Rom dumping over audio

Announce (tech) demos or games releases

Moderator: Mask of Destiny

Post Reply
twosixonetwo
Very interested
Posts: 58
Joined: Tue Feb 25, 2014 3:38 pm

Rom dumping over audio

Post by twosixonetwo » Mon Aug 25, 2014 7:50 am

Let me begin by stating that this is isn't a finished product and I wouldn't advice anyone to use this in its current state to create a backup archive of their games. What I want to show here is a mess that I hacked together until it finally worked.

Link to the files

What is it?

It's a method to dump cartridges with just the following equipment:
- Mega Drive
- Flash Cartridge (I've used an EverDrive)
- Stereo Recording device (PC)

How does it work?

You plug in the flash cartridge with the dumping programm, start the mega drive, start the dumping programm, pull out the flash cartridge, insert the cartridge that is meant to be dumped, start the recording and press c.

What happens is that the code of the dumping programm is copied into ram and the 68k jumps into ram, thus not more depending on the flas cartridge to run the code. As soon as c is pressed on the controller, the code starts reading the cartridge that is currently inside the cartridge port, and outputting the data in 2-bit samples on both channels.

And it works?

Yes, I've successfully dumped "the ottifants" to test if it works:

Image
Image

Are there any Problems?

Yes.
1. It's currently only tested with 96000hz sampling rate recording and I doubt it currently works with 44100hz.
2. It's a bit slow, taking ~22 minutes to record 1mb of data.
3. Currently the conversion tool is pretty bad and relies on a number of fixed constants. This should be changed where possible to make it more usable for different people.
4. Due to a tiny bug, the dumping rom will leave a tail on the last sample, which the conversion tool might recognize as further bytes. These bytes can be removed in a hex editor to create a clean dump.
5. The current rom is hardcoded to dump 1mb.

This is not meant to help illegal rom spreading.

bgvanbur
Interested
Posts: 46
Joined: Fri Jun 22, 2012 11:13 pm

Post by bgvanbur » Mon Aug 25, 2014 1:49 pm

Very cool.

I think this might work on the Sega CD (so you wouldn't need a flash cartridge). Insert cartridge after Sega CD is running from RAM, would also need to use the modify the catridge address since different starting address with the Sega CD in use, and if you are already using the 68k for the audio portion it should be able to use the same audio routine but if using z80 for audio that would either require converting to 68k audio or use the Sega CD PCM.

ICEknight
Very interested
Posts: 51
Joined: Mon Apr 23, 2012 10:41 am

Post by ICEknight » Mon Aug 25, 2014 5:11 pm

This is really interesting!

Would there be any way for this system to access each individual chip inside the cartridge (when appliable), for individual dumps?

sega16
Very interested
Posts: 251
Joined: Sat Jan 29, 2011 3:16 pm
Location: U.S.A.

Post by sega16 » Tue Aug 26, 2014 1:33 am

As there is no source code I could not check if you are doing any integrity checks but if you are not you should be. For example maybe a crc32 for every one kilobyte of data.

twosixonetwo
Very interested
Posts: 58
Joined: Tue Feb 25, 2014 3:38 pm

Post by twosixonetwo » Tue Aug 26, 2014 8:43 am

bgvanbur wrote:I think this might work on the Sega CD (so you wouldn't need a flash cartridge). Insert cartridge after Sega CD is running from RAM, would also need to use the modify the catridge address since different starting address with the Sega CD in use, and if you are already using the 68k for the audio portion it should be able to use the same audio routine but if using z80 for audio that would either require converting to 68k audio or use the Sega CD PCM.
Yes that might be more practical for those who have a sega cd. Unfortunately, my sega cd has got a bad laser so I can't test that in the near future.
ICEknight wrote:Would there be any way for this system to access each individual chip inside the cartridge (when appliable), for individual dumps?
No, I don't think so. You can only see what the 68000k gets when reading from a certain address.
sega16 wrote:As there is no source code I could not check if you are doing any integrity checks but if you are not you should be. For example maybe a crc32 for every one kilobyte of data.
Indeed I am currently not doing any integrity checks. However I plan on adding that aswell. Currently the only thing additional to the raw data is a 32bit value in the beginning, that is used by the converter tool to determine the cutoff values.

LocalH
Very interested
Posts: 152
Joined: Tue Dec 19, 2006 5:04 pm

Post by LocalH » Fri Aug 29, 2014 3:42 am

twosixonetwo wrote:
ICEknight wrote:Would there be any way for this system to access each individual chip inside the cartridge (when appliable), for individual dumps?
No, I don't think so. You can only see what the 68000k gets when reading from a certain address.
I guess one could have a semi-automated way to do it post-dump with a scriptable tool that can be programmed using info derived from analyzing the PCB. As long as the data from each chip is present within the 68k address space, it can be separated out from there, and if you have two 8-bit ROMs, you know you'd need to deinterleave odd and even bytes.

Post Reply