Dumping Game Genie Cheating Cartridges

[PW5190]

Hey, I have a question. Does the OSCR support dumping Codemasters' Game Genie brand of cheating devices? These are made for NES, SNES, Game Boy, Genesis/Mega Drive and Game Gear. I have a Genesis Game Genie on me, but I need to get my hands on an OSCR when another group order becomes available in the foreseeable future. The Game Genie carts are manufactured by Codemasters and distributed by Camerica (Canadian NES) and Galoob Toys (US NES, SNES, GB, GEN/MD, GG).

I just wanted to ask this question to see if Codemasters' Game Genie cartridges would work on the OSCR, and if they can be dumped.

EDIT: Revised the message.

[Ancyker]

I don't have those, but I tried with a Gameshark Pro (GBC) and it dumped something but mGBA says the file is invalid.

OSCR HW5 V10.2

[+] Game Boy

[+] Game Boy (Color)

HEADER CHECKSUM ERROR



Press Button to
ignore or clean
cart and try again

Title: DAMON BARWIN_7
Revision: 10
Mapper: MBC1
ROM Size: 256 KB
Save Size: None


[+] Read ROM


Saving to GB/ROM/DAMON BARWIN_7/25/...
[*******************]
Checksum: BB16 != 0000
Invalid Checksum
CRC32... 794A2FEC -> Not found

[kamalawala]

Does "DAMON BARWIN_7" have significance? The cartridge wouldn't boot on a real Game Boy if the header checksum is wrong, so make sure to clean the Gameshark Pro with isopropyl alcohol and q-tips (and if there's a cartridge inserted into the Gameshark clean that too).

[Ancyker]

According to this archived page, Damon Barwin was one of the developers that were working for Datel.

Boot up your GB or GB Colour with your own logo using a pic to toggle memory banks on power up. logo.zip I was able to open up a MegaMem cartridge (made by Datel) to see how they had been able to bypass Nintendo's logo - they used a PIC12C508 to toggle memory banks on power up. Damon Barwin and Alex Edge from Datel created the original device.

[Ancyker]

I looked at the file in a hex editor and it sort of looks like a ROM but it appears it was dumped multiple times in the same file.

@sanni Would it help to send you what it dumped?

[kamalawala]

Try trimming the file so that there are no repeats, and also try bgb; it has better accuracy for GB/C games (though I'm glad you're not using VisualBoyAdvance haha).

[Ancyker]

When a game cartridge is inserted the header appears to be a copy of its header. But again, it doesn't dump correctly. I tried both on an Everdrive GB X7 and neither would boot. There's likely more to a Gameshark than just the ROM, though it's also possible the ROMs are just useless without chips from the original cartridge that they probably rely on. The code is probably trying to access things that aren't there.

[damon32666]

What would you like to know about Action Replay/Gameshark? It was a long time ago but I do remember quite a lot of it.
Unfortunately I don't think I have the source code for it anymore but I'll definitely have a look.

[ButThouMust]

With a Game Genie for Game Boy, I was able to get a dump that matched what's in No-Intro, but had to do some extra steps.

First, here are the contents of the OSCR dump log I got:

OSCR HW5 V15.1

[+] Game Boy

[+] Game Boy (Color)

HEADER CHECKSUM ERROR



Press Button to
ignore or clean
cart and try again

Name: UNKNOWN
Revision: 255
Mapper: HuC-1
ROM Size: 
Save Size: None


[+] Read ROM


Saving to GB/ROM/UNKNOWN/1197/...
[*******************]
Checksum: A3E2 != FFFF
Invalid Checksum
CRC32... 158E7F3B -> Not found

This produced a 32KB file for me. Because No-Intro says the Game Genie ROM is 8 KB, I tried looking at the file in a hex editor. I found that the same 8 KB are duplicated in the ranges 0x2000-0x3FFF, 0x4000-0x5FFF, and 0x6000-0x7FFF. If you copy the data from any of those ranges into its own file, this matched what was in No-Intro.

Interestingly, the range 0x0-0x1FFF is almost a correct dump but has a block of all FF bytes from 0x104-0x14F, which should be a block of all 00 bytes instead.

[sanni]

Interestingly, the range 0x0-0x1FFF is almost a correct dump but has a block of all FF bytes from 0x104-0x14F, which should be a block of all 00 bytes instead.

The GB code has the internal pull-up resistors enabled which most likely turns "no response" from the maskrom into 0xFF. Maybe if you remove this line https://github.com/sanni/cartreader/blob/master/Cart_Reader/GB.ino#L140 it will read as 0x00.