PlayStation Development Network

Great that the ROM have been dumped, maybe we could understand how the hardware is used to dump the ROM and emulate it, then if someone with lots of motivation could make a better emulator, we could reflash the hardware with this new emulator and it would be much more usable

In fact, it's been dumped years ago.

Also, here's a bootleg ROM, from EMS I guess :
GB Hunter version 1.3.rom

the rom "Innovation Super GB Booster " is not dumped

pepe wrote: ↑January 28th, 2018, 7:12 am Does anyone know how to change the internal images and game booster logo ?
first is necessary to extract the images to modify

Yeah, you'll have to open the ROM and find the TIM headers. Then, extract the TIM's and replace them 1:1 with the ones you want.

ok I took some time today to write a little program to dump the ROM, pack it and write it onto 2 memory card so I could retrieve the data on my computer using my USB PS1 Memory card reader tool.
I verified the integrity of the ROM using SHA1 algorithm computed directly on the PSX
Here is the file: http://onorisoft.free.fr/psx/Karat_Game_Booster_JP.zip
The header is very similar to the GameHunter 1.3 rom posted on this topic but with some differences.

pepe > How can you run this rom under an emulator like no$psx ?

I hope someone can disassemble the rom to understand how to access the Gameboy port.
The ROM seems flashable using XFlash, maybe we can make a better gameboy emulator and flash it to this nice cartridge

Or maybe like pepe said, if copying a 32kb game at the end of the action replay rom works, then maybe the PAL chip inside the cardridge just map the Gameboy data at the end of the AR ROM address ? and then you need to use the classic gameboy bankswitching technic to get the rest of the data (which explain how a bigger GB rom works on the real hardware but not on no$psx emulator)
I really wonder how pepe achived to run this AR Rom on no$psx because I can't find a way to load any data in the memory of no$psx :/
I will try to read beyond the AR Rom with a GB cartridge attached to the device to see if it dumps the GB Rom on the fly !

Orion_ wrote: ↑January 29th, 2018, 4:43 amok I took some time today to write a little program to dump the ROM, pack it and write it onto 2 memory card so I could retrieve the data on my computer using my USB PS1 Memory card reader tool.
I verified the integrity of the ROM using SHA1 algorithm computed directly on the PSX
Here is the file: http://onorisoft.free.fr/psx/Karat_Game_Booster_JP.zip
The header is very similar to the GameHunter 1.3 rom posted on this topic but with some differences.

Thanks very much for sharing !
Do you allow me to put it in the next X-Flash mod update ? Your rom is missing from our set.

Orion_ wrote: ↑January 29th, 2018, 4:43 amOr maybe like pepe said, if copying a 32kb game at the end of the action replay rom works, then maybe the PAL chip inside the cardridge just map the Gameboy data at the end of the AR ROM address ?

I don't have a GB game so I could not check, but yeah, from what I saw after a quick disasm of the emu, the GB Rom gets mapped at 1F040000h by the PAL. At least, the emu accesses it from here, and copies it to the RAM.
In TETRIS.EXE, I did change a few 1F040000h pointers to 80050000h (only in the copy function) for it to load the embedded Tetris ROM. Though I have not done further researches.
As for how it swaps banks and remaps the upper part, perhaps it's done with a simple command.

Orion_ wrote: ↑January 29th, 2018, 4:43 amI really wonder how pepe achived to run this AR Rom on no$psx because I can't find a way to load any data in the memory of no$psx :/

File/Load Diskimage/rom file worked when I tried with the UK rom. GB Hunter has crashed for some reason. I hope it's not a bad dump...
EDIT : Tried your rom. Stuck here, after the Game Booster splash screen :

kHn wrote: ↑January 29th, 2018, 8:26 am Thanks very much for sharing !
Do you allow me to put it in the next X-Flash mod update ? Your rom is missing from our set.

Yes of course

kHn wrote: ↑January 29th, 2018, 8:26 am I don't have a GB game so I could not check, but yeah, from what I saw after a quick disasm of the emu, the GB Rom gets mapped at 1F040000h by the PAL. At least, the emu accesses it from here, and copies it to the RAM.
In TETRIS.EXE, I did change a few 1F040000h pointers to 80050000h (only in the copy function) for it to load the embedded Tetris ROM. Though I have not done further researches.
As for how it swaps banks and remaps the upper part, perhaps it's done with a simple command.

Thanks for this info !
As for the bank swapping, I was talking about the Gameboy bank swap, the PAL chip don't have to handle this, it's the MBC chip inside the Gameboy cartridge that is handling the bank switch, since the Gameboy addressing it limited to 64k (32k for the ROM)
I really need to find a way to upload a program on my PSX without using the Xplorer FX, I will try PSXserial to do some testing.

kHn wrote: ↑January 29th, 2018, 8:26 am File/Load Diskimage/rom file worked when I tried with the UK rom. GB Hunter has crashed for some reason. I hope it's not a bad dump...

It's not working on my side, I use the latest version 2.0 of no$psx, but all I get is the emulator freezing on a black screen.
I use File/Load Diskimage but it seems that it only accept CDrom image

the only way to know how this works would be to dump the memory from a real psx using cartridge greater to 32 kb

Spipis wrote: ↑January 28th, 2018, 7:36 am WOW!
After two years what an unexpected surprise!
Thank you guys for sharing all these informations and files!

I think we should better find a way for the emulator to load files straight from a folder.

I think you better eitehr reverseengineer their emulation core or compile your own emulator for the PS1. its probably made to look for it on the memorybus, not on a disk filesystem or some SD card loading mechanism.

gamebooster work with mame ?

https://github.com/mamedev/mame/blob/ma ... ooster.cpp
https://mamedev.emulab.it/haze/2018/01/ ... do-348693/

[BBvideo=560,315]https://www.youtube.com/watch?v=GIXFYKnLngw[/BBvideo]

I have problems loading the sram from cartridge,no load any data
game booster automatic load the sram or not ?

saving sram to cartridge shows the message "Error"

I've dumped both eeproms from my E.M.S. TopView Movie Card device.
Both are 256k.
The VCD eeprom content is encrypted (bits inverted), the GAME eeprom code is found in its usual form.
The rom is labeled E.M.S. Golden Finger CD (2M) 2.3 but didn't look like a normal 256k rom.
I was wondering what the code past 0x20000 was.
Turns out its a Game Boy emulator based on the GB Hunter as found in the Gold Finger 2 in 1 / Gold Finger 3 in 1 devices (also from E.M.S.).
Huge thanks to kHn for pointing this out.

You'll need to put some .GB rom files on a mode 2 disc and load them from the CD-ROM(plus) menu.
As for using the rom itself, an AR/GS v2 cart or equivalent clone is required to get it to work if you don't own a TopView device.

I've only quickly tested Castlevania 1 , Castlevania 2, Super Mario Land, Tennis and Tetris so far (all headerless).
They all worked but without any sound emulation at all.
Frame rate isn't great and varies from a game to another.

Enjoy... or not !

If someone is really keen on playing Game Boy games on a PSX, you're honestly rather off coding up your own Z80 emulator and then emulating the rest of the Game Boy hardware. The PlayStation can easily handle it. This cartridge emulator is just written horribly

pepe wrote: ↑January 28th, 2018, 7:58 am the rom "Innovation Super GB Booster " is not dumped

Here's the Innovation Super GB Booster Plus dump.
Comes with a 512k SST 28SF040 eeprom.
There're 2 switches on the devices, one is used to select each 256k bank, see manual from the link for details.

Add 2 schematic diagrams for this old topic, the original Japanese version, and the Innovation clone.
In image format and vector pdf format.

Notes on the Innovation clone:
There are 2 switches on this cart.

• The lower one (H8 in the schematic): Switch to the upper position(GND) for the Cheating feature, switch to the lower position(+5V) for the GB emulator.

• The upper one (H7 in the schematic): (Only used in Cheating feature) Switch to the upper position(+5V) for enable Cheating feature, switch to the lower position(GND) for disabling it.

For the ROM file, @Squaresoft74 has already shared the dumps. This cartridge has one SST 28SF040 Flash ROM in 512K bytes.

• The first 128KB space is "EMS Golden Finger CD (MAX) 1.1". This is a Caetla based hack, and hacked Flash ROM access code to adopt 28SF040 write command(non-JEDEC standard). DO NOT flash with other Caetla variants, as they are not adopted to 28SF040 command. Any cheat DB modification will cause them halt immediately.

• The 2nd and 3rd 128KB space(256KB in total) are "Innovation GB Hunter (Datel Hack)". This is a ROM based on Datel's but changed the LOGO and the internal game Rebound Mission is also disabled.

• The 4th 128KB space is empty. Filled with 0xFF. Not used in this product.

Additional notes on both the original one and the knock-off:

The GB ROM is mapped to 0x1F040000-0x1F04FFFF.
The GB_A0-A14 are directly connected to PS1_EXP_A0-A14. So there should be no problem for software in direct access to 0x0000-0x7FFF region on cartridge address.
Assuming we expect the emulator support Gameboy MBC1 mapper:
If the emulator re-copy the 0x4000-0x7FFF to system memory after doing any bank switch. Then ROM banking of MBC1 is fully supported.


But for SRAM usage, the emulator need to access 0xA000-0xBFFF on cartridge. It should be 0x1F04A000-0x1F04BFFF on this hardware(the PS_EXP_A15 line is 1(high) in this case). And the SRAM_CS line on GB cart should be pulled down to enable.
Turn into the logic code: The GB_A15 and /GB_SRAM_CS are controlled by PLD chip. But the PS_EXP_A15 is not grabbed as an input signal for the PLD. So it's not possible for this hardware to take action on GB_A15 and /GB_SRAM_CS lines on saving. The MBC1 SRAM access won't be usable.


I have not attached logic analyzer on GB_A15 line and /GB_SRAM_CS line. But I guess they are always GB_A15=0 and /GB_SRAM_CS=1.