Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Sega 8-bit winter of dumps Part 2: 4 PAK All Action

Reply to topic Goto page 1, 2  Next
Author Message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Sega 8-bit winter of dumps Part 2: 4 PAK All Action
Post Posted: Fri Jan 20, 2012 12:51 am
Last edited by Bock on Fri Jan 20, 2012 1:05 am; edited 1 time in total
We're back with a long, long awaited dump.



4 PAK All Action for the Master System, published in small quantities in Australia by HES in 1995. This 8 megabit multi-game cartridges contains 4 original Korean games developed for the Master System by Open. Some of them were previously known, but the versions in 4 PAK All Action were localized for an English-speaking audience and bear different names.

Let's have a look at our four games..



Adventure Kid ! A clear unlicensed clone of later Adventure Island games (iterations of Wonder Boy) using a legacy SG-1000 video mode (not smooth scrolling alas, but the game plays relatively well).



Power Block ! Previously known as Suho Jeonsa (수호전사), this is its English localisation.



Twin Mouse ! An original platformer.



Cave Dude ! Previously known as Toto World 3 (토토 월드3), also an English localization of the game.

We hope you'll be having fun trying those odd Korean-developed games released in Australia. Please note that the 4 PAK All Action cartridge relies on unusual mapper hardware and is only supported by a few emulators so far (MEKA and MESS). Go on and talk to your favorite emulator author to get it supported in other emulators!
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Temporary Transitional Attachment Fairy
Post Posted: Fri Jan 20, 2012 12:52 am
This message will auto destruct itself someday.

  View user's profile Send private message Visit poster's website
  • Joined: 16 Dec 2004
  • Posts: 473
  • Location: El Cerrito, CA
Reply with quote
Post Posted: Fri Jan 20, 2012 12:59 am
I thought this dump would never arrive!

By the way, I think Adventure Kid is actually a clone of Adventure Island 2 or 3. The dinosaur riding gives it away.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Fri Jan 20, 2012 6:20 am
Hmm, can't seem to get this working on Meka 0.73 or 0.80. It goes to the game selection screen and resets once you have selected a game.

Edit: My version of Meka was a tad out of date, got it working now
  View user's profile Send private message Visit poster's website
  • Joined: 24 May 2010
  • Posts: 119
  • Location: New York
Reply with quote
Post Posted: Fri Jan 20, 2012 6:53 am
Yay! Not that I have an emulator that can play it yet (stuck on PPC here), but still: yay!
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 12981
  • Location: London
Reply with quote
Post Posted: Fri Jan 20, 2012 8:04 am
Is the mapper documented anywhere?
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2011
  • Posts: 236
  • Location: Netherlands
Reply with quote
Post Posted: Fri Jan 20, 2012 8:04 am
Wow! That Adventure Kid is pretty decent.

Hope to find the MSX versions some time....
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Fri Jan 20, 2012 9:54 am
Last edited by Bock on Sat Jan 21, 2012 10:00 pm; edited 1 time in total
The mapper as I reverse engineered it is:

Write xx to 3FFE: map bank (xx)&maxbankmask to memory slot in 0000-3FFF region
Write yy to 7FFF: map bank (yy)&maxbankmask to memory slot in 4000-7FFF region
Write zz to BFFF: map bank ((xx&0x30)+(zz))&maxbankmask to memory slot in 8000-BFFF region

*EDIT* there was a typo above before

The code is on MEKA svn, file mapper.c grep for Write_Mapper_SMS_4PakAllAction
  View user's profile Send private message Visit poster's website
  • Joined: 18 Dec 2009
  • Posts: 113
  • Location: Norway
Reply with quote
Post Posted: Fri Jan 20, 2012 10:09 am
Nice! You've been trying to dump this for years, haven't you? What made the breakthrough possible?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Fri Jan 20, 2012 11:18 am
tommy1983 wrote
Nice! You've been trying to dump this for years, haven't you? What made the breakthrough possible?

Nothing particular, I've been processing a long queue of unusual cartridges and in the last 3 years didn't have access to that one in particular. Last time I tried to dump this was probably 6-7 years ago and then it would fail reading stable data with my SMS Reader.
  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Fri Jan 20, 2012 11:22 am
and, to be precise, the dump works in MESS by using either the Japanese SMS driver (smsj) or the Korean one (sms2kr)
  View user's profile Send private message
  • Joined: 27 Oct 2009
  • Posts: 138
Reply with quote
Post Posted: Fri Jan 20, 2012 12:30 pm
In RetroCopy with the BIOS enabled this game isn't detected in the cartridge slot.

This dump doesn't look "valid" to me. A lot of FF filling cart space and the inability for this game to function on a real system due to lack of checksum and TMR SEGA text? If the game was released in the Australian region I would think it would need to comply with the local SMS and its BIOS? :)
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Fri Jan 20, 2012 12:54 pm
There could be an issue with the header, I will look into that this week-end.

As for the ROM chip being 1 MB i assume there's lot of unused space though.
  View user's profile Send private message Visit poster's website
  • Joined: 27 Oct 2009
  • Posts: 138
Reply with quote
Post Posted: Fri Jan 20, 2012 1:20 pm
I just thought a bit of the data looked "too repeated" but who knows. :)

Thanks for the dump bock, interesting cartridge to dump and have in a collection now.
  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Fri Jan 20, 2012 2:31 pm
is the header checked by the Korean BIOS? I never investigated exactly which routines are active in which BIOS (judge had made them all work long before I started fiddling with SMS ;)...), but the dump definitely work with the Samsung BIOS so either the check is not enabled or the header is not so corrupted.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 12981
  • Location: London
Reply with quote
Post Posted: Fri Jan 20, 2012 8:16 pm
Japanese and Korean systems don't check the header.
  View user's profile Send private message Visit poster's website
  • Joined: 27 Oct 2009
  • Posts: 138
Reply with quote
Post Posted: Sat Jan 21, 2012 11:59 am
etabeta wrote
is the header checked by the Korean BIOS? I never investigated exactly which routines are active in which BIOS (judge had made them all work long before I started fiddling with SMS ;)...), but the dump definitely work with the Samsung BIOS so either the check is not enabled or the header is not so corrupted.


Just to follow up on Maxim's post, this game was apparently only released in the Australian market and all its machines had a BIOS which checked the header.

I guess the bigger question is if the header isn't dumped correctly what else is missing? Can't really be sure until Bock does some investigation I guess.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sat Jan 21, 2012 10:24 pm
I don't have the exact details off-hand but I recall that 4 PAK All Action doesn't work on all types of SMS1/SMS2 consoles.

I am toying with the cartridge now and cannot find a TMR SEGA so far so I will keep trying things.

Page 1 to 15 are basically empty they contains:

Page+0000 : XOR A
Page+0001 : LD (3FFE), A
Which reset the mapper. Presumably because the mapper has no stable reset mechanism? After the paging is completion following instruction would execute the normal code in Page 0.

# smspage "4 PAK All Action (AU).sms"
[4 PAK All Action (AU).sms]
Size: 1048576 bytes (64 pages), CRC:A67F2A5C
 0 ; af 32 fe 3f c3 72 00 ff ff ff ff ff ff ff ff ff ; Sum:229CB4, CRC:6561A682
 1 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 2 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 3 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 4 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 5 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 6 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 7 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 8 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 9 ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 A ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 B ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 C ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 D ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 E ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
 F ; af 32 fe 3f ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:3FBA14, CRC:FCEA8F7F
  Same pages: 01-0F
  Similar to pages: 3C (9327/16384), 3E (9756/16384)
10 ; 41 42 09 40 f3 ed 56 18 63 c3 1b 40 c3 ce 41 c3 ; Sum:18C257, CRC:43068B3B  ; Game A
11 ; 00 00 00 01 03 07 07 0f 1b 39 38 3c 3c 1c 00 00 ; Sum:195772, CRC:7D30ABD4
12 ; 80 00 80 00 80 00 f8 00 0a ff f8 e0 c0 80 ff c0 ; Sum:1EED11, CRC:56F6EEFC
13 ; 80 00 80 00 80 00 f8 00 be ff 4c f0 fd fe fe ff ; Sum:1B032B, CRC:8C15F0C3
14 ; a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a0 a4 a8 ac a0 a0 ; Sum:1E0A8C, CRC:6F31EB66
15 ; ac 58 a4 58 58 58 58 a4 58 58 a0 88 88 88 88 88 ; Sum:1A1834, CRC:BFB88288
16 ; a0 a0 a0 a0 a0 a0 a0 a4 ac a0 a0 a0 a0 a0 a0 a0 ; Sum:1E3067, CRC:6741DC4B
17 ; b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 b4 ; Sum:15161E, CRC:ED13DC5F
18 ; f3 ed 56 31 f0 df c3 0c 0e 00 00 00 00 00 00 00 ; Sum:1811BF, CRC:7D2E4F65  ; Game B
19 ; dd 35 0a dd 7e 0a a7 c0 21 5a 40 11 3c 40 cd 5f ; Sum:0D47AB, CRC:731DDDED
1A ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:13C5F4, CRC:40F92211
1B ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:109E68, CRC:EE2D85BF
1C ; 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 ; Sum:187350, CRC:083535C2
  Similar to pages: 3D (9766/16384)
1D ; 00 00 00 00 00 00 00 00 00 00 00 61 00 00 00 00 ; Sum:1EE4D3, CRC:F33CA68E
1E ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:1072AA, CRC:BBDA3E8D
1F ; ff ff 1e 8a 00 8a 3b 8a 5f 8a 30 8a 4c 8a d1 8a ; Sum:2AFB1E, CRC:D85F01DC
20 ; f3 ed 56 31 f0 df c3 de 2c 00 00 00 00 00 00 00 ; Sum:1AF1F1, CRC:0C7FD6F5  ; Game C
21 ; 05 c5 ed 5f fe 90 d2 57 40 47 21 10 c2 5f 16 00 ; Sum:1410B9, CRC:9B6F162D
22 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:1CB2DA, CRC:026F58ED
23 ; ff 7f 00 ff ff 7f 00 ff ff ff ff ff ff f7 11 f7 ; Sum:1E65DB, CRC:2E961608
24 ; 07 f8 fc 00 cf f0 3c 00 7f f0 88 00 3f c0 f0 00 ; Sum:1FA39D, CRC:41F250B9
25 ; ff 00 00 ff ff 00 00 ff ff 00 00 c3 c3 3c 00 81 ; Sum:1F8881, CRC:A9B67EB1
26 ; bb 1b bf 07 47 47 84 03 7b 78 43 80 bc bc 44 83 ; Sum:1B2654, CRC:499541F3
27 ; e0 00 1f 07 07 07 ff 00 00 00 ff 00 00 00 ff 00 ; Sum:167A44, CRC:0F416B13
28 ; 00 07 07 07 06 fb bb fb 83 1b 1b 1b 11 7b 3b 7b ; Sum:1F23CB, CRC:35669A46
29 ; ff ff ff ff ff fc ff f5 f5 ff f5 eb eb ff eb 84 ; Sum:1AD5D0, CRC:5058FA99
2A ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:11BE54, CRC:847BE9DA
2B ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:138B4B, CRC:779208CA
2C ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:14E29A, CRC:6DA125F9
2D ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:12881C, CRC:DB987915
2E ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:15BB3D, CRC:E8E01057
2F ; 01 00 00 00 07 00 00 00 0f 00 00 00 1f 00 00 00 ; Sum:0FCC37, CRC:D3380A02
30 ; f3 ed 56 31 f0 df cd 1c 19 cd 0f 19 21 00 c0 11 ; Sum:17AAA0, CRC:92F99FA3  ; Game D
31 ; f5 fe 4c d4 6e 40 f1 d6 4a 87 87 87 87 21 74 24 ; Sum:18213F, CRC:596BF1F4
32 ; 00 00 00 00 07 00 00 00 19 01 06 00 27 07 18 00 ; Sum:0F7C5B, CRC:BEBAD88E
33 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:11C0EC, CRC:654D104A
34 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:17CF4C, CRC:F747E754
35 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:1903FD, CRC:45650076
36 ; 9a 00 01 13 89 10 01 14 90 00 01 11 82 10 01 12 ; Sum:19B01B, CRC:B30B23A4
37 ; ff 21 b1 21 ff 22 b1 22 89 00 84 06 83 00 84 06 ; Sum:17D353, CRC:043DDF59
38 ; 00 00 00 00 00 00 00 00 7e 00 00 00 c3 3c 00 00 ; Sum:0E0873, CRC:25473AE8
39 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:1395DB, CRC:BFCBD851
  Similar to pages: 3A (8895/16384)
3A ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:1569F6, CRC:585FC45C
  Similar to pages: 39 (8895/16384)
3B ; 00 3c 3c 3c 3c 7e 42 7e 7c ff 93 ff 7e ff b9 ff ; Sum:16F557, CRC:500F78DC
3C ; ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ; Sum:2994DF, CRC:311B2D9A
  Similar to pages: 01 (9327/16384), 02 (9327/16384), 03 (9327/16384), 04 (9327/16384), 05 (9327/163
84), 06 (9327/16384), 07 (9327/16384), 08 (9327/16384), 09 (9327/16384), 0A (9327/16384), 0B (9327/1
6384), 0C (9327/16384), 0D (9327/16384), 0E (9327/16384), 0F (9327/16384)
3D ; 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 ; Sum:1EFBED, CRC:07DA37F9
  Similar to pages: 1C (9766/16384), 3E (9243/16384)
3E ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:2B184E, CRC:59C1F57F
  Similar to pages: 01 (9756/16384), 02 (9756/16384), 03 (9756/16384), 04 (9756/16384), 05 (9756/163
84), 06 (9756/16384), 07 (9756/16384), 08 (9756/16384), 09 (9756/16384), 0A (9756/16384), 0B (9756/1
6384), 0C (9756/16384), 0D (9756/16384), 0E (9756/16384), 0F (9756/16384), 3D (9243/16384)
3F ; 85 6f d0 24 c9 f5 e5 d5 c5 e6 0f 87 21 20 80 cd ; Sum:23714D, CRC:CC22EDFD
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sat Jan 21, 2012 10:36 pm
Googling for it seems to suggest that it only works with the Alex Kidd in Miracle World BIOS.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sat Jan 21, 2012 11:01 pm
Attached are pictures of the board. Consider the fact that the 'TMR SEGA' is a measure against unlicensed game releases because including that string in your cartridge would be infriguing Sega trademark somehow?
So, as much as I hate making up random theories with no explanation, do you think there could be a way the cartridge could hijack ROM/RAM code in some way?

Chipsets left to rigjt:

GS 9436
GD74LS74A

GS 9441
GD74LS138

AL (vertically)
P9348
GAL20V8-25LNC

GoldStar
GD74LS670
9314 KOREA

DIS-SG4-1 (rom chip)

  View user's profile Send private message Visit poster's website
  • Joined: 27 Oct 2009
  • Posts: 138
Reply with quote
Post Posted: Sun Jan 22, 2012 1:39 am
I already had been thinking about a "hijack" system. How did you dump the game? Was it from inside the SMS or just pulling it off the ROMs?

If it's inside the SMS you should be getting the TMR SEGA bit when you read it, otherwise the BIOS would also fail it?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 1:47 am
I confirmed the above dump on SMS Reader reading from 0000-3FFF region using register 3FFE and reading from 8000-BFFF region using register BFFF as well.

Reading from the 4000-7FFF region using register 7FFF would always return me Page 1 (Sum:3FBA14, CRC:FCEA8F7F) for any value >= 1 for some reason, so unless I made a mistake or missed on some of mapper behavior.

Connected to a JSMS and reading 0000-7FFF directly without writing to any mapper would return me Page 1 (Sum:3FBA14, CRC:FCEA8F7F) in both 16kb slots. This is what the BIOS would see I imagine.

I'll investigate more later but maybe you guys can get additional information from the board pictures.?
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jun 2010
  • Posts: 200
  • Location: Earth Planet
Reply with quote
Post Posted: Sun Jan 22, 2012 2:25 am
The ROMs is like a Multi-Cart with a Menu, but with a lot unused data that is not acessible...
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 2:28 am
Sonic of 8! wrote
The ROMs is like a Multi-Cart with a Menu, but with a lot unused data that is not acessible...

I don't understand what you are saying here.
  View user's profile Send private message Visit poster's website
  • Joined: 21 Jun 2010
  • Posts: 200
  • Location: Earth Planet
Reply with quote
Post Posted: Sun Jan 22, 2012 2:50 am
I mean this liking a FC multi-cart without a game, and only menu. This is the first time that occured with SMS...
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 12981
  • Location: London
Reply with quote
Post Posted: Sun Jan 22, 2012 11:42 am
One thing that might be possible: the cart could take over the bus and nobble the BIOS checks in RAM - maybe just writing a jump, thereby never including the TMR SEGA string, but it would be very specific to the BIOS revisions it would work with. Maybe it could do this with a timer or based on some detection of the CPU accesses to the cart?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 4:44 pm
Last edited by Bock on Sun Jan 22, 2012 5:23 pm; edited 1 time in total
Testing the cartridge on different consoles:

SMS1 1.3 BIOS : Software Error
SMS1 Hang On : Works
SMS1 Hang On & Safari Hunt BIOS : Works
SMS1 Missile Defense 3-D : Missile Defense runs (no software error)
SMS2 Alex Kidd : Works
SMS2 Sonic The Hedgehog : Software Error
  View user's profile Send private message Visit poster's website
  • Joined: 12 Feb 2006
  • Posts: 194
  • Location: Wales
Reply with quote
Post Posted: Sun Jan 22, 2012 4:51 pm
Bock wrote
Testing the cartridge on different consoles:

SMS1 1.3 BIOS : Software Error
SMS1 Hang On : Works
SMS1 Hang On & Safari Hunt BIOS : Works
SMS1 Missile Defense 3-D : Missile Defense runs (no software error)
SMS2 Alex Kidd : Works


Being an 8Megabit cart I wouldn't expect it to work on the earlier consoles, as with Street Fighter and a few other Tec Toy games. I'm surprised it worked on a Hang On only model, all the ones I've had refuse a 8meg cart.
  View user's profile Send private message Visit poster's website
  • Joined: 14 Oct 2008
  • Posts: 320
Reply with quote
Post Posted: Sun Jan 22, 2012 6:09 pm
Bock wrote
Attached are pictures of the board. Consider the fact that the 'TMR SEGA' is a measure against unlicensed game releases because including that string in your cartridge would be infriguing Sega trademark somehow?
So, as much as I hate making up random theories with no explanation, do you think there could be a way the cartridge could hijack ROM/RAM code in some way?


Must be that case in Australia, then. :)
I understand it right, Sega vs. Accolade said such a protection measure wouldn't hold in the US, decided like three years earlier (it ruled that trademark infringement was allowed if it was the only means of access to hardware in order to release legal unlicensed software, nullifying the Genesis equivalent of TMR SEGA).
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 6:28 pm
If I was developping an unlicensed cartridge and I found a way to bypass using the official "unlocking" scheme then I would do it anyway.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Sun Jan 22, 2012 6:32 pm
It also works on the SMS1 with Alex Kidd bios, which I am assuming is the same as the SMS2 Alex Kidd (still surprised me when I got that SMS1 and Alex Kidd was on it!)

It is interesting to compare the palette differences between the game viewed on real hardware and on the emulator. On real hardware it is much darker, check out the little guy standing on the map!



  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 6:35 pm
The Mark III and SMS have a darker palette than a SG-1000/SG-1000 II/SC-3000 when playing legacy video mode.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Sun Jan 22, 2012 6:43 pm
Well it is good to see it closer to the way it was originally intended (^_^)

Check out the sky color in the first shot, it is cyan on real hardware and sky blue on the emulator.

I wonder if it would be possible to rip out the Adventure Kid code and get it working on an MSX emulator?

Edit: Looks like your dump of Wonsiin works on the MSX:

http://www.msxposse.com/site/forum/viewtopic.php?p=24327&sid=68b49b53fdd995b...

Of course this situation is more difficult because the game is on a multi-cart.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 12981
  • Location: London
Reply with quote
Post Posted: Sun Jan 22, 2012 8:41 pm
Bock wrote
Testing the cartridge on different consoles:

SMS1 1.3 BIOS : Software Error
SMS1 Hang On : Works
SMS1 Hang On & Safari Hunt BIOS : Works
SMS1 Missile Defense 3-D : Missile Defense runs (no software error)
SMS2 Alex Kidd : Works
SMS2 Sonic The Hedgehog : Software Error

Can you give the Missile Defense one another try? It's odd that it'd fail there but not elsewhere, as its BIOS routines are basically identical to the AKMW BIOS. SOFTWARE ERROR only appears if the TMR SEGA is found, so that's working (or, at least, passing) on all systems but the difference is with either the checksum or region code. If the game was able to alter the BIOS code then it'd make sense to skip the whole lot rather than individually altering the various checks, so I think my earlier idea is unlikely to be the case.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 22, 2012 11:35 pm
LogBomber: as Adventure Kid was likely intented for MSX1 system first its intended color are more like those you would see on most emulators.
However it is true that emulators should give the choice to use the crappy SMS palette as an option.

If you extract 128 KB of data from after the first 256 KB you'll get a standalone Adventure Kid. The mapper code may requires hacking thought.

I'll try the Missile Defense 3-D BIOS again sorry.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Mon Jan 23, 2012 12:39 am
Last edited by Logbomber on Mon Jan 30, 2012 12:01 am; edited 1 time in total
Bock wrote
LogBomber: as Adventure Kid was likely intented for MSX1 ...

If you extract 128 KB of data from after the first 256 KB you'll get a standalone Adventure Kid. The mapper code may requires hacking though


Ok I have extracted the 128k game, and tested the attached .rom file on blueMSX and renamed it to .sg and tested it on Meka (which works with Wonsiin on either) and as you thought it doesn't work.

Any pointers on how to hack it to sort out the mapper?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Mon Jan 23, 2012 12:50 am
The fix is easy to do to run with a SMS emulator but I won't do it as it is wouldn't be useful. I don't know enough about available MSX1 mappers/hardware. Someone who knows can easily reverse engineer it using MEKA debugger. Or you can BlueMSX people if they want to support it.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Mon Jan 23, 2012 1:06 am
Forgive my ignorance, but are you saying the emulator has to be changed to run the rom, or the rom can be hacked to run in the emulator?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Mon Jan 23, 2012 1:10 am
Both ways are possible. Changing the emulator is more accurate. Changing the ROM possible if MSX1 has similar mappers as SMS ones which I think it does.
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2011
  • Posts: 236
  • Location: Netherlands
Reply with quote
Post Posted: Mon Jan 23, 2012 11:12 pm
The image seems to have a proper MSX header (starting with AB at 0x4000 when loaded in MSX emulator) and the right ports. But the mapper seems to be the problem.
  View user's profile Send private message
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Tue Jan 24, 2012 1:31 am
Thanks Zipper. If anyone is interested I have started a topic to see if any of the MSX guys will help, here:

http://www.msxposse.com/site/forum/viewtopic.php?t=1544
  View user's profile Send private message Visit poster's website
  • Joined: 27 Apr 2005
  • Posts: 420
  • Location: Australia
Reply with quote
Post Posted: Tue Jan 24, 2012 7:35 am
Been examining the board pics, here's some numbers written all over them to say what goes where. It's messy but it might save someone some work. Also tracing hidden areas, dunno. Maybe the GAL could be dumped for further investigation.
4pak_back.jpg (342.62 KB)
4 pak mapped back
4pak_back.jpg
4pak_front.jpg (329.19 KB)
4 pak mapped front
4pak_front.jpg

  View user's profile Send private message
  • Joined: 06 Apr 2011
  • Posts: 236
  • Location: Netherlands
Reply with quote
Post Posted: Tue Jan 24, 2012 1:02 pm
Logbomber wrote
Thanks Zipper. If anyone is interested I have started a topic to see if any of the MSX guys will help, here:

http://www.msxposse.com/site/forum/viewtopic.php?t=1544


I'll try to drop it on #msxdev at IRC too.
  View user's profile Send private message
  • Joined: 24 May 2010
  • Posts: 119
  • Location: New York
Reply with quote
Post Posted: Sat Jan 28, 2012 12:12 am
Forgive me if this is a redundant question based on other conversations already happening, but:

I know Adventure Kid won't run on a Genesis, but for the other three games, would it be possible to extract them so they could be run on a flashcart? If so, would there be some kind of relatively straightforward processing required to make it work (i.e. take everything from 0xQ to 0xR, and then XOR every fourth byte or something)?
  View user's profile Send private message
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Sat Jan 28, 2012 8:27 am
We managed to get Adventure Kid working on the MSX for anyone that is interested, just check the forum link a couple of posts back.

@goldenband: The Korean Toto World 3 (Cave Dude) and Suho Jeonsa (Power Block) roms are available, and they will probably work on the Genesis with a SMS converter. No doubt Twin Mouse would be a bit trickier, but Cave Dude and Power Block are the better SMS games on the cart anyway.
  View user's profile Send private message Visit poster's website
  • Joined: 08 Dec 2009
  • Posts: 115
Reply with quote
Post Posted: Sun Jan 29, 2012 1:02 am
Twin Mouse is kinda weird... it has the two different characters, but the boy seems to have no advantage at all, while the girl can glide downwards slowly from jumps.
  View user's profile Send private message
  • Joined: 24 May 2010
  • Posts: 119
  • Location: New York
Reply with quote
Post Posted: Sun Jan 29, 2012 5:55 am
Logbomber wrote
@goldenband: The Korean Toto World 3 (Cave Dude) and Suho Jeonsa (Power Block) roms are available, and they will probably work on the Genesis with a SMS converter.


Yeah, I'm pretty sure I've played one or both on my Everdrive, especially Toto World 3. Mainly I'd just like to play them in English, and also I was curious if Cave Dude's music is as completely messed up (obvious programming errors) as Toto World 3's is.
  View user's profile Send private message
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Sun Jan 29, 2012 9:41 am
Last edited by Logbomber on Sun Jan 29, 2012 12:02 pm; edited 3 times in total
Edit: Cave Dude removed.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8114
  • Location: Paris, France
Reply with quote
Post Posted: Sun Jan 29, 2012 11:42 am
The sound seems badly broken. If possible try to avoid posting a bunch of broken roms publicly to reduce confusion. Get it done and tested then post it would be my recommendation :)
  View user's profile Send private message Visit poster's website
  • Joined: 06 Apr 2009
  • Posts: 198
Reply with quote
Post Posted: Sun Jan 29, 2012 12:05 pm
Cave Dude was just an after thought, it was late and I didn't realize the sound was broken.
  View user's profile Send private message Visit poster's website
Reply to topic Goto page 1, 2  Next



Back to the top of this page

Back to SMS Power!