GameCube Ocarina of Time Master Quest version flashed to a real Nintendo 64 Cartridge, playable on N

Pinout I got so far:
N64 edge connector -> Max II CPLD Pin#
Reset -> 50
CLK -> 49
AD0 -> 72
AD1 -> 74
AD2 -> 76
AD3 -> 79
AD4 -> 82
AD5 -> 84
AD6 -> 86
AD7 -> 88
AD8 -> 73
AD9 -> 75
AD10 -> 77
AD11 -> 81
AD12 -> 83
AD13 -> 85
AD14 -> 87
AD15 -> 89
ALE_L -> 53
ALE_H -> 51
WRITE -> 54
READ -> 52

Flashrom -> Max II CPLD Pin#
CE#1 -> 69 (controlled by Max II depending on high part of address)
CE#2 -> 68 (controlled by Max II depending on high part of address)
OE -> 71 (controlled by N64 #read)
WE -> 5 (controlled by N64 #write)
WP -> 3.3V (not protected)
BYTE -> 3.3V (Word mode)

The Attiny Ultracic and the 2 sram chips are directly connected to the cart edge's VCC pin while the Max II CPLD and the flashroms are routed through a 662k 5V to 3.3V voltage converter. In my cart reader the voltage drops from 3.3V to 3.2V due to the voltage regulator, which is totally fine.
The jtag header is directly connected to this 3.3V line after the voltage converter.

Cartridge bus activity during Resident Evil intro video sequence.

 

Bit of a random entry here, but a friend of mine came over recently and I showed him the cartridge. When I told him it was a repro he was absolutely shocked and said there was no way! I told him "I don't think you've held an N64 cartridge for a while..." and pulled one of my legit games from the shelf. Once he picked both up could instantly tell the difference in build quality and such.

When it comes to looks they're definitely good enough to fool people if they haven't messed with a cartridge in a while or they're only limited to "okay" quality photos.

 

Dumping the repro works now.
The last few offsets have some additional bytes though.

The question is whether these are just read errors or if the chinese manufacturer did write the last few bytes wrongly to the flashroms or if those bytes are some sort of configuration for the Max II.
They look alot lot like a flashrom command sequence.

 

What would be the purpose of having the Flash commands at the end of the ROM space? Is it possible that they're also flashing the ROM chip through the cart connector, and those commands are required for that?

 

Yes, it's very likely that the flashrom chips were written through the cart connector. I can't speculate on the purpose of those extra bytes at the end of the rom yet. We would need more dumps to see if they are present in all of them or if it really was just a flashing error with this particular repro.

Now armed with the flash commands from the datasheet's table posted above, the pinout and the knowledge that the flash chips can be read correctly it's off to the next phase.
The first thing you want to do is reading the IDs of the flashrom. This will tell you that you can send commands to the flash correctly. Which ofc is essential.
To read the IDs you send 0xAA to address 0x555 followed by 0x55 to 0x2AA and finally 0x90 to 0x555.
Then the next two words you read should be 0x01 and 0x227E. At least that is what the datasheet tells us.

But before we write any Arduino code we first wire the logic analyzer to our repro pcb so we can debug it easier later on. Might not need it now but when you do you will be happy that the wiring work has already been done.


Next we just add some quick lines to the existing Arduino Cartridge Reader project and see what happens:

Code:

// Send Command
  setAddress_N64(romBase + (0x555 << 1));
  writeWord_N64(0xAA);
  setAddress_N64(romBase + (0x2AA << 1));
  writeWord_N64(0x55);
  setAddress_N64(romBase + (0x555 << 1));
  writeWord_N64(0x90);

  setAddress_N64(romBase + 0x00);
    // Read manufacturer ID 0x01
  Serial.println(readWord_N64(), HEX);
  // Read flashrom ID 0x227E
  Serial.println(readWord_N64(), HEX);

Let's hope that the flashrom accepts the commands and returns the right values when we read it...

And yes it does.

Next up: Completely deleting the flashroms and hoping you manage to rewrite them again and not just ruining a perfectly fine repro.

 

Nice work, sanni!

I'll dump my copy of the RE2 repro when it gets here.

 

EDIT:
Nothing to see here. Move along.

 

Just a quick status update. Re-writing the repros works now:


(wait times have been cut out to make the video smaller)

Also the price of those repros dropped to $16 shipped from ebay, they all seem to come with 64MB flash now:



If anyone of you does have a N64 repro other that the 6 on the following list and also can dump it somehow it would be great if you could share the last line of the rom file when viewed in a hex editor as we're trying to figure out what the bytes the repro manufacturer added at the end mean.

55 AA 55 AA 55 AA 55 AA 01 08 FF FF FF FF 58 FF // Super Smash Bros(SRAM save 16MB rom)
55 AA 55 AA 55 AA 55 AA 01 20 00 00 00 00 2F 00 // Resident Evil 2 (SRAM save 64MB rom)
55 AA 55 AA 55 AA 55 AA EE 08 00 00 00 00 D4 00 // Bomberman 2nd Attack (EEPROM save 16MB rom)
55 AA 55 AA 55 AA 55 AA EE 10 FF FF FF FF A4 FF // Mario Party 3 (EEPROM save 32MB rom)
55 AA 55 AA 55 AA 55 AA EE 20 FF FF FF FF BA FF // Conker BFD (EEPROM save 64MB rom)
55 AA 55 AA 55 AA 55 AA 01 10 FF FF FF FF FB FF// Zelda OoT Master Quest (SRAM save 32MB rom)

So far we're thinking:
01 = SRAM save
EE = EEPROM save
08 = 16MB rom
10 = 32MB rom
20 = 64MB rom

The second last byte is the checksum of the rom (just a simple addition of all bytes in the whole rom besides the checksum byte where you just add 0xFF)

Speculated:
04 = 8MB rom
02 = 4MB rom
01 = 2MB rom

Any help would be appreciated, thanks.

 

Nice

 

Just an FYI. I was playing the ROM the other day with the patches applied to restore the original N64 buttons on my 64 Drive and some tricky things are going on! After you fight Ganondorf and are running down the castle, you have to fight two stalfos. They literally would not die! I would get to that area with like 2:20 left and I couldn't even kill one. I remembered I was playing a hacked ROM so I copied my save and played the original unpatched MQ and had no problem beating them. I'm pretty sure I just grabbed a pre-patched ROM instead of applying it myself. So I would definitely apply the patch on your own and not trust a random .z64 hahah

 

That would be the Stalfos Bug.

It was only ever a bug in Aroenai's and my patches, and only there from May through June or July. If it's the PAL version, that could be either of our patches. If it's the NTSC version, that would be Aroenai's patch. As you said, re-patch with the newest patch available and you should be good.

 

OOT MQ card doesn't work with N64 pal + Passport3.
I wait a sanny's writer .

 

Try bridging the two pins marked blue together in this picture while making absolutely sure that they are not connected to the red pad.



This should switch the ultracic to PAL and it then should be able to boot on a PAL console.

Also use a multimeter to doublecheck that GND and VCC are not shorted together.
It seems like the pcb design is changing constantly so better be safe than sorry.

 

Your my hero for today. I was looking all around, if it was possible too get those repo's working on a PAL system.

But would it be possible, too insert the repro,(with the solder blob on the pins), and it will boot? or am I missing something?

 

There are a couple more catches:
- First the cart slot in the N64 has two tabs that you would need to remove since the repros do come with the US negavtive tab.
Or as an alternative you can just put the repro pcb into a PAL cartridge shell. Sadly so far the current repros do not come with the pirate negative tab in the picture that would work without modification.



- Second there are games that check your region via software by querying the osTvType register. As a rule of thumb early games don't do that but all later games do. So the solution to that would be to reflash the rom of the repro with a PAL rom. Or use a bootemulator that changes the osTvType, a good import adapter should do this.

Since I do not own a PAL console this is all just speculation as I am not able to test it.

 

Thanks.
I'll test today and i'll give my feedback.


Edit : tested but... killed the power supply (?)... you think it's possible ?

 

Can you upload a picture of your repro?
Did you accidentally connect all three of the pads together instead of only the bottom 2?
It could also be possible that the manufacturer changed the pcb design. There seem to be many variants of the N64 repro out now with lots of different chips and stuff.

The N64 power supply has a self resetting fuse, it should come back to life after a little while. But you should remove the bridge on the repro again until we can investigate further.

 

It's my fault, the welding has not been done in the right place ^^ I look badly at your image.
Sorry, I was very badly awake this morning.



My another OOT MQ card :

Tested the bride : WORKS !
Thanks sanni !

 

Nice, thanks for confirming

Also just a general hint for everyone, if you want to buy a repro you should buy one with a big game on it like Conker or Resident Evil since the repro manufacturer has gone over to using tiny 8MB flashroms for smaller games instead of the one size fits all 64MB flashroms he used before.

 

Thanks for the heads up. The hardware for saving is always the same though, right? Also, are 8MB/64MB the only sizes so far, or have 16/32 been encountered too?