N64 pirate carts

Hey

I've made a small article about an N64 pirate cart of mine (the only one I've got). The funny thing is that they work with out the need of an adapter, unlike the ones Assembler once had on his website.

Does anyone else here own N64 pirate carts?

A link to the article can be found here:
http://www.nesworld.com/n64piracy.php

 

Smash it open.

Shiggsy

 

finally i see one of these, i asked about these months ago, was told to search myself, but i couldn't find shit.

thanks!

i second that!

 

nice dude!
i never knew that there was that kind of piracy possible for the n64 lol

 

http://web.archive.org/web/20010303...arvgm.com/Black_market/Grey_N64/grey_n64.html

Assembler had a few of them on his old site, but they required you to piggy-back an official game to get past the CIC security chip.

Acey's pirate game was probably also made in the early days...and I am really interested in seeing how they solved the CIC thing. I wasn't aware that any pirate games on the N64 could get around the protection.

Shiggsy

 

I'd really like to look inside one of these...

I know for certain (by a friend from the N64 scene in the late 90s) that the CIC lockout chip is a glop-top inside, and does a half-assed job of cloning the signal timing of the original. It's very dirty and rough but it works well enough to fool the PIF into booting.

Kevin Horton also says that he has a Super Mario 64 pirate cart. Haven't got any details on it though.

 

Smash it open.

Shiggsy

 

haha

 

I've seen n64 pirates where the carts are empty (no chips) when you take them home, they don't work. "No refunds!", "I don't know you", "We don't sell those here!" Pretty gay, but I guess with expensive costs I suppose there is a greater insentive to rip people off.

 

Really interesting find. As others have said though, it would be really great to see pics inside this cart :nod:

 

I own a pirated Super Mario 64 cart. I modified it, so now it is self-boot. I removed a 6102 CIC clone (yeah, a CIC clone) from a single-slot adapter (not the dual-slot thing) and soldered it to PCB.





The clone is the chip labelled as "S-A 144".

 

Very nice pics, great to see the insides

 

How hard would it be for us to "pirate" our own? Any specs...I'd like some modded GoldenEye ROMs like CS Multi pak to be made into real ones...

 

Very because N64 ROMs aren't just ROMs, they're ROMs with embedded logic to latch the multiplexed bus, perform burst access and do address decoding internally. Same with the save chips too. (Not that without those complications it'd be easy/cheap to find 128M/256M Flash, get access to a programmer with TSOP adaper then wire the ROM to a game board or make an entirely new PCB...)

 

These pirate carts usually come with two or three chip configurations.
One is the "interface" and does the multiplex stuff Calpis mentioned (like the globtop chip on the Dr.V64 manboard, close to the FPGA chip) the other (or others) chip is usually a large maskrom or eeprom die.

Maybe isolating the multiplexer chip from such a pirate cart and reversing the pinout would allow for a NOR flash replacement ?

 

Actually the PI protocol is pretty well-documented and it's possible to use a few 74 series chips to handle it.

First the high word of the address is latched in, then the low word. Then a burst read is performed. Up to 256words (512bytes) can be read by just strobing /RD. After that you need to latch in the address again.

0x0 of the game ROM is mapped to 0x10000000.

The reason you don't see carts is because it's damn near impossible to find NOR memories larger than 64mbit, and all of them are TSOP surfacemount packages

 

I had a buddy in HK and he said the fake empty carts were everywhere before the V64 came out. Typical Chinese mentality of trying to make a quick buck.

 

sorry for bump/continuing offtopic, but would something like http://www.hynix.com/datasheet/pdf/flash/HY27(U_S)S(08_16)121M(Rev0.6).pdf work or does it have to be nor?
The multiplexed data/address lines are there, and besides the spare data (crc?) per page, the page sizes are same. Since the data is pulled via strobes, the extra shouldn't matter. A tsop to dip adapter should make this work right? Only thing I can find about nor and nand difference is that nand is slower to read?
Also don't official flash carts use nand?

 

It won't work without a lot of logic. NAND flash will need command translation, where NOR flash just needs a couple latches and counters. Once you necessitate a FPGA, you might as well use a SD card...

Official flash carts use NOR, but the mask ROMs in retail carts are probably NAND (not flash) using a custom interface, same with GBA and DS carts.

 

Why would this chip need additional logic? From what I'm understanding about the PI bus and this chip, all the logic is embedded, and the chip is ready to accept PI style commands. I'm basing that assumption on http://www.crazynation.org/N64/n64_cart_info.htm
Page 4 of the datasheet has the internal logic diagram.
Read A is the same as a Read on the PI bus,
Read B is only used in 8bit mode,
Read C isn't utilized by the n64 (nor is it needed, as it reads the spare data).
Unless I'm missing something with the address line, I think it should work.