|
ForumsSega Master System / Mark III / Game GearSG-1000 / SC-3000 / SF-7000 / OMV |
Home - Forums - Games - Scans - Maps - Cheats - Credits Music - Videos - Development - Hacks - Translations - Homebrew |
Author | Message |
---|---|
|
Korean "128합" 128-in-1 Cartridge (likely pirate? missing original label)
Posted: Sun Mar 29, 2020 11:44 pm Last edited by bsittler on Mon Mar 30, 2020 3:31 pm; edited 1 time in total |
I recently bought a Korean "128합" 128-in-1 Cartridge missing its label and was curious about its contents. It appears to have a whole bunch of MSX and SG-1000 games (edit: just MSX, actually - the titles I thought were SG-1000 had first been converted to MSX!), possibly including a few Korean originals — though they may just be localizations where I am unfamiliar with the non-Korean work from which they derive. It works great in the Mega SG with an adapter.
Is this a known multicart? Does anyone have mapper documentation for it? I've attached a few images of the menus and the cartridge itself. I apologize in advance for the atrocious quality of the pictures! I was curious about how the multicart was constructed. Unfortunately my attempt to open the cartridge without damaging the shell failed, so I haven't seen the inside yet. If I were to dump the contents, would any emulator be able to run it? It appears to use some sort of paging system/memory mapper and possibly 8 kbyte pages — I tried writing sequences of consecutive integers to a whole bunch of addresses using the Tengu Game Gear dumper through a stack of adapters, and some of them are apparently control registers (haven't narrowed down which ones, yet) that caused reads to return successive 8 kbyte blocks of games I more or less recognized the code for — two pages of MSX Galaga, for instance, though this copy seems quite modified. The overall ROM seems like it might be 2 megabytes or so, but again I am not sure yet. Lots of the 8 kbyte blocks start with "A" "B", MSX-style. The actual number of games is much less than 128, there appear to be many repeats and/or unused slots in the later pages. I've tried running many of the games, and most seem to work fine though they have original author information removed. A few have some graphical corruption, though they remain playable. edit: the original listing, for the curious: https://www.ebay.com/itm/Samsung-Gamboy-Sega-Mark-III-128-in-1-Multi-Cart-Rare-K... — note that the seller still has a couple SG-1000 cartridges from Taiwan listed, Champion Ice Hockey https://www.ebay.com/itm/Champion-Ice-Hockey-R-061-Rare-Taiwan-Version-Sega-SG-1... and Chack 'n Pop https://www.ebay.com/itm/Chack-N-Pop-R-060-Rare-Taiwan-Version-Sega-SG-1000/2931... |
|
|
Posted: Mon Mar 30, 2020 4:02 am Last edited by bsittler on Mon Mar 30, 2020 3:55 pm; edited 21 times in total |
Starting to understand a little about the mapper in this, it is somehow vaguely similar to Codemasters but the blocks are smaller. A few screenshots from MSX-derived titles taken in mednafen, apologies for the disorganization and hasty manual cropping
edit: these were all captured using a different MSX BIOS replacement. I haven't yet figured out how to get the one(s?) in this cartridge to work edit 2: I attached too much, but some others I found in my dump include: Rally-X = kr128-4k-10-page03
Pac-Man = kr128-4k-10-page05 Pooyan = kr128-4k-10-page14 King's Valley = kr128-4k-10-page19 Circus Charlie = kr128-4k-10-page1B King & Balloon = kr128-4k-10-page2F Lode Runner = kr128-4k-10-page33 Hang-On = kr128-4k-10-page35 Zaxxon = kr128-4k-10-page37 Zanac A.I. = kr128-4k-10-page39 TwinBee = kr128-4k-10-page3B Star Force = kr128-4k-10-page3D Q*Bert (MSX version a.k.a. Q*Bert's Qubes) = kr128-4k-10-page3F Tank Battalion = kr128-4k-01-page03 Galaxian = kr128-4k-01-page06 Scramble Eggs = kr128-4k-01-page08 독수리/Dogsuri ("Eagle"?) = kr128-4k-01-page09 Bomber Man = kr128-4k-01-page0B Cannon Ball = kr128-4k-01-page0C Warp & Warp = kr128-4k-01-page1F Also found parts of several others, but they are broken likely due to being incompletely reconstructed during my dump inspection. Incomplete list of incomplete bits: Dig Dug, Mappy, Flicky, Adventure Island, Bosconian edit: A few of the Namco(t) games have other games interleaved with them (the originals used a sparse address layout). I have not yet successfully recovered either the of the interleaved games from any of these pages |
|
|
Posted: Mon Mar 30, 2020 5:06 am |
By the way, the 독수리/Dogsuri/Dogsuli ("Eagle"?) here is not Eagles 5. I've attached a screenshot in the hopes that someone recognizes this game
|
|
|
Posted: Mon Mar 30, 2020 5:31 am Last edited by bsittler on Mon Apr 13, 2020 5:34 am; edited 18 times in total |
Removed the MSX BIOS replacement I had been inserting and now the first 6 pages of the menu are visible [kr128-4k-10-page0F rom]
edit 2: all pages of the menu are visible using a different MSX BIOS replacement from the previous standalone Hi-Com Galaxian dump found elsewhere here at smspower edit: and here's my quick-and-dirty attempt to translate (really, more like transliterate in most cases) the names of the games on the menu screens; apologies, though — I don't know Korean so I may make mistakes! edit 3: page(?) numbers (values written to 0x6000 when switching to the game) are included here too; the menu itself is conveniently 0x00. Page numbers are not unique, sometimes multiple games share these: 0x00: 128 Total #1
0x7C: Spelunker 0x5C: Penguin Land [Penguin Land Adventure] 0x3C: Tennis 0x3E: Kung-Fu [Yie Ar Kung-Fu] 0x1C: Step UP 0x1D: Picture Puzzle 0x1C: Peetan 0x1D: Mr. Chin 0x78: Lode Runner 0x58: Kung Fu II [Yie Ar Kung-Fu 2] 0x38: Road Fighter 0x3A: Sky Jaguar 0x18: Rally-X 0x19: Tank Battalion 0x19: Pyramid Warp 0x74: Hang-On 128 Total #2 0x54: Demon Castle Legend [Majou Densetsu: Knightmare] 0x34: Pippols 0x36: Pooyan 0x14: Pac-Man 0x15: Heavy Boxing 0x15: Looping (?) [Jump Coaster; literally "루팡", instead I guess it might be intended to suggest a Lupin III game?] 0x70: Zaxxon 0x50: Goonies 0x30: Mopiranger 0x32: Fantasy Table Tennis [Konami's Ping Pong] 0x10: Mappy 0x11: Fruit Search 0x13: Galaxian 0x6C: Zanac 0x4C: Flicky 0x2C: King's Valley 128 Total #3 0x2E: Magical Tree [Or maybe "Magic/Witchcraft Tree"? It's the Konami's classic] 0x0C: Galaga 0x0D: Eagle [Literally "독수리"] 0x0F: Chick [Scramble Eggs; game screen says "EGG -> 병아리", i.e. "EGG -> Chick"] 0x68: TwinBee 0x48: Castle [I think it's The Castle] 0x28: Circus [Circus Charlie] 0x2A: Hyper Rally 0x08: Dig Dug 0x09: Bomber Man 0x0B: Dragon Attack 0x64: Star Force 0x44: Wonder Boy [Takahashi Meijin no Bouken Jima, a.k.a. Adventure Island] 0x24: Bread Factory [Comic Bakery] 0x26: Cabbage [Cabbage Patch Kids] 0x04: Bosconian 128 Total #4 0x60: Q*Bert [a.k.a. Q*Bert's Qubes on other platforms] 0x40: King Balloon [King & Balloon] 0x42: Sports II [Hyper Sports 2] 0x20: Trouble [Space Trouble] 0x21: Warp Warp [Warp & Warp] 0x22: Antarctic Expedition [Antarctic Adventure] 0x05: Buta Pants [Butamaru Pants, a.k.a. Pig Mock] 0x07: Cannon Ball 0x01: Clapton [Clapton II] 0x24: Bread Factory #2 [Comic Bakery] 0x04: Bosconian #2 0x04: " #3 0x04: " #4 0x04: " #5 0x28: Circus #2 [Circus Charlie] 0x28: " #3 128 Total #5 0x50: Goonies #2 0x50: " #3 0x50: " #4 0x50: " #5 0x3E: Kung-Fu #2 [Yie Ar Kung-Fu] 0x3E: " #3 0x26: Cabbage #2 [Cabbage Patch Kids] 0x26: " #3 0x18: Rally-X #2 0x18: " #3 0x18: " #4 0x18: " #5 0x10: Mappy #2 0x10: " #3 0x10: " #4 0x10: " #5 128 Total #6 0x58: Kung-Fu II #2 [Yie Ar Kung-Fu 2] 0x58: " #3 0x58: " #4 0x58: " #5 0x38: Road Fighter #2 0x38: " #3 0x38: " #4 0x38: " #5 0x6C: Zanac #2 0x6C: " #3 0x6C: " #4 0x6C: " #5 0x30: Mopiranger #2 0x30: " #3 0x30: " #4 0x30: " #5 128 Total #7 0x44: Wonder Boy #2 [Takahashi Meijin no Bouken Jima, a.k.a. Adventure Island] 0x44: " #3 0x44: " #4 0x44: " #5 0x2C: King's Valley #2 0x2C: " #3 0x2C: " #4 0x2C: " #5 0x54: Demon Castle Legend #2 [Majou Densetsu: Knightmare] 0x54: " #3 0x54: " #4 0x54: " #5 0x08: Dig Dug #2 0x08: " #3 0x08: " #4 0x08: " #5 128 Total #8 0x4C: Flicky #2 0x4C: " #3 0x4C: " #4 0x4C: " #5 0x4C: " #6 0x4C: " #7 0x4C: " #8 0x4C: " #9 0x78: Lode Runner #2 0x78: " #3 0x78: " #4 0x78: " #5 0x78: " #6 0x78: " #7 0x78: " #8 0x78: " #9 |
|
|
Posted: Mon Mar 30, 2020 8:43 am |
Nice work.
I was hesitating on purchasing this one, glad you got it. Nowadays Meka should be much easier to compile, thanks to help from Maxim with the build system, so you may be tempted to look into adding a custom mapper or I'd be happy to help. We could later look into comparing with existing dumps (most released, some not. Btw if you are interested in more stuff to analyze I've probably got 40+ dumps in the tricky "need analysis" queue). The two TW carts same seller is selling I have copies of and they are dumped. |
|
|
Posted: Mon Mar 30, 2020 3:44 pm |
Thanks! Any idea whether you dumped a cart with this menu before? I tried searching here for it and didn't see any mention, but there are a bunch of archival work threads and I easily could have missed this one. So far the standalone similar Korean MSX-to-SG 1000 transplants I've found your dumps of are each different in at least a few parts at the binary level from the versions in this cart. edit 2: Also, looking slightly deeper it seems some of the non-defacement modifications from known dumps are to make the games easier, e.g. by increasing the initial store of player lives edit: I believe I was wrong when I thought some of these were regular SG-1000 games — I now believe they are all MSX conversions. Flicky, Zaxxon, and a few others had me confused at first. :)
I appreciate the offer, I might take you up on it. I have Meka building from sources already on my Mac, and indeed it looks easy enough to modify. Also that debugger is quite handy! I'm going to attempt to dump this cartridge again a bit more systematically first, using information derived from running the Meka debugger (or possibly manual disassembly, should that look straightforward enough) on the menu now that I have isolated that section in the dump.
That sounds challenging but maybe if I can successfully analyze this one I'll be ready. Are your dumps in need of analysis made by physically extracting the ROMs and dumping them with a EPROM programmer, or by reading them through the cartridge connector? If you use an EPROM programmer can you recommend a setup?
Yeah, I suspected that from the photos so I passed on those, given the prices. I thought maybe one had a different label but it seems an official-enough release that the ROMs are unlikely to differ in any case and that's the part I was more interested in. |
|
|
Posted: Tue Mar 31, 2020 12:23 am |
It looks like it might have 57 distinct games plus some variations.
The menus are "translated"/transliterated at least roughly — apologies since I don't actually understand the language — see edits to earlier entries. |
|
|
Posted: Tue Mar 31, 2020 8:11 am |
> Any idea whether you dumped a cart with this menu before?
I gave a quick look at my files and I think I did not. I have dozens of partially dumped xx-in-1 (for both SMS and GG) waiting for disassembly and dumping but none that uses exactly this font AFAIK unless I missed one. |
|
|
Posted: Wed Apr 01, 2020 4:30 am |
Neat! FWIW the menu on this one seems to write a page number or something like that to port 0x6000 when jumping to the selected game. Still digging into how it's all laid out. edit: also I now believe the paging granularity is much larger than I first though it was — I believe initially I was fooled by data repetition inside pages edit 2: ignore that, please, looks like the earlier guess may have been right. will follow up again once i'm more certain |
|
|
Posted: Wed Apr 01, 2020 6:03 am |
MSX stuff tends to have 8KB paging slots. | |
|
Posted: Wed Apr 01, 2020 8:25 am |
I suggest using my tool SmsPage to quickly "visualize" data pattern and repetition.
https://www.smspower.org/Development/SMSPage C:\Users\Omar>smspage
SMS Page 0.24 - by Omar Cornut, 2019/05/10 http://www.smspower.org -- Syntax: smspage [options] romfiles... Available options: /4 /8 /16 /32 : Page size in kilobyte [default: 16] /sum : Print total ROM and half-rom sum Here's one offender in term of data repetition: [Blade Eagle 3-D [Proto].sms]
Size: 262144 bytes (16 pages), CRC:58D5FC48 0 ; f3 ed 56 31 f0 df c3 88 00 00 00 00 00 00 00 00 ; Sum:1877FE, CRC:76E64196 1 ; 80 0c 22 0b c4 09 34 08 a4 06 14 05 52 03 c2 01 ; Sum:0A89E8, CRC:89B22B63 2 ; d9 3a 00 d0 b7 08 21 0c d0 d9 21 09 d0 7e b7 28 ; Sum:195B34, CRC:E7C37522 Same pages: 02, 0D 3 ; 00 0f 3f 38 3a 20 03 2a 12 2f 0b 30 00 3e 18 05 ; Sum:2D11C1, CRC:FBE7134A 4 ; 01 01 02 01 01 00 00 00 00 00 00 06 00 00 00 00 ; Sum:03FDA8, CRC:B8AE1A4C 5 ; 01 02 01 01 00 00 00 00 00 00 06 00 00 00 00 00 ; Sum:0430B0, CRC:90966837 6 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:04ADF8, CRC:642B3272 7 ; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; Sum:04E798, CRC:A66E9BC7 8 ; 00 0f 3f 0b 3a 00 02 2a 01 35 10 30 20 03 18 24 ; Sum:191912, CRC:7BB705AC 9 ; 06 14 29 25 0c 1a 02 13 1b 0f 3f 00 08 01 2a 05 ; Sum:1B15AD, CRC:1547B86C Similar to pages: 0B (10285/16384) A ; 00 15 29 25 00 04 02 13 0b 0f 3f 07 06 01 2a 05 ; Sum:1CE03F, CRC:2D62B5F1 B ; 24 2a 15 00 30 3f 2b 34 02 13 3e 38 0a 2c 28 3c ; Sum:1956DB, CRC:008CFC7D Similar to pages: 09 (10285/16384) C ; 0b 00 81 08 0f 00 02 18 03 00 00 09 00 85 1c 3e ; Sum:1CDDFD, CRC:5D6438E9 D ; d9 3a 00 d0 b7 08 21 0c d0 d9 21 09 d0 7e b7 28 ; Sum:195B34, CRC:E7C37522 Same pages: 02, 0D E ; 0e 80 52 81 7a 80 ca 81 e6 80 66 82 d2 82 4a 83 ; Sum:10BB01, CRC:34CD2C06 Similar to pages: 0F (14634/16384) F ; 00 00 00 00 00 00 00 00 07 03 04 04 1d 06 19 19 ; Sum:0FD792, CRC:191B21F6 Similar to pages: 0E (14634/16384) 128kb part 1/2 (pages 00-07): Sum:07B32C3, CRC:40A620E0 128kb part 2/2 (pages 08-15): Sum:0C1319D, CRC:B073D5F9 256kb part 1/1 (pages 00-15): Sum:13C6460, CRC:58D5FC48 Sum for all pages: 13C6460 |
|
|
Posted: Wed Apr 01, 2020 3:05 pm |
That's really useful! Actually I had already done an equivalent thing myself by computing cryptographic hashes of each 8k block with a shell script, but next time I will hopefully remember to try this tool instead.
As for the dump itself, it seems like it has 1 megabyte of menu and game data followed by 1 megabyte of zeros, at least from the perspective of the console accessing it through the edge connector using the mapper. The games and menu don't seem to use the second megabyte. Given this, should the dump include or exclude the zeros? I'm still working to understand some of the mapper functionality, but I believe I have a "clean" dump now of the memory itself, with multiple identical reads of each memory page to confirm the data wasn't corrupted. How would you feel about including a dump of this cartridge here for preservation purposes? If you're interested, how might we go about that?
|
|
|
Posted: Wed Apr 01, 2020 3:30 pm |
Document somewhere the returned zeros (which are probably just a side-effect of the mapper/wiring rather than data stored) but don't include in the dump.
I'd suggest we get it emulated in Meka and maybe another emulator before releasing, what do you think? You can e-mail me the dump and we can look at it together. |
|
|
Posted: Thu Apr 02, 2020 2:00 am |
Sounds good! I hope to get back to this dump during the coming weekend, and I'll ensure it's somehow made available to emulator authors.
Disclaimer: the information below is unproven hypothesis! Take it with a grain of salt, please. At startup, the mapper paging register acts in a very nonintuitive manner — page numbers for multi-page games seem to count downward, and none of the page numbers match what the menu system uses to reach those games. It looks like the mapper may somehow scramble the order of the pages in the ROM, and the menu system first has to write the correct descrambling value to a different mapper register to achieve a logical linear page address layout. It looks like maybe the unscrambling value is XOR'ed with the page numbers. While this sort of thing is somewhat expected for Famicom/Famiclone pirate cart mappers as a feature to prevent cloning (since the clone's mapper hardware would need to support this special feature), I never expected to see it in a Gam*Boy cartridge! This leads to two questions: 1. This makes me more curious about what's actually inside this cartridge, electronically speaking. Do any of you have advice on how to nondestructively open a pirate Gam*Boy cartridge? This one seems to have some sort of locking tab or screw arrangement beneath the replacement label, but all the plastic is very brittle and I'm hoping to avoid destroying the shell. 2. If a dump of this ROM were to be made for archival purposes, and provided my current hypothesis about how it works turns out to be correct, should it be dumped in the power-on (scrambled) order, or the post-setup (unscrambled) order? I presume the first, but would be happy to hear your thoughts |
|
|
Posted: Thu Apr 02, 2020 7:17 am |
Pirate games are usually glop tops which means opening the cartridge yields very little information. | |
|
Posted: Thu Apr 02, 2020 8:55 am |
That. If I understand correctly it would work without requiring any extranous "data" stored to emulate the mapper, only code?
The old KR SMS ones are most likely to not use glop tops, it's generally GG ones that do. |
|
|
Posted: Sun Apr 05, 2020 9:18 pm |
This mapper is taking longer to reverse-engineer than I had hoped, in part due to other time commitments and in part due to somewhat unreliable reads from the cartridge using the Tengu Game Gear bus emulator/dumper, possibly in part because the Squirrel scripting engine sometimes runs too quickly for the dumper. In any case I am attempting to make repeated dumps with consistent returned data from an initial unpowered state each time.
As a temporary measure I will share my current best guess for both initial (scrambled) and post-setup (unscrambled) contents privately with emulator authors, but I hesitate to formally release the dump through until I'm confident it's accurate. In any case none of the games themselves are really new, these look to all be known MSX titles just with assorted defacement and SMS-adaptation patches, and with some oddness in how they are laid out in the ROM due to the mapper Edit: actually I will only share the scrambled version, since it's the one I have a little more confidence in |
|
|
Posted: Mon Apr 13, 2020 5:37 am |
Turns out the top-right entry on menu screen 4 is Clapton [Clapton II], not Krypton. Still learning my way around the MSX catalogue, but I have no excuse, really, since this one is written right there in the game | |
|
Posted: Mon Apr 13, 2020 3:51 pm |
Thanks to lots of help from other members of this forum, this mapper is now understood. The page mapper in this cartridge uses XOR internally, which leads to some strange page ordering when the starting page number is not a multiple of 4, leading to this layout: ("128 Total #1" indicates the menu)
0x00 0x01 0x02 0x03: 128 Total #1
0x01 0x00 0x03 0x02: Clapton [Clapton II] 0x04 0x05 0x06 0x07: Bosconian 0x05 0x04 0x07 0x06: Buta Pants [Butamaru Pants, a.k.a. Pig Mock] 0x07 0x06 0x05 0x04: Cannon Ball 0x08 0x09 0x0A 0x0B: Dig Dug 0x09 0x08 0x0B 0x0A: Bomber Man 0x0B 0x0A 0x09 0x08: Dragon Attack 0x0C 0x0D 0x0E 0x0F: Galaga 0x0D 0x0C 0x0F 0x0E: Eagle [Literally "독수리"] 0x0F 0x0E 0x0D 0x0C: Chick [Scramble Eggs; game screen says "EGG -> 병아리", i.e. "EGG -> Chick"] 0x10 0x11 0x12 0x13: Mappy 0x11 0x10 0x13 0x12: Fruit Search 0x13 0x12 0x11 0x10: Galaxian 0x14 0x15 0x16 0x17: Pac-Man 0x15 0x14 0x17 0x16: Heavy Boxing & Looping (?) [Jump Coaster; literally "루팡", instead I guess it might be intended to suggest a Lupin III game?] 0x18 0x19 0x1A 0x1B: Rally-X 0x19 0x18 0x1B 0x1A: Tank Battalion & Pyramid Warp 0x1C 0x1D 0x1E 0x1F: Step UP & Peetan 0x1D 0x1C 0x1F 0x1E: Picture Puzzle & Mr. Chin 0x20 0x21 0x22 0x23: Trouble [Space Trouble] 0x21 0x20 0x23 0x22: Warp Warp [Warp & Warp] 0x22 0x23 0x20 0x21: Antarctic Expedition [Antarctic Adventure] 0x24 0x25 0x26 0x27: Bread Factory [Comic Bakery] 0x26 0x27 0x24 0x25: Cabbage [Cabbage Patch Kids] 0x28 0x29 0x2A 0x2B: Circus [Circus Charlie] 0x2A 0x2B 0x28 0x29: Hyper Rally 0x2C 0x2D 0x2E 0x2F: King's Valley 0x2E 0x2F 0x2C 0x2D: Magical Tree [Or maybe "Magic/Witchcraft Tree"? It's the Konami's classic] 0x30 0x31 0x32 0x33: Mopiranger 0x32 0x33 0x30 0x31: Fantasy Table Tennis [Konami's Ping Pong] 0x34 0x35 0x36 0x37: Pippols 0x36 0x37 0x34 0x35: Pooyan 0x38 0x39 0x3A 0x3B: Road Fighter 0x3A 0x3B 0x38 0x39: Sky Jaguar 0x3C 0x3D 0x3E 0x3F: Tennis 0x3E 0x3F 0x3C 0x3D: Kung-Fu [Yie Ar Kung-Fu] 0x40 0x41 0x42 0x43: King Balloon [King & Balloon] 0x42 0x43 0x40 0x41: Sports II [Hyper Sports 2] 0x44 0x45 0x46 0x47: Wonder Boy [Takahashi Meijin no Bouken Jima, a.k.a. Adventure Island] 0x48 0x49 0x4A 0x4B: Castle [I think it's The Castle] 0x4C 0x4D 0x4E 0x4F: Flicky 0x50 0x51 0x52 0x53: Goonies 0x54 0x55 0x56 0x57: Demon Castle Legend [Majou Densetsu: Knightmare] 0x58 0x59 0x5A 0x5B: Kung Fu II [Yie Ar Kung-Fu 2] 0x5C 0x5D 0x5E 0x5F: Penguin Land [Penguin Land Adventure] 0x60 0x61 0x62 0x63: Q*Bert [a.k.a. Q*Bert's Qubes on other platforms] 0x64 0x65 0x66 0x67: Star Force 0x68 0x69 0x6A 0x6B: TwinBee 0x6C 0x6D 0x6E 0x6F: Zanac 0x70 0x71 0x72 0x73: Zaxxon 0x74 0x75 0x76 0x77: Hang-On 0x78 0x79 0x7A 0x7B: Lode Runner 0x7C 0x7D 0x7E 0x7F: Spelunker Paging is by register 0x2000, but due to partial address decoding the register is also mirrored in all of 0x2000-0x3FFF and 0xA000-0xBFFF. The value written to the register is a byte which sets the page numbers for 0x4000-0xBFFF after an XOR operation. Page granularity is 8 KB. The mapper acts as though the ROM is twice as large (2 MB overdump, 256 pages) but the second half reads entirely as zeroes. The one known mapper register: 0x2000: MPR, initial value usually 0x7F Memory layout is as follows: 0x0000…0x1FFF: hard-wired to page 0x1F 0x2000…0x3FFF: hard-wired to page 0x1F 0x4000…0x5FFF: mapped to page (MPR ⊕ 0x1F) 0x6000…0x7FFF: mapped to page (MPR ⊕ 0x1E) 0x8000…0x9FFF: hard-wired to page (MPR ⊕ 0x1D) 0xA000…0xBFFF: hard-wired to page (MPR ⊕ 0x1C) * [see below] ⊕ indicates XOR * Reads from 0xA000…0xBFFF don't seem completely reliable, the last four bytes from (unscrambled) pages 0x02, 0x06, 0x16, 0x1E, and 0x6F usually return different values inconsistently. As an example, when reading through the 0xA000…0xBFFF window, reading what should be the linear ROM addresses 0xDFFFC…0xDFFFF usually returns instead the bytes from linear ROM addresses 0xCFFFC…0xCFFFF. File fingerprinting information for this dump: 1.0M '128 Total (KR).sms'
Checking for export header with matching CRC... NO sha256:d398fff1599211711d037a073db02b131c7d00bbdd13e64abbd816545c3b4dee 128 Total (KR).sms sha1:07d4be0635bab0a6523019c8ce2c23d9cd3b3e1d 128 Total (KR).sms md5:6dddeb0bb21622b6ee1deb4c4870f801 128 Total (KR).sms mekacrc:0707EB856DC38BC7 128 Total (KR).sms crc32:ba5ec0e3 128 Total (KR).sms |
|
|
Posted: Mon Apr 27, 2020 6:27 am |
Slight progress on the menu: the entries describing starting page and overrides start at linear address 0x0BBC, and are variable length. They take one of the following forms:
Simple entry: 0xPP 0x00 - two-byte entry starting mapping at 0x4000 to page 0xPP running the "primary" game; edit: appears to use the MSX ROM header mapped at 0x4000 Simple entry: 0xPP 0x80 - two-byte entry starting mapping at 0x4000 to page 0xPP running the "secondary" game; edit: appears to use the MSX ROM header mapped at 0x8000 "Trained" entry: 0xPP 0x01 0xVV 0xLL 0xHH [ 0xVV 0xLL 0xHH ... ] 0xFF - multibyte entry starting mapping at 0x4000 to page 0xPP running the "primary" game, with one or more patches re-applied in every VBLANK. Each patch simply writes its 0xVV value byte to the address 0xHHLL. The format can't encode a 0xFF value byte, but apparently no game needs it. Here's a decoding of the whole menu metadata structure: 128 Total #1 0x0bbc: 0: page 0x7c 0x7d 0x7e 0x7f, flags 0x00 0x0bbe: 1: page 0x5c 0x5d 0x5e 0x5f, flags 0x00 0x0bc0: 2: page 0x3c 0x3d 0x3e 0x3f, flags 0x00 0x0bc2: 3: page 0x3e 0x3f 0x3c 0x3d, flags 0x00 0x0bc4: 4: page 0x1c 0x1d 0x1e 0x1f, flags 0x00 0x0bc6: 5: page 0x1d 0x1c 0x1f 0x1e, flags 0x00 0x0bc8: 6: page 0x1c 0x1d 0x1e 0x1f, flags 0x80 0x0bca: 7: page 0x1d 0x1c 0x1f 0x1e, flags 0x80 0x0bcc: 8: page 0x78 0x79 0x7a 0x7b, flags 0x00 0x0bce: 9: page 0x58 0x59 0x5a 0x5b, flags 0x00 0x0bd0: 10: page 0x38 0x39 0x3a 0x3b, flags 0x00 0x0bd2: 11: page 0x3a 0x3b 0x38 0x39, flags 0x00 0x0bd4: 12: page 0x18 0x19 0x1a 0x1b, flags 0x00 0x0bd6: 13: page 0x19 0x18 0x1b 0x1a, flags 0x00 0x0bd8: 14: page 0x19 0x18 0x1b 0x1a, flags 0x80 0x0bda: 15: page 0x74 0x75 0x76 0x77, flags 0x00 128 Total #2 0x0bdc: 0: page 0x54 0x55 0x56 0x57, flags 0x00 0x0bde: 1: page 0x34 0x35 0x36 0x37, flags 0x00 0x0be0: 2: page 0x36 0x37 0x34 0x35, flags 0x00 0x0be2: 3: page 0x14 0x15 0x16 0x17, flags 0x00 0x0be4: 4: page 0x15 0x14 0x17 0x16, flags 0x00 0x0be6: 5: page 0x15 0x14 0x17 0x16, flags 0x80 0x0be8: 6: page 0x70 0x71 0x72 0x73, flags 0x00 0x0bea: 7: page 0x50 0x51 0x52 0x53, flags 0x00 0x0bec: 8: page 0x30 0x31 0x32 0x33, flags 0x00 0x0bee: 9: page 0x32 0x33 0x30 0x31, flags 0x00 0x0bf0: 10: page 0x10 0x11 0x12 0x13, flags 0x00 0x0bf2: 11: page 0x11 0x10 0x13 0x12, flags 0x00 0x0bf4: 12: page 0x13 0x12 0x11 0x10, flags 0x00 0x0bf6: 13: page 0x6c 0x6d 0x6e 0x6f, flags 0x00 0x0bf8: 14: page 0x4c 0x4d 0x4e 0x4f, flags 0x00 0x0bfa: 15: page 0x2c 0x2d 0x2e 0x2f, flags 0x00 128 Total #3 0x0bfc: 0: page 0x2e 0x2f 0x2c 0x2d, flags 0x00 0x0bfe: 1: page 0x0c 0x0d 0x0e 0x0f, flags 0x00 0x0c00: 2: page 0x0d 0x0c 0x0f 0x0e, flags 0x00 0x0c02: 3: page 0x0f 0x0e 0x0d 0x0c, flags 0x00 0x0c04: 4: page 0x68 0x69 0x6a 0x6b, flags 0x00 0x0c06: 5: page 0x48 0x49 0x4a 0x4b, flags 0x00 0x0c08: 6: page 0x28 0x29 0x2a 0x2b, flags 0x00 0x0c0a: 7: page 0x2a 0x2b 0x28 0x29, flags 0x00 0x0c0c: 8: page 0x08 0x09 0x0a 0x0b, flags 0x00 0x0c0e: 9: page 0x09 0x08 0x0b 0x0a, flags 0x00 0x0c10: 10: page 0x0b 0x0a 0x09 0x08, flags 0x00 0x0c12: 11: page 0x64 0x65 0x66 0x67, flags 0x00 0x0c14: 12: page 0x44 0x45 0x46 0x47, flags 0x00 0x0c16: 13: page 0x24 0x25 0x26 0x27, flags 0x00 0x0c18: 14: page 0x26 0x27 0x24 0x25, flags 0x00 0x0c1a: 15: page 0x04 0x05 0x06 0x07, flags 0x00 128 Total #4 0x0c1c: 0: page 0x60 0x61 0x62 0x63, flags 0x00 0x0c1e: 1: page 0x40 0x41 0x42 0x43, flags 0x00 0x0c20: 2: page 0x42 0x43 0x40 0x41, flags 0x00 0x0c22: 3: page 0x20 0x21 0x22 0x23, flags 0x00 0x0c24: 4: page 0x21 0x20 0x23 0x22, flags 0x00 0x0c26: 5: page 0x22 0x23 0x20 0x21, flags 0x00 0x0c28: 6: page 0x05 0x04 0x07 0x06, flags 0x00 0x0c2a: 7: page 0x07 0x06 0x05 0x04, flags 0x00 0x0c2c: 8: page 0x01 0x00 0x03 0x02, flags 0x80 0x0c2e: 9: page 0x24 0x25 0x26 0x27, flags 0x01 patch 0x02 @ 0xe051 0x0c34: 10: page 0x04 0x05 0x06 0x07, flags 0x01 patch 0x05 @ 0xe010, 0x04 @ 0xe011 0x0c3d: 11: page 0x04 0x05 0x06 0x07, flags 0x01 patch 0x06 @ 0xe010, 0x05 @ 0xe011 0x0c46: 12: page 0x04 0x05 0x06 0x07, flags 0x01 patch 0x07 @ 0xe010, 0x06 @ 0xe011 0x0c4f: 13: page 0x04 0x05 0x06 0x07, flags 0x01 patch 0x08 @ 0xe010, 0x07 @ 0xe011 0x0c58: 14: page 0x28 0x29 0x2a 0x2b, flags 0x01 patch 0x02 @ 0xe051, 0x02 @ 0xe052 0x0c61: 15: page 0x28 0x29 0x2a 0x2b, flags 0x01 patch 0x03 @ 0xe051, 0x03 @ 0xe052 128 Total #5 0x0c6a: 0: page 0x50 0x51 0x52 0x53, flags 0x01 patch 0x06 @ 0xe061, 0x02 @ 0xe06c 0x0c73: 1: page 0x50 0x51 0x52 0x53, flags 0x01 patch 0x0b @ 0xe061, 0x03 @ 0xe06c 0x0c7c: 2: page 0x50 0x51 0x52 0x53, flags 0x01 patch 0x10 @ 0xe061, 0x04 @ 0xe06c 0x0c85: 3: page 0x50 0x51 0x52 0x53, flags 0x01 patch 0x15 @ 0xe061, 0x05 @ 0xe06c 0x0c8e: 4: page 0x3e 0x3f 0x3c 0x3d, flags 0x01 patch 0x03 @ 0xe051, 0x02 @ 0xe054 0x0c97: 5: page 0x3e 0x3f 0x3c 0x3d, flags 0x01 patch 0x05 @ 0xe051, 0x04 @ 0xe054 0x0ca0: 6: page 0x26 0x27 0x24 0x25, flags 0x01 patch 0x02 @ 0xe051 0x0ca6: 7: page 0x26 0x27 0x24 0x25, flags 0x01 patch 0x03 @ 0xe051 0x0cac: 8: page 0x18 0x19 0x1a 0x1b, flags 0x01 patch 0x04 @ 0xe030 0x0cb2: 9: page 0x18 0x19 0x1a 0x1b, flags 0x01 patch 0x08 @ 0xe030 0x0cb8: 10: page 0x18 0x19 0x1a 0x1b, flags 0x01 patch 0x0c @ 0xe030 0x0cbe: 11: page 0x18 0x19 0x1a 0x1b, flags 0x01 patch 0x10 @ 0xe030 0x0cc4: 12: page 0x10 0x11 0x12 0x13, flags 0x01 patch 0x02 @ 0xe044, 0x02 @ 0xe045 0x0ccd: 13: page 0x10 0x11 0x12 0x13, flags 0x01 patch 0x03 @ 0xe044, 0x03 @ 0xe045 0x0cd6: 14: page 0x10 0x11 0x12 0x13, flags 0x01 patch 0x04 @ 0xe044, 0x04 @ 0xe045 0x0cdf: 15: page 0x10 0x11 0x12 0x13, flags 0x01 patch 0x05 @ 0xe044, 0x05 @ 0xe045 128 Total #6 0x0ce8: 0: page 0x58 0x59 0x5a 0x5b, flags 0x01 patch 0x03 @ 0xe066, 0x04 @ 0xe053 0x0cf1: 1: page 0x58 0x59 0x5a 0x5b, flags 0x01 patch 0x04 @ 0xe066, 0x05 @ 0xe053 0x0cfa: 2: page 0x58 0x59 0x5a 0x5b, flags 0x01 patch 0x05 @ 0xe066, 0x06 @ 0xe053 0x0d03: 3: page 0x58 0x59 0x5a 0x5b, flags 0x01 patch 0x06 @ 0xe066, 0x07 @ 0xe053 0x0d0c: 4: page 0x38 0x39 0x3a 0x3b, flags 0x01 patch 0x03 @ 0xe043 0x0d12: 5: page 0x38 0x39 0x3a 0x3b, flags 0x01 patch 0x04 @ 0xe043 0x0d18: 6: page 0x38 0x39 0x3a 0x3b, flags 0x01 patch 0x05 @ 0xe043 0x0d1e: 7: page 0x38 0x39 0x3a 0x3b, flags 0x01 patch 0x06 @ 0xe043 0x0d24: 8: page 0x6c 0x6d 0x6e 0x6f, flags 0x01 patch 0x04 @ 0xe701 0x0d2a: 9: page 0x6c 0x6d 0x6e 0x6f, flags 0x01 patch 0x05 @ 0xe701 0x0d30: 10: page 0x6c 0x6d 0x6e 0x6f, flags 0x01 patch 0x06 @ 0xe701 0x0d36: 11: page 0x6c 0x6d 0x6e 0x6f, flags 0x01 patch 0x07 @ 0xe701 0x0d3c: 12: page 0x30 0x31 0x32 0x33, flags 0x01 patch 0x05 @ 0xe052, 0x04 @ 0xe053 0x0d45: 13: page 0x30 0x31 0x32 0x33, flags 0x01 patch 0x05 @ 0xe052, 0x04 @ 0xe053 0x0d4e: 14: page 0x30 0x31 0x32 0x33, flags 0x01 patch 0x09 @ 0xe052, 0x08 @ 0xe053 0x0d57: 15: page 0x30 0x31 0x32 0x33, flags 0x01 patch 0x0d @ 0xe052, 0x0c @ 0xe053 128 Total #7 0x0d60: 0: page 0x44 0x45 0x46 0x47, flags 0x01 patch 0xa6 @ 0xe76c 0x0d66: 1: page 0x44 0x45 0x46 0x47, flags 0x01 patch 0xa7 @ 0xe76c 0x0d6c: 2: page 0x44 0x45 0x46 0x47, flags 0x01 patch 0xa8 @ 0xe76c 0x0d72: 3: page 0x44 0x45 0x46 0x47, flags 0x01 patch 0xa9 @ 0xe76c 0x0d78: 4: page 0x2c 0x2d 0x2e 0x2f, flags 0x01 patch 0x0a @ 0xe055 0x0d7e: 5: page 0x2c 0x2d 0x2e 0x2f, flags 0x01 patch 0x0c @ 0xe055 0x0d84: 6: page 0x2c 0x2d 0x2e 0x2f, flags 0x01 patch 0x0d @ 0xe055 0x0d8a: 7: page 0x2c 0x2d 0x2e 0x2f, flags 0x01 patch 0x0e @ 0xe055 0x0d90: 8: page 0x54 0x55 0x56 0x57, flags 0x01 patch 0x03 @ 0xe062, 0x04 @ 0xe061 0x0d99: 9: page 0x54 0x55 0x56 0x57, flags 0x01 patch 0x04 @ 0xe062, 0x05 @ 0xe061 0x0da2: 10: page 0x54 0x55 0x56 0x57, flags 0x01 patch 0x05 @ 0xe062, 0x06 @ 0xe061 0x0dab: 11: page 0x54 0x55 0x56 0x57, flags 0x01 patch 0x06 @ 0xe062, 0x07 @ 0xe061 0x0db4: 12: page 0x08 0x09 0x0a 0x0b, flags 0x01 patch 0x11 @ 0xe708, 0x0a @ 0xe701 0x0dbd: 13: page 0x08 0x09 0x0a 0x0b, flags 0x01 patch 0x16 @ 0xe708, 0x0f @ 0xe701 0x0dc6: 14: page 0x08 0x09 0x0a 0x0b, flags 0x01 patch 0x21 @ 0xe708, 0x14 @ 0xe701 0x0dcf: 15: page 0x08 0x09 0x0a 0x0b, flags 0x01 patch 0x26 @ 0xe708, 0x19 @ 0xe701 128 Total #8 0x0dd8: 0: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x08 @ 0xe0e7, 0x08 @ 0xe0e8, 0x02 @ 0xe0ea 0x0de4: 1: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x0c @ 0xe0e7, 0x0c @ 0xe0e8, 0x03 @ 0xe0ea 0x0df0: 2: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x10 @ 0xe0e7, 0x10 @ 0xe0e8, 0x04 @ 0xe0ea 0x0dfc: 3: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x14 @ 0xe0e7, 0x14 @ 0xe0e8, 0x05 @ 0xe0ea 0x0e08: 4: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x18 @ 0xe0e7, 0x18 @ 0xe0e8, 0x06 @ 0xe0ea 0x0e14: 5: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x1c @ 0xe0e7, 0x1c @ 0xe0e8, 0x07 @ 0xe0ea 0x0e20: 6: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x20 @ 0xe0e7, 0x20 @ 0xe0e8, 0x08 @ 0xe0ea 0x0e2c: 7: page 0x4c 0x4d 0x4e 0x4f, flags 0x01 patch 0x24 @ 0xe0e7, 0x24 @ 0xe0e8, 0x09 @ 0xe0ea 0x0e38: 8: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x10 @ 0xef66 0x0e3e: 9: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x18 @ 0xef66 0x0e44: 10: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x20 @ 0xef66 0x0e4a: 11: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x28 @ 0xef66 0x0e50: 12: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x30 @ 0xef66 0x0e56: 13: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x38 @ 0xef66 0x0e5c: 14: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x40 @ 0xef66 0x0e62: 15: page 0x78 0x79 0x7a 0x7b, flags 0x01 patch 0x48 @ 0xef66 |
|
|
Posted: Wed May 06, 2020 3:20 am |
Sorry a bit late, but that game is Con-Dori by Cross Talk. Released for MSX. |
|
|
Posted: Wed May 06, 2020 3:29 am |
Thank you! I totally failed in my searches for this one. Also, the similarities to Pooyan are difficult for me to deny |
|