N64 SRAM/FlashRAM results

Just wanted to post my results with implementing SRAM/FlashRAM support into my savegame dumper.

Forum love

The most active retro forums seem to be Benheck and Assemblergames. The first one is closed for new members and on the second it took one week until my thread got unlocked by a moderator. No comments after one week and today the thread got deleted.... Kind of disappointing, because I would have appreciated some external input. 

PIN mirroring

My first idea was to mirror AD0-AD15, ALE_L, ALE_H, VCC, GND and switch \READ, \WRITE.

The problem with this idea is that the 64drive will not start with the flashram connected to the mentioned PINs and if you connect them while the 64drive is already running you will just read crap. I also realized that the XPloder64 was interfering with the reading/writing commands. So I had to desolder the cartridge slot.

Full PIN switching

Because the PIN mirroring was not working I modified the gameshark cartridge so I can switch AD0-AD15, ALE_L, ALE_H, \READ and \WRITE during runtime. VCC and GND can of course be mirrored. This is the hardware setup:

Ugly PIN switch setup

Kind of messy, but works in general.

Writing the dumper

I thought this would be an easy task, because the N64 port of ScummVM already has FlashRAM support. It is based on hkz-libn64. Sadly neither the SRAM nor the FlashRAM routines were working for me at all. So I wrote my own routines based on the code from hkz-libn64 and LaC's n64 hardware dox. Against MESS and the 64drive SRAM/FlashRAM emulation these routines work perfectly. I used the following test to verify the functionality of the routines. I filled a buffer (sie of SRAM/FlashRAM) with values from a pseudo random generator and wrote the buffer to the SRAM/FlashRAM. Then I set the same SEED again for the pseudo random generator and filled the buffer with zeros. Now I read the SRAM/FlashRAM into the buffer and compared it to the results from the pseudo random generator. If this works it is very likely that my routines work.

The results

As mentioned above the routines work great against MESS and the 64drive, but not so much against an actual SRAM, FlashRAM chip. There are some strange read/write errors.

Strange SRAM/FlashRAM read errors

I am still not sure if this a problem of my software routines or because of bad wiring. I rewired several times and resoldered some parts, but I was still getting very strange results. I was able to back up F-Zero X (SRAM), 1080 (SRAM) and Pokemon Stadium (FlashRAM) which tells me that it is working in general. But it is not working perfect so I declared the code routines as experimental and I can not ensure that it will work properly for your games. Games I had no luck with are Zelda OOT (SRAM), Zelda MM (FlashRAM), Jet Force Gemini (FlashRAM) and Paper Mario (FlashRAM). It could just be a bad connection problem, but simply neither have the time nor the urge to create a custom board with full soldering for all 20 important connections with switches. These are all games anyway which I would start from the beginning if I ever wanted to play them again. So I backed up the three games which were most important to me.

The final dumper

Here you can see some screenshots of the dumper with experimental SRAM/FlashRAM support and can download it here.

The main menu

SRAM quick Hexview

FlashRAM copy feature with CRC

Future work

I am only partially happy, because it is no definitive solution, but neither a full soldering setup nor switching to the official N64 setup are solutions I think would justify the effort. The only think I might try is to check if the XPloder64 is compatible with GSuploader. But most likely it wont be compatible, because the Gameshark was from Datel and the Xploder64 from Blaze. The only Xploder64 software seems to be X-Killer 0.6, which would involve setting up a Windows 98 PC again. Maybe I am bored on Christmas...

Transferring Project64 savegames to 64drive

Normal x86 machines are little-endian and the N64's MIPS64 CPU is big-endian.
So the EEPROM/SRAM/FlashRAM savegames have to be byte swapped before they work on the other platform.

In Project64 it is very easy to cheat so this can be a motivation to transfer an unlocked savegame to the 64drive.

The easiest way I found is this little perl snippet:

$ perl -e 'open F,shift; do { read(F,$a,4); print scalar reverse($a);} while(!eof(F));' bigend.bin > littlend.bin
src: http://stackoverflow.com/questions/6438099/linux-command-line-tool-to-reverse-byte-order-change-endianess

Transferring N64 cartridge savegames to a 64drive - continued

Today I finished my N64 EEPROM copy utility. It was easier than expected because libdragon link already has EEPROM support.

The idea of my copy utility is very simple:

• select the EEPROM size in the 64drive loading screen and start the copy utility.
• switch S_DAT line to cartridge.
• start the 4K/16K dumping process by pressing the correct button listed on the screen. The dumper will copy the EEPROM content into memory.
• switch the S_DAT line back to the 64drive.
• let the copy utility write the EEPROM dump from memory to the 64drive's virtual EEPROM.
• reset the N64 so the 64drive writes the EEPROM to the CF/SD card.

You can download my SaveGame Dumper here: N64 SaveGame Dumper v0.1

Once again you are doing this at your own risk, because if you don't follow exactly the instructions you can override your savedata with garbage.

I tested the utility without any problems for the following games savegames which were all properly dumped:

4K EEPROM
Banjo-Kazooie
Blast Corps
Body Harvest
Cruis'n USA
Diddy Kong Racing
GoldenEye 007
Lylat Wars / Star Fox 64
Mario Kart 64
Mario Party
Mission Impossible
Pilotwings 64
Super Mario 64
Wave Race 64

16K EEPROM
Banjo-Tooie
Cruis'n World
Donkey Kong 64
Perfect Dark
RR64 - Ridge Racer 64
Yoshi's Story

You will most likely only do this once for your collection. So take your time, check every savegame by running it with the appropriate game on the 64drive or if in doubt dump the EEPROM more than once and compare their hash values (MD5/SHA1).

If for some reason you want to copy a 64drive savegame to a real cartridge you just have to reverse the steps and can use the same program for this task.

Future work
With my SaveGame Dumper I was able to backup all my N64 games with EEPROM saves which are nearly all of my games. It was much easier than expected, because only one pin must be switched and libdragon already has EEPROM support.

What is still missing is SRAM and FlashRAM support. I am currently unsure if this is possible without desoldering, because SRAM/FlashRAM shares all PINs (besides the /write) PIN with the game ROM. libdragon also has no SRAM/FlashRAM support. But this should be the smaller problem because the N64 is documented fairly good on the net.

More on SRAM/FlashRAM in another post.

Transferring N64 cartridge savegames to a 64drive

What this is all about
I bought a 64drive last year and from day one I was not happy with the fact that I would loose all my savegames from my old N64 cartridges. Don't get me wrong the 64drive is a nearly perfect product (cheat support might be the only missing feature after this project), but the fact that only Controller Pak based games can be "continued" on the 64drive is unsatisfying. Most first party titles use an EEPROM, SRAM or FLASHRAM to save the progress and have no support to transfer it via a Controller Pak to another  N64 cartridge. For a few games like Perfekt Dark this works perfectly, but for other games like Diddy Kong Racing or Wave Race this is nearly useless because you can only transfer certain aspects of the game. But more on this later.

First failed approach
Since most of the games use an 4Kbit or 16Kbit EEPROM my first idea was to dump the content with a small AVR Atmega 8 circuit over SPI or I2C/TWI. After some digging I found the pinout of the EEPROM. It is a two wire interface with a clock and data line comparable to I2C/TWI, but proprietary. I found no practical solution to dump these proprietary EEPROM's besides with the US Gameshark 3.3 which can unreliably dump the savegames to a controller pak or over the parallel port. I have an old Gamebuster 3.0 without parallel port and an Xploder 64 which has a parallel port but is not supported by the GSCC tool.

Even so my first approach failed, it became clear that the easiest way would be to write a custom program for the 64drive and build a custom hardware to hot swap the EEPROM.

This post is about the hardware I build and which games savegames can be copied even without a special program running on the 64drive.

Building the necessary hardware

Warning I will not take any responsibility if you break your N64, 64drive, game cartridge or burn down you house, etc... with this instructions. Even if I consider it unlikely you have been warned.

I needed a board to mirror or switch certain pins of the 64drive to a real cartridge EEPROM. Therefore I bought a broken Gameshark for a few bucks, used my Xploder 64 as cartridge holder and a breadboard.

I removed all components from the broken Gameshark and reconnected all broken connections or cut connections which were unwanted. The \read PIN 10 was not connected at all and the \write PIN8 was connected to AD11 PIN11. Finding and fixing these broken and flawed connections to longer than the actual wiring and soldering.

The actual wiring is very simple. Mirror VCC (e.g. PIN 9) , GND (e.g. PIN6), the 1,6MHZ clock (PIN19) and cold reset (PIN20) from the N64 to the 64drive and the actual cartridge. Additionally you have to make S_DAT (PIN21 the EEPROM data line) switchable between the 64drive and the cartridge. By switching the S_DAT line you will be able to hot swap the EEPROM while the N64 in powered on. Don't forget to connect pull-up resistors to both S_DAT lines. I used two 10K  resistors.

This is how my setup ended up / pictures

Xploder64, Gameshark and Breadboard

The empty Gameshark which connects the N64 and the 64drive

The still working XPloder64 which connects to the cartridge

The breadboard for wiring, switching and the two pull-up resistors

The complete setup in action. Not beautiful, but works flawless

Copying savegames without a dedicated dumper

After some initial testing I was curious which games savegames can actually be copied without a dedicated program. The basic idea / procedure is as follows:

1. Load the ROM with the 64drive, which corresponds to your cartridge and let it create a savegame on the CF/SD card.
2. Start the game again, but with game connected to the EEPROM in the cartridge.
3. Find a spot in the game where the complete EEPROM or at least the necessary part is in memory and you can be very certain that the game is currently not reading/writing to the EEPROM.
4. Now switch the S_DAT line back to the 64drive and let the game write into the virtual EEPROM of the 64drive.

Surprisingly this simple procedure works for a lot of games and I will list the results for which games it did work for me. I will not list games without an EEPROM or a SRAM/FLASHRAM module.

Games which worked for me

• Banjo Kazooie: Load your savegame, switch S_DAT, select Save and Quit.
• Banjo Tooie:  Load your savegame, switch S_DAT, select Save and Quit.
• Body Harvest: Load the game, switch S_DAT on savegame select screen and copy the saveslot with the menu items.
• Crusin USA: The game has proper working functionality to copy your EEPROM savegame to Controller Pak. You can also use the following method. Load your savegame, switch S_DAT, race any track.
• Crusin World: No more Controller Pak support here. So use the same method. Load your savegame, switch S_DAT, race any track.
• Diddy Kong Racing: The game has built in Controller Pak support for copying your savegames and your best times. The problem is that you can not back up your unlocked secrets like Drumstick and Tic Tac and the restoring of "Adventure Two" savegames does not work until you beat the final boss in a normal savegame again. Luckily the following method can be used to back up your savegames and unlocked characters. (For best times use a Controller Pak). Go to the saveslot screen, start the copy process, switch S_DAT, select target slot.
• Goldeneye:  Load the game, switch S_DAT on savegame select screen and copy the save slot with the menu items.
• Mario Party: Complicated, but this worked for me. Load into game city, switch S_DAT, save two times on mini games island, visit bank to deselect/select some icons, set game to mono/stereo.
• Mission Impossible:  Load the game, switch S_DAT on savegame select screen and copy the save slot with the menu items.
• Pilot Wings 64: Load game, switch S_DAT, completing any mission on the second saveslot will also save the first saveslot to the 64drive.
• Ridge Racer 64: Load savegame, switch S_DAT, save to other slot.
• Super Mario 64:  Load the game, switch S_DAT on savegame select screen and copy the save slot with the menu items.

Game which don't work but have working Controller Pak backup functions

• Perfect Dark: Game always reports corrupted savegame after switching, but everything can be backed up with a Controller Pak.

Games which did not work at all

• Blast Corps: The savegame seems to get corrupted independent of the save point. The game also has Controller Pak support, but copying your EEPROM savegame to the Controller Pak is not possible. If you started your game with a Controller Pak you obviously have no problem.
• Donkey Kong 64: Even if you load from the original EEPROM, switch and try to save in game, the game will not write anything to the 64drive virtual EEPROM. No idea if the game detects the changed EEPROM, it is connected to the CIC copy protection or is because of some special 64drive handling for  this game.
• Lylat Wars / StarFox 64: Seems to only write the highscore and options if necessary. I did not try getting a new highscore... Everything else only corrupts the savegame on the 64drive.
• Mario Kart 64: Comparable to Lylat Wars / StarFox 64 it only seems to write some parts if absolutely necessary. Winning a cup does not trigger the writing if you already won the cup.
• Wave Race 64: Has Controller Pak support, but you can only back up the driver names (very important...), the bike settings and the best times. You cannot back up the unlocked courses or the unlocked championships. 
• Yoshi Story: only corrupts savegame.

Future work

This is obviously no satisfying result. I was even surprised for how many games you can use this method. Still it does not work for all EEPROM based games, you don't get a 1:1 copy of the EEPROM content and there still is SRAM / FLASHRAM which need some research, a different wiring and a dedicated dumper. The next step will be writing the EEPROM dumper for 4K/16K with libdragon.

Blogger it is... for now

In need for a small brain dump I chose Blogger.

Let's get started.