Rom Hunter mkII

Ascended (19469)

03-07-2019, 11:54

Found so far:
- before loading, it writes 0 to 60FF and 70FF and 4000
- after each 16k block it writes an increased value to 7000, 1 after the first block, 2 after the second, etc., so looks like 0x7000 writes determine the 16kB block on page 2
- After loading 8 blocks (I dumped Nemesis), it writes:
- 0 to 6010
- 1 to 6810
- 2 to 7010
- 3 to 7810
and then it crashes.

Van Manuel

Ascended (19469)

03-07-2019, 12:08

For an ASCII16 ROM it wrote only 0's at the end. And at the beginning it wrote zeroes to 60FF, 70FF, 4000, 8000, 8001, 8002 and then starts loading at 8000 where I see the cartridge data coming in (starting with A, B, etc.)

Van Manuel

Ascended (19469)

03-07-2019, 12:12

For an ASCII8 ROM I see exactly the same as with an ASCIi16 ROM.

Van Manuel

Ascended (19469)

03-07-2019, 12:13

Note: I assumed that writes would be in the 0x4000-0xC000 range, but perhaps that's wrong.

Van enribar

Paragon (1214)

03-07-2019, 12:29

Can you kindly write a resume about this cart? In particular, can Rom Hunter guess automatically the mapper of the cartridge to dump? This is a advantage because recent utilities need a manual specification of mapper.

Van Takamichi

Hero (641)

03-07-2019, 13:41

The thread has increased quite a bit since... anyway my experiments so far.
1. Konami SCC cart dumping
On WebMSX, I dumped several Konami SCC roms. Contra, Salamander and Space Manbow (Konami 5, right?) were successful; Quarth failed. I don't know why. Results PIN: whyonlyqfails Note the extension differs depending on the game such as .RHA, .RHB or .RHT
2. RAM mapper
I tried testRAM on real MSX, a) without cart, b) with Rom Hunter and for comparison reason c) an AddRAM 4MB cart. The results between a) and b) were same! Come to think of that, the figure after "MAIN RAM:" at the MSX startup doesn't increase with Rom Hunter inserted. Photos PIN: rhand4mbcart
3. Opening the case
I feel strong resistance when applying force to open the casing. Not something as feeble as glue but surely something secure is there. I even suspect "tamper proof" that destroys the Rom Hunter when opened by force. I've seen it with electronic equipment before! This photo shows limit of opening the case. PIN: nofurther
4. Does the disk work without the cart?
The utility disk starts without problem but when I inserted A1 Spirit into slot 2, MSX started emitting shrieking beeep (in PSG, not the MSX beep sound) and the utility program didn't recognize the cart. Perhaps the utility detects existence of the Rom Hunter cart to accept/refuse to work.
5. Rom Hunter can't play
I've saved a game rom, namely Zanac Ex into a diskette, booted the util and chose [1] LOAD -> START. After choosing the file. the disk drive loaded several times, and then the MSX rebooted... only to boot the Rom Hunter cart, not the Zanac Ex game. I tried 1 key Z80 boot when quitting the Rom Hunter cart's tape menu, but the result was worse, util didn't boot and the MSX hanged up.

Do 2. and 5. suggest the RAMs in my cartridge dead?
btw what are the mnemonics in pure ascii written from &HBF2 of the Rom Hunter rom file starting from CALL TAPIOF, are they dummies?

Rom Hunter always auto detects the mapper type. The user cannot manually specify. The box only states MSX and MSX2 so things that were released after MSX2+ might not be supported.
Forgot one thing, of course I know that MG2 file was a fanwork more than most other people in the world ;) I tried with Japanese original... and failed again. PIN: suneeeeku

Van Takamichi

Hero (641)

03-07-2019, 13:39

gdx wrote:

On the back of the box it's written that the ASCII and Konami mappers are supported. So at least three Rom mappers are supported (ASCII 8k/16k and Konami 4). This cartridge can not be emulated if we do not know how to switch the mapper type.

The image took quite a long time to load... ;) A few translations might be worth
---
Backs up maximum 2Mbit rom cartridge to tape or disk
* Can copy ROM cartridge to tape/disk regardless of the protection
* Supports any MSX and MSX2 with at least 2 throttles
* Absolutely does not require modifying the MSX itself
* Supports not only the standard cartridges but megarom cartridges up to 2 megabit
* Supports the ascii mapper method and konami mapper method therefore can copy megarom cartridges constituted from a mapper of either type and a rom
* If you are skilled enough to code in assembly you can use this as a 256 kilobyte expansion ram using ascii mapper
* Rom Hunter entirely auto detects the ascii mapper method, konami mapper method and the bank units so the operation is easy.
---
"2 throttles" is obviously a typo for 2 slots :D

Van gdx

Enlighted (6221)

03-07-2019, 13:43

1. The fact that the SCC Roms have a different extension may mean that the loader applies a patch to the load. For Quarth or Metal Gear 2, I think the auto-detection of Rom mapper is not effective.

2. testRAM not support the Rom mappers. A "MegaRam" is not a "Memory Mapper".

3. Do not force! There are probably clips like Konami's cartridges.

5. Try with a Konami megarom without SCC sound or a megarom with ASCII 8k mapper

Van RetroTechie

Paragon (1563)

03-07-2019, 15:51

Screw(s) covered by the label is also common. Usually you can feel this by going over the label with your fingers. If used, you have the choice between break things, damage label, or not open it up.

And yes, failed RAM chips is always a possibility. Pretty common actually. No reason this cartridge would be an exception to that rule even if unused most of the time.

Note that failed RAM chips don't prevent you from running test software & check what response you get. If eg. a RAM providing 1 bit failed, that leaves 7 bits that do behave like RAM. Garbage coming out != the usual FFh of 'empty' space. And mapper mechanisms are easy to detect as well.

Van Manuel

Ascended (19469)

03-07-2019, 17:00

This is in the ROM indeed (texts, but also part of the source code):

    DAITO MICOM SYSTEM PRESENTS
      ROM HUNTER Mk2  Version 1.1
       Copyright 1986 Y.KITAGAWA
         [1]  TAPE   ->   START
         [2]  ROM    ->   TAPE
         [3]  TAPE   ->   TAPE
         [4]  CHANGE BAUDRATE
         [5]  QUIT
         [6]  SKIP CARTRIDGE
      YOU SELECT NUMBER [ 1 - 6 ] 
         [1]  TAPE   ->   START
         SET TAPE AND PUSH PLAY
              LOADING !
         [2]  ROM    ->   TAPE
           NO ROM CARTRIDGE !
         [2]  ROM    ->   TAPE
        ROM CARTRIDGE SLOT #
             PUSH ANY KEY 
         (N:FOR NEXT CARTRIDGE)
             PUSH ANY KEY
         [2]  ROM    ->   TAPE
             OUT OF MEMORY
         [4]  CHANGE BAUDRATE
             (1)  1200 BPS
             (2)  2400 BPS
      YOU SELECT NUMBER ( 1 - 2 ) 
        SAVE BAUDRATE : 
1200 BPS
2400 BPS
         [3]  TAPE   ->   TAPE
              OUT OF MEMORY
         [3]  TAPE   ->   TAPE
         SET TAPE AND PUSH PLAY
         [3]  TAPE   ->   TAPE
         [6]  SKIP CARTRIDGE
         SKIP CARTRIDGE SLOT#
         [6]  SKIP CARTRIDGE
           NO ROM CARTRIDGE !
D!C@
 CALL TAPIOF
 POP AF
 POP AF      ;RETURN STACK UP
 RET
CHKSLT:CALL 0138H
 AND 0CH
 SRL A
 SRL A ;SHIFT RIGHT 2 BIT
 LD C,A
 LD B,0
 LD HL,0FCC1H
 ADD HL,BC
 LD A,(HL)
 AND 80H
 OR C    ;EXPANDING ?
 LD HL,0FCC5H
 ADD HL,BC
 LD C,A
 LD A,(HL)
 AND 0CH ;EXPANDING SLOT #
 OR C
 RET
SETSLT:CALL CHKSLT
 LD HL,8000H
 PUSH AF
 CALL 0024H
 POP AF
 RET
BAUDS:CALL MSG07
 CALL CHGET
 CP '1
 JP Z,BAUD1
 CP '2
 RET NZ
 LD HL,0F401H
 JR BAUD2   ;2400BPS
BAUD1:LD HL,0F3FCH
BAUD2:LD DE,0F406H
 LD BC,0005H
 LDIR
 RET
***********************
* ROM SET CHECK       *
*   ROM EXIST CF=0    *
*    NO EXIST CF=1    *
***********************
CHKROM:LD A,(IX+1)
 LD HL,4000H
 CALL 000CH
 CP 41H
 JR NZ,CHKRM1 ;NOT EXIST
 INC HL
 LD A,(IX+1)
 CALL 000CH
 CP 42H
 JR NZ,CHKRM1 ;NOT EXIST
 PUSH HL
 LD HL,5000H
 LD BC,0025H
CHKRM3:PUSH BC
 LD A,(IX+1)
 CALL 000CH
 POP BC
 CPI
 JR NZ,CHKRM4 ;NOT SAME
 JP PE,CHKRM3 ;SAME
 POP HL
CHKRM1:LD A,(IX+1)
 LD HL,8000H
 CALL 000CH
 CP 41H
 JR NZ,CHKRM2 ;NOT EXIST
 INC HL
 LD A,(IX+1)
 CALL 000CH
 CP 4COPYRIGHT 1986 BY YOSHIKO KITAGAWA

The menu texts are between offset 0x04FA and 0x098D. That source code is betweeen 0x0BF1 and 0x1021. After that, there is nothing in the ROM anymore until 0x1100, except for some value on 0x1080. From 0x1100-0x1268 is some code (looks like a bunch of helper routines), and after that emptiness again. The net amount of code is only 4kB or so.

FYI, this code corresponds to this actual code in the ROM (using offsets as it is in memory):

41BB  call   #00e7        CD E7 00
41BE  pop    af           F1
41BF  pop    af           F1
41C0  ret                 C9
41C1  call   #0138        CD 38 01
41C4  and    #0c          E6 0C
41C6  srl    a            CB 3F
41C8  srl    a            CB 3F
41CA  ld     c,a          4F
41CB  ld     b,#00        06 00
41CD  ld     hl,#fcc1     21 C1 FC
41D0  add    hl,bc        09
41D1  ld     a,(hl)       7E
41D2  and    #80          E6 80
41D4  or     c            B1
41D5  ld     hl,#fcc5     21 C5 FC
41D8  add    hl,bc        09
41D9  ld     c,a          4F
41DA  ld     a,(hl)       7E
41DB  and    #0c          E6 0C
41DD  or     c            B1
41DE  ret                 C9
41DF  call   #41c1        CD C1 41
41E2  ld     hl,#8000     21 00 80
41E5  push   af           F5
41E6  call   #0024        CD 24 00
41E9  pop    af           F1
41EA  ei                  FB
41EB  ret                 C9
41EC  call   #44b0        CD B0 44
41EF  call   #009f        CD 9F 00
41F2  cp     #31          FE 31
41F4  jp     z,#41ff      CA FF 41
41F7  cp     #32          FE 32
41F9  ret    nz           C0
41FA  ld     hl,#f401     21 01 F4
41FD  jr     #4202        18 03
41FF  ld     hl,#f3fc     21 FC F3
4202  ld     de,#f406     11 06 F4
4205  ld     bc,#0005     01 05 00
4208  ldir                ED B0
420A  ret                 C9