SNES CIC and SA-1 cartridge dumping

SNES CIC and SA-1 cartridge dumping
by byuu on 2010-07-08 (#63896)

So it would seem that to access the ROM on an SA-1 cartridge (Super Mario RPG, Kirby's Dreamland 3, ...), the SA-1 must first validate that it is talking to the SNES via its CIC. I believe it also verifies the CIC's region.

Attempts at stop-and-swap are no go for two reasons: 1. swapping carts would throw off the handshake, and 2. it can detect an SNES CIC with pin 4 broken (to turn it into a key); but if we don't disable the CIC, we can't swap carts in the first place.

So I'm curious if anyone who has written cart dumpers / readers were considering updating their devices now that we have the SNES CIC reverse engineered.

That, or if anyone has had success in dumping these games through something like the GD SF7. In theory, as long as it passes the CIC pins through, it should be possible to dump the games with it.

by lunaris on 2010-07-16 (#64332)

iunno, but if it helps, dumping it by ripping out the maskrom and reading it with a programmer would work fine

by MottZilla on 2010-07-16 (#64347)

I have a GDSF7, but I don't own any SA-1 games. If I did I would try it and let you know. But I don't really have any plans to obtain any SA-1 games in the near future.

by JohnDie on 2010-07-18 (#64408)

You can dump SDD-1 and SA-1 cartridges using a SWC DX2 and uCON64. There is an option called --xswc-io to enable special dumping methods for those cartridges. I have not used it since a while, but it worked at least for some SA-1 cartridges when I added the "DX2 trick" (which enables you to access banks 00-7F of the cartridge through the SWC DX2, see source code for more information). I can't remember for sure if there were any features left unimplemented.

More informatione at http://ucon64.sourceforge.net/ucon64/readme.html and at http://ucon64.cvs.sourceforge.net/viewv ... iew=markup (line 126 and 572)

That should work at least for some SA-1 cartridges if you can get them to get out of reset by constantly switching off and on. The timing when doing that does matter a lot.

Improving one of the available dumpers (Mash Mods, Tototek, Retrode) by a CIC clone would certainly be a great improvement.

My ideal cartridge interface would have a USB interface, a CIC clone, fully programmable cartridge connector pins (input and output, all adress lines, all data lines, and especially every control signal seperately). The Tototek programmer lacks the possibility to drive the /CART signal, for example.

by byuu on 2010-07-18 (#64413)

I see, thank you for the info.

Unfortunately, I do not own the Rolls Royce of SNES copiers :(
I only have the GD SF7 and UFO 8.3j.

I am wondering if there's a BIOS command to enable you to read from the cartridge bus, like the BIOS itself must do. But I imagine there's probably a BIOS disable register that's written to immediately before your game starts :/

No skill to reflash a BIOS chip to get around that, either. Which is a shame, a BIOS program to run my serial communications right off the bat would be pretty damn awesome.

I wonder how long it would take for a cartridge reader to incorporate a Super Ciclone in it? I probably have a good year ahead of me with all the other dumping and scanning work anyway.