted: Wed Nov 25, 2015 4:14 pm
I have a full collection of SMS Virtual Consol title for Wii... is there a list of dumped ones ? I can extract the missing if needed !
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Wed Nov 25, 2015 4:33 pm
Whatever's in this thread is what we have. It'd be good to confirm the regional versions too.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Wed Nov 25, 2015 6:04 pm
Maxim wrote
Whatever's in this thread is what we have. It'd be good to confirm the regional versions too.


Just extracted all my PAL collection (full .ccf extraction included): sendspace . com / file / 34howk
(add w w w at the beginning, remove spaces)

I don't remember if Wonderboy is pal or not.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Wed Nov 25, 2015 10:24 pm
Do you have the Japanese and US ones? Your Wonder Boy is the EU version.

The patches are the most interesting to me, many are commented in Japanese, most seem to be removing flashing but also removing red crosses on hospitals - any guesses why?

I'd like to publish the details with IPS patches and screens hots. I also want to confirm the ROM checksums when I get a chance :)
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 12:48 am
Last edited by asper on Thu Nov 26, 2015 12:50 am; edited 1 time in total
Maxim wrote
Do you have the Japanese and US ones? Your Wonder Boy is the EU version.

The patches are the most interesting to me, many are commented in Japanese, most seem to be removing flashing but also removing red crosses on hospitals - any guesses why?

I'd like to publish the details with IPS patches and screens hots. I also want to confirm the ROM checksums when I get a chance :)


The rom JUE are Japanese-USA-EUR version I suppose. Anyway those are my only titles. Hokuto no ken was released in Japan only.
Titles (wads) can be eur/ntsc-u/ntsc-j but the rom inside can be multi-region i suppose.

Games seems to be working correctly with dolphin emulator.
  View user's profile Send private message
  • Joined: 16 Jul 2006
  • Posts: 24
  • Location: Somewhere out in Germany
Reply with quote
Post Posted: Thu Nov 26, 2015 12:50 am
I heard that a few years ago the red cross skoke out against the use of their symbol on medipacks and stuff due to them occuring mostly in shooters. I think this started also the trend of things like regenerating health in shooters. Could be that it's related this
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 12:52 am
DerZocker wrote
I heard that a few years ago the red cross skoke out against the use of their symbol on medipacks and stuff due to them occuring mostly in shooters. I think this started also the trend of things like regenerating health in shooters. Could be that it's related this


I agree: https://en.wikipedia.org/wiki/List_of_regionally_censored_video_games
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 6:46 am
It seems Ni****do has been editing out Christian crosses and red crosses for export releases since the 80s, long before the Red Cross started criticising video games. It isn't helped by the many Japanese games where the church is a magic/healing/resurrection location.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 9:10 am
Maxim wrote
Do you have the Japanese and US ones? Your Wonder Boy is the EU version.

The patches are the most interesting to me, many are commented in Japanese, most seem to be removing flashing but also removing red crosses on hospitals - any guesses why?

I'd like to publish the details with IPS patches and screens hots. I also want to confirm the ROM checksums when I get a chance :)


Luckly enough I had another folder with all NTSC-U SMS Titles !
I was correct: JUE stands for JAP-USA-EUR.
All the games are identical except for space harrier: https://www.sendspace.com/file/py5q6n

Did you analyzed the roms in the previous pack ? Are them new or already known dumps ?
  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 9:16 am
Anyway here it is the full extracted NTSC-U data package: https://www.sendspace.com/file/vquwdm
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 10:34 am
I didn't get a chance yet, it's a simple task to run SMS Checker over them (or a competing product) but I can't easily do that on my phone. Sega (or Ni****do?) seem to have used clean dumps with a patching system rather than patching binaries, but I'm still interested to see if there are unreleased bug fixes they used (since in the mask ROM days, minor bug fixes would only get released if they sold out the last batch). There's something in there about variants of Sonic 2 but I suspect it's the bug fix we already know about. Paul Baker will turn up sooner or later to confirm :)
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 10:59 am
Maxim wrote
I didn't get a chance yet, it's a simple task to run SMS Checker over them (or a competing product) but I can't easily do that on my phone. Sega (or Ni****do?) seem to have used clean dumps with a patching system rather than patching binaries, but I'm still interested to see if there are unreleased bug fixes they used (since in the mask ROM days, minor bug fixes would only get released if they sold out the last batch). There's something in there about variants of Sonic 2 but I suspect it's the bug fix we already know about. Paul Baker will turn up sooner or later to confirm :)


I forgot about sms checker ;)
Here it is the scan:


So i think they are not "new" dumps, correct ?
oUB1zZE.png (24.19 KB)
oUB1zZE.png

  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 5:30 pm
Indeed, they are not. A bit odd that they used v0 of AKMW when v1 had a bug fix - see http://www.smspower.org/Development/AlexKiddInMiracleWorld-SMS - and they didn't patch it either. But then again, it's a minor cosmetic bug.

It's good to see that they didn't have GoodSMS-named ROMs - do they match anything else? My suspicion is that they obtained the ROMs from the internet rather than Sega's archives.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8644
  • Location: Paris, France
Reply with quote
Post Posted: Thu Nov 26, 2015 7:47 pm
Most are much GoodSMS names renamed to remove spacing and special characters (presumably because the Wii file system may not support them).
HOKUTO-B.sms and scommndo.sms are very early internet names, the first one in particular is how I named the Japanese dump when we first had it: http://www.smspower.org/db/hokuto-b.shtml
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 8:21 pm
Good catch :)
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 9:24 pm
Page added here:

http://www.smspower.org/Development/NintendoWiiVirtualConsoleTitles

I didn't make IPS patches (or even test the effect of the patches) for all the games - this already took several hours. (I assumed the comments were telling the truth to describe the patch effects - the data seems to match the comments.) If someone else wants to do that, and get more screenshots, please contribute them in this thread.

I'd like to confirm the remaining Japanese titles - I suspect they are the same as the US ones.

Probably the most impressive part is how they made some fairly minimal patches to the data to edit the graphics - when the data itself is compressed. The edited bytes may just be in non-RLE runs, but it's still pretty difficult to do.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Thu Nov 26, 2015 10:54 pm
Maxim wrote
I'd like to confirm the remaining Japanese titles - I suspect they are the same as the US ones.


Unfortunately seems that no one ever dumped the jap titles.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14682
  • Location: London
Reply with quote
Post Posted: Thu Nov 26, 2015 11:27 pm
I found some disreputable sites with some of them in a short Google search... I suspect there will be local versions of the Monster World and Phantasy Star games, maybe also the full version of Enduro Racer. I doubt there's anything too exciting to find, but it would be good to finish the job.

(The 3DS virtual console comes next, I have no idea if those are even dumped. There are probably other modern and older consoles with emulators which haven't been hacked apart yet as well.)
  View user's profile Send private message Visit poster's website
  • Joined: 14 Oct 2008
  • Posts: 508
Reply with quote
Post Posted: Fri Nov 27, 2015 1:23 am
I don't think SMS games were even released on 3DS VC anywhere?
(with the only Sega games being the arcade and Genesis 3D Classics upgrades, using a custom emulator)
I'd have to check again, maybe Fantasy Zone II, or was that made using the "arcade" version Sega made for the PS2 FZ collection? FZ2 Deluxe, I think they called that port?
  View user's profile Send private message
  • Joined: 08 Apr 2014
  • Posts: 34
Reply with quote
Post Posted: Fri Nov 27, 2015 7:59 am
No SMS titles, but 22 Game Gear games are available on the 3DS Virtual Console (16 in EU/US), mainly things like the Sonic games, GG Shinobi and Columns.
  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Fri Nov 27, 2015 4:00 pm
Maxim wrote
I found some disreputable sites with some of them in a short Google search... I suspect there will be local versions of the Monster World and Phantasy Star games, maybe also the full version of Enduro Racer. I doubt there's anything too exciting to find, but it would be good to finish the job.


I was not able to find those jap files, if you want pm me (many sites have very very old non working mediafire links).
  View user's profile Send private message
Reply to topic Goto page 1, 2, 3  Next



Back to the top of this page

Back to SMS Power!