Dumping for fun

Mayhem · Post by **Mayhem** » Sat Mar 18, 2006 7:08 am

I just took possession of this...

http://cgi.ebay.co.uk/ws/eBayISAPI.dll? ... 8774695026

So let's see if I have any success getting info out of those carts I own that haven't been dumped before

aneurysm · Post by **aneurysm** » Sun Mar 19, 2006 11:55 am

I had no idea something like that was ever invented. All this time I thought ROM dumpers were some kind of geek-tech wizards that magically summoned the image from a cart to a file on a drive using fancy hand gestures.

Mayhem · Post by **Mayhem** » Wed Mar 29, 2006 4:03 pm

Well I've had a chance to try it out. And it actually works! Following the instructions I was able to reload the files back into the Vic and reset to boot the image.

Next stage is figuring out how to translate what I recorded into a workable emulator image. And this is where the techs on here can come in

Do only 1540 drives work with the Vic20? I tried saving out the dumps to my 1541 and it wasn't having anything of it. So I saved them to tape (just as well I had a spare one to hand) and I've made a TAP of the tape.

All the files are brought into the Vic using 8K RAM expansion and loading LOAD"",1,1 on real hardware. Then you toggle a switch on the board and hit the reset and bingo, you get the game you dumped.

I tried it out with Amazing Maze, Bug Crusher and Tank Wars, three rare OEM carts. All load off block 5 btw. If I post the TAP here, would someone somehow be able to figure out how to get the damn dumps running on their own in Vice?

Note that whilst the dumps are called AMAZING, BUG and TANKWARS, they don't appear in the file listing if you go to attach the TAP within Vice. They soon appear if you do the LOAD"",1,1 and press PLAY however. Not sure what the files that are in the listing signify but might have something to do with the hardware dumping. Or not.

carlsson · Post by **carlsson** » Wed Mar 29, 2006 4:21 pm

No, 1541 (and 1541-II, 1571, 1581 etc) work perfectly fine with VIC-20. Did you load/save to the original address (,8,1)?

What does the switch do? Is it for toggling the address block of the 8K RAM expansion? Sure, post one or more TAPs and we can figure it out one way or another how to extract cartridge images out of the archive. Does the TAP contain some kind of custom loader for a cartridge image?

Mayhem · Post by **Mayhem** » Wed Mar 29, 2006 5:26 pm

To dump the carts, you load a special program into the Vic20 memory supplied with the board (see the auction listing in the first post). You run this and tell the program if you want to save to tape or disk. It was not attempting to save to disk (I had the drive connected and on with a disk inserted) when told, so I saved to tape instead. The program does the saving for you, you don't type anything.

On the board there are three switches. Two toggle the memory blocks 3 and 5 on/off (eg. to dump the OEM carts, I had the switch for block 5 toggled off when I loaded the dump program and ran it, and turned on when I wanted to run the dump) and the other one I think tells the Vic20 to boot what's in the toggled memory blocks on the board or not. This third switch is set to on (normal) when dumping, and off (protect) after loading in a dump.

I'll post the TAP shortly so people can have a look at it.

Mike · Post by **Mike** » Thu Mar 30, 2006 1:56 am

Mayhem,

As soon as the cartridge has been started in VICE (with 'Full' setup):

- start the monitor with 'Alt+M'
- overwrite part of the "A0CBM" RESET signature with '>A004 00'
- exit the monitor with 'x'
- do a soft reset 'Alt+R'
- (only necessary if BLK3 is used [*]:) protect BLK3 with 'POKE55,0:POKE56,96:CLR'
- re-create the signature with 'POKE40964,65'
- attach a *.d64 image
- save BLK5 with:

Code: Select all

SYS57809"A000DUMP",8,1:POKE193,0:POKE194,160:POKE780,193:POKE781,0:POKE782,192:SYS65496

- save BLK3 with:

Code: Select all

SYS57809"6000DUMP",8,1:POKE193,0:POKE194,96:POKE780,193:POKE781,0:POKE782,128:SYS65496

Good luck,

Michael

[*]: The contents of the strings in the SYS57809 statements would otherwise overwrite the end of the BLK3 area!

Mayhem · Post by **Mayhem** » Thu Mar 30, 2006 3:55 am

Mike wrote:As soon as the cartridge has been started in VICE (with 'Full' setup):

Well you lost me at that point there

Mainly because I'm not starting a cartridge (and what's "Full setup" btw?). You can attach the TAP in Vice and I can LOAD"",1,1 and put the dump into memory. Wondering what to possibly do after that.

Mike · Post by **Mike** » Thu Mar 30, 2006 4:10 am

Mayhem wrote:[...] and what's "Full setup" btw? [...] I can LOAD"",1,1 and put the dump into memory. Wondering what to possibly do after that.

You can change the memory configuration in the menu: Settings > VIC settings ...

and 'Full' simply means all blocks are available.

You say the loader doesn't autostart? Provided the cartridge dump doesn't have a protection (i.e. overwrites itself to check whether it is in RAM or in ROM) you could simply try a soft reset (Alt-R) to actually start the cartridge in VICE. Copying the cartridge data to a *.d64 image then simply amounts to entering the code lines with the 'SYS'es in my posting above.

Michael

carlsson · Post by **carlsson** » Thu Mar 30, 2006 4:45 am

I bet if Mayhem can post one TAP - only one is required to see what it contains - we will be able to figure out exactly what to do with it.

By the way, isn't it easier to do POKE40964,0 than going through the monitor if we're only overwriting one byte? I'm wondering if it is not enough to POKE56,30:CLR instead of doing a soft reset, as I suppose you want various pointers to be reset after loading a memory image?

A couple of cool SYSes! I re-invented the wheel a while ago:

10 DATA 169,2,162,8,168,32,186,255,173,255,31,162,0,160,30,32,189,255
15 DATA 169,160,133,252,162,0,134,251,169,251,160,192,32,216,255,96
20 FORI=0 TO 33:READ B:POKE 673+I,B:NEXT

It will read the file name from the upper left corner (7680) in SHIFTED letters, and take the number of characters in file name from 8191. Thus, it is not nearly as elegant as the existing ROM call.

Mike · Post by **Mike** » Thu Mar 30, 2006 5:28 am

carlsson wrote:By the way, isn't it easier to do POKE40964,0 than going through the monitor if we're only overwriting one byte?

I wrote this because I assumed the loader would autostart the cartridge (which it doesn't).

carlsson wrote:A couple of cool SYSes!

In another thread I mentioned:

Code: Select all

POKE147,0:SYS57809(N$),8,1:POKE780,0:SYS65493

which loads the file in N$ to its correct address without restarting the BASIC program.

Two new candidates for the 'ROM calls' thread in the 'Programming' section.

Michael

Mayhem · Post by **Mayhem** » Thu Mar 30, 2006 6:14 am

If you look at the picture of the board in the auction link, once you've done the LOAD"",1,1 on a real Vic20 and brought the game into memory, you flick one switch to PROTECT and the relevant block switches (either or both of 3 and 5) to the down position, hit reset on the board and the game boots.

Trying a soft reset in Vice didn't work (unsurprising there) after I did the LOAD"",1,1 on the TAP. I guess the board must do some jiggerypokery to put what you loaded into the right block slots and then execute it when you hit reset.

So it's a question getting what I have on the TAP and you can load in Vice via LOAD"",1,1 then out to some file we can fiddle with to autoboot merely by attaching it to the revelent memory block in the emulator.

I'll post the TAP I made tonight for people to hack with

Mayhem · Post by **Mayhem** » Thu Mar 30, 2006 2:22 pm

You can grab it from here: http://www.mayhem64.co.uk/misc/cartdump.zip

Mike · Post by **Mike** » Fri Mar 31, 2006 2:15 am

Mayhem,

I sent you an e-mail. I found the data of AMAZING from $2000 onwards. No wonders, that it didn't autostart. I then proceeded as follows:

Soft-Reset with 'Alt+R' to re-initialise the BASIC. Then I protected that area with 'POKE55,0:POKE56,32:CLR'. I saved the first half of BLK1 with (AMAZING is a 4K image):

Code: Select all

SYS57809"AMAZING",8,1:POKE193,0:POKE194,32:POKE780,193:POKE781,0:POKE782,48:SYS65496

So far so good. But that file still had the wrong loading address. I extracted the file from the *.d64 image, and made the neccessary alterations to get both an '*.prg' (loading address $a000) and an '*.crt', without header.

Greetings,

Michael

carlsson · Post by **carlsson** » Fri Mar 31, 2006 3:49 am

That is what I expected, the expansion board acts like a regular 16K expansion, and by flipping the switches, you shift the two blocks up high into address space and can run the dump.

The TAP contains Amazing Maze, Bug Crusher and Tank Wars. All those are already archived on Funet/Zimmers since a few years ago. They are protected from running in RAM, but the versions on the FTP are patched. I even knew a guy who owned Amazing Maze, and borrowed it only a few years ago. Bug Crusher even refuses to boot properly if there is RAM in BLK1 (+8K).

Mayhem · Post by **Mayhem** » Fri Mar 31, 2006 6:17 am

Hmmm I've not seen a dump for Tank Wars about, I'll have to go back and recheck (countering what I wrote in my email to Mike here). Still at least it's proof of concept that it works. Next step, trying to dump the carts I have that are definitely not out there. Simple question is... is there any easy way for me to tell which blocks they will use?