How to read and write Startropics MMC6 save RAM with Kazoo?

I was able to back up saves to most of my cartridges using the Kazoo and Anago, however I'm having trouble dumping and writing the saves of Startropics and Zoda's Revenge. I read these use the MMC6, which is similar to the MMC3 except for how the save RAM works. I read up on MMC3 and MMC6 on the wiki and still couldn't figure out how to code this.

Here's what I tried so far.

1. I copied the MMC3.ag script in the anago folder and renamed it MMC6.ag
2. In the header I changed the cpu_ram lines to this because the MMC6 RAM is only 1KB (mirrored four times) instead of 8KB
cpu_ram = {
size_base = 0x0400, size_max = 0x0400,
banksize = 0x0400,
}
I think I only need to write the first 1KB, maybe that's wrong.
3. Next, I edited the function cpu_ram_access to disable the MMC6's different PRG RAM protection and write the save to the appropriate location
function cpu_ram_access(d, pagesize, banksize)
{
cpu_write(d, 0x8000, 0x20);
cpu_write(d, 0xa001, 0xf0);
cpu_ramrw(d, 0x7000, banksize);
}
The first line changes the bit at 0x8000 to enable the PRG RAM. Without this, reading and writing to the PRG RAM has no effect. This is the main difference between MMC6 and MMC3.

The second line should enable reading and writing to the PRG RAM. However, the closet I've got to reading a save file is 0x200 lines of zeroes then 0x200 lines of the same repeating junk line. Reading or writing like this seems to delete the save. I tried setting a001 to 10, 20, 30, ... e0, f0 and couldn't get it to work on any so I know I'm missing something else here (possibly need to update NES mapper 4; I have no idea how to do that).

The third line writes the save file (it's size 0x400 and starts at 0x7000). I'm not sure, but I think this is supposed to mirror three more times to 0x7FFF after it's written.

I'm not sure how to make it work. Here's some other things I tried:

1. dump save with mmc3.ag -> get a .sav full of Fs. This is correct.
2. tweak 0xa001 -> still all Fs. This is also correct, since the PRG RAM is still locked in MMC6.
3. set 0x8000 to 0x20 -> now, tweaking 0xa001 has an effect, but I still can't get it to read/write the save properly.
Setting 0xa001 to the following values has the following effects:
0x00: .sav is still all Fs.
0x10: .sav is all Fs.
0x20: .sav is all 0s. Interesting.
0x40: .sav is all Fs.
0x80: .sav is 200 lines of 0s, followed by 200 of the same junk line, repeated four times. The save file on the cartridge is erased when reading or writing.
0xf0: same as setting 0xa001 to 0x80

I think this should be simple. What am I missing? Can someone figure out how to read and write a save to a Startropics or Zoda's Revenge cart and share how to do it?

I found a cartridge that had a deleting save problem similar to the Startropics and Zoda carts, though it didn't help me read/write the MMC6 PRG RAM. So I tried two Zelda carts and read and wrote to them with their own methods (MMC1). One of the Zelda carts kept the save after reading and writing, one didn't. No idea why two Zeldas behaved differently, maybe a small board difference. Anyway, I read repeatedly from the self-deleting Zelda cart and found that it kept its save until I removed it from the Kazoo. However, when I unplugged the Kazoo first then removed that Zelda cart, it kept its save. If you've got a cartridge that seems to be losing its save, try unplugging the Kazoo first.

I tried this with the Startropics and Zoda carts but with no change. Their saves are deleted differently, when reading/writing, not when removing the cart. Oh well. If anyone can back up their Startropics save without deleting it, I'd like to know how.

here's my stab at a MMC6 dump file.

I left the WRAM size at 8KB as that's the most fail safe way, the resulting 8KB file should be the 1KB save file mirrored to fill the 8KB. You should be able to just use the first 1KB. If the one above does work, then you can try my version which only creates a 1KB save file here.

Let me know how it works and I can add it to the .zip download from my site.

I don't see any errors in your changes. But you didn't follow the same proceedure as the mmc3.ag which disables WRAM after reading/writing to it. So perhaps that's why you're loosing saves. My script does disable WRAM after reading/writing, so perhaps that'll solve the erasure issue. I didn't write the original kazzo firmware and gave up on my efforts to fix all the issues I've had with it as disclosed. I started working on the dumping feature of my own firmware which I would be able to resolve such issues with once released.

I tried that MMC6 script and got similar behavior. Dumped 0x1000 lines of FFs then 0x1000 lines of zeroes and "okay"s, and erased the cartridge save. Something interesting is happening with these MMC6 carts. If anyone can read/write one successfully I'd like to read how.