Help dumping Mega Drive game w/DPF or MGH

Help dumping Super Mario World 64 for MD/Gen

Hi;

I was in the process of dumping all my cartridges that are either pirate variants or undumped unlicensed games. I ran into a particular snag with one unlicensed Mega Drive cart that I'm unsure how to get around.

Currently I've got a 16m Multi-Game Hunter and a 24m Double Pro Fighter trying to dump a Mega Drive game. The cart plays fine on my machine without any problems. When connected to either of these copiers it does not even show up, both report a game not inserted in the cart slot.

I've dug around a bit trying to find some more information, possibly someone else that has run into the same situation. All I've managed to find is a guy that was trying to dump a Sonic 3 cart with a DPF, he found that by masking over a few pins on the right hand side of the cart connector he got the game to show up and dump properly.

Any ideas? I'm sure there's some sort of copy protection in place as most of these original run unlicensed games have, but all I've ran into at least showed up when connected to a copier.

 

have you tried dumping with a sega cd transfer cable?

 

It's possible the cart information at the beginning of ROM doesn't exist or is invalid so maybe the copier relies on that. I think the Sega CD transfer method allows you to specify ROM size for dumping which means it wouldn't rely on valid cart info in the ROM.

 

MD copiers can only dump standard licensed games, and not even very well. Unlicensed MD games often have unique memory decoding and bankswitching so it's unlikely there's anything you can do without a lot of technical expertise or a device programmer.

Basically if the game has unknown hardware you can tinker with the cart with custom dumping software and either implement your own PC interface like the MCD transfer tool, or hack the algorithm into a copier.

LOTS OF WORK.

On the other hand you can just read the ROM with a device programmer which takes little understanding or time. From there other people can disassemble the game to try to understand the hardware and implement it in emulators or whatever.

If you took a picture of the board that could give an understanding of what's being dealt with here, maybe I'm overthinking it.

 

Assuming the chip is easily identified and a programmer found this is likely the best method.

Though dumping via the SegaCD method is a good option as well. Any accidental overdump could be trimmed off.

 

You obviously know more about this hardware than I do, but I must admit that between these two devices I have dumped about a dozen unlicensed games, several of them undumped or not shared publicly. I had never ran into this problem before.

Of course anything that had copy protection did not work unpatched, but it managed to dump everything correctly to produce an image suitable for patching.

Not that I'm saying you're wrong, but that I had done this before with similar software and never ran into this particular problem.

Unfortunately both games use a combination of chips and a globtop.

Looks like the Sega CD cable is my only option and I do not own one. If someone has one that I could borrow I would certainly appreciate it.

 

the Sega CD cable is meant to be built on your own, it was never sold as a packaged product. I built mine myself out of radioshack parts, it is very simple - http://www.retrodev.com/transfer.html

you will need a PC with an LPT port, which could be troublesome if you only have a relatively new PC handy.

fwiw the transfer cable cannot dump Pier Solar

 

I guess I misspoke, I mean the unlicensed library relative to the licensed library which follows a very standard hardware arrangement enforced by Sega.

All copy protected games have some odd hardware (or something called "partial decoding") which break copier compatibility. The only reason these games could have been dumped with the old copiers is because they had to have been decoded to the standard ROM area and didn't use bankswitching; effectively the same simple hardware as a licensed game. The MGH is so bad at dumping games I vaguely remember not being able to dump a 16M game (which doesn't even use bankswitching) much less a 24M or 32M game.

Are you sure the chips aren't the ROMs? It's possible the epoxy contains a mapper. Post some pics.

The cable isn't magic, the software has support for only so many boards. If you have a new undiscovered board that isn't supported, a new algorithm needs to be written, and without that, the SCD cable isn't any more useful than the MGH or DPF.

 

What game are you trying to dump ? A picture of the board would help as well.

A lot of chinese/taiwanese pirates (generally those illegally using licensed characters) share the same banking mechanisms which are now known and emulated for existing dumps.
That's said, it seems that the banking mechanism for those games is only used while running the game as a protection to detect if it runs from the original cartridge or from flashcart/emulator/etc (i.e game software writes something to its banking hardware to change ROM mapping and shift banks then execute code from the area).
These games probably could be dumped entirely using common methods because the banking hardware is in default state on startup (i.e whole ROM is accessible in cartridge area).

However, other games (especially those which are not yet dumped because it means dumping them is probably not so straight forward) might use bankshifting as soon as the cart is powered. This would result in your dump being incomplete, with a lot of mirrored data, which size depends on the bank size
As Calpis said, these carts cannot be dumped with traditional methods and the ROM is generally not accessible for direct dump. You need to dump the partial ROM , analyse it, figure how the bank mapping is controlled then use custom software and/or custom hardware to "mimic" what the game program is doing to access the full ROM range.

On that matter, unlicensed games generally also have copy-protection hardware that comes in the form of four hardware registers mapped in unused memory space which return fixed or bitshifted values. Again, those registers are only used while the game is running to detect it's running on original cartridge hardware but this should not prevent them from being dumped.
It seems that a lot of unlicensed games were patched immediately by releaser to work with emulators, and original versions were lost. Some others come unpatched and were analysed to figure the protection.

 

Link

That I'll be doing soon.

Thanks for the information, that just saved me both some money and aggravation. I very seriously doubt there are algorithms in place for these obscure unlicensed games.

Looks like my only bet, other than physically removing the chips (even if that's possible) is a USB dumping device similar to the Retrode.

Does anyone have one of these they could spare for a good cause? I'd return it as soon as I was done.

And thanks for everyone's really helpful information.

Also, DerekB noted that Pier Solar couldn't be dumped with a Sega CD cable. Now I realize that the size of the ROM versus my copier RAM size wouldn't allow a dump anyway, but just as an experiment I plugged it in. The Double Pro Fighter 24m doesn't even recognize a cart inserted. The MGH 16 recognizes a 16m cart inserted (of course), and attempts to dump the first two floppies, which of course are useless. I also noticed it you just straight up play the cart while connected through the device it crashes at (what I'm assuming) is a red checksum error screen after the initial first credits screen.

That kinda struck me as odd that it would show up in one unit an not the other, then the testimonial of the guy who dumped several picky Sonic 3 carts that wouldn't show up unless he covered certain pins on the PCB made me think there might be an easy way around this.

 

well thats pretty shitty of tototek if they are making money off MoD's design, you'd have to be mentally handicapped to not be able to build that yourself

Pier Solar will start dumping with transfer cable, and is detected properly as 64mbit but freezes halfway through the dump, probably due to however their bank switching is setup. I'd try Retrode if it is in your budget

 

The Retrode will not be of any help, and I don't know of anything similar to it. Like everything else it has built in algorithms and they are likely to be the absolute minimal set. Even worse it relies on the game's internal header (used for cataloging) to choose an algorithm since there's no other input, and unlicensed games typically won't have this.

The RAM isn't used when backing up with a DPF. Some copiers require you to backup to RAM before copying to disk but it's only an idiosyncrasy.

As a 64M game Pier Solar will either have bankswitching and/or protection and/or extended ROM decoding past the 32M ROM area into memory reserved for expansion (illegal for licensed games). Again it's the algorithm that allows you to dump.

Your best bet will be to either desolder the ROMs and read them with a programmer, or lend the cart to a skilled MD homebrewer to dump.

Sonic 3 is an almost standard 16M cart with save RAM. The only difference is that the RAM (is FRAM and) is bankswitched like a game >16M to protect its contents from accidental corruption when powering off the console. Covering over the pins simply disables the RAM, and is only necessary because the DPF apparently gets confused otherwise.

The 16M that your MGH dumped is probably valid. Despite tricks the cart uses, there always has to be some ROM to the standard ROM area initially or nothing could start and that is what the MGH dumped. It could actually be useful in determining the rest of the cart's hardware if you gave it to someone to be analyzed.

 

Thanks for the information supplied by everyone. I guess I am just shit out of luck on this one.

Attached is a picture as example, 3 globtops + 2 20 pin chips on the board.

 

You're right the ROMs certainly are under the epoxy. Perhaps it's a 12M game? I don't see why else there'd be 3 chips. The discrete chips likely make the complete mapper; the PAL must be used for decoding and possibly bankswitching, the '244 on the other hand is a very strange thing to be there. I guess it's protection since 8 bits isn't enough to buffer the address or data bus to use it for electrical characteristics. Likely one side of the buffer is hardwired to a bit sequence and the other to the data bus. This way the game can read the buffer to check that it's running on this unique board.

If you want to get this dumped, it has to be done with a custom algorithm. You can still learn a lot about it by examining the board. The first thing I'd check is whether the MD's /RESET line connects to the PAL, and check which MD signal pin 1 of the PAL connects to. These things usually give away whether the PAL contains latches or registers. Then I'd check how the '244 is wired and whether it's enable signals are tied together or connect to the PAL separately. If you trace the discrete chips and most of the traces leading to the blobs, it will be clear what the mapper is capable of and probably most of it's operation. This is important not only for dumping but for emulating as well (unless you don't mind using a cracked ROM).

 

You should at least be able to read the first part (boot program) of the ROM, just like the console is doing after power-on. Just dump the full cartridge ($000000-$3FFFFF) area to see what you get (very likely, mirrored data). If you can get this initial ROM dump, we could disassemble and analyse the code to figure the bankswitching / copy-protection mechanism.

Once this is done, something like this could be used to write customized software that communicate with the cartridge just like the game is doing in order to dump the full ROM.

About the board, from what I can see:

- it doesn't use !TIME signal for bankswitching
- it doesn't use RESET, neither CLK signals
- it only detects writes to odd address / lower byte (!UWR not connected)
- it can generate its own !DTACK and uses !AS from 68k (valid address strobe) which could mean the cart can answer to illegal areas access (extra cart hardware mapped in $800000-$9FFFFF range ?)
- it uses the full 16MB address range (A1-A23) except A19 for address decoding, while most games only use A1-A21 (4MB), which makes me think ROM size is 512k and is mirrored in the first MB.
- it uses /CAS0 (Output Enable) but does not use !CE0 signal which is generally used as cartridge ROM chip enable, which confirms the cart uses its own address decoding through /AS and address lines.

 

@Azathoth you have Super Mario World 64? That pirate is extremely rare! Where you bought it?

 

Eke, what hardware could I possibly use to even get to this point?

Insignificant but last night I noticed this cart hangs right before the level loads if it's attached to a Pro Action Replay, it also doesn't play the speech sample at the title screen.

 

The SCD transfer cable.

 

Sega CD transfer cable or Retrode should both work, they will at least allow you to read the 4MB cartridge area, then we can work with the dumped data.

The reason it does not work with your current hardware might be because the cartridge does not put the /CART signal low (see how B32 on the right side of the board has some weird connection, maybe it's forced to 5V from the other side ?), which make those copy devices think there is no cartridge inserted. The console would need this signal to generate the /CE signal to access the cartridge ROM but as said earlier, this cartridge seems to have its own address decoding logic and doesn't use that /CE signal.

Do you have a console with BIOS license screen on startup ? If it shows up for normal games but not this one, this would be another hint that this cartridge does not assert the /CART signal...

EDIT: just saw you said MGH can dump it partially, this 2MB dump could be of some use actually, care to share it ?

Pro Action Replay cartridge does not connect all signals from the console connector to the plugged cartridge so it's very likely some of the required signals (/DTACK and /AS probably) are missing.