Dumping educational cartridge RB-925 34 in 1 (word/excel and other stuff)
I found out by accident this weird educational cartridge:
I am trying to dump it but without succes, so maybe any advices will be welcome. Game writes to $CDEF (0 on powerup and then different values when choosing various items from the menu), but when I am doing that write on my kazzo, reads from $8000-$ffff always return the same set of data. My Kazzo controls M2 line resulting in same CPU cycles as on NES (though the lenghth of low and high part of M2 is around 3us). Anyway, M2 never stays in same state for more than 6 us. So either:
* this cartridge needs almost exact timings like on 6502 (which is strange cause even MMC5 allows 10us of idle time on M2 and the R-C-D circuit on many multicarts isn't that sensitive too),
* there is some other kind of protection (I saw other multicarts needing dumping data in packets of at most $80 bytes),
* this register is to fake reverse-engineer proces.
Hardware consists of:
* 32 pin 62512 64 KB SRAM for CHR-RAM, but all upper lines are tied to VCC making efectively 8kB 6265 out of it,
* 24 pin 6116 2KB SRAM for PRG-RAM
* blob which is mapper + PRG-ROM
* one jumper at bottom, which connects SRAM's pin 21 to either R/!W or CPU-A11 (allowing to use 24-pin 6116 or 32-pin 6264).
* one (open) jumper at top connecting unknown blob line to VCC (voltage on it is around 5V), but when connecting it to GND, CHR-RAM becomes open bus and PRG reading from $4000-$5FFF returns data
Blob wires CPU D0-D7/ A0-A14, !ROMSEL, R/!W, M2, PPU-A10, PPU-A11, CIRAM-A10 and PRG-RAM-!CS
I found out by accident this weird educational cartridge:
I am trying to dump it but without succes, so maybe any advices will be welcome. Game writes to $CDEF (0 on powerup and then different values when choosing various items from the menu), but when I am doing that write on my kazzo, reads from $8000-$ffff always return the same set of data. My Kazzo controls M2 line resulting in same CPU cycles as on NES (though the lenghth of low and high part of M2 is around 3us). Anyway, M2 never stays in same state for more than 6 us. So either:
* this cartridge needs almost exact timings like on 6502 (which is strange cause even MMC5 allows 10us of idle time on M2 and the R-C-D circuit on many multicarts isn't that sensitive too),
* there is some other kind of protection (I saw other multicarts needing dumping data in packets of at most $80 bytes),
* this register is to fake reverse-engineer proces.
Hardware consists of:
* 32 pin 62512 64 KB SRAM for CHR-RAM, but all upper lines are tied to VCC making efectively 8kB 6265 out of it,
* 24 pin 6116 2KB SRAM for PRG-RAM
* blob which is mapper + PRG-ROM
* one jumper at bottom, which connects SRAM's pin 21 to either R/!W or CPU-A11 (allowing to use 24-pin 6116 or 32-pin 6264).
* one (open) jumper at top connecting unknown blob line to VCC (voltage on it is around 5V), but when connecting it to GND, CHR-RAM becomes open bus and PRG reading from $4000-$5FFF returns data
Blob wires CPU D0-D7/ A0-A14, !ROMSEL, R/!W, M2, PPU-A10, PPU-A11, CIRAM-A10 and PRG-RAM-!CS