Harmony as a CopyCart

[Omegamatrix]

Well, I haven't had a bad dump yet. I've now also tested:

 

 

2k

Outer Space (sears)

 

4k

Yars' Revenge

Seaquest

Radar (Zellers)

 

8k

Pengo

Gremlins

H.E.R.O.

 

16k

Motorodeo

Summer Games

 

 

One thing I noticed is that with 2k/4k joined in the selection menu, you always will get an overdump of the 2k cart. Any chance of a separate 2k option?

 

I also occasionally get this glitch where the screen prints Fred's Cart Dumper twice. The second print occurs when I plug the dump cart in. I think it might happen if I plug in the cart on the 10 second mark, not sure. None the less, it does not affect the dump.

 

 

 

I tried to see if I could get away from having to plug the dump cart and power cable in on the countdown. It was no dice. I have to stick to doing it in the proper sequence. I have no problem with this though. Makes it sort of a game to get it all done in time. You should change it to 1.76 seconds and make it real challenging. J/K I like the 10 seconds as sometimes I have to flip the USB cable the other way, etc... 10 seconds seems about right for time.

 

 

Are more special schemes going to be added? I saw the custom option, but I don't know if that would work for E0, E7, FE, etc...

[+batari]

Well, E0 could be done by specifying 1FE0 as the start and 24 banks. E7 could work as 1FE0 with 12 banks (?), but in either case, manipulation of the binary would be required after the fact. Schemes that use the data bus aren't possible yet, even by indirect means (like 3F, FE, and others.)

 

I do plan to eventually add the other schemes, but first I need to make several changes. Grabbing smaller amounts (like 1k) is not hard to do, and 3F is possible (just put 3F on the address bus and drive the data bus), but I'm still not entirely sure what sort of access pattern an actual FE cart expects to see, at a minimum (I don't think it's necessary to duplicate the full behavior of JSR/RTS.)

[Buzbard]

Nice job guys, I just tried out the last version, had very few hang-ups.

I dumped Combat, Defender, both versions of Asteroids and Commando, I don't have any F4 carts, so I can't test that.

 

I tried Robot Tank and I couldn't get it to work then I finally discovered (according to sizes.txt) that it's a FE cart that's been fixed to run as a F8, no wonder it didn't work.

[Omegamatrix]

Nice job guys, I just tried out the last version, had very few hang-ups

 

Is it hanging up at the terminal started point? If you're not already then try what Batari suggested to me. Wait until the countdown begins before plugging in the dump cart, and then power on the dump cart.

 

 

 

I tried Robot Tank and I couldn't get it to work then I finally discovered (according to sizes.txt) that it's a FE cart that's been fixed to run as a F8, no wonder it didn't work.

 

AFAIK no F8 version of Robot Tank exists. Seeing that Space Shuttle was converted from FE to F8 by Activision, the possibility always exists that there will be other F8 conversions too that we don't know about. A PAL F8 version of Space Shuttle might be out there... On that note I also suspect there might be more HES F6 conversions of Activision games, but now I'm digressing.

 

 

 

@ Batari I don't know if it's possible, but are you thinking of adding auto-detection of bank schemes in the future? That would be sweet.

[+batari]

@ Batari I don't know if it's possible, but are you thinking of adding auto-detection of bank schemes in the future? That would be sweet.

That is possible, now that you mention it. It's just a matter of trying various hotspots and seeing if anything changed. When I get some more time later in the week, maybe I'll take a crack at it.

[alex_79]

I'm still not entirely sure what sort of access pattern an actual FE cart expects to see, at a minimum (I don't think it's necessary to duplicate the full behavior of JSR/RTS.)

There's a detailed explanation in this old patent from Activision.

activision_FE_bankswitch.pdf

[...]

Upon detection of the 01FE address, a one cycle delay is activated which then actuates latch connected to the data bus. The three most significant bits on the data bus are latched and provide the address bits A13, A14, and A15 which are then applied to a 3 to 8 de-multiplexer.

[...]

Edited October 18, 2010 by alex_79

[Buzbard]

Is it hanging up at the terminal started point? If you're not already then try what Batari suggested to me. Wait until the countdown begins before plugging in the dump cart, and then power on the dump cart.

 

Yes, that's where it hung-up, but it only did it once. After that I just waited until the countdown to apply power to the dump cart.

 

AFAIK no F8 version of Robot Tank exists. Seeing that Space Shuttle was converted from FE to F8 by Activision, the possibility always exists that there will be other F8 conversions too that we don't know about. A PAL F8 version of Space Shuttle might be out there... On that note I also suspect there might be more HES F6 conversions of Activision games, but now I'm digressing.

 

Yeah, I was looking through sizes.txt (attached) for an Activision F8 cart to try and it lists Robot Tank as an F8:

Robot Tank 	AZ-028 	R 8 	F8 X X2 J ROBO_FIX

 

but right below that section (which I didn't see at first) it states:

X2: This used to be an FE cart, but has been fixed to run as an F8.

 

Which is why I was temporarily confused.

 

sizes.txt

[Omegamatrix]

@ Batari I don't know if it's possible, but are you thinking of adding auto-detection of bank schemes in the future? That would be sweet.

That is possible, now that you mention it. It's just a matter of trying various hotspots and seeing if anything changed. When I get some more time later in the week, maybe I'll take a crack at it.

 

Does the Harmony use the auto-detection developed for Stella already? I guess you'd just port that over in any case. Glad this is possible. It'll make the dumper a lot more user friendly.

[Omegamatrix]

Yes, that's where it hung-up, but it only did it once. After that I just waited until the countdown to apply power to the dump cart.

 

I would leave the dump cart entirely out of the unit as well. I was still getting bad dumps if the dump cart was plugged in (un-powered) before the countdown. After the countdown it was no problems at all.

 

Edit: I can't remember if it was bad dumps or just hanging up. I do remember it caused me a lot of grief.

 

 

Yeah, I was looking through sizes.txt (attached) for an Activision F8 cart to try and it lists Robot Tank as an F8:

Robot Tank 	AZ-028 	R 8 	F8 X X2 J ROBO_FIX

 

but right below that section (which I didn't see at first) it states:

X2: This used to be an FE cart, but has been fixed to run as an F8.

 

Which is why I was temporarily confused.

It'd be neat to find an F8 Robot Tank. In this case it sounds like a hack? Not to sure...

[supercat]

I wonder if one could use a Harmony cart sitting in parallel with another cart on a 2600's bus as a means of capturing bus transactions for debugging. It wouldn't have a huge trace capacity, but if it could be set to start logging some amount of time after some particular memory access it could be very handy.

[+batari]

@ Batari I don't know if it's possible, but are you thinking of adding auto-detection of bank schemes in the future? That would be sweet.

That is possible, now that you mention it. It's just a matter of trying various hotspots and seeing if anything changed. When I get some more time later in the week, maybe I'll take a crack at it.

 

Does the Harmony use the auto-detection developed for Stella already? I guess you'd just port that over in any case. Glad this is possible. It'll make the dumper a lot more user friendly.

That won't work as we don't have the entire binary available to us until we know what hotspots switch in the data. My idea was just to trigger certain addresses and see what they do (actually, this method will be easier than looking for signatures in the binary.)

I wonder if one could use a Harmony cart sitting in parallel with another cart on a 2600's bus as a means of capturing bus transactions for debugging. It wouldn't have a huge trace capacity, but if it could be set to start logging some amount of time after some particular memory access it could be very handy.

Yes, in fact the dumper is based on logic analyzer code that cd-w wrote. It would grab up to around ~1000 address/data values and dump them to a PC. It would wait for a trigger point and record data like a real logic analyzer. Currently, the trigger point is hard coded so changing it would require rebuilding. However, perhaps a command-line interface could be added where you could send it commands on the fly.

[A.J. Franzman]

My cart dumper assembly is almost far enough along to start using it (I think), but something strikes me as odd. Are the pin number assignments on the Harmony Cart edge connector's silkscreen, ahem, "nonstandard"?

Edited October 19, 2010 by A.J. Franzman

[A.J. Franzman]

AFAIK no F8 version of Robot Tank exists. Seeing that Space Shuttle was converted from FE to F8 by Activision, the possibility always exists that there will be other F8 conversions too that we don't know about. A PAL F8 version of Space Shuttle might be out there... On that note I also suspect there might be more HES F6 conversions of Activision games, but now I'm digressing.

Yeah, I was looking through sizes.txt (attached) for an Activision F8 cart to try and it lists Robot Tank as an F8:

Robot Tank 	AZ-028 	R 8 	F8 X X2 J ROBO_FIX

 

but right below that section (which I didn't see at first) it states:

X2: This used to be an FE cart, but has been fixed to run as an F8.

 

Which is why I was temporarily confused.

 

sizes.txt

I think you're still confused. Robot Tank cartridges are FE. The Sizes.txt document came about as an offshoot of Kevin Horton's "Bankzilla" project, which is a console that has just about every vintage NTSC original release VCS game built in. In order for Bankzilla to run Robot Tank, he (or someone at his request) hacked Robot Tank to work as F8, and that file (ROBO_FIX.BIN) is what Bankzilla uses.

 

I don't know why he had to use a hacked version of Robot Tank, but apparently was able to use the unmodified original version of The Activision Decathlon, though.

Edited October 19, 2010 by A.J. Franzman

[+batari]

My cart dumper assembly is almost far enough along to start using it (I think), but something strikes me as odd. Are the pin number assignments on the Harmony Cart edge connector's silkscreen, ahem, "nonstandard"?

What is the standard?

 

The only thing I would call a standard is the pin assignments in the Atari 2600 FAQ, and AFAIK, this was written way back in the RGVC heydays (and this FAQ is also available here), which shows only 1-12 and TOP/BOTTOM. I didn't think repeating 1-12 on each side made sense, so 1-12 TOP does match 1-12 on Harmony, but 1-12 BOTTOM corresponds to 13-24 on Harmony. To me this is totally logical, if not strictly "standard."

 

The only other place I've seen pins enumerated from 1-24 is on the FB2 silkscreen. These pin assignments are as far from "standard" as you can get, IMO, and don't seem to match anything known to man.

[Omegamatrix]

I think AJ is referring to the 2600 hardware schematic:

 

 

 

Pins 13-24 on the schematic correspond to 1-12 on the Harmony, and then pins 1-12 on the schematic correspond to 13-24 on the Harmony.

[+batari]

I think AJ is referring to the 2600 hardware schematic:

 

 

 

Pins 13-24 on the schematic correspond to 1-12 on the Harmony, and then pins 1-12 on the schematic correspond to 13-24 on the Harmony.

Thanks, I wasn't aware that there were pin numbers on the schematic. If I had known, I probably would have tried to match them. Oh well.

[A.J. Franzman]

Pins 13-24 on the schematic correspond to 1-12 on the Harmony, and then pins 1-12 on the schematic correspond to 13-24 on the Harmony.

Thanks for the confirmation. Some original cartridge boards also have one or more positions identified, for example the "Kluge" board. Also, position 24 is sometimes identified as SGND or Shield Ground, and other times as /EXROM (its original intended function, to tell the console when to disable the built-in ROM, which was deleted just before production began).

Edited October 19, 2010 by A.J. Franzman

[+stephena]

That won't work as we don't have the entire binary available to us until we know what hotspots switch in the data. My idea was just to trigger certain addresses and see what they do (actually, this method will be easier than looking for signatures in the binary.)

If you come up with a good algorithm for this, please consider releasing it (the idea itself, not the actual code). While looking for signatures has served Stella well so far, it isn't with its problems, and isn't really a definitive solution for the more esoteric schemes. The biggest problem is that the searching currently isn't done on instruction boundaries, and hence can find a signature that isn't really there. I guess the real problem boils down to a static analysis not being comprehensive enough; the ROM really has to run a little to get all the information needed.

[Buzbard]

I think you're still confused. Robot Tank cartridges are FE. The Sizes.txt document came about as an offshoot of Kevin Horton's "Bankzilla" project, which is a console that has just about every vintage NTSC original release VCS game built in. In order for Bankzilla to run Robot Tank, he (or someone at his request) hacked Robot Tank to work as F8, and that file (ROBO_FIX.BIN) is what Bankzilla uses.

 

I don't know why he had to use a hacked version of Robot Tank, but apparently was able to use the unmodified original version of The Activision Decathlon, though.

 

No, there's no confusion, I completely understand that Robot Tank is an FE cart, that's why I couldn't get a workable dump because I was trying to dump it as an F8.

What really confused me, is after dumping it, I ran it through Stella and it reported it as a PAL cart, I don't have any PAL carts!

It's similar to the [hMF8] version that's floating around, just displays "Switching to reserve tank" on a rolling screen.

Edited October 19, 2010 by Buzbard

[+batari]

That won't work as we don't have the entire binary available to us until we know what hotspots switch in the data. My idea was just to trigger certain addresses and see what they do (actually, this method will be easier than looking for signatures in the binary.)

If you come up with a good algorithm for this, please consider releasing it (the idea itself, not the actual code). While looking for signatures has served Stella well so far, it isn't with its problems, and isn't really a definitive solution for the more esoteric schemes. The biggest problem is that the searching currently isn't done on instruction boundaries, and hence can find a signature that isn't really there. I guess the real problem boils down to a static analysis not being comprehensive enough; the ROM really has to run a little to get all the information needed.

What I planned to do was try to exercise the bankswitch hardware on the physical carts and see how it responds. For example, discerning E0 from F8 could involve hitting 1FE0 and 1FE1, then 1FF8 and 1FF9. The physical E0 cart would behave differently than the physical F8 cart in this case. That wouldn't work in Stella since there is no physical hardware present.

[supercat]

Yes, in fact the dumper is based on logic analyzer code that cd-w wrote. It would grab up to around ~1000 address/data values and dump them to a PC. It would wait for a trigger point and record data like a real logic analyzer. Currently, the trigger point is hard coded so changing it would require rebuilding. However, perhaps a command-line interface could be added where you could send it commands on the fly.

 

BTW, another couple useful features would be: (1) Note the approximate time when the data changes, to identify cycles where timing is dubious; (2) use 'rolling buffer' mode until a trigger event occurs (maybe 78 cycles with no address change). A CPU jam could then be used as a crude trigger if something is found to have gone wrong.

[A.J. Franzman]

OK, I have my dumper apparently working. Having to modify the dumper.bat file to work under Win98 was fun. I don't think I have the code right yet for fetching the user input for custom bankswitching but I hope to get it there soon. The single USB to power everything seems OK, and it's nice only having to plug in one thing during the 10 second delay. I tried about 50 dumps, and got a lot of dumps of duplicate carts that matched each other, and matched binaries from Rom Hunter's V5 collection (using Anti-Twin for comparing). But I also got a few dumps of duplicate carts that didn't match each other, and several that don't match anything in V5. Will investigate and report further.

[+batari]

Here is a new version that attempts to detect the cart. It is a WIP version that doesn't add anything except this detection, so only use it if you wish to help me test the detection.

 

I only have 2k, 4k, F8 and F6 carts and it seems to detect them fine. I added detection attempts for E0, E7, F4, FA (CBS), 3F, MB (Megaboy), and FE but do not own any of these carts to test. If anyone has these carts and wishes to help me test the detection, let me know if it worked. If detection works, it should dump the game correctly, but E0 and E7 will not dump the proper data (yet.)

Harmony_cart_dumper.zip

[Omegamatrix]

I'm traveling on the road right now and won't have a chance to try this until late Saturday or Sunday. I'm not sure if I actually have any E7 carts, but I have everything else (besides the bad assed MegaBoy).

[A.J. Franzman]

I tried about 50 dumps, and got a lot of dumps of duplicate carts that matched each other, and matched binaries from Rom Hunter's V5 collection (using Anti-Twin for comparing). But I also got a few dumps of duplicate carts that didn't match each other, and several [individual dumps] that don't match anything in V5. Will investigate and report further.

On looking over the list of my questionable dumps from last night, I saw that most of them are Activision titles. As their slightly thinner circuit boards are known to cause reliability issues that can usually be resolved by cleaning, I've cleaned both cart ports of my dumper, and am about to start on all of the affected cartridges' contacts including the Harmony. I'll re-dump each cartridge three times and see what comes up.

 

 

Here is a new version that attempts to detect the cart. It is a WIP version that doesn't add anything except this detection, so only use it if you wish to help me test the detection.

 

I only have 2k, 4k, F8 and F6 carts and it seems to detect them fine. I added detection attempts for E0, E7, F4, FA (CBS), 3F, MB (Megaboy), and FE but do not own any of these carts to test. If anyone has these carts and wishes to help me test the detection, let me know if it worked. If detection works, it should dump the game correctly, but E0 and E7 will not dump the proper data (yet.)

I don't have a Megaboy or a Fatal Run (F4) but I should be able to test most of the others later today.

 

BTW, what would be the most effortless way to split the overdumped 2K binaries? Preferrably, this would either include checking that both halves match, or at least saving both halves separately so that they can be compared by another means.

Edited October 20, 2010 by A.J. Franzman