1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216 |
- SNES Kart v1.6
- The most complete guide to a SNES cartridge worldwide
- . .
- ______ ______ .
- .:_\_ . \\_ .__\_::.
- . .::./ ./ // ./__ .:::. .
- :_<_____/<______>_:.
- . .
- Damaged Cybernetics Australia
- It is a crime to redistribute this document in a commercial
- venture of any kind without permission or a licensing agreement.
- Contact us via email for more information on licensing.
- This is freely distributable for non-commercial use, however we
- require that you acknowledge the following:
- SNES Kart 1.6 Copyright (c) 1995-1996 DiskDude. All rights reserved.
- [Image]
- None of the information contained in this text comes from any confidential
- source. It was obtained from various sources on the Internet, but also the
- product of my own investigation. Refer to the Acknowledgements section at
- the end of this text.
- Use this information for your own use, I will not take any responsibility
- for your actions. All copyrights and trademarks are owned by their
- respective owners, even if not acknowledged, no infringements intended.
- I wrote this because all of this information is scattered in small files
- everywhere, if existing at all, most of it outdated. This is an attempt to
- conveniently bring all of the information to one place, and as up-to-date
- as possible. If you find this useful, tell me! I love positive feedback.
- Contents
- Pin Layouts Cheat Device Decoding
- * What is the cartridge pin * Pro Action Replay (hardware)
- layout? * Gold Finger (software)
- * What is the ROM pin layout? * Game Genie (hardware)
- * What is the DSP1 pin layout? * Converting between CPU
- * What is the MAD-1 and its pin addresses and ROM addresses
- layout? * Easily converting between
- * What is the pin layout of the codes
- 16kbit SRAM most commonly used
- by Nintendo? SNES Copiers
- Cartridge Addressing Schemes * What are copiers?
- * Super Wild Card (SWC) header
- * LoROM cartridges information
- * HiROM cartridges * Pro Fighter (FIG) header
- format
- Embedded Cartridge Information * Game Doctor file name format
- * Super Wild Card parallel port
- * Game title (21 bytes) I/O protocol
- * ROM makeup (1 byte)
- * ROM type (1 byte) ROM Protection Schemes
- * ROM size (1 byte)
- * SRAM size (1 byte) * SlowROM checks
- * Country (1 byte) * PAL/NTSC checks
- * License (1 byte) * SRAM size checks
- * Game Version (1 byte)
- * Inverse ROM Checksum (2 bytes) IPS Patch Format
- * ROM Checksum (2 bytes)
- * Non Maskable Interrupt / VBL Acknowledgements
- Vector (2 bytes)
- * Reset Vector (2 bytes)
- * How do I know if the ROM is
- HiROM or LoROM?
- Pin Layouts
- What is the cartridge pin layout?
- If the SNES doesn't detect the CIC while power is on, then it will not
- continue to read the cartridge. Further details of this are not known to
- me.
- Super FX 01 32
- 02 33
- 03 34
- 04 35
- GND 05 36 GND
- F A11 06 37 A12
- r A10 07 38 A13
- o A9 08 39 A14
- n A8 09 40 A15
- t A7 10 41 BA0
- A6 11 42 BA1
- o A5 12 43 BA2
- f A4 13 44 BA3
- A3 14 45 BA4
- c A2 15 46 BA5
- a A1 16 47 BA6
- r A0 17 48 BA7
- t /IRQ 18 49 /CS
- D0 19 50 D4
- D1 20 51 D5
- D2 21 52 D6
- D3 22 53 D7
- /RD 23 54 /WR
- CIC out data (p1) 24 55 CIC out data (p2)
- CIC in data (p7) 25 56 CIC in clock (p6)
- RESET 26 57 nc
- Vcc 27 58 Vcc
- 28 59
- 29 60
- 30 61
- Left audio 31 62 Right audio
- LoROM: 32kbyte pages/banks (A15 not used - assumed high)
- HiROM: 64kbyte pages/banks
- BA0-BA7 switch between a possible 256 banks/pages.
- LoROM data is stored in the upper 32kbytes of the possible 64kbyte
- bank/page (A15 is assumed high). Using 64kbyte pages, the SNES can address
- a huge 16Mbytes or 128Mbits!
- According to a SNES memory map, LoROM games can be as large as 16Mbit while
- HiROM games are limited to 32Mbit... what about the 48Mbit game floating
- around?
- What is the ROM pin layout?
- This pin layout was taken from a Donkey Kong Country 2 cartridge and seems
- to be consistent with all their mask ROMs (some are 32pin, others 36pin).
- A20 Vcc
- A21 A22
- A17 01 32 Vcc
- A18 02 31 /OE
- A15 03 30 A19
- A12 04 29 A14
- A7 05 28 A13
- A6 06 27 A8
- A5 07 26 A9
- A4 08 25 A11
- A3 09 24 A16
- A2 10 23 A10
- A1 11 22 /CS
- A0 12 21 D7
- D0 13 20 D6
- D1 14 19 D5
- D2 16 18 D4
- Vss 16 17 D3
- What is the DSP1 pin layout?
- This was taken from a hacked Pilotwings cartridge with a switch on it -
- possibly to select between HiROM and LoROM DSP1 games. I'm not 100% sure
- that the following is correct or complete though.
- Vcc 01 28 Vcc
- Vcc 02 27 A14 (A12 - used for HiROM?)
- nc 03 26 /CS
- nc 04 25 /RD
- nc 05 24 /WR
- D0 06 23 ?
- D1 07 22 ?
- D2 08 21 Vcc
- D3 09 20 Vcc
- D4 10 19 Vcc
- D5 11 18 Vcc
- D6 12 17 GND
- D7 13 16 /RESET (inverted RESET- SNES slot)
- D8 14 15 CLOCK?
- If you can verify/correct this, it would be greatly appreciated.
- What is the MAD-1 and its pin layout?
- The MAD-1 stands for Memory Address Decoder revision 1. It is used on the
- Donkey Kong Country (1 and 2) cartridge and possibly other cartridges in
- order to address one or two ROMs and a static RAM.
- /HI 01 16 /LO
- /SE 02 15 A13
- 03 14 A14
- /RE 04 13 BA5
- Vcc 05 12 A15
- Vcc 06 11 /CS (p49 SNES slot)
- Vcc 07 10 Vcc
- GND 08 09 RESET (p26 SNES slot)
- /RE - /CS on a 32Mbit ROM (possibly for MAD-1a only)
- /LO - /CS on ROM1 (lower 16mbit)
- /HI - /CS on ROM2 (upper 16mbit)
- /SE - /CS on Static RAM
- What is the pin layout of the 16kbit SRAM most commonly used by Nintendo?
- It seems that Nintendo uses this SRAM in many of their games, mainly
- because it is very cheap, only $A5 (retail) - much cheaper for Nintendo who
- buys millions of them. It can address up to 2048 bytes or 16kbits.
- A7 01 24 Vcc
- A6 02 23 A8
- A5 03 22 A9
- A4 04 21 /WE
- A3 05 20 /OE
- A2 06 19 A10
- A1 07 18 /CS
- A0 08 17 D7
- D0 09 16 D6
- D1 10 15 D5
- D2 11 14 D4
- Vss 12 13 D3
- Cartridge Addressing Schemes
- LoROM cartridges: HiROM cartridges:
- read ROM /RD, /CS, RESET low read ROM /CS, /RD, RESET low
- /WR high /WR high
- read SRAM /CS, /RD low read SRAM /RD low
- RESET, /WR high RESET, /WR, /CS high
- A15, BA4, BA5 high A13, A14, BA5 high
- write SRAM /CS, /WR low write SRAM /WR low
- RESET, /RD high RESET, /RD, /CS high
- A15, BA4, BA5 high A13, A14, BA5 high
- Would anyone like to verify this?
- Embedded Cartridge Information
- Most of the information in this section was obtained from Mindrape's SNES
- ROM, available from http://www.futureone.com/~damaged/.
- All values are in decimal unless specified with a trailing 'h'.
- The starting offset for this information is located at the end of the first
- page:
- LoROM: offset 32704
- HiROM: offset 65472
- Game title (21 bytes)
- The title is in upper case on most games.
- ROM makeup (1 byte)
- Upper nibble (4 bits):
- Value ROM speed
- 0 SlowROM (200ns)
- 3 FastROM (120ns)
- Lower nibble (4 bits):
- Value Bank size
- 0 LoROM (32kb banks)
- 1 HiROM (64kb banks)
- ROM type (1 byte)
- Byte ROM type
- 0 ROM only
- 1 ROM and RAM
- 2 ROM and Save RAM
- 3 ROM and DSP1 chip
- 4 ROM, RAM and DSP1 chip
- 5 ROM, Save RAM and DSP1 chip
- 19 ROM and Super FX chip
- 227 ROM, RAM and GameBoy data
- 246 ROM and DSP2 chip
- ROM size (1 byte)
- Byte ROM size
- 8 2 MegaBits
- 9 4 MegaBits
- 10 8 MegaBits
- 11 16 MegaBits
- 12 32 MegaBits
- At the time of writing, the largest SNES game is 48Mbit, while 8Mbit
- cartridges are the most common. There are cartridge sizes of 10Mbit,
- 12Mbit, 20Mbit and 24Mbit, which are reported as 16Mbit, 16Mbit, 16Mbit and
- 32Mbit respectively.
- Another way of calculating the ROM size is: 1 shl (ROMbyte-7) MegaBits
- SRAM size (1 byte)
- Byte SRAM size
- 0 (none)
- 1 16 KiloBits
- 2 32 KiloBits
- 3 64 KiloBits
- 64 KiloBit SRAM's are the largest Nintendo uses (except DOOM?), while most
- copiers have 256 kiloBits on-board.
- Another way of calculating the SRAM size is: 1 shl (SRAMbyte+3) KiloBits
- Country (1 byte)
- Byte Country Video system
- 0 Japan NTSC
- 1 USA NTSC
- 2 Australia, Europe, Oceania and Asia PAL
- 3 Sweden PAL
- 4 Finland PAL
- 5 Denmark PAL
- 6 France PAL
- 7 Holland PAL
- 8 Spain PAL
- 9 Germany, Austria and Switzerland PAL
- 10 Italy PAL
- 11 Hong Kong and China PAL
- 12 Indonesia PAL
- 13 Korea PAL
- License (1 byte)
- Byte Company Byte Company
- 1 Nintendo 131 Lozc
- 3 Imagineer-Zoom 132 Koei
- 5 Zamuse 134 Tokuma Shoten Intermedia
- 6 Falcom 136 DATAM-Polystar
- 8 Capcom 139 Bullet-Proof Software
- 9 HOT-B 140 Vic Tokai
- 10 Jaleco 142 Character Soft
- 11 Coconuts 143 I''Max
- 12 Rage Software 144 Takara
- 14 Technos 145 CHUN Soft
- 15 Mebio Software 146 Video System Co., Ltd.
- 18 Gremlin Graphics 147 BEC
- 19 Electronic Arts 149 Varie
- 21 COBRA Team 151 Kaneco
- 22 Human/Field 153 Pack in Video
- 23 KOEI 154 Nichibutsu
- 24 Hudson Soft 155 TECMO
- 26 Yanoman 156 Imagineer Co.
- 28 Tecmo 160 Telenet
- 30 Open System 164 Konami
- 31 Virgin Games 165 K.Amusement Leasing Co.
- 32 KSS 167 Takara
- 33 Sunsoft 169 Technos Jap.
- 34 POW 170 JVC
- 35 Micro World 172 Toei Animation
- 38 Enix 173 Toho
- 39 Loriciel/Electro Brain 175 Namco Ltd.
- 40 Kemco 177 ASCII Co. Activison
- 41 Seta Co.,Ltd. 178 BanDai America
- 45 Visit Co.,Ltd. 180 Enix
- 49 Carrozzeria 182 Halken
- 50 Dynamic 186 Culture Brain
- 51 Nintendo 187 Sunsoft
- 52 Magifact 188 Toshiba EMI
- 53 Hect 189 Sony Imagesoft
- 60 Empire Software 191 Sammy
- 61 Loriciel 192 Taito
- 64 Seika Corp. 194 Kemco
- 65 UBI Soft 195 Square
- 70 System 3 196 Tokuma Soft
- 71 Spectrum Holobyte 197 Data East
- 73 Irem 198 Tonkin House
- 75 Raya Systems/Sculptured Software 200 KOEI
- 76 Renovation Products 202 Konami USA
- 77 Malibu Games/Black Pearl 203 NTVIC
- 79 U.S. Gold 205 Meldac
- 80 Absolute Entertainment 206 Pony Canyon
- 81 Acclaim 207 Sotsu Agency/Sunrise
- 82 Activision 208 Disco/Taito
- 83 American Sammy 209 Sofel
- 84 GameTek 210 Quest Corp.
- 85 Hi Tech Expressions 211 Sigma
- 86 LJN Toys 214 Naxat
- 90 Mindscape 216 Capcom Co., Ltd.
- 93 Tradewest 217 Banpresto
- 95 American Softworks Corp. 218 Tomy
- 96 Titus 219 Acclaim
- 97 Virgin Interactive Entertainment 221 NCS
- 98 Maxis 222 Human Entertainment
- 103 Ocean 223 Altron
- 105 Electronic Arts 224 Jaleco
- 107 Laser Beam 226 Yutaka
- 110 Elite 228 T&ESoft
- 111 Electro Brain 229 EPOCH Co.,Ltd.
- 112 Infogrames 231 Athena
- 113 Interplay 232 Asmik
- 114 LucasArts 233 Natsume
- 115 Parker Brothers 234 King Records
- 117 STORM 235 Atlus
- 120 THQ Software 236 Sony Music Entertainment
- 121 Accolade Inc. 238 IGS
- 122 Triffix Entertainment 241 Motown Software
- 124 Microprose 242 Left Field Entertainment
- 127 Kemco 243 Beam Software
- 128 Misawa 244 Tec Magik
- 129 Teichio 249 Cybersoft
- 130 Namco Ltd. 255 Hudson Soft
- Game Version (1 byte)
- The version is stored as version 1.VersionByte and must be less than 128.
- i.e. Less than 1.128.
- Inverse ROM Checksum (2 bytes)
- This is the same as XORing the two checksum bytes. i.e. The checksum bits
- are inversed.
- ROM Checksum (2 bytes)
- The checksum is a 16bit word with the lower 8bits stored first, followed by
- the upper 8bits.
- The checksum is calculated by dividing the ROM into 4Mbit chunks then
- adding all the bytes in these chunks together. Once you have the checksum
- for each chunk, add them together and take the lower 32bits of the result.
- With a non-standard image size, you do not get it equally divisible by
- 4Mbit (excluding 2Mbit images). e.g. 10Mbit = 4Mbit + 4Mbit + 2Mbit chunks.
- Therefore, you must create a 4Mbit chunk from what is left over. Using the
- same example, you would add the checksum of the following chunks to get the
- ROM checksum:
- 4Mbit + 4Mbit + (2Mbit + 2Mbit)
- or
- 4Mbit + 4Mbit + (2 x 2Mbit)
- Non Maskable Interrupt / VBL Vector (2 bytes)
- LoROM: at offset 33274
- HiROM: at offset 66042
- Reset Vector (2 bytes)
- Where to start the ROM code.
- LoROM: at offset 33276
- HiROM: at offset 66042 [correction by Qwertie: 66044?]
- How do I know if the ROM is HiROM or LoROM?
- When you OR the checksum bytes of a disk image and the inverse checksum
- bytes, the result should be FFFF hex. Therefore, to detect whether an image
- is HiROM or LoROM, you must read those bytes, OR them, and see if they
- equal FFFF hex.
- The ROM's type depends at which location the OR'd bytes equal FFFF hex. If
- it isn't found at either location, then the other way of checking is to see
- at which location the title contains uppercase alphanumeric characters.
- (But this fails with most Japanese cartridges)
- Why don't you use the ROM Makeup Byte? You can, and some utilities do, but
- some utilities allow you to change this byte, so incorrect results may
- occur.
- For the actual ROM, the embedded cartridge information is stored at the
- same position for both LoROM and HiROM. In this case, you must use the ROM
- Makeup Byte or read a 64kb page and see if both 32kb chunks (upper and
- lower 32kb) are the same. If they are the same, it is LoROM (32kb pages -
- A15 is not used, the data repeats itself) otherwise it is HiROM.
- As a general rule of thumb, if you can't detect which ROM type it is,
- default to LoROM, as these are the most common of cartridges.
- Cheat Device Decoding
- We'll start with the easiest first then work our way down. These codes work
- by replacing a byte at a specific location in the ROM.
- E.g. In the game F-Zero, at a particular position in the ROM, there is a
- number 3 indicating 3 lives to start off with. What a cheat code will do is
- replace this byte with, let's say, the number 9, so now when the game is
- run, the player starts off with 9 lives.
- Pro Action Replay (hardware)
- Code format: AAAAAADD (8 digits)
- A - Address
- D - Data
- These codes are in Hex, the address being a CPU address, not a direct ROM
- location (more about this later).
- Gold Finger (software)
- Code format: AAAAADDDDDDCCW (14 digits)
- A - Address
- D - Data
- C - Checksum
- W - What to change (DRAM or SRAM)
- This code was designed for the copiers, and are straight Hex characters.
- Therefore the Address is a ROM address, not a CPU address. Data bytes are
- arranged in 2 characters (2 D's per byte), which allows for 3 bytes. If a
- byte is not being used, it is denoted by 'XX'. I have never seen a code
- with three unused bytes - what's the point of one anyhow?
- The address (A's) is a base address. The first data byte (D's) is to be
- placed at this address. The second at address+1, the third at address+2 (if
- to be used, that is, if they are not 'XX').
- To calculate the checksum you must take the A's and D's, add a zero (0) to
- the front of the shortened code, then divide into block's of 2 hex digits
- (bytes). Add these hex digits together (2 characters per hex digit) then
- minus 160 hex (352 decimal). Now AND this number by FF hex (255 decimal) to
- get the lower 8 bits (byte). Convert this number to hex and you have your
- checksum (C's).
- W tells the copier whether to replace the byte in the DRAM (ROM image) or
- the SRAM (Saved game static RAM) of the copier.
- Value of W Where to place byte
- 0 DRAM (ROM image)
- 1 SRAM (Saved game image)
- The rec.games.video FAQ specifies that there may be non- standard values of
- 2, 8, A, C, F for W, which may be converted to 0. I personally have only
- seen Gold Finger codes with W = 0.
- Game Genie (hardware)
- Code format: DDAA-AAAA (8 digits)
- A - Address
- D - Data
- This is the most difficult code to decipher out of the lot. It is as
- follows:
- First take the code in the form xxxx-xxxx and take out the dash ('-') to
- form xxxxxxxx. Convert these characters (Genie Hex) to normal hex
- characters using the following table:
- Genie Hex: D F 4 7 0 9 1 5 6 B C 8 A 2 3 E
- Normal Hex: 0 1 2 3 4 5 6 7 8 9 A B C D E F
- The first two characters is the data byte in Hex. Now take the other 6
- following characters (encoded address) and put it into it's binary form of
- 24 bits.
- Now take each bit of the encoded address and rearrange to form the real
- address:
- 24bit encoded address: ijklqrst opabcduv wxefghmn
- 8bit encoded data: ABCDEFGH
- Rearrange as:
- 24bit address : 8bit data
- abcdefgh ijklmnop qrstuvwx: ABCDEFGH
- MSB LSB MSB LSB
- Bit 23 of the encoded address (bit 15 of the real address) is always 1. The
- reason being that the SNES CPU address must be 1 for it to access the ROM.
- Converting between CPU addresses and ROM addresses
- This is very easy once you understand how it is done. To convert from a CPU
- address to a ROM address, all you need to do is remove bit 15. By doing
- this, I don't mean just setting it to 0. I mean by removing it, then moving
- all bits after it down one.
- e.g. ROMaddress = (CPUaddress and 7FFFh) or ((CPUaddress and FF0000h) shl 1)
- Therefore, to convert from a ROM address to a CPU address, you must insert
- a high bit into position 15 (bit 15).
- e.g. CPUaddress = (ROMaddress and 7FFFh) or ((ROMaddress and 7F8000h) shr 1) or 8000h
- Easily converting between codes
- I have made available two DOS programs with source code on my WWW pages
- which allow you to convert between Game Genie and Gold Finger codes. These
- are available freely from http://www.parodius.com/~diskdude/CartDisk/.
- Note: Because the Gold Finger can only address upto 8Mbit of game data,
- while other codes can address upto 64Mbit of game data, some Game Genie and
- Action Replay codes may not be converted to Gold Finger.
- SNES Copiers
- What are copiers?
- A copier is a device which sits on top of the SNES and allows you to backup
- your cartridges as well as play your backed up games. It does this by
- storing the ROM image of a cartridge to floppy disks via a 1.44Mb disk
- drive. Most copiers also include a parallel PC port interface, allowing
- your PC to control the unit and store images on your hard drive.
- Copier's contain DRAM from 1 Megabyte to 16 Megabytes, 8MegaBits to
- 128MegaBits respectively. This is the reason why they are so expensive.
- It is legal to own and use a copier for your own personal backup of
- cartridges which you legally own in this point in time, although it is
- illegal to distribute this copy (only one copy is allowed). This may vary
- depending on where you live.
- If you wish to make your own "home brew" copier for the SNES, and other
- consoles, more information can be found at
- http://www.parodius.com/~diskdude/CartDisk/.
- Super Wild Card (SWC) header information
- The SWC (Super Wild Card) image format consists of a 512 byte header. It's
- layout is as follows (set unused bytes to 00h):
- Offset Function
- 0 Lower 8 bits of size word
- 1 Upper 8 bits of size word
- 2 Image information byte
- 8 SWC header identifier (set to AAh)
- 9 SWC header identifier (set to BBh)
- 10 SWC header identifier (set to 04h)
- The size word is calculated by multiplying the image size, not game size
- (in MegaBits) by 16. e.g. Image is 4 Mbits, so size word would be 4*16=64.
- Image information byte (in the form of 76543210):
- Bit Description
- 7 1 - Run program in Mode 0 (JMP $8000)
- 0 - Run program in Mode 1 (JMP RESET Vector)
- 6 1 - Multi image (there is another split file to follow)
- 0 - Not multi image (no more split files to follow)
- 5 1 - SRAM memory mapping Mode 21 (HiROM)
- 0 - SRAM memory mapping Mode 20
- 4 1 - DRAM memory mapping Mode 21 (HiROM)
- 0 - DRAM memory mapping Mode 20
- 3/2 00: 256kbit SRAM
- 01: 65kbit SRAM
- 10: 16kbit SRAM
- 11: no SRAM
- 1/0 reserved
- Pro Fighter (FIG) header format
- This format is similar to the SWC. It consists of a 512byte header who's
- layout is as follows (set unused bytes to 00h):
- Offset Function
- 0 Lower 8 bits of size word
- 1 Upper 8 bits of size word
- 2 40h - Multi image
- 00h - Last image in set (or single image)
- 3 80h - if HiROM
- 00h - if LoROM
- 4 If using DSP1 microchip:
- FDh - If using SRAM (SRAM size>0)
- 47h - If no SRAM (SRAM size=0)
- 77h - If not using DSP1 and no SRAM (SRAM size=0)
- 5 If using DSP1 microchip:
- 82h - If using SRAM (SRAM size>0)
- 83h - If no SRAM (SRAM size=0)
- 83h - If not using DSP1 and no SRAM (SRAM size=0)
- Game Doctor file name format
- The Game Doctor does not use a 512 byte header like the SWC, instead it
- uses specially designed filenames to distinguish between multi files. I'm
- not sure if it used the filename for information about the size of the
- image though.
- Usually, the filename is in the format of: SFXXYYYZ.078
- Where SF means Super Famicon, XX refers to the size of the image in Mbit.
- If the size is only one character (i.e. 2, 4 or 8 Mbit) then no leading "0"
- is inserted.
- YYY refers to a catalogue number in Hong Kong shops identifying the game
- title. (0 is Super Mario World, 1 is F- Zero, etc). I was told that the
- Game Doctor copier produces a random number when backing up games.
- Z indicates a multi file. Like XX, if it isn't used it's ignored.
- A would indicate the first file, B the second, etc. I am told 078 is not
- needed, but is placed on the end of the filename by systems in Asia.
- e.g. The first 16Mbit file of Donkey Kong Country (assuming it is cat. no.
- 475) would look like: SF16475A.078
- Super Wild Card parallel port I/O protocol
- I was given this information a while ago. It is supposed to be direct from
- the company which makes SWC's and I have included this information because
- a few people have been asking for it. If you have similar information for
- other backup devices, it would be appreciated if you could send it to me.
- [PROTOCOL USED IN PC]
- * BYTE OUTPUT PROCEDURE
- WAIT BUSY BIT = 1 STATUS PORT BIT7 (HEX n79, n7D)
- WRITE ONE BYTE DATA LATCH (HEX n78, n7C)
- REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
- * BYTE INPUT PROCEDURE
- WAIT BUSY BIT = 0 STATUS PORT BIT7 (HEX n79, n7D)
- READ LOW 4 BITS OF BYTE STATUS PORT BIT3-6 (HEX n79, n7D)
- REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
- WAIT BUSY BIT = 0 STATUS PORT BIT7 (HEX n79, n7D)
- READ HIGH 4 BITS OF BYTE STATUS PORT BIT3-6 (HEX n79, n7D)
- REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
- * 5 TYPES OF COMMAND
- * COMMAND LENGTH = 9 BYTES.
- * COMMAND FORMAT
- BYTE 1 D5 ID CODE 1
- BYTE 2 AA ID CODE 2
- BYTE 3 96 ID CODE 3
- BYTE 4 00|01|04|05|06 COMMAND CODE
- BYTE 5 al LOW BYTE OF ADDRESS
- BYTE 6 ah HIGH BYTE OF ADDRESS
- BYTE 7 ll LOW BYTE OF DATA LENGTH
- BYTE 8 lh HIGH BYTE OF DATA LENGTH
- BYTE 9 cc CHECKSUM = 81^BYTE4^BYTE5^BYTE6^BYTE7^BYTE8
- * COMMAND [00] : DOWNLOAD DATA
- al, ah = ADDRESS
- ll, lh = DATA LENGTH
- OUTPUT DATAS AFTER COMMAND
- * COMMAND [01] : UPLOAD DATA
- al, ah = ADDRESS
- ll, lh = DATA LENGTH
- INPUT DATAS AFTER COMMAND
- * COMMAND [04] : FORCE SFC PROGRAM TO JMP
- al, ah = ADDRESS
- * COMMAND [05] : SET MEMORY PAGE NUMBER
- al BIT0-1 = PAGE NUMBER
- al BIT2-7 + ah BIT0-1 = BANK NUMBER
- * COMMAND [06] : SUB FUNCTION
- al = 0 INITIAL DEVICE
- al = 1 PLAY GAME IN DRAM
- al = 2 PLAY CARTRIDGE
- ROM Protection Schemes
- This section details ways of bypassing the FastROM, PAL/NTSC and SRAM size
- checks implemented in many SNES games in order to stop people backing them
- up using copiers.
- Note: You don't necessarily have to find and replace all strings to remove
- the check(s).
- SlowROM checks
- Most cartridges these days use 120ns ROM in order to get the most out of
- the ageing SNES. However, there are still many copiers around which emulate
- ROM at speeds of 200ns meaning they cannot backup the newer cartridges
- correctly.
- Changing the ROM code to bypass the SlowROM check, found in many, but not
- all FastROM games, allows many people with SlowROM copiers to backup
- FastROM games.
- To patch a ROM and bypass the SlowROM check, you must find any of the
- following strings in the image and replace it with the patch string: (all
- codes in hex)
- Search for Replace with
- A9 01 8D 0D 42 A9 00 8D 0D 42
- A9 01 8E 0D 42 A9 00 8E 0D 42
- A2 01 8D 0D 42 A2 00 8D 0D 42
- A2 01 8E 0D 42 A2 00 8E 0D 42
- A9 01 00 8D 0D 42 A9 00 00 8D 0D 42
- A9 01 8F 0D 42 00 A9 00 8F 0D 42 00
- PAL/NTSC checks
- Most SNES games have code which detects which video system the cartridge is
- being played on and refuses to run if not in the right mode. This is to
- stop people from buying games from other countries before they are released
- locally.
- To bypass the PAL/NTSC check the following patterns must be found and
- replaced with the ones specified: (all codes in hex)
- Search for Replace with
- 3F 21 29 10 C9 10 F0 3F 21 29 10 C9 10 80
- 3F 21 89 10 C9 10 F0 3F 21 89 10 C9 10 80
- 3F 21 29 10 F0 3F 21 29 10 80
- 3F 21 00 89 10 F0 3F 21 00 89 10 80
- 3F 21 00 29 10 F0 3F 21 00 29 10 80
- 3F 21 89 10 00 F0 3F 21 89 10 00 80
- 3F 21 29 10 00 F0 3F 21 29 10 00 80
- AD 3F 21 29 10 00 D0 AD 3F 21 29 10 00 80
- AF 3F 21 00 29 10 D0 AF 3F 21 00 29 10 80
- AF 3F 21 00 29 10 00 D0 AF 3F 21 00 29 10 00 EA EA
- AD 3F 21 29 10 D0 AD 3F 21 29 10 EA EA
- AD 3F 21 29 10 F0 AD 3F 21 29 10 80
- AD 3F 21 89 10 D0 AD 3F 21 89 10 80
- AD 3F 21 29 10 C9 00 F0 AD 3F 21 29 10 C9 00 80
- AF 3F 21 00 29 10 00 F0 AF 3F 21 00 29 10 00 80
- AF 3F 21 00 89 10 00 F0 AF 3F 21 00 89 10 00 80
- SRAM size checks
- Some SNES games check to see how much SRAM is connected to the SNES as a
- form of copy protection. As most copiers have 256kbits standard, the game
- will know it's running on a backup unit and stop to prevent people copying
- the games. However, the newer copiers get around this detection somehow.
- To disable the SRAM size check in a ROM image, search for the following and
- replace as appropriate.
- Note: All codes are in hex, although 'xx' means anything, while a comma
- means search for either of the two or more (enclosed in brackets).
- Search for (8F, 9F) xx xx 70 (CF, DF) xx xx 70 D0
- Replace with (8F, 9F) xx xx 70 (CF, DF) xx xx 70 EA EA (if SRAM size of game = 64kbit)
- (8F, 9F) xx xx 70 (CF, DF) xx xx 70 80 (if SRAM size of game <> 64kbit)
- Search for (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) D0
- Replace with (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) 80
- Search for (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) F0
- Replace with (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) EA EA
- Search for (8F, 9F) xx xx (30, 31, 32, 33) AF xx xx (30, 31, 32, 33) C9 xx xx D0
- Replace with (8F, 9F) xx xx (30, 31, 32, 33) AF xx xx (30, 31, 32, 33) C9 xx xx 80
- Many thanks to Chp for making his uCON v1.41 source publicly available,
- from which these patterns came.
- IPS Patch Format
- This patch format is used a lot for patching SNES ROM images. Therefore I
- have included it's format in this text. For a more detailed explanation of
- the IPS format, please visit the Damaged Cybernetics WWW pages
- http://www.futureone.com/~damaged/.
- The format is as follows:
- Description Size
- IPS file identifier 5 bytes (characters PATCH)
- Offset in file to place patch 3 bytes
- Number of bytes in patch 2 bytes (allows 65535 patch bytes)
- Patch byte(s) (specified by 'No. of bytes in patch')
- . .
- . .
- Start again, looking 3 bytes (characters EOF)
- for new offset, unless
- and EOF is found.
- Sample IPS file contents with 2 offset points:
- PATCHooonn?ooonn?EOF
- o - Offset in file
- n - Number of bytes in patch
- ? - Data byte(s) (n number of bytes)
- Acknowledgements
- The following people have contributed to this text, whether they know it or
- not. Many thanks to them for their wonderful contribution(s).
- Donald Moore (moore@futureone.com)
- Chp (ronaldm@netcom.com)
- Thomas Rolfes (Thomas_Rolfes@ms.maus.de)
- Jeremy Chadwick(yoshi@parodius.com)
- Nigel Bryant (nbb@essex.ac.uk)
- Also used for the creation of this text was the rec.games.video Frequently
- Asked Questions (FAQ) file; a FAQ with a huge amount of information on
- consoles in general.
- [Image]
- Special thanks to Mark for the midi!
- [Image]
- Questions, comments or complaints can be sent to DiskDude via e-mail.
- Copyright © 1995-1996 DiskDude of Damaged Cybernetics. All rights reserved.
- Last updated 1st January 1997
- Damaged Cybernetics is not connected or affiliated with any mentioned
- company in any way. The opinions of Damaged Cybernetics do not reflect the
- views of the various companies mentioned here. Companies and all products
- pertaining to that company are trademarks of that company. Please contact
- that company for trademark and copyright information.
|