#65821 - Locke - Thu Jan 05, 2006 11:11 pm
Mi flashcard writer was broken, and in order to continue burning my apps into it, I came with the idea of using the Nintendo DS to write the cart's ROM.
I'm working on a small program that loads by wifi and writes the data to the cart, but I'm getting some problems to get it to work correctly. First I clear bit 7 of the WAIT_CR register so arm9 can write to the gba memory. Then I use
Code: |
void writeROM(char* src, int size) {
char* dest = 0x08000000;
while(size--)
*dest++ = *src++;
} |
to write my data to the cart, but it doesn't work. Any ideas about what's wrong with it?
Thank you for your time
#65824 - tepples - Thu Jan 05, 2006 11:21 pm
You need to 1. unlock the flash cart's ASIC, 2. unlock the flash chips themselves, and then 3. rewrite using the flash chip's protocol.
_________________
-- Where is he?
-- Who?
-- You know, the human.
-- I think he moved to Tilwick.
#65825 - Dwedit - Thu Jan 05, 2006 11:22 pm
There's a reason why it doesn't work, and it's the same reason why it's called ROM: You can't directly write to it.
The actual code to write to a GBA cartridge varies across flash cartridge models. There is code out there for the Flash2Advance cartridges that I've tested and verified works, but I don't know about the others.
_________________
"We are merely sprites that dance at the beck and call of our button pressing overlord."
#65828 - Locke - Thu Jan 05, 2006 11:32 pm
I thought it was easier, as MK2/3 (for example) can write to GBA rom at boot time.
I'm using a XG2005. If someone knows how to write to this flash, please let me know. Maybe the F2A code can work for me. Can you tell me where to find it?
#65829 - leoedin - Thu Jan 05, 2006 11:38 pm
as far as I know, the Mk2/3 only work with neoflash carts (and the ones they where cloned off).
Leo
_________________
Yours Truly
my website
my blog
M3 Review
#65832 - Locke - Thu Jan 05, 2006 11:41 pm
leoedin wrote: |
as far as I know, the Mk2/3 only work with neoflash carts (and the ones they where cloned off).
Leo |
XG2005 is the cart Neoflash was cloned from, so if MK2 can write to it, then it is possible to do it :)
The main problem is how to do it...
#65849 - Sintax - Fri Jan 06, 2006 3:33 am
You can tell the MK2/3 to write to the cart, and could probably even do it without the MK, but the documentation for coding the MK is little to none and there is probably none for writing to the cart.
Although source is available for the windows program that writes to the cart, I'm not sure you can get much info from that.
#65863 - Lupin - Fri Jan 06, 2006 8:21 am
Open the cart, look for the flash ICs part number, google for a datasheet and then follow the instructions in the datasheet to write to the cart. This will work as long as the cart doesn't have some kind of custom interface or non standard flash memory (which i doubt).
_________________
Team Pokeme
My blog and PM ASM tutorials
#65866 - Filb - Fri Jan 06, 2006 8:56 am
Dwedit wrote: |
There is code out there for the Flash2Advance cartridges that I've tested and verified works, but I don't know about the others. |
Where to find it?
#65871 - crossraleigh - Fri Jan 06, 2006 9:59 am
There is NeoFlash register info at http://www.bottledlight.com/ds/index.php/Hardware/FlashCartridges. I don't know about F2A.
By the way, Locke, your cel-shaded fighter sounds interesting. I'm looking forward to a demo.
#65927 - Dwedit - Fri Jan 06, 2006 9:00 pm
Found it, look for cartlib.c inside http://www.devrs.com/gba/files/flgba.zip
(from http://www.devrs.com/gba/software.php#misc )
_________________
"We are merely sprites that dance at the beck and call of our button pressing overlord."
#66211 - Locke - Mon Jan 09, 2006 1:19 am
Bottledlight wrote: |
Unlock sequence:
0x09555554:16 = 0xAAAA
0x08AAAAAA:16 = 0x5555
Any read to the AD mux bus will disable the 'unlock'.
The following registers are on the compatible bus (0x0E00xxxx on the GBA, 0x0A00xxxx on the DS), and are thus 8 bits wide.
Save memory type register (0xFFF8)
7 6 5 4 3 2 1 0
0 1 1 1 1 Mode
Mode:
* 000: 32 KB SRAM
* 001: 64 KB Flash
* 010: EEPROM
* 101: 128 KB Flash (bankswitched with 0xB0)
* dunno about other values
Flash offset register (0xFFFE)
7 6 5 4 3 2 1 0
A23 A22 A21 A20 A19 A18 A17 A16
Save memory offset register (0xFFFF)
7 6 5 4 3 2 1 0
Fixed Shared SRAM EEPROM
1 H2 H1 H0 A15 A15 A14 A13
Notes:
* The high address bits are shared for all 3 types of memory
* EEPROM specific bits are only used for EEPROM
* SRAM A15 should be zero when using Flash
The flash chip (Intel Z412LA35A on the NeoFlash cart) can be erased/written after being unlocked. If anyone has chip names for Xg1 / Xg2 carts, I'd appreciate the information. |
So from that last info I gess that in order to unlock the cart i need to write those two values into the appropiate addreses, so my code should be as follows:
Code: |
void writeROM(char* src, int size)
{
char* dest = 0x08000000;
*(uint16 *)0x09555554 = 0xAAAA;
*(uint16 *)0x08AAAAAA = 0x5555;
while(size--)
*dest++ = *src++;
} |
or, in case that the addreses are relative to the start of the flash chip and not to the NDS memory map:
Code: |
void writeROM(char* src, int size)
{
char* dest = 0x08000000;
*(uint16 *)(0x09555554 + dest) = 0xAAAA;
*(uint16 *)(0x08AAAAAA + dest) = 0x5555;
while(size--)
*dest++ = *src++;
} |
It's nosense, there must be something I'm doing wrong... maybe someone wiser than me can find the problem? :(
#66245 - tepples - Mon Jan 09, 2006 6:42 am
The unlocking for the flash chip is separate from the unlocking for the bankswitching and save type configuration.
_________________
-- Where is he?
-- Who?
-- You know, the human.
-- I think he moved to Tilwick.
#66339 - Locke - Mon Jan 09, 2006 9:58 pm
Ok, I think I give up. There is no technical reference for the Intel Z412LA35A anywhere on the net. Even the Intel component database has no entry related to this item, and I can't unlock it without the correct secuence.
Thank you all. Although useless, it was very instructive.