SNES: Issue dumping SA1 games like PGA Tour 96 #734
Comments
|
Hi, I have a similar issue with the PAL version of PGA Tour 96 (PCB = SNSP-1L3B-01)
|
|
skaman and myself have noticed in the past that different SA1 games behave differently. Most likely there are different revisions of the SA1 chip. Some are way harder to unlock than others. SA1 was marketed as a copy protection if I remember correctly so it would make sense if they had updated the chips during its lifecycle, but that is just speculations on my part. Personally I think that the current unlocking code for SA1 is flawed since the clock of the Arduino Mega and the clocks of the Adafruit Clock Generator are not in sync like they would be on a real SNES. There is also a second thing I have noticed but not have investigated further: I had an old Super Famicom that still had the 4Mhz CIC clock, and on that Super Famicom I could not unlock SA1 games with a PIC with the snesCIC hexfile, only with a PIC with the superCIC hex file. Unlocking SA1 games is certainly something that would need further investigation using a logic analyzer. So far I have not checked any timings of any system with a logic analyzer, other than N64 Eeprom/Controller Pak. All timings are just best guesses. This is something I always wanted to check and fine-tune. The first thing would definitely be to understand why exactly the unlocking fails. Like capture the CIC communication of a successful and an unsuccessful unlock and then compare them, see where they differ. |
sanni
changed the title
|
I ordered a US version, will test it, and see if I can reproduce the issue.
|
|
I'm planning on testing out PGA European Tour when I get a hold of a copy. The only other North American SA1 game is Power Rangers Zeo: Battle Racers which I may also try to get. |
|
I can confirm the problem comes from the PIC12F629 / snescic-lock-resync.hex. |
|
Just came to post that I could not reproduce it with a US cartridge...
|
Are you using a snesCIC or a SuperCIC chip? |
|
PAL with PIC12F629/snescic-lock-resync works here too:
|
PIC12F629/snescic-lock-resync |
I have that game; it's what I use to test SA1 with, lol.
|
|
Panic Bomberworld is the only other SA1 game I have.
Both my SA1 cartridges can be quite temperamental. Like right now I can't seem to unlock PGA 96 anymore, always header error, so I try Bomberworld and it dumps fine on the first try, then I try PGA 96 again and it also dumps fine first try. Almost as if the SA1 locks up and then you have to wait for the caps to fully drain before trying again. |
When I first got the Battle Racers game, I took it apart to make sure it was legit. I cleaned the edge connector/contacts (always do for new-to-me games, regardless of what the seller claims -- I've yet to have one that wasn't still dirty), and then tried it in the OSCR. It did not work. Reinserted it a few times, still didn't work. I didn't have an SNES at the time, so I had no way to verify if it was the game or the cart reader, but the seller claimed they tested it (but also claimed they cleaned it...). So, I took it apart again and looked super closely at it. It seemed fine, but while handling it, I noticed the back of the PCB felt a little sticky. It was super subtle. I sat it on my workbench and touched my finger to it, and when I lifted it up, it clung to it and moved ever so slightly but just slightly. I was like, well, it's worth a shot, and cleaned it. Did my usual 2-phase process: First, I clean it with Goo Gone (for those outside the US, Goo Gone is a name brand for a mix of petroleum distillates, solvents, limonene, and orange extract -- as the name implies, it nukes anything sticky or gooey, especially adhesives). Afterward, I cleaned it with contact cleaner (I use WD-40 brand). For both of those, I just drown the thing in it. I don't just wipe it off, I spray it all over the PCB front and back and let it sit for a few seconds, then wipe it off with a paper towel. Finally, I put it back together, and it's worked flawlessly ever since. I don't really know what was wrong with it; the pic I posted above of the PCB is from before I cleaned it, and you can see it looked perfectly fine, but something was going on. Edit: Just wanted to note as a warning, if anyone decides to use my cleaning method, be careful with Goo Gone. If it wasn't clear/obvious, it will absolutely destroy labels and stickers. It will also immediately remove any "permanent" marker (aka Sharpie). Like, instantly. There's no time to react; if Goo Gone touches a sticker, it will immediately ruin it, or with marker, it will immediately remove it. I use it to clean cartridge cases/housings, but I spray the paper towel instead of the case, and I'm very careful around the label. Goo Gone makes isopropyl look like water in comparison. It also makes PCBs really shiny until it evaporates: |
|
I dumped all the Japan and US SA-1 carts during my testing. I do have one somewhat stubborn PGA Tour 96 (US) cart that sometimes doesn't unlock. Several other copies of the cart work fine. |
|
I'm wondering if the hardware from this link is related to this project: Open Source Cartridge Reader V3-ALTER Build service [Group F] since it has a purchase option "SA-1 UNLOCK SNES & N64 EEPROM SAVE (OPTION FEE $28 [PIC12F629 MICROCONTROLLER WITH THE SNESCIC AND CLOCK GENERATOR])" If I have such board borrowed from a friend, how can I tell if it was purchased with the SA-1 option or not? Any way to tell? |
|
I do not have their cart reader, but this is the CIC unlock chip: And I believe this is right under here: You might be able to see it from the back. You can also look for the clock gen: Since the board is blue it should stand out. It should be visible from the side with the switches. You can also just try it and see. The worst that will happen is it won't work (the dump will fail). It won't damage anything. Edit: Feel free to join the Discord if you have more questions. SaveTheHero is also in the Discord. |
|
@Ancyker thanks a lot for the explanation! |
|
We've been developing a separate SNES cartridge reader for Epilogue (epilogue.co). We're currently facing the same issues as this project. Some cartridges unlock properly while some others don't. Our project uses clock generators from crystals while from what I've seen this project uses a clock generator IC from Adafruit. In the following days we'll be building a separate module with a FPGA (DE-10 Nano) to see if the unlocking mechanism works better when the CIC_CLK is modulated in a similar fashion as the original SNES. We usually release our code closed source, but in this case if we manage to make it a separate module we're open to sharing the code so that it could be implemented for this project as well and benefit the community. |
|
A brief update, we've replicated the clock for MCK, SYS_CLK and CIC_CLK using a DE10-Lite and integrated it on our boards. We do not have the hardware for this project (sanni/cartreader) to try it as well there, but it did not improve the unlocking mechanism on our boards. We didn't have an exact 21.477MHz crystal available to use on the FPGA and derive the clock signals from it, but we used a 50MHz clock and the PLL integrated, having extremely close results.
Even if the clock could be part of the problem, it's not the main culprit. We'll look into the boot sequence of the supercic project to see what the issue is. We mostly can't seem to unlock SA-1 Japanese titles, EU and US works fine most of the time. |
|
We've successfully unlocked the SA-1 on our devices without needing the FPGA to modulate SYS_CLK. Both @sanni and @nsx0r have pointed out correctly that the PIC16F630 tends to have a higher success rate. Statistics:
Key Observations:
Additional Note:
|
I have a fully-built HW5 Rev3 I can send you for the cost of parts and shipping, if it will help with this. Send me a DM in the community Discord server. |
@petrutoader This is interesting. I was trying to make a new six-slot PCB with a bulk cap on it and was having issues, I didn't consider the bulk cap could be why, I thought it was some bad trace routing. Thanks for that. P.S. I have your GB Operator :3 |
We've ordered all PCBs needed since we had most of the hardware needed in our inventory already. Thanks you for your kind offer!
Beautiful setup and thank you! The bulk cap was really annoying since it extends all timings by quite a lot, the time to discharge makes the unlock very slow. I'm continuing my work on unlock stability, once I get to a satisfactory result I'm looking forward to share what we've implemented. |
|
Brief update, we managed to get to the point in which we get perfect unlocking over a sample of 1k tests. We noticed something quite important: SA-1 cartridges don't seem to unlock properly if the voltage on the cart's VCC line goes over 5.2V. We have Anker Hubs which output 5.28V with spikes reaching 5.35V. When using those it almost never unlocks. However, testing with a TP-Link powered hub and getting a clean 5.0V we have no issues unlocking. Has anyone faced anything similar? We'll continue testing by using an external power supply and seeing at what voltage it doesn't unlock. This makes sense as the 5V obtained internally in the SNES is created using a regulator, and those were precise even in the 90s. We've also had great unlocking with HW5 by powering it through a power supply with a fixed 5V voltage. |
|
Had no idea that the cartridges were so finicky about the input voltage. What I've heard in some youtube video is that the pitch of any game sound is higher as the console temperature is higher, probably it increases the clock frequency slightly or some. |
|
This is a solid point you're making @superbonaci and it's something I hadn't considered before. It's possible that the success rate of unlocking is linked to the clock frequency (MCK & CIC_CLK) and the voltage applied to the cartridge: the two being in a relationship. Currently, we are in the process of determining the optimal input voltage for the cartridge. I am conducting tests on around 18 different SA-1 games with varying PCB serial numbers. Notably, these PCB serials exhibit differences, ranging from capacitance in the I/O and power traces to potentially different batches of SA-1 chips. I plan to provide a report in a comment. Although our testing is conducted with our own hardware, the findings in the report should be applicable across various platforms and be valid for HW5 as well. We've done tests with HW5 in parallel and noticed that when using an external supply at 5.3V all unlocks fail for us. Yet it works fine with the testing we've done under 5.0V. |
|
Attached you can find the report I've made regarding the different voltage levels and how it seems to influence unlocking and data r/w success. Please take note that the ROM integrity checks might fail due to improper timings in the read/write waveforms. In addition to this, I have a Super Retro Trio 3+ that I've taken apart and it uses the superCIC project. When probing the voltage across the cartridge it reads a clear 4.7V which is in line with my report. I'll continue testing @superbonaci idea that the clock frequencies might be in relation with the voltage across the cartridge. |
|
@petrutoader it's mentioned here: S-SMP, the game sound may vary depending on console temperature, not sure about cartridge' s one (may affect or not). The article says "may" but some experts say it's a fact: higher pitch with hither temperature. |
|
Does anyone have an SA1-based cartridge that's finicky to unlock that I can buy/borrow? I can return it to you after testing if you are in the USA. If it's more than $20-30 I will only borrow it (in other words, I'm not interested in buying an NA Super Mario RPG, lol). I've got 3 of them now but none of them have any issues with consistently unlocking. I was thinking if the reason the unlocking fails on the OSCR is the voltage not dropping enough we could use VSELECT to toggle the voltage to 3.3V for a period to help it drop sooner. That may or may not help. Obviously, that's only a solution for units with VSELECT installed but it's something. But I'm doubtful if the voltage drop is really our issue. The OSCR's bulk capacitor is, electrically speaking, very far from the slot and PIC -- I believe around 8-10+ inches. Even with me adding a 100 uF bulk capacitor to the CIC module I can't get the SA1 carts I have to fail to unlock. The OSCR has poor voltage regulation response at the slots, the droop is pretty awful and modern silicon would probably malfunction if it worked at all. Luckily this old tech isn't as sensitive. Now seeing as most people building an OSCR use the cheap clock generators from Aliexpress (I can get these for less than $2/unit shipped), if the clock signal generator's quality has anything to do with whether unlocking is successful or not then that might explain things a bit. That is to say, maybe the people with issues have a bad clock generator. Not so bad that nothing works but rather one that's bad enough that the SA1 cares. Anyway, yeah, all of this combined with how rarely people run into carts that won't unlock makes me think that the voltage issue is not why we are seeing carts that won't unlock. If not the clock generator then maybe something else. But that's all just a theory, I can't test any of this without a cart that has issues unlocking. Though, if I'm right about it being a bad component (i.e. the clock gen), then if someone sends me a cart that they have issues unlocking I won't have any issues with it. |
|
Alright, so here's a weird one. I finally encountered a PIC module that won't correctly dump my copy of PGA Tour. About half the time it fails to unlock and when it does unlock the dump is invalid: Now, I originally wrote this module off as just a bad module, and in a way it is, as it was 1 of 10 I made and the others worked fine. However, today that changed. I made a new Clock Generator PCB that includes the RTC on it as well with the idea that anyone could use it on any version of the OSCR with a Clock Generator header. Since I was making it specifically for the OSCR I opted not to include the footprint/pads for the SMA connectors and moved the clock generator IC as close to the clock pins as possible. I also used a 4-layer PCB. Today the assembled modules I ordered came and I was testing them and they worked fine. I got curious and popped in that CIC module that wasn't working (the one in the image above) and gave it a shot. I didn't expect it to work but I figured why not. I'm sure glad I did, because: To my complete and utter amazement, it worked. Since I had to remove the RTC IC from the main PCB, at first I thought maybe I had just done something else (i.e. reseating the adapter, cart, etc, did something) and figured it was a coincidence, so I put my original clock gen (Aliexpress) back and disabled RTC in the firmware, and sure enough it doesn't work: Wanting to go further I tried a real Adafruit Clock Generator, and that didn't work either: At this point I was thinking it must have just been a coincidence, and since I only tried with my clock gen once I put another, but not the same, of my clock gens in and tried again. It worked... So I tried yet another one of them... So, yeah. At this point, I think it's safe to say the clock generator fairly conclusively plays a role in whether or not SA1 games unlock. While I still think there is something wrong with this module as it doesn't consistently unlock the cart even with my clock gen (though when it does unlock the dumped ROM seems to always pass the checksums), the fact that changing it out lets it work is quite interesting. It seems fairly consistent as well, maybe more can come of this when I have time to mess with it and experiment more. |
|
I'm in the process of finally building a HW5 unit. My temperamental PGA Tour 96 (US) cart does not like HW5. I'm using a 12F629 on a small PCB and an original Adafruit Clock Generator module. I'll try to do some comparisons with my HW1, HW2, and portable SNES reader to see what might be the difference. |
|
Update: My temperamental PGA Tour 96 (US) cart dumps fine now on HW5. Fully assembled HW5 with all the options in a Kytor shell. My HW5 uses a small snesCIC 12F629 board. After final assembly, I redid the clock calibration and found that the finicky cart dumps without a problem. |
I'm having an issue dumping the SA1 chip game PGA Tour 96 for the SNES. I'm using a HW5 Rev3 cart reader with V12.3 firmware and I can dump Super Mario RPG, Kirby Super Star, and Kirby's Dream Land 3 without any issues. When I try to dump PGA Tour 96 it gives me this error:
ERROR
Rom header corrupt
or missing
Press button for
manual configuration
or powercycle if SA1
I get the same error with two different PGA Tour 96 cartridges, both of which play fine on an SNES. One of the cartridge PCB's is SHVC-1L3B-01 and the other is SHVC-1L3B-02.
The text was updated successfully, but these errors were encountered: