Dumping for fun
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
Dumping for fun
I just took possession of this...
http://cgi.ebay.co.uk/ws/eBayISAPI.dll? ... 8774695026
So let's see if I have any success getting info out of those carts I own that haven't been dumped before
http://cgi.ebay.co.uk/ws/eBayISAPI.dll? ... 8774695026
So let's see if I have any success getting info out of those carts I own that haven't been dumped before
Lie with passion and be forever damned...
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
Well I've had a chance to try it out. And it actually works! Following the instructions I was able to reload the files back into the Vic and reset to boot the image.
Next stage is figuring out how to translate what I recorded into a workable emulator image. And this is where the techs on here can come in
Do only 1540 drives work with the Vic20? I tried saving out the dumps to my 1541 and it wasn't having anything of it. So I saved them to tape (just as well I had a spare one to hand) and I've made a TAP of the tape.
All the files are brought into the Vic using 8K RAM expansion and loading LOAD"",1,1 on real hardware. Then you toggle a switch on the board and hit the reset and bingo, you get the game you dumped.
I tried it out with Amazing Maze, Bug Crusher and Tank Wars, three rare OEM carts. All load off block 5 btw. If I post the TAP here, would someone somehow be able to figure out how to get the damn dumps running on their own in Vice?
Note that whilst the dumps are called AMAZING, BUG and TANKWARS, they don't appear in the file listing if you go to attach the TAP within Vice. They soon appear if you do the LOAD"",1,1 and press PLAY however. Not sure what the files that are in the listing signify but might have something to do with the hardware dumping. Or not.
Next stage is figuring out how to translate what I recorded into a workable emulator image. And this is where the techs on here can come in
Do only 1540 drives work with the Vic20? I tried saving out the dumps to my 1541 and it wasn't having anything of it. So I saved them to tape (just as well I had a spare one to hand) and I've made a TAP of the tape.
All the files are brought into the Vic using 8K RAM expansion and loading LOAD"",1,1 on real hardware. Then you toggle a switch on the board and hit the reset and bingo, you get the game you dumped.
I tried it out with Amazing Maze, Bug Crusher and Tank Wars, three rare OEM carts. All load off block 5 btw. If I post the TAP here, would someone somehow be able to figure out how to get the damn dumps running on their own in Vice?
Note that whilst the dumps are called AMAZING, BUG and TANKWARS, they don't appear in the file listing if you go to attach the TAP within Vice. They soon appear if you do the LOAD"",1,1 and press PLAY however. Not sure what the files that are in the listing signify but might have something to do with the hardware dumping. Or not.
Lie with passion and be forever damned...
No, 1541 (and 1541-II, 1571, 1581 etc) work perfectly fine with VIC-20. Did you load/save to the original address (,8,1)?
What does the switch do? Is it for toggling the address block of the 8K RAM expansion? Sure, post one or more TAPs and we can figure it out one way or another how to extract cartridge images out of the archive. Does the TAP contain some kind of custom loader for a cartridge image?
What does the switch do? Is it for toggling the address block of the 8K RAM expansion? Sure, post one or more TAPs and we can figure it out one way or another how to extract cartridge images out of the archive. Does the TAP contain some kind of custom loader for a cartridge image?
Anders Carlsson
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
To dump the carts, you load a special program into the Vic20 memory supplied with the board (see the auction listing in the first post). You run this and tell the program if you want to save to tape or disk. It was not attempting to save to disk (I had the drive connected and on with a disk inserted) when told, so I saved to tape instead. The program does the saving for you, you don't type anything.
On the board there are three switches. Two toggle the memory blocks 3 and 5 on/off (eg. to dump the OEM carts, I had the switch for block 5 toggled off when I loaded the dump program and ran it, and turned on when I wanted to run the dump) and the other one I think tells the Vic20 to boot what's in the toggled memory blocks on the board or not. This third switch is set to on (normal) when dumping, and off (protect) after loading in a dump.
I'll post the TAP shortly so people can have a look at it.
On the board there are three switches. Two toggle the memory blocks 3 and 5 on/off (eg. to dump the OEM carts, I had the switch for block 5 toggled off when I loaded the dump program and ran it, and turned on when I wanted to run the dump) and the other one I think tells the Vic20 to boot what's in the toggled memory blocks on the board or not. This third switch is set to on (normal) when dumping, and off (protect) after loading in a dump.
I'll post the TAP shortly so people can have a look at it.
Lie with passion and be forever damned...
- Mike
- Herr VC
- Posts: 4839
- Joined: Wed Dec 01, 2004 1:57 pm
- Location: Munich, Germany
- Occupation: electrical engineer
Mayhem,
As soon as the cartridge has been started in VICE (with 'Full' setup):
- start the monitor with 'Alt+M'
- overwrite part of the "A0CBM" RESET signature with '>A004 00'
- exit the monitor with 'x'
- do a soft reset 'Alt+R'
- (only necessary if BLK3 is used [*]:) protect BLK3 with 'POKE55,0:POKE56,96:CLR'
- re-create the signature with 'POKE40964,65'
- attach a *.d64 image
- save BLK5 with:
- save BLK3 with:
Good luck,
Michael
[*]: The contents of the strings in the SYS57809 statements would otherwise overwrite the end of the BLK3 area!
As soon as the cartridge has been started in VICE (with 'Full' setup):
- start the monitor with 'Alt+M'
- overwrite part of the "A0CBM" RESET signature with '>A004 00'
- exit the monitor with 'x'
- do a soft reset 'Alt+R'
- (only necessary if BLK3 is used [*]:) protect BLK3 with 'POKE55,0:POKE56,96:CLR'
- re-create the signature with 'POKE40964,65'
- attach a *.d64 image
- save BLK5 with:
Code: Select all
SYS57809"A000DUMP",8,1:POKE193,0:POKE194,160:POKE780,193:POKE781,0:POKE782,192:SYS65496
Code: Select all
SYS57809"6000DUMP",8,1:POKE193,0:POKE194,96:POKE780,193:POKE781,0:POKE782,128:SYS65496
Michael
[*]: The contents of the strings in the SYS57809 statements would otherwise overwrite the end of the BLK3 area!
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
Well you lost me at that point thereMike wrote:As soon as the cartridge has been started in VICE (with 'Full' setup):
Mainly because I'm not starting a cartridge (and what's "Full setup" btw?). You can attach the TAP in Vice and I can LOAD"",1,1 and put the dump into memory. Wondering what to possibly do after that.
Lie with passion and be forever damned...
- Mike
- Herr VC
- Posts: 4839
- Joined: Wed Dec 01, 2004 1:57 pm
- Location: Munich, Germany
- Occupation: electrical engineer
You can change the memory configuration in the menu: Settings > VIC settings ...Mayhem wrote:[...] and what's "Full setup" btw? [...] I can LOAD"",1,1 and put the dump into memory. Wondering what to possibly do after that.
and 'Full' simply means all blocks are available.
You say the loader doesn't autostart? Provided the cartridge dump doesn't have a protection (i.e. overwrites itself to check whether it is in RAM or in ROM) you could simply try a soft reset (Alt-R) to actually start the cartridge in VICE. Copying the cartridge data to a *.d64 image then simply amounts to entering the code lines with the 'SYS'es in my posting above.
Michael
I bet if Mayhem can post one TAP - only one is required to see what it contains - we will be able to figure out exactly what to do with it.
By the way, isn't it easier to do POKE40964,0 than going through the monitor if we're only overwriting one byte? I'm wondering if it is not enough to POKE56,30:CLR instead of doing a soft reset, as I suppose you want various pointers to be reset after loading a memory image?
A couple of cool SYSes! I re-invented the wheel a while ago:
10 DATA 169,2,162,8,168,32,186,255,173,255,31,162,0,160,30,32,189,255
15 DATA 169,160,133,252,162,0,134,251,169,251,160,192,32,216,255,96
20 FORI=0 TO 33:READ B:POKE 673+I,B:NEXT
It will read the file name from the upper left corner (7680) in SHIFTED letters, and take the number of characters in file name from 8191. Thus, it is not nearly as elegant as the existing ROM call.
By the way, isn't it easier to do POKE40964,0 than going through the monitor if we're only overwriting one byte? I'm wondering if it is not enough to POKE56,30:CLR instead of doing a soft reset, as I suppose you want various pointers to be reset after loading a memory image?
A couple of cool SYSes! I re-invented the wheel a while ago:
10 DATA 169,2,162,8,168,32,186,255,173,255,31,162,0,160,30,32,189,255
15 DATA 169,160,133,252,162,0,134,251,169,251,160,192,32,216,255,96
20 FORI=0 TO 33:READ B:POKE 673+I,B:NEXT
It will read the file name from the upper left corner (7680) in SHIFTED letters, and take the number of characters in file name from 8191. Thus, it is not nearly as elegant as the existing ROM call.
Anders Carlsson
- Mike
- Herr VC
- Posts: 4839
- Joined: Wed Dec 01, 2004 1:57 pm
- Location: Munich, Germany
- Occupation: electrical engineer
I wrote this because I assumed the loader would autostart the cartridge (which it doesn't).carlsson wrote:By the way, isn't it easier to do POKE40964,0 than going through the monitor if we're only overwriting one byte?
In another thread I mentioned:carlsson wrote:A couple of cool SYSes!
Code: Select all
POKE147,0:SYS57809(N$),8,1:POKE780,0:SYS65493
Two new candidates for the 'ROM calls' thread in the 'Programming' section.
Michael
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
If you look at the picture of the board in the auction link, once you've done the LOAD"",1,1 on a real Vic20 and brought the game into memory, you flick one switch to PROTECT and the relevant block switches (either or both of 3 and 5) to the down position, hit reset on the board and the game boots.
Trying a soft reset in Vice didn't work (unsurprising there) after I did the LOAD"",1,1 on the TAP. I guess the board must do some jiggerypokery to put what you loaded into the right block slots and then execute it when you hit reset.
So it's a question getting what I have on the TAP and you can load in Vice via LOAD"",1,1 then out to some file we can fiddle with to autoboot merely by attaching it to the revelent memory block in the emulator.
I'll post the TAP I made tonight for people to hack with
Trying a soft reset in Vice didn't work (unsurprising there) after I did the LOAD"",1,1 on the TAP. I guess the board must do some jiggerypokery to put what you loaded into the right block slots and then execute it when you hit reset.
So it's a question getting what I have on the TAP and you can load in Vice via LOAD"",1,1 then out to some file we can fiddle with to autoboot merely by attaching it to the revelent memory block in the emulator.
I'll post the TAP I made tonight for people to hack with
Lie with passion and be forever damned...
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
You can grab it from here: http://www.mayhem64.co.uk/misc/cartdump.zip
Lie with passion and be forever damned...
- Mike
- Herr VC
- Posts: 4839
- Joined: Wed Dec 01, 2004 1:57 pm
- Location: Munich, Germany
- Occupation: electrical engineer
Mayhem,
I sent you an e-mail. I found the data of AMAZING from $2000 onwards. No wonders, that it didn't autostart. I then proceeded as follows:
Soft-Reset with 'Alt+R' to re-initialise the BASIC. Then I protected that area with 'POKE55,0:POKE56,32:CLR'. I saved the first half of BLK1 with (AMAZING is a 4K image):
So far so good. But that file still had the wrong loading address. I extracted the file from the *.d64 image, and made the neccessary alterations to get both an '*.prg' (loading address $a000) and an '*.crt', without header.
Greetings,
Michael
I sent you an e-mail. I found the data of AMAZING from $2000 onwards. No wonders, that it didn't autostart. I then proceeded as follows:
Soft-Reset with 'Alt+R' to re-initialise the BASIC. Then I protected that area with 'POKE55,0:POKE56,32:CLR'. I saved the first half of BLK1 with (AMAZING is a 4K image):
Code: Select all
SYS57809"AMAZING",8,1:POKE193,0:POKE194,32:POKE780,193:POKE781,0:POKE782,48:SYS65496
Greetings,
Michael
That is what I expected, the expansion board acts like a regular 16K expansion, and by flipping the switches, you shift the two blocks up high into address space and can run the dump.
The TAP contains Amazing Maze, Bug Crusher and Tank Wars. All those are already archived on Funet/Zimmers since a few years ago. They are protected from running in RAM, but the versions on the FTP are patched. I even knew a guy who owned Amazing Maze, and borrowed it only a few years ago. Bug Crusher even refuses to boot properly if there is RAM in BLK1 (+8K).
The TAP contains Amazing Maze, Bug Crusher and Tank Wars. All those are already archived on Funet/Zimmers since a few years ago. They are protected from running in RAM, but the versions on the FTP are patched. I even knew a guy who owned Amazing Maze, and borrowed it only a few years ago. Bug Crusher even refuses to boot properly if there is RAM in BLK1 (+8K).
Anders Carlsson
- Mayhem
- High Bidder
- Posts: 3027
- Joined: Mon May 24, 2004 7:03 am
- Website: http://www.mayhem64.co.uk
- Location: London
Hmmm I've not seen a dump for Tank Wars about, I'll have to go back and recheck (countering what I wrote in my email to Mike here). Still at least it's proof of concept that it works. Next step, trying to dump the carts I have that are definitely not out there. Simple question is... is there any easy way for me to tell which blocks they will use?
Lie with passion and be forever damned...