Extending Arduino SNES ROM-reader -- solderless reader, spc7110 support

This short article shows my following extensions on the Arduino SNES ROM-reader as described here.

Construct the reader hardware without soldering
  • Solderless reader
  • SPC7110 support

Solderless reader

The key thing is to identify the names of the components that you need and get them. In fact that step takes me quite a while to sort out.


The components that you need:
  • Arduino
  • Resistors, capacitors and shift registers as described in the schematic diagram 
  • A security screwdriver for Nintendo SNES (to open the SNES cart)
Extra stuff needed for solder-less construction
  • breadboards
  • Wire cable connectors (male-to-male and male-to-female)
  • 0.100" 35- or 36-pin Spacing Card Edge Connector -- note that we need to have male pin on one side of the connector, so we can plug in the male-to-female connectors to connect it to the breadboard

SPC7110 support

SPC7110 is a special chip that appears in a few SNES carts in 1995-1997. Carts with this chip features a 8Mb program ROM and a variable-size data ROM. In Far East of Eden Zero (Tengai Makyo Zero), the size of the data ROM is 32Mb.

A few things that we need to know in order to read the data from the ROMs.
  • If an unlock sequence is not written to registered addressed 0x4834, only the first 8Mb of the data ROM can be read. Attempts to read the other parts just give you the same first 8Mb of the data ROM. The unlock sequence is as follows: 0x80, 0x00, 0x80, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x00, 0x80, 0x80, 0x00, 0x80, 0x00.
  • By default, the program ROM is mapped to addresses 0xc00000 to 0xcfffff while the first 24Mb of the data ROM is mapped to 0xd00000 to 0xffffff.
  • Register at 0x4833 can be used to decide which 8Mb of data ROM data be mapped to addresses 0xf00000 to 0xffffff. If it has 3 as its value, the last 8Mb of the 40Mb data ROM is mapped to that range of addresses. To write to that register, it appears that we need to put 0xff to register 0x4834, as shown in the ucon64 swc.c code.
For some unknown reason, my reader fails to write the registers most of the time. I need to take the following alternative approach with this set of code.

  1. Upload and run the unlock0 script which just makes sure we have correct initial register values. Once you start running the script, open the Serial Monitor. If the program says 0x4844-0x4841 are not of values 0, 2, 1, 0, close the serial monitor, disconnect, reconnect the Arduino USB/power and open the serial monitor again.
  2. Without disconnecting the Arduino power, upload and run the read0 script. This time, use a terminal console to obtain the data stream from Arduino. This gives you the program ROM and the 1st 8Mb of the data ROM data. Note you may need to manually edit the two hex starting at 00100000 to 01.
  3. Upload and run the unlock1 script which just unlocks the cart, without changing the register at 0x4833. Once you start running the script, open the Serial Monitor. If the program says 0x4844 is not of value 7, close the serial monitor, disconnect, reconnect the Arduino USB/power and open the serial monitor again. Only when the program says the value is 7, we are sure the unlock sequence has been successfully written and the data ROM unlock.
  4. Without disconnecting the Arduino power, upload and run the read1 script. This time, use a terminal console to obtain the data stream from Arduino. This gives you the 2nd and 3rd 8Mb of the data ROM data. Note that you may need to manually edit the two hex at the beginning to 20.
  5. Upload and run the unlock2 script which unlocks the cart and changes the register at 0x4833 to 3. Once you start running the script, open the Serial Monitor. If the program says 0x4844 is not of value 7, close the serial monitor, disconnect, reconnect the Arduino USB/power and open the serial monitor again. Only when the program says the value is 7, we are sure that the data ROM has been unlocked. The program should also say the value of the 0x4833 register is 3.
  6. Without disconnecting the Arduino power, upload and run the read2 script. This time, use a terminal console to obtain the data stream from Arduino. This gives you the program ROM and the last 8Mb of the data ROM data. Note that you may need to manually edit the two hex at the beginning to BF.
  7. Use some program to join the file obtained in the above steps. Now you should have got the complete ROM.


References:
  • http://forum.arduino.cc/index.php/topic,158974.0.html
  • http://www.cherryroms.co.uk/forums/copier-and-hardware-forum/get-those-goodsnes-verifications.html
  • https://www.assembla.com/code/quickdev16/git/nodes/485a7831dbd27125d8e08cc159b164af4b52db64/tools/ucon64-2.0.0-src/src/backup/swc.c

Comments

Popular posts from this blog

Using PlayStation 1 Densha de Go controller on emulators

Using PS1/PC Densha de Go! controller SLPH-00051/TCPP-20001/DGOC-44U on PS4/Switch Densha de Go!!

Play octoshape stream on windows with VLC player