Sneskart.txt 34 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216
  1. SNES Kart v1.6
  2. The most complete guide to a SNES cartridge worldwide
  3. . .
  4. ______ ______ .
  5. .:_\_ . \\_ .__\_::.
  6. . .::./ ./ // ./__ .:::. .
  7. :_<_____/<______>_:.
  8. . .
  9. Damaged Cybernetics Australia
  10. It is a crime to redistribute this document in a commercial
  11. venture of any kind without permission or a licensing agreement.
  12. Contact us via email for more information on licensing.
  13. This is freely distributable for non-commercial use, however we
  14. require that you acknowledge the following:
  15. SNES Kart 1.6 Copyright (c) 1995-1996 DiskDude. All rights reserved.
  16. [Image]
  17. None of the information contained in this text comes from any confidential
  18. source. It was obtained from various sources on the Internet, but also the
  19. product of my own investigation. Refer to the Acknowledgements section at
  20. the end of this text.
  21. Use this information for your own use, I will not take any responsibility
  22. for your actions. All copyrights and trademarks are owned by their
  23. respective owners, even if not acknowledged, no infringements intended.
  24. I wrote this because all of this information is scattered in small files
  25. everywhere, if existing at all, most of it outdated. This is an attempt to
  26. conveniently bring all of the information to one place, and as up-to-date
  27. as possible. If you find this useful, tell me! I love positive feedback.
  28. Contents
  29. Pin Layouts Cheat Device Decoding
  30. * What is the cartridge pin * Pro Action Replay (hardware)
  31. layout? * Gold Finger (software)
  32. * What is the ROM pin layout? * Game Genie (hardware)
  33. * What is the DSP1 pin layout? * Converting between CPU
  34. * What is the MAD-1 and its pin addresses and ROM addresses
  35. layout? * Easily converting between
  36. * What is the pin layout of the codes
  37. 16kbit SRAM most commonly used
  38. by Nintendo? SNES Copiers
  39. Cartridge Addressing Schemes * What are copiers?
  40. * Super Wild Card (SWC) header
  41. * LoROM cartridges information
  42. * HiROM cartridges * Pro Fighter (FIG) header
  43. format
  44. Embedded Cartridge Information * Game Doctor file name format
  45. * Super Wild Card parallel port
  46. * Game title (21 bytes) I/O protocol
  47. * ROM makeup (1 byte)
  48. * ROM type (1 byte) ROM Protection Schemes
  49. * ROM size (1 byte)
  50. * SRAM size (1 byte) * SlowROM checks
  51. * Country (1 byte) * PAL/NTSC checks
  52. * License (1 byte) * SRAM size checks
  53. * Game Version (1 byte)
  54. * Inverse ROM Checksum (2 bytes) IPS Patch Format
  55. * ROM Checksum (2 bytes)
  56. * Non Maskable Interrupt / VBL Acknowledgements
  57. Vector (2 bytes)
  58. * Reset Vector (2 bytes)
  59. * How do I know if the ROM is
  60. HiROM or LoROM?
  61. Pin Layouts
  62. What is the cartridge pin layout?
  63. If the SNES doesn't detect the CIC while power is on, then it will not
  64. continue to read the cartridge. Further details of this are not known to
  65. me.
  66. Super FX 01 32
  67. 02 33
  68. 03 34
  69. 04 35
  70. GND 05 36 GND
  71. F A11 06 37 A12
  72. r A10 07 38 A13
  73. o A9 08 39 A14
  74. n A8 09 40 A15
  75. t A7 10 41 BA0
  76. A6 11 42 BA1
  77. o A5 12 43 BA2
  78. f A4 13 44 BA3
  79. A3 14 45 BA4
  80. c A2 15 46 BA5
  81. a A1 16 47 BA6
  82. r A0 17 48 BA7
  83. t /IRQ 18 49 /CS
  84. D0 19 50 D4
  85. D1 20 51 D5
  86. D2 21 52 D6
  87. D3 22 53 D7
  88. /RD 23 54 /WR
  89. CIC out data (p1) 24 55 CIC out data (p2)
  90. CIC in data (p7) 25 56 CIC in clock (p6)
  91. RESET 26 57 nc
  92. Vcc 27 58 Vcc
  93. 28 59
  94. 29 60
  95. 30 61
  96. Left audio 31 62 Right audio
  97. LoROM: 32kbyte pages/banks (A15 not used - assumed high)
  98. HiROM: 64kbyte pages/banks
  99. BA0-BA7 switch between a possible 256 banks/pages.
  100. LoROM data is stored in the upper 32kbytes of the possible 64kbyte
  101. bank/page (A15 is assumed high). Using 64kbyte pages, the SNES can address
  102. a huge 16Mbytes or 128Mbits!
  103. According to a SNES memory map, LoROM games can be as large as 16Mbit while
  104. HiROM games are limited to 32Mbit... what about the 48Mbit game floating
  105. around?
  106. What is the ROM pin layout?
  107. This pin layout was taken from a Donkey Kong Country 2 cartridge and seems
  108. to be consistent with all their mask ROMs (some are 32pin, others 36pin).
  109. A20 Vcc
  110. A21 A22
  111. A17 01 32 Vcc
  112. A18 02 31 /OE
  113. A15 03 30 A19
  114. A12 04 29 A14
  115. A7 05 28 A13
  116. A6 06 27 A8
  117. A5 07 26 A9
  118. A4 08 25 A11
  119. A3 09 24 A16
  120. A2 10 23 A10
  121. A1 11 22 /CS
  122. A0 12 21 D7
  123. D0 13 20 D6
  124. D1 14 19 D5
  125. D2 16 18 D4
  126. Vss 16 17 D3
  127. What is the DSP1 pin layout?
  128. This was taken from a hacked Pilotwings cartridge with a switch on it -
  129. possibly to select between HiROM and LoROM DSP1 games. I'm not 100% sure
  130. that the following is correct or complete though.
  131. Vcc 01 28 Vcc
  132. Vcc 02 27 A14 (A12 - used for HiROM?)
  133. nc 03 26 /CS
  134. nc 04 25 /RD
  135. nc 05 24 /WR
  136. D0 06 23 ?
  137. D1 07 22 ?
  138. D2 08 21 Vcc
  139. D3 09 20 Vcc
  140. D4 10 19 Vcc
  141. D5 11 18 Vcc
  142. D6 12 17 GND
  143. D7 13 16 /RESET (inverted RESET- SNES slot)
  144. D8 14 15 CLOCK?
  145. If you can verify/correct this, it would be greatly appreciated.
  146. What is the MAD-1 and its pin layout?
  147. The MAD-1 stands for Memory Address Decoder revision 1. It is used on the
  148. Donkey Kong Country (1 and 2) cartridge and possibly other cartridges in
  149. order to address one or two ROMs and a static RAM.
  150. /HI 01 16 /LO
  151. /SE 02 15 A13
  152. 03 14 A14
  153. /RE 04 13 BA5
  154. Vcc 05 12 A15
  155. Vcc 06 11 /CS (p49 SNES slot)
  156. Vcc 07 10 Vcc
  157. GND 08 09 RESET (p26 SNES slot)
  158. /RE - /CS on a 32Mbit ROM (possibly for MAD-1a only)
  159. /LO - /CS on ROM1 (lower 16mbit)
  160. /HI - /CS on ROM2 (upper 16mbit)
  161. /SE - /CS on Static RAM
  162. What is the pin layout of the 16kbit SRAM most commonly used by Nintendo?
  163. It seems that Nintendo uses this SRAM in many of their games, mainly
  164. because it is very cheap, only $A5 (retail) - much cheaper for Nintendo who
  165. buys millions of them. It can address up to 2048 bytes or 16kbits.
  166. A7 01 24 Vcc
  167. A6 02 23 A8
  168. A5 03 22 A9
  169. A4 04 21 /WE
  170. A3 05 20 /OE
  171. A2 06 19 A10
  172. A1 07 18 /CS
  173. A0 08 17 D7
  174. D0 09 16 D6
  175. D1 10 15 D5
  176. D2 11 14 D4
  177. Vss 12 13 D3
  178. Cartridge Addressing Schemes
  179. LoROM cartridges: HiROM cartridges:
  180. read ROM /RD, /CS, RESET low read ROM /CS, /RD, RESET low
  181. /WR high /WR high
  182. read SRAM /CS, /RD low read SRAM /RD low
  183. RESET, /WR high RESET, /WR, /CS high
  184. A15, BA4, BA5 high A13, A14, BA5 high
  185. write SRAM /CS, /WR low write SRAM /WR low
  186. RESET, /RD high RESET, /RD, /CS high
  187. A15, BA4, BA5 high A13, A14, BA5 high
  188. Would anyone like to verify this?
  189. Embedded Cartridge Information
  190. Most of the information in this section was obtained from Mindrape's SNES
  191. ROM, available from http://www.futureone.com/~damaged/.
  192. All values are in decimal unless specified with a trailing 'h'.
  193. The starting offset for this information is located at the end of the first
  194. page:
  195. LoROM: offset 32704
  196. HiROM: offset 65472
  197. Game title (21 bytes)
  198. The title is in upper case on most games.
  199. ROM makeup (1 byte)
  200. Upper nibble (4 bits):
  201. Value ROM speed
  202. 0 SlowROM (200ns)
  203. 3 FastROM (120ns)
  204. Lower nibble (4 bits):
  205. Value Bank size
  206. 0 LoROM (32kb banks)
  207. 1 HiROM (64kb banks)
  208. ROM type (1 byte)
  209. Byte ROM type
  210. 0 ROM only
  211. 1 ROM and RAM
  212. 2 ROM and Save RAM
  213. 3 ROM and DSP1 chip
  214. 4 ROM, RAM and DSP1 chip
  215. 5 ROM, Save RAM and DSP1 chip
  216. 19 ROM and Super FX chip
  217. 227 ROM, RAM and GameBoy data
  218. 246 ROM and DSP2 chip
  219. ROM size (1 byte)
  220. Byte ROM size
  221. 8 2 MegaBits
  222. 9 4 MegaBits
  223. 10 8 MegaBits
  224. 11 16 MegaBits
  225. 12 32 MegaBits
  226. At the time of writing, the largest SNES game is 48Mbit, while 8Mbit
  227. cartridges are the most common. There are cartridge sizes of 10Mbit,
  228. 12Mbit, 20Mbit and 24Mbit, which are reported as 16Mbit, 16Mbit, 16Mbit and
  229. 32Mbit respectively.
  230. Another way of calculating the ROM size is: 1 shl (ROMbyte-7) MegaBits
  231. SRAM size (1 byte)
  232. Byte SRAM size
  233. 0 (none)
  234. 1 16 KiloBits
  235. 2 32 KiloBits
  236. 3 64 KiloBits
  237. 64 KiloBit SRAM's are the largest Nintendo uses (except DOOM?), while most
  238. copiers have 256 kiloBits on-board.
  239. Another way of calculating the SRAM size is: 1 shl (SRAMbyte+3) KiloBits
  240. Country (1 byte)
  241. Byte Country Video system
  242. 0 Japan NTSC
  243. 1 USA NTSC
  244. 2 Australia, Europe, Oceania and Asia PAL
  245. 3 Sweden PAL
  246. 4 Finland PAL
  247. 5 Denmark PAL
  248. 6 France PAL
  249. 7 Holland PAL
  250. 8 Spain PAL
  251. 9 Germany, Austria and Switzerland PAL
  252. 10 Italy PAL
  253. 11 Hong Kong and China PAL
  254. 12 Indonesia PAL
  255. 13 Korea PAL
  256. License (1 byte)
  257. Byte Company Byte Company
  258. 1 Nintendo 131 Lozc
  259. 3 Imagineer-Zoom 132 Koei
  260. 5 Zamuse 134 Tokuma Shoten Intermedia
  261. 6 Falcom 136 DATAM-Polystar
  262. 8 Capcom 139 Bullet-Proof Software
  263. 9 HOT-B 140 Vic Tokai
  264. 10 Jaleco 142 Character Soft
  265. 11 Coconuts 143 I''Max
  266. 12 Rage Software 144 Takara
  267. 14 Technos 145 CHUN Soft
  268. 15 Mebio Software 146 Video System Co., Ltd.
  269. 18 Gremlin Graphics 147 BEC
  270. 19 Electronic Arts 149 Varie
  271. 21 COBRA Team 151 Kaneco
  272. 22 Human/Field 153 Pack in Video
  273. 23 KOEI 154 Nichibutsu
  274. 24 Hudson Soft 155 TECMO
  275. 26 Yanoman 156 Imagineer Co.
  276. 28 Tecmo 160 Telenet
  277. 30 Open System 164 Konami
  278. 31 Virgin Games 165 K.Amusement Leasing Co.
  279. 32 KSS 167 Takara
  280. 33 Sunsoft 169 Technos Jap.
  281. 34 POW 170 JVC
  282. 35 Micro World 172 Toei Animation
  283. 38 Enix 173 Toho
  284. 39 Loriciel/Electro Brain 175 Namco Ltd.
  285. 40 Kemco 177 ASCII Co. Activison
  286. 41 Seta Co.,Ltd. 178 BanDai America
  287. 45 Visit Co.,Ltd. 180 Enix
  288. 49 Carrozzeria 182 Halken
  289. 50 Dynamic 186 Culture Brain
  290. 51 Nintendo 187 Sunsoft
  291. 52 Magifact 188 Toshiba EMI
  292. 53 Hect 189 Sony Imagesoft
  293. 60 Empire Software 191 Sammy
  294. 61 Loriciel 192 Taito
  295. 64 Seika Corp. 194 Kemco
  296. 65 UBI Soft 195 Square
  297. 70 System 3 196 Tokuma Soft
  298. 71 Spectrum Holobyte 197 Data East
  299. 73 Irem 198 Tonkin House
  300. 75 Raya Systems/Sculptured Software 200 KOEI
  301. 76 Renovation Products 202 Konami USA
  302. 77 Malibu Games/Black Pearl 203 NTVIC
  303. 79 U.S. Gold 205 Meldac
  304. 80 Absolute Entertainment 206 Pony Canyon
  305. 81 Acclaim 207 Sotsu Agency/Sunrise
  306. 82 Activision 208 Disco/Taito
  307. 83 American Sammy 209 Sofel
  308. 84 GameTek 210 Quest Corp.
  309. 85 Hi Tech Expressions 211 Sigma
  310. 86 LJN Toys 214 Naxat
  311. 90 Mindscape 216 Capcom Co., Ltd.
  312. 93 Tradewest 217 Banpresto
  313. 95 American Softworks Corp. 218 Tomy
  314. 96 Titus 219 Acclaim
  315. 97 Virgin Interactive Entertainment 221 NCS
  316. 98 Maxis 222 Human Entertainment
  317. 103 Ocean 223 Altron
  318. 105 Electronic Arts 224 Jaleco
  319. 107 Laser Beam 226 Yutaka
  320. 110 Elite 228 T&ESoft
  321. 111 Electro Brain 229 EPOCH Co.,Ltd.
  322. 112 Infogrames 231 Athena
  323. 113 Interplay 232 Asmik
  324. 114 LucasArts 233 Natsume
  325. 115 Parker Brothers 234 King Records
  326. 117 STORM 235 Atlus
  327. 120 THQ Software 236 Sony Music Entertainment
  328. 121 Accolade Inc. 238 IGS
  329. 122 Triffix Entertainment 241 Motown Software
  330. 124 Microprose 242 Left Field Entertainment
  331. 127 Kemco 243 Beam Software
  332. 128 Misawa 244 Tec Magik
  333. 129 Teichio 249 Cybersoft
  334. 130 Namco Ltd. 255 Hudson Soft
  335. Game Version (1 byte)
  336. The version is stored as version 1.VersionByte and must be less than 128.
  337. i.e. Less than 1.128.
  338. Inverse ROM Checksum (2 bytes)
  339. This is the same as XORing the two checksum bytes. i.e. The checksum bits
  340. are inversed.
  341. ROM Checksum (2 bytes)
  342. The checksum is a 16bit word with the lower 8bits stored first, followed by
  343. the upper 8bits.
  344. The checksum is calculated by dividing the ROM into 4Mbit chunks then
  345. adding all the bytes in these chunks together. Once you have the checksum
  346. for each chunk, add them together and take the lower 32bits of the result.
  347. With a non-standard image size, you do not get it equally divisible by
  348. 4Mbit (excluding 2Mbit images). e.g. 10Mbit = 4Mbit + 4Mbit + 2Mbit chunks.
  349. Therefore, you must create a 4Mbit chunk from what is left over. Using the
  350. same example, you would add the checksum of the following chunks to get the
  351. ROM checksum:
  352. 4Mbit + 4Mbit + (2Mbit + 2Mbit)
  353. or
  354. 4Mbit + 4Mbit + (2 x 2Mbit)
  355. Non Maskable Interrupt / VBL Vector (2 bytes)
  356. LoROM: at offset 33274
  357. HiROM: at offset 66042
  358. Reset Vector (2 bytes)
  359. Where to start the ROM code.
  360. LoROM: at offset 33276
  361. HiROM: at offset 66042 [correction by Qwertie: 66044?]
  362. How do I know if the ROM is HiROM or LoROM?
  363. When you OR the checksum bytes of a disk image and the inverse checksum
  364. bytes, the result should be FFFF hex. Therefore, to detect whether an image
  365. is HiROM or LoROM, you must read those bytes, OR them, and see if they
  366. equal FFFF hex.
  367. The ROM's type depends at which location the OR'd bytes equal FFFF hex. If
  368. it isn't found at either location, then the other way of checking is to see
  369. at which location the title contains uppercase alphanumeric characters.
  370. (But this fails with most Japanese cartridges)
  371. Why don't you use the ROM Makeup Byte? You can, and some utilities do, but
  372. some utilities allow you to change this byte, so incorrect results may
  373. occur.
  374. For the actual ROM, the embedded cartridge information is stored at the
  375. same position for both LoROM and HiROM. In this case, you must use the ROM
  376. Makeup Byte or read a 64kb page and see if both 32kb chunks (upper and
  377. lower 32kb) are the same. If they are the same, it is LoROM (32kb pages -
  378. A15 is not used, the data repeats itself) otherwise it is HiROM.
  379. As a general rule of thumb, if you can't detect which ROM type it is,
  380. default to LoROM, as these are the most common of cartridges.
  381. Cheat Device Decoding
  382. We'll start with the easiest first then work our way down. These codes work
  383. by replacing a byte at a specific location in the ROM.
  384. E.g. In the game F-Zero, at a particular position in the ROM, there is a
  385. number 3 indicating 3 lives to start off with. What a cheat code will do is
  386. replace this byte with, let's say, the number 9, so now when the game is
  387. run, the player starts off with 9 lives.
  388. Pro Action Replay (hardware)
  389. Code format: AAAAAADD (8 digits)
  390. A - Address
  391. D - Data
  392. These codes are in Hex, the address being a CPU address, not a direct ROM
  393. location (more about this later).
  394. Gold Finger (software)
  395. Code format: AAAAADDDDDDCCW (14 digits)
  396. A - Address
  397. D - Data
  398. C - Checksum
  399. W - What to change (DRAM or SRAM)
  400. This code was designed for the copiers, and are straight Hex characters.
  401. Therefore the Address is a ROM address, not a CPU address. Data bytes are
  402. arranged in 2 characters (2 D's per byte), which allows for 3 bytes. If a
  403. byte is not being used, it is denoted by 'XX'. I have never seen a code
  404. with three unused bytes - what's the point of one anyhow?
  405. The address (A's) is a base address. The first data byte (D's) is to be
  406. placed at this address. The second at address+1, the third at address+2 (if
  407. to be used, that is, if they are not 'XX').
  408. To calculate the checksum you must take the A's and D's, add a zero (0) to
  409. the front of the shortened code, then divide into block's of 2 hex digits
  410. (bytes). Add these hex digits together (2 characters per hex digit) then
  411. minus 160 hex (352 decimal). Now AND this number by FF hex (255 decimal) to
  412. get the lower 8 bits (byte). Convert this number to hex and you have your
  413. checksum (C's).
  414. W tells the copier whether to replace the byte in the DRAM (ROM image) or
  415. the SRAM (Saved game static RAM) of the copier.
  416. Value of W Where to place byte
  417. 0 DRAM (ROM image)
  418. 1 SRAM (Saved game image)
  419. The rec.games.video FAQ specifies that there may be non- standard values of
  420. 2, 8, A, C, F for W, which may be converted to 0. I personally have only
  421. seen Gold Finger codes with W = 0.
  422. Game Genie (hardware)
  423. Code format: DDAA-AAAA (8 digits)
  424. A - Address
  425. D - Data
  426. This is the most difficult code to decipher out of the lot. It is as
  427. follows:
  428. First take the code in the form xxxx-xxxx and take out the dash ('-') to
  429. form xxxxxxxx. Convert these characters (Genie Hex) to normal hex
  430. characters using the following table:
  431. Genie Hex: D F 4 7 0 9 1 5 6 B C 8 A 2 3 E
  432. Normal Hex: 0 1 2 3 4 5 6 7 8 9 A B C D E F
  433. The first two characters is the data byte in Hex. Now take the other 6
  434. following characters (encoded address) and put it into it's binary form of
  435. 24 bits.
  436. Now take each bit of the encoded address and rearrange to form the real
  437. address:
  438. 24bit encoded address: ijklqrst opabcduv wxefghmn
  439. 8bit encoded data: ABCDEFGH
  440. Rearrange as:
  441. 24bit address : 8bit data
  442. abcdefgh ijklmnop qrstuvwx: ABCDEFGH
  443. MSB LSB MSB LSB
  444. Bit 23 of the encoded address (bit 15 of the real address) is always 1. The
  445. reason being that the SNES CPU address must be 1 for it to access the ROM.
  446. Converting between CPU addresses and ROM addresses
  447. This is very easy once you understand how it is done. To convert from a CPU
  448. address to a ROM address, all you need to do is remove bit 15. By doing
  449. this, I don't mean just setting it to 0. I mean by removing it, then moving
  450. all bits after it down one.
  451. e.g. ROMaddress = (CPUaddress and 7FFFh) or ((CPUaddress and FF0000h) shl 1)
  452. Therefore, to convert from a ROM address to a CPU address, you must insert
  453. a high bit into position 15 (bit 15).
  454. e.g. CPUaddress = (ROMaddress and 7FFFh) or ((ROMaddress and 7F8000h) shr 1) or 8000h
  455. Easily converting between codes
  456. I have made available two DOS programs with source code on my WWW pages
  457. which allow you to convert between Game Genie and Gold Finger codes. These
  458. are available freely from http://www.parodius.com/~diskdude/CartDisk/.
  459. Note: Because the Gold Finger can only address upto 8Mbit of game data,
  460. while other codes can address upto 64Mbit of game data, some Game Genie and
  461. Action Replay codes may not be converted to Gold Finger.
  462. SNES Copiers
  463. What are copiers?
  464. A copier is a device which sits on top of the SNES and allows you to backup
  465. your cartridges as well as play your backed up games. It does this by
  466. storing the ROM image of a cartridge to floppy disks via a 1.44Mb disk
  467. drive. Most copiers also include a parallel PC port interface, allowing
  468. your PC to control the unit and store images on your hard drive.
  469. Copier's contain DRAM from 1 Megabyte to 16 Megabytes, 8MegaBits to
  470. 128MegaBits respectively. This is the reason why they are so expensive.
  471. It is legal to own and use a copier for your own personal backup of
  472. cartridges which you legally own in this point in time, although it is
  473. illegal to distribute this copy (only one copy is allowed). This may vary
  474. depending on where you live.
  475. If you wish to make your own "home brew" copier for the SNES, and other
  476. consoles, more information can be found at
  477. http://www.parodius.com/~diskdude/CartDisk/.
  478. Super Wild Card (SWC) header information
  479. The SWC (Super Wild Card) image format consists of a 512 byte header. It's
  480. layout is as follows (set unused bytes to 00h):
  481. Offset Function
  482. 0 Lower 8 bits of size word
  483. 1 Upper 8 bits of size word
  484. 2 Image information byte
  485. 8 SWC header identifier (set to AAh)
  486. 9 SWC header identifier (set to BBh)
  487. 10 SWC header identifier (set to 04h)
  488. The size word is calculated by multiplying the image size, not game size
  489. (in MegaBits) by 16. e.g. Image is 4 Mbits, so size word would be 4*16=64.
  490. Image information byte (in the form of 76543210):
  491. Bit Description
  492. 7 1 - Run program in Mode 0 (JMP $8000)
  493. 0 - Run program in Mode 1 (JMP RESET Vector)
  494. 6 1 - Multi image (there is another split file to follow)
  495. 0 - Not multi image (no more split files to follow)
  496. 5 1 - SRAM memory mapping Mode 21 (HiROM)
  497. 0 - SRAM memory mapping Mode 20
  498. 4 1 - DRAM memory mapping Mode 21 (HiROM)
  499. 0 - DRAM memory mapping Mode 20
  500. 3/2 00: 256kbit SRAM
  501. 01: 65kbit SRAM
  502. 10: 16kbit SRAM
  503. 11: no SRAM
  504. 1/0 reserved
  505. Pro Fighter (FIG) header format
  506. This format is similar to the SWC. It consists of a 512byte header who's
  507. layout is as follows (set unused bytes to 00h):
  508. Offset Function
  509. 0 Lower 8 bits of size word
  510. 1 Upper 8 bits of size word
  511. 2 40h - Multi image
  512. 00h - Last image in set (or single image)
  513. 3 80h - if HiROM
  514. 00h - if LoROM
  515. 4 If using DSP1 microchip:
  516. FDh - If using SRAM (SRAM size>0)
  517. 47h - If no SRAM (SRAM size=0)
  518. 77h - If not using DSP1 and no SRAM (SRAM size=0)
  519. 5 If using DSP1 microchip:
  520. 82h - If using SRAM (SRAM size>0)
  521. 83h - If no SRAM (SRAM size=0)
  522. 83h - If not using DSP1 and no SRAM (SRAM size=0)
  523. Game Doctor file name format
  524. The Game Doctor does not use a 512 byte header like the SWC, instead it
  525. uses specially designed filenames to distinguish between multi files. I'm
  526. not sure if it used the filename for information about the size of the
  527. image though.
  528. Usually, the filename is in the format of: SFXXYYYZ.078
  529. Where SF means Super Famicon, XX refers to the size of the image in Mbit.
  530. If the size is only one character (i.e. 2, 4 or 8 Mbit) then no leading "0"
  531. is inserted.
  532. YYY refers to a catalogue number in Hong Kong shops identifying the game
  533. title. (0 is Super Mario World, 1 is F- Zero, etc). I was told that the
  534. Game Doctor copier produces a random number when backing up games.
  535. Z indicates a multi file. Like XX, if it isn't used it's ignored.
  536. A would indicate the first file, B the second, etc. I am told 078 is not
  537. needed, but is placed on the end of the filename by systems in Asia.
  538. e.g. The first 16Mbit file of Donkey Kong Country (assuming it is cat. no.
  539. 475) would look like: SF16475A.078
  540. Super Wild Card parallel port I/O protocol
  541. I was given this information a while ago. It is supposed to be direct from
  542. the company which makes SWC's and I have included this information because
  543. a few people have been asking for it. If you have similar information for
  544. other backup devices, it would be appreciated if you could send it to me.
  545. [PROTOCOL USED IN PC]
  546. * BYTE OUTPUT PROCEDURE
  547. WAIT BUSY BIT = 1 STATUS PORT BIT7 (HEX n79, n7D)
  548. WRITE ONE BYTE DATA LATCH (HEX n78, n7C)
  549. REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
  550. * BYTE INPUT PROCEDURE
  551. WAIT BUSY BIT = 0 STATUS PORT BIT7 (HEX n79, n7D)
  552. READ LOW 4 BITS OF BYTE STATUS PORT BIT3-6 (HEX n79, n7D)
  553. REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
  554. WAIT BUSY BIT = 0 STATUS PORT BIT7 (HEX n79, n7D)
  555. READ HIGH 4 BITS OF BYTE STATUS PORT BIT3-6 (HEX n79, n7D)
  556. REVERSE STROBE BIT CONTROL PORT BIT0 (HEX n7A, n7E)
  557. * 5 TYPES OF COMMAND
  558. * COMMAND LENGTH = 9 BYTES.
  559. * COMMAND FORMAT
  560. BYTE 1 D5 ID CODE 1
  561. BYTE 2 AA ID CODE 2
  562. BYTE 3 96 ID CODE 3
  563. BYTE 4 00|01|04|05|06 COMMAND CODE
  564. BYTE 5 al LOW BYTE OF ADDRESS
  565. BYTE 6 ah HIGH BYTE OF ADDRESS
  566. BYTE 7 ll LOW BYTE OF DATA LENGTH
  567. BYTE 8 lh HIGH BYTE OF DATA LENGTH
  568. BYTE 9 cc CHECKSUM = 81^BYTE4^BYTE5^BYTE6^BYTE7^BYTE8
  569. * COMMAND [00] : DOWNLOAD DATA
  570. al, ah = ADDRESS
  571. ll, lh = DATA LENGTH
  572. OUTPUT DATAS AFTER COMMAND
  573. * COMMAND [01] : UPLOAD DATA
  574. al, ah = ADDRESS
  575. ll, lh = DATA LENGTH
  576. INPUT DATAS AFTER COMMAND
  577. * COMMAND [04] : FORCE SFC PROGRAM TO JMP
  578. al, ah = ADDRESS
  579. * COMMAND [05] : SET MEMORY PAGE NUMBER
  580. al BIT0-1 = PAGE NUMBER
  581. al BIT2-7 + ah BIT0-1 = BANK NUMBER
  582. * COMMAND [06] : SUB FUNCTION
  583. al = 0 INITIAL DEVICE
  584. al = 1 PLAY GAME IN DRAM
  585. al = 2 PLAY CARTRIDGE
  586. ROM Protection Schemes
  587. This section details ways of bypassing the FastROM, PAL/NTSC and SRAM size
  588. checks implemented in many SNES games in order to stop people backing them
  589. up using copiers.
  590. Note: You don't necessarily have to find and replace all strings to remove
  591. the check(s).
  592. SlowROM checks
  593. Most cartridges these days use 120ns ROM in order to get the most out of
  594. the ageing SNES. However, there are still many copiers around which emulate
  595. ROM at speeds of 200ns meaning they cannot backup the newer cartridges
  596. correctly.
  597. Changing the ROM code to bypass the SlowROM check, found in many, but not
  598. all FastROM games, allows many people with SlowROM copiers to backup
  599. FastROM games.
  600. To patch a ROM and bypass the SlowROM check, you must find any of the
  601. following strings in the image and replace it with the patch string: (all
  602. codes in hex)
  603. Search for Replace with
  604. A9 01 8D 0D 42 A9 00 8D 0D 42
  605. A9 01 8E 0D 42 A9 00 8E 0D 42
  606. A2 01 8D 0D 42 A2 00 8D 0D 42
  607. A2 01 8E 0D 42 A2 00 8E 0D 42
  608. A9 01 00 8D 0D 42 A9 00 00 8D 0D 42
  609. A9 01 8F 0D 42 00 A9 00 8F 0D 42 00
  610. PAL/NTSC checks
  611. Most SNES games have code which detects which video system the cartridge is
  612. being played on and refuses to run if not in the right mode. This is to
  613. stop people from buying games from other countries before they are released
  614. locally.
  615. To bypass the PAL/NTSC check the following patterns must be found and
  616. replaced with the ones specified: (all codes in hex)
  617. Search for Replace with
  618. 3F 21 29 10 C9 10 F0 3F 21 29 10 C9 10 80
  619. 3F 21 89 10 C9 10 F0 3F 21 89 10 C9 10 80
  620. 3F 21 29 10 F0 3F 21 29 10 80
  621. 3F 21 00 89 10 F0 3F 21 00 89 10 80
  622. 3F 21 00 29 10 F0 3F 21 00 29 10 80
  623. 3F 21 89 10 00 F0 3F 21 89 10 00 80
  624. 3F 21 29 10 00 F0 3F 21 29 10 00 80
  625. AD 3F 21 29 10 00 D0 AD 3F 21 29 10 00 80
  626. AF 3F 21 00 29 10 D0 AF 3F 21 00 29 10 80
  627. AF 3F 21 00 29 10 00 D0 AF 3F 21 00 29 10 00 EA EA
  628. AD 3F 21 29 10 D0 AD 3F 21 29 10 EA EA
  629. AD 3F 21 29 10 F0 AD 3F 21 29 10 80
  630. AD 3F 21 89 10 D0 AD 3F 21 89 10 80
  631. AD 3F 21 29 10 C9 00 F0 AD 3F 21 29 10 C9 00 80
  632. AF 3F 21 00 29 10 00 F0 AF 3F 21 00 29 10 00 80
  633. AF 3F 21 00 89 10 00 F0 AF 3F 21 00 89 10 00 80
  634. SRAM size checks
  635. Some SNES games check to see how much SRAM is connected to the SNES as a
  636. form of copy protection. As most copiers have 256kbits standard, the game
  637. will know it's running on a backup unit and stop to prevent people copying
  638. the games. However, the newer copiers get around this detection somehow.
  639. To disable the SRAM size check in a ROM image, search for the following and
  640. replace as appropriate.
  641. Note: All codes are in hex, although 'xx' means anything, while a comma
  642. means search for either of the two or more (enclosed in brackets).
  643. Search for (8F, 9F) xx xx 70 (CF, DF) xx xx 70 D0
  644. Replace with (8F, 9F) xx xx 70 (CF, DF) xx xx 70 EA EA (if SRAM size of game = 64kbit)
  645. (8F, 9F) xx xx 70 (CF, DF) xx xx 70 80 (if SRAM size of game <> 64kbit)
  646. Search for (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) D0
  647. Replace with (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) 80
  648. Search for (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) F0
  649. Replace with (8F, 9F) xx xx (30, 31, 32, 33) (CF, DF) xx xx (30, 31, 32, 33) EA EA
  650. Search for (8F, 9F) xx xx (30, 31, 32, 33) AF xx xx (30, 31, 32, 33) C9 xx xx D0
  651. Replace with (8F, 9F) xx xx (30, 31, 32, 33) AF xx xx (30, 31, 32, 33) C9 xx xx 80
  652. Many thanks to Chp for making his uCON v1.41 source publicly available,
  653. from which these patterns came.
  654. IPS Patch Format
  655. This patch format is used a lot for patching SNES ROM images. Therefore I
  656. have included it's format in this text. For a more detailed explanation of
  657. the IPS format, please visit the Damaged Cybernetics WWW pages
  658. http://www.futureone.com/~damaged/.
  659. The format is as follows:
  660. Description Size
  661. IPS file identifier 5 bytes (characters PATCH)
  662. Offset in file to place patch 3 bytes
  663. Number of bytes in patch 2 bytes (allows 65535 patch bytes)
  664. Patch byte(s) (specified by 'No. of bytes in patch')
  665. . .
  666. . .
  667. Start again, looking 3 bytes (characters EOF)
  668. for new offset, unless
  669. and EOF is found.
  670. Sample IPS file contents with 2 offset points:
  671. PATCHooonn?ooonn?EOF
  672. o - Offset in file
  673. n - Number of bytes in patch
  674. ? - Data byte(s) (n number of bytes)
  675. Acknowledgements
  676. The following people have contributed to this text, whether they know it or
  677. not. Many thanks to them for their wonderful contribution(s).
  678. Donald Moore (moore@futureone.com)
  679. Chp (ronaldm@netcom.com)
  680. Thomas Rolfes (Thomas_Rolfes@ms.maus.de)
  681. Jeremy Chadwick(yoshi@parodius.com)
  682. Nigel Bryant (nbb@essex.ac.uk)
  683. Also used for the creation of this text was the rec.games.video Frequently
  684. Asked Questions (FAQ) file; a FAQ with a huge amount of information on
  685. consoles in general.
  686. [Image]
  687. Special thanks to Mark for the midi!
  688. [Image]
  689. Questions, comments or complaints can be sent to DiskDude via e-mail.
  690. Copyright © 1995-1996 DiskDude of Damaged Cybernetics. All rights reserved.
  691. Last updated 1st January 1997
  692. Damaged Cybernetics is not connected or affiliated with any mentioned
  693. company in any way. The opinions of Damaged Cybernetics do not reflect the
  694. views of the various companies mentioned here. Companies and all products
  695. pertaining to that company are trademarks of that company. Please contact
  696. that company for trademark and copyright information.