Dumping Nintendo 64 cartridges

[marshallh]

N64 Cartridge Dumping
Last updated 12-24-07

http://img171.imageshack.us/img171/8522/n64cartridgeyk5.jpg
Image from HowStuffWorks

The N64 cartridges contain one or two mask ROMs, with multiplexed
address and data lines, to save pins on its connector.

http://img167.imageshack.us/img167/5580/n64256flash01cn1.jpg
Image (c)Shiggsy

The large, bulky flash cartridges contain banks of flash ROMs - accessable
through a ASIC and some glue logic. They can be dumped in the same
manner as normal cartridges.


Dumping

Because the ROM is multiplexed, the carts can't be dumped with just an
EEPROM reader. The most popular and easy way to dump carts is using a
backup device, such as a Doctor V64, CD64, or the like. It is also possible
to build your own cartridge reader, but make sure it works before you ruin
any of your protos ;)

With a V64
You will need to remove the gray emulation adapter and plug in the
cartridge on top of the V64, and download the latest 2.03b BIOS with
backup feature enabled.
With a CD64
Maybe someone who has one can help me out here, but the procedure will
be similar. As with the V64, you need a straight-through parallel cable to
connect it to your computer.
Other methods
As I said, you can build your own, provided you have some electronics
knowledge. The timing for accessing the ROM is fairly simple and be
accomodated with some 74 logic.
http://www.crazynation.org/N64/n64_cart_info.htm

(http://www.crazynation.org/N64/n64_cart_info.htm)If you have a suitably large microcontroller with RS232 support, that will
work as well. I can design a USB-based cartridge reader/writer if there
is interest.
(http://www.crazynation.org/N64/n64_cart_info.htm)
So there you have it, folks - the easiest method is to borrow someone's
copier. If anyone has any suggestions or details to add, let me know
and I'll update this post.

[Calpis]

CD64 actually needs a special adapter that sits between the CD64 and the parallel port.

Z64 can also of course dump games to Zip disks, and it's by far the most user friendly.

V64 Jr can dump games too, but it's less user friendly than other devices.

Supercom 64 aka Wild Card 64 can dump games too with an ISA card and cartridge adapter.

[Calpis]

Bump, just remembered the cheapest/most available solution for N64 backup--the GameShark!!! (parallel port version)

[Shiggsy]

I seem to remember that the Z64 cant backup dev cartridges...just normal games.

Shiggsy

[APE]

Bump, just remembered the cheapest/most available solution for N64 backup--the GameShark!!! (parallel port version)

I found the cable for the GS to be extremely hard to find, at least back in the day when that thing first came out. Made loading up codes extremely easy, didn't know it worked for dumping.

Shame it's hard to find a 100% proper working GS these days. My current one's parallel port doesn't work.

[ElBarto]

I think I have two GS with parallel port, how does it work to dump a game ?
Does it use a standard parallel cable ?

[ConsoleFun]

I seem to remember that the Z64 cant backup dev cartridges...just normal games.Funny you should mention that, I have had problems backing up dev carts with my Z64.

[Calpis]

I think I have two GS with parallel port, how does it work to dump a game ?
Does it use a standard parallel cable ?
It works by interrupting the game and downloading it with the PC software, very similarly to how cheat finding works.

Yes, it just needs a regular straight through parallel cable.


Funny you should mention that, I have had problems backing up dev carts with my Z64.

Any idea why that is? Couldn't be a problem interfacing. Couldn't be that ROM is mapped abnormally. Maybe the Z64 doesn't follow the strobing protocol exactly like the N64.

[ConsoleFun]

Any idea why that is? Couldn't be a problem interfacing. Couldn't be that ROM is mapped abnormally. Maybe the Z64 doesn't follow the strobing protocol exactly like the N64.Let me find those dev carts and do some testing....

Update:
I have three dev carts here, which I got from a friend who had bought some N64 dev kits. One cart is marked NUS-16F32SB (256M+256K), and when I tried it in my JPN N64 it boots Kirby 64 -The Crystal Shards. I would like to dump this game and check if somebody just flashed the cart with the retail version (my guess..) or if this is something else.

The other two carts are both NUS-8F16F 128M. They don't boot in my JPN N64. I opened them once, and seem to remember that they had PAL CICs. I have tried to boot them with no luck using a couple of different import adapters.... Need to get my PAL N64 from storage one day... The carts might be erased empty for what I know....

I just backed up a few of my N64 retail games without any problems with my Z64 (V3 HW, 2.18C). JPN, USA or PAL carts - no problem. One thing that is handy with the Z64 is that doesn't even need to be connected to the N64 to backup games - it has a nice LCD and is very portable. When I backed up the retail games, the Z64 displayed the name of the games in the LCD....

When I try to backup the dev carts, the Z64 can't display the name of any of the games - not even for the Kirby cart which boots fine. It does however ask if I want to dump 32Mbit regardless of which dev cart that is inserted, which can't be the correct size of ROMs. Kirby 64 is 256Mbit (?). There is something strange with the dumps, because the Z64 doesn't display them in the list of games. Once I find my USB ZIP-drive I will check out the dumps....

[Shiggsy]

There is something strange with the dumps, because the Z64 doesn't display them in the list of games. Once I find my USB ZIP-drive I will check out the dumps....

Dont bother, Ive tried it and I seem to remember there being only a few kb of garbage or nothing at all. I think it can backup the save file though...but its been a few years since I tried it.

Shiggsy

[ConsoleFun]

V64 Jr can dump games too, but it's less user friendly than other devices.
What would be the best way to do this?

I have a 512Mbit V64 Jr. (ehh, E64 actually). Usually I use elim, because of EPP emulation in software, for uploading code...

As far I as remember elim, ucon64 and wJrWrite don't support dumping....


Dont bother, Ive tried it and I seem to remember there being only a few kb of garbage or nothing at all. I think it can backup the save file though...but its been a few years since I tried it.
Did you find an easy way to dump dev carts? :-)

[Calpis]

The reason why there's garbage must be because the Z64's protocol is bad.
The thing about the Flash carts is that the N64 is interfaced with the Flash through a CPLD. The CPLD must expect the N64 to strobe a very specific way and when the Z64 does things out of order, it doesn't end up making a valid access.

It's been some years since I've done this but to backup games with the V64 Jr, you need to transfer a dumping program over, wait until the game is copied into RAM and then download from RAM using a transfer tool. This surely will work even with Flash carts because the N64 acts as the mediary.

[ConsoleFun]

The reason why there's garbage must be because the Z64's protocol is bad.
The thing about the Flash carts is that the N64 is interfaced with the Flash through a CPLD. The CPLD must expect the N64 to strobe a very specific way and when the Z64 does things out of order, it doesn't end up making a valid access.I follow you. Your logic seems sound.


It's been some years since I've done this but to backup games with the V64 Jr, you need to transfer a dumping program over, wait until the game is copied into RAM and then download from RAM using a transfer tool. This surely will work even with Flash carts because the N64 acts as the mediary.I'll check out dextrose and see what I can find on the subject..... Want to try this now :)

[ASSEMbler]

LMK if it works consolefun, I have a stack of flash carts that need dumping.

[ElBarto]

It works by interrupting the game and downloading it with the PC software, very similarly to how cheat finding works.


Does someone have this software or the name, couldn't find it on dextrose

[Shiggsy]

Ziyal by Obsidian?

Shiggsy

[ConsoleFun]

Ziyal by Obsidian?Thx Shiggsy! ZiyalII looks very promising, and like elim it has even got support for EPP-emulation in software :D

http://go.to/obsidian/

[Flyinghigh]

I seem to remember that the Z64 cant backup dev cartridges...just normal games.

Shiggsy
That is right
it will dump a 32Mbit rom which is fillled with zeros no matter what proto you have.
Dumping with a v64 Jr is easy, i used wJrRead V1 - By RaO as transfer software all the time.
But when i remember right, i had always a windows 98 SE partition to do dumping becaus it was not working in XP.

[ConsoleFun]

LMK if it works consolefun, I have a stack of flash carts that need dumping.
It works :) I just dumped the Kirby dev cart with a V64Jr using ZiyalII. The command line is simply:
ziyalII [CIC-Type]

The CIC-types supported by ziyalII are listed in the included documentation (all CIC-types seem to be supported). Once executed the program will upload the dumping software to the V64jr. Then simply follow the on-screen instructions.

The only snag is that the dumping code needs to run on the N64. So you need a PAL N64 to dump a PAL cart, and a NTSC N64 to dump a USA/JPN cart, if you don't use any import converters or other tricks (i.e. replace the CIC in the cart).

If anyone is curious; there was nothing special on those other two dev carts either. One seems empty / dead. The other booted with a Paradox crack intro, so it was no prototype or beta or anything exciting....



Dumping with a v64 Jr is easy, i used wJrRead V1 - By RaO as transfer software all the time.
But when i remember right, i had always a windows 98 SE partition to do dumping becaus it was not working in XP.
Good to know! You need a PC with an EPP compatible parallel port, or does it do EPP emulation in software?

What I really like about elim and ziyal is the EPP emulation which makes them compatible with all kinds of old and new parallel ports :D

[Flyinghigh]

Good to know! You need a PC with an EPP compatible parallel port, or does it do EPP emulation in software?

What I really like about elim and ziyal is the EPP emulation which makes them compatible with all kinds of old and new parallel ports :D

Well i tried last week or so again and i got it work under XP pro SP2
You need to copy two files in the System 32 and Driver Folder and set compatibility Mode to Win 2000. Works great, no Win98SE anymore ^^

[ConsoleFun]

Well i tried last week or so again and i got it work under XP pro SP2
You need to copy two files in the System 32 and Driver Folder and set compatibility Mode to Win 2000. Works great, no Win98SE anymore ^^
Yeah, you need drivers to get access to i/o ports in Microsofts NT-based operating systems.

What I am talking about is the mode of the parallel port (standard SPP, IBM bidirectional, EPP 1.7, EPP 1.9, ECP, EPP+ECP etc.). V64jr requires the parallel port to be EPP 1.9 compatible. Other modes don't work AFAIK. So EPP 1.9 emulation in software is really nice (slow, but working) for those who don't have EPP 1.9 compatible hardware.

[andoba]

What about the other way out? There is some actual way for connecting EPROM's or similar to the N64 withouth using external hardware? With glue logic or a cheap CPLD it could be sorted out, or it's more extensive?

[Calpis]

Yeah, you can make a N64 cartridge from EPROM, but EPROM only go up to 32Mbit and are extremely rare at that size.

[Infrid]

CD64 actually needs a special adapter that sits between the CD64 and the parallel port.

no problem
http://n64.icequake.net/doc/cd64-ppa/parallelportadaptor.html
Mirror (http://img265.imageshack.us/img265/8598/ppabb9.jpg)

[TranceDoll]

For those of you interested in using a GameShark to dump, you can refer to this guide I wrote a year ago:
http://ts.death.angel.googlepages.com/gamesharkstuff

If anyone in Europe needs their carts dumped I am located in Norway :P

[WolverineDK]

For those of you interested in using a GameShark to dump, you can refer to this guide I wrote a year ago:
http://ts.death.angel.googlepages.com/gamesharkstuff

If anyone in Europe needs their carts dumped I am located in Norway :P

Damn, you are a Norwegian ? wow I thought there were only one from my northern neighbour country . Cool, now I know there are more Norwegians on board :) (sorry to go offtopic) carry on.

[Sojiroh]

Thanks marshallh (http://www.assemblergames.com/forums/member.php?u=1832) for this excellent guide, because of this we may get a banjo kazooie kiosk rom (it seems to have quite a bit of beta stuff in it).

[Jackhead]

hi,
im looking for an IPL-ROM cart of the 64DD dev unit.
After research in the web i was thinking about making an cart by myself with an flash cart. I found this http://www.ic2005.com/shop/product.php?productid=115&cat=0&page=1 . Im not sure if this works when i get my hands on a ipl-rom image from the dev cart?
Also im not sure if someone have an dump of the cart? Or was only the retail ipl image dumped?
Hope you guys can help me.
regards
Chris

[Jackhead]

Thanks so far! Maybe interested in the Partner-N64 env V2.0 ?

[Nintendo]

best dumping method is Z64 if you have it. Use to own one but had to sell it for money.
Work great for dumping the MASK ROM data or EMULATION playing

[CZroe]

I recall requesting the GameShark ROM dump feature from the CMGSCCC guys before it was in the software. I mostly used it for accurate screen shots since I had much better ways to dump, but I thought it was an obviously useful feature for others.


It works :) I just dumped the Kirby dev cart with a V64Jr using ZiyalII. The command line is simply:
ziyalII [CIC-Type]

The CIC-types supported by ziyalII are listed in the included documentation (all CIC-types seem to be supported). Once executed the program will upload the dumping software to the V64jr. Then simply follow the on-screen instructions.

The only snag is that the dumping code needs to run on the N64. So you need a PAL N64 to dump a PAL cart, and a NTSC N64 to dump a USA/JPN cart, if you don't use any import converters or other tricks (i.e. replace the CIC in the cart).

If anyone is curious; there was nothing special on those other two dev carts either. One seems empty / dead. The other booted with a Paradox crack intro, so it was no prototype or beta or anything exciting....


Good to know! You need a PC with an EPP compatible parallel port, or does it do EPP emulation in software?

What I really like about elim and ziyal is the EPP emulation which makes them compatible with all kinds of old and new parallel ports :D

You don't need a PAL N64 to dump a PAL game with a V64jr. You can run a 7101 PAL game on 6102, a 7102 PAL game on 6101 (StarFox 64 was the only one), and all the rest relate directly (for example, 6104 = 7104; 6105 = 7105). Even if you cant see it, the software will boot and the dump should still work.


What would be the best way to do this?

I have a 512Mbit V64 Jr. (ehh, E64 actually). Usually I use elim, because of EPP emulation in software, for uploading code...

As far I as remember elim, ucon64 and wJrWrite don't support dumping....


Did you find an easy way to dump dev carts? :-)

Obsidian made a whole suite of excellent tools with EPP emulation (elim, evek, ziyal, etc). Dextrose blocked their tools because they believed the 8 bytes needed to support each CIC were copyrighted Nintendo code. This was silly because, even if it were protected by copyright, all utilities and homebrew for 6102/7101 games had the standard header bytes for 6102/7101 and no one pulled those. Also, copyright law typically provides an exception for necessary header duplication to allow for code execution. It's why Datel and others could put the Nintendo logo in their unofficial Gameboy stuff to get by the BIOS check on a Gameboy and a NHL Hitz header on the Gamecube.


Thanks so far! Maybe interested in the Partner-N64 env V2.0 ?

That would be: YES!


best dumping method is Z64 if you have it. Use to own one but had to sell it for money.
Work great for dumping the MASK ROM data or EMULATION playing
As established earlier in this thread: No. It isn't. It doesn't even work with dev carts.

[Zoinkity]

A memory dump from ROM uses code 127. IIRC, you can read any address from rdram or ROM using it from within the GS menus. Copied this from my third GS access demo. Stupidly, I did a disassembly of the possible commands, then got a list from one of the devs ;*) Still not brave enough to try uploading a BIOS.

Original was here, 16bit app built in TurboC 2 on win3.1:
http://www.mediafire.com/download.php?71ttht1tjyv85x3
I'll have to double-check this code, but if you were using HCS's code source as a base:



#define AR_MEM_DUMP 127
#define AR_DISCONNECT 'd'
#define AR_END 'e'

int MemDump(FILE * infile, unsigned long size, unsigned long address) {

unsigned long c=0,x=0,y=0;

/*ensure address and size are word-aligned */
address+=3;
address&=-4;
size+=3;
size&=-4;

if (SendCommand(AR_MEM_DUMP)) return 1;
ReadWrite32(address);
ReadWrite32(size);
printf("Writing to file... 0%%");
for (c=0; c < size; c+=4) {

y=ReadWrite32(0);
y=byteswap(y);
fwrite(&y,4,1,infile);
x+=y;
if (c & 0x400) printf("\b\b\b%2d%%",c*100/size);
}
printf("\b\b\bDone.\n");

/*confirm data valid*/
x&=0xFF;
y=ReadWriteByte(0);
if(x!=y) printf("Checksum invalid!\t%02X\t%02X\n",x,y);

return x!=y;
}

int SendCommand(char command) {

if (InitGSComms()) return 1;
ReadWriteByte(command);
return 0;
}


Some other random defines:


/*Defines for some of the commands*/
#define SH_VERSION 'f'
#define SH_UPDATE 'g'
#define SH_NEW_BIOS 'n'
#define TR_SCREENSHOT 'r'
#define SH_D_CODELIST 124
#define SH_U_CODELIST 125
#define SH_ROM_DUMP 126
/*BIOS update modes*/
#define UPDATE_OVERWRITE 0
#define UPDATE_NO_WRITE 1
#define UPDATE_UNENCRYPTED 2


SH_ROM_DUMP is an interesting one. It dumps a given number of bytes from 80500000. So, if you use it, send the command, then a long size. Don't send an address. Not sure if it's targeting the shell or the trainer honestly.

This demo (http://www.mediafire.com/download.php?ap2avdthnbrfh4q) plays tricks with the trainer and isn't nearly as interesting.