Cracking Mapper 185 Games

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Cracking Mapper 185 Games
by on (#208333)
Mapper 185 games are really just Mapper 0 games with a security check. All have either 16K/8K or 32K/8K of PRG-ROM/CHR-ROM. Mapper 3 in its Nintendo-canonical implementation can support four banks of 8KB of CHR-ROM.

The security check uses the Mapper 3 bankswitch register and checks to see that a "garbage bank" is loaded before a "correct bank". If it sees the "correct bank" first, it won't load the game. Only 9 Japanese Famicom games were released with this protection. Fortunately, the check only is done when the game is first loaded, and if passed, the rest of the game will work without further issue.

In order to fix these games, first we must change the mapper number in the iNES header from 185 to 3. Next, we must adjust the number of CHR-ROM banks in the header to match the number we will add to the ROM.

The more difficult issue is that you need to add dummy 8KB banks to your ROM. This can be done in a hex editor. The dummy bank should use nothing but FF, and must be $2000 in size. Some games only require 1 additional 8KB dummy bank, others require 3. You will need to insert them like so, depending on the game (always add $10 for the header) :

Bird Week

Add 1 CHR-ROM Bank, make the correct bank the 2nd 8KB :
$4010 - dummy
$6010 - correct

Seicross (v2)

Add 1 CHR-ROM Bank, make the correct bank the 1st 8KB :
$8010 - correct
$A010 - dummy


B-Wings
Mighty Bomb Jack


Add 1 CHR-ROM Bank, make the correct bank the 2nd 8KB :
$8010 - dummy
$A010 - correct


Othello
Sansuu 1 Nen
Sansuu 2 Nen
Sansuu 3 Nen
Spy vs Spy


Add 3 CHR-ROM Banks, make the correct bank the 3rd 8KB :
$8010 - dummy
$A010 - dummy
$C010 - correct
$E010 - dummy

When released in the U.S., Mighty Bomb Jack bypassed its own security code by doing exactly this in hardware. I do not fully understand how Mapper 185's security worked (and still don't :(, but the discussion Lidnariq and NewRisingSun had here : viewtopic.php?f=9&t=7912&p=207824&hilit=mighty+bomb+jack#p207793 and the information on the NESdev wiki gave me enough information to figure out how to make these games work.

The Analogue Nt Mini's flash cart functionality does not work with any of these games except for B-Wings, and the NES PowerPak fails to load Seicross (v2). Ironically, Seicross is the easiest game to fix! Once fixed, the Nt Mini loaded all games and the NES PowerPak worked with Seicross.
Re: Cracking Mapper 185 Games
by on (#208339)
Is this the same problem that the new 185 submappers are supposed to fix?
Re: Cracking Mapper 185 Games
by on (#208349)
Myask wrote:
Is this the same problem that the new 185 submappers are supposed to fix?


Yes, but my solution would have to be adjusted for a hypothetical newly discovered Mapper 185 game.
Re: Cracking Mapper 185 Games
by on (#208364)
Probably better to remove the infinite loop using a 1-byte patch to PRG rather than add 8 to 24 KiB of padding in the CHR...