Handheld Underground

Crash 40 - Live and Learn

posted by taizou @ 2020-05-25 01:53:25 Dumps

Got two more Sintax GBA games dumped by RibShark today. These are definitely two of the most-wanted Sintax games, being attached to popular series and also being some of the earliest ones to be documented in video form. And they were both games I don't own. But fortunately Rib came through! Thanks once again for allowing me to repost these here!

Crash Advance IV

Everyone's favourite jorts-wearing bandicoot makes a return visit to Sintax-land. You may remember their GBC game 2003 Crash II Advance, which featured a similar title screen to this game (both being based on the one from the official GBA game "Crash Bandicoot: The Huge Adventure"). Unfortunately, the similarities end there - while Crash II Advance was a decent attempt to recreate Crash Bandicoot's gameplay on GBC, Crash Advance IV is just... well, it's just this again.

A video has been posted purportedly showing another Sintax Crash GBA game called "Crash Bandicoot 3: Warped", but the level shown also appears later in Crash IV, and no cartridge nor title screen has yet been sighted with the Crash 3 title, so nobody is quite sure if that version really exists or if it was a mistitled video of Crash IV.

Download: Crash Advance IV (Unl) (Eng) [YJ restored].zip

Sonic 3 - Fighter Sonic

You all knew this was coming. He's the world's most famous hedgehog. Sintax would never turn their back on that kind of reflected glory. They even pre-empted Sonic 4 in taking the series back to basics; there's no Tails, no Knuckles, no Johnson the Octopus, not even my boy Big the Cat - the only playable character is ol' Blue Bollocks himself. So how about Sonic's trademark speed? Did Sintax buck expectations and stick a rocket up the arse-pipe of their tired old engine? Well... you know they didn't. Sonic just strolls along shooting out spin-dash sprites and it's just like every other one of these games. But there's Sonic!

The title screen just says "Fighter Sonic", but the box and cartridge call it "Sonic 3: Fighter Sonic", which probably means it came out between Sonics Advance 2 and 3 and they were trying to pass it off as the real third game.

Download: Sonic 3 - Fighter Sonic (Unl) (Eng) [YJ restored].zip

16 Comments

Lord of the Rehashes

posted by taizou @ 2020-05-20 02:58:47 Dumps

Sintax GBA time again! There are so many of these. Dumps will probably come a bit slower from now on, since most of everything I have left has the second-version protection with trap addresses, which takes a bunch of trial and error to work around.

The Lord of the Rings IV - The Fellowship of the Ring

Cartridge ID: E12-U15

Today's "new" game comes with a loose Lord of the Rings theme. And this game has the music bug, despite being a fairly late-on ID. There really isn't that much rhyme or reason to which ones have the bug and which don't.

Overwritten header bytes are 90 AE 4B 4A 59 4A - but after some investigation I've found it doesn't really have any protection-related significance, since I have another game with the same bytes here but completely different trap addresses and mirroring. I've also found another location where this data is stored, scrambled, so maybe I'll stop noting them here for now.

Download: The Lord of the Rings IV - The Fellowship of the Ring (Unl) (Eng) [YJ restored].zip

Rayman IV / Rayman - Sunshine of Trip

This one was dumped by RibShark who kindly allowed me to repost it here!

I previously dumped the Russian version, and here's the English. The only in-game difference seems to be the title screen.

Interestingly, unlike the Russian version, this one did have trap addresses, making it trickier to dump. This difference seems like it may be accounted for by different PCB revisions rather than per-game - so different printings of the same game may exist with different "levels" of protection.

Download: Rayman IV (Rayman - Sunshine of Trip) (Unl) (Eng) [YJ restored].zip

2 Comments

Turtles and Rayman, together at last

posted by taizou @ 2020-05-09 00:08:17 Dumps

Hey who's ready for some more Sintax GBA games?!?! I have two this time! These are basically the same game as the previously dumped Super Mario DX, but with different graphics, reordered levels and a few bug fixes. Some of the reskins also have all of one different level layout (but I honestly can't be arsed to go and check if that's the case with either of these).

These two were much easier to dump than most YJencrypted games, because they didn't have any of the "trap" addresses that lock out further reads - in general that seems to be the case with earlier releases, but one of them has a later ID than Mario DX, which had the most bastardly version of the protection, so... it's not an exact science.

Teenage Mutant Ninja Turtles 2 (Teenage Mutant Hero Turtles II)

Cartridge ID: E12-U2

Turtles in a turtle shell! The ID of this one presumably indicates it was released earlier than Mario DX, but I think Mario DX was actually made first, because Turtles 2 fixes some of the more egregious bugs present in that game (which were carried over from the prototype Digimon Adventure).

I've named the ROM after the title from the cartridge label here; the title screen uses the "Hero Turtles" title, because it's taken from the European version of Turtles in Time with the brightness turned way down (on an original GBA it's almost invisible!) but I figured the label title is probably the intended one and it's not worth doubling the filename length to work in the alternate one.

As with all dumps from YJencrypted carts so far, this is a 32MB ROM despite only 4MB of actual data being present. It required no data to be skipped and patched back up, only the Nintendo logo in the header. The overwritten-and-maybe significant bytes in the logo were 90 AE 4F 4A 59 4A.

Download: Teenage Mutant Ninja Turtles 2 (Unl) (Eng) [YJ restored].zip

Rayman IV / Rayman - Puteshestviye Solnechnogo Sveta (Райман - Путешествие солнечного света)

Cartridge ID: R12-U14

This is a Russian version! But only the title screen. Even the box was just the English one with a Russian sticker on it - and while the cartridge label actually has a Russian flag printed on it, it still just uses the English "Rayman IV" title. Minimal effort translations right there. Russia was apparently a big market for these games, though, and a lot of the later ones have so far only shown up there and in China. Again, this one fixes some of the bugs from Mario DX.

All the same ROM stuff applies as with Turtles 2 - it's 32MB, no skipped/patched data. Overwritten header bytes: 90 AE 5F 4A 59 4A (it's a little bit different!?)

Download: Rayman IV (Rayman - Puteshestviye Solnechnogo Sveta) (Unl) (Rus) [YJ restored].zip

8 Comments

Mario's Disappointing Xperience

posted by taizou @ 2020-05-04 14:08:38 Dumps

So I mentioned in the Pokemon Sapphire post that that cart used the same protection as GBA Sintax games. You probably see where this is going.

These things have eluded dumping for YEARS - well, get ready to get extremely bored of them because there are like 20 and most of them are exactly the same!

Basically, they're all reskinned versions of the "Digimon Adventure" game that has been floating around for a while; but Digimon Adventure was a leaked dev build and is much buggier than the released games. Which is saying a lot, because the released games are buggy as fuck.

Digimon Adventure itself is a port of a SNES game, supposedly made by Sintax with help from Vast Fame (borne out by its use of Vast Fame's music) - but Sintax themselves clearly had no idea what they were doing on the GBA once Vast Fame was out of the picture, hence them putting out the same broken game over and over again with different graphics.

This particular iteration is "Super Mario DX", aka just "Mario DX" on the cartridge, and its cartridge ID number is "E12-U8".

Most of its graphics are from Super Mario Advance 2, at least to begin with, so you could almost mistake it for Super Mario World in stills. Until you see the second level and its subsequent boss fight, anyway.

In common with other early games in this series, it has a tendency for the in-game music to randomly cut out and then later be replaced by a different track when certain enemies appear on-screen - this due to a bug with how sound effects are handled, which was at least fixed in later entries. You can also experience such niceties as platforms with no collision detection, bosses whose behaviour can be charitably described as "arbitrary", and many many more?!?

This was ALMOST dumpable using the same technique as Pokemon Sapphire, EXCEPT that one of the "trap" addresses which locks the cartridge from further reads was placed in the Nintendo logo in the header, meaning that any attempt to reboot the cartridge would lead to it being locked out. How in the hell do you solve a problem like that when your entire dumping method is predicated on rebooting the cartridge? Well... you need to somehow disconnect the data lines from the cart to the GBA while retaining power. And it just so happens that there are ridiculous, bulky "game switcher" devices which do just that!? So the process becomes a bit more awkward and convoluted, but I got there in the end.

As with Pokemon Sapphire, this ROM was dumped with addresses skipped and patched back up from repeated data; and, again, the ROM is 32MB, when the actual game data is only 4MB, since the data is mirrored in weird ways that the game relies upon. I've also patched up the overwritten bit of the Nintendo logo in the header; the bytes that overwrite it here are "90 AE 4B 4A 59 4A", with only the middle two bytes being different from Sapphire. It's gotta mean something? Maybe?

Anyway: here is the ROM

Super Mario DX (Unl) (Eng) [YJ restored].zip

Thanks to SuperRetroGamer2741 for lending this cart! He's also done a full playthrough of the game:

9 Comments

A mysterious sapphire

posted by taizou @ 2020-04-14 23:55:12 Dumps

Hey everyone I'm back??? With something pretty different!

It's Pokémon! Sapphire! For GBA! In English!

Now, you might be wondering: wasn't English Sapphire just a regular, boring, official release? Well, it was... but not like this.

This is an unofficial English translation, done between the game's Japanese and North American releases. The gap between those two releases was only four months, meaning the makers of this translation had to really rush it out the door to have any semblance of a viable market before the proper English version hit the shelves.

Not only that, they saw fit to copy protect it, using the same "YJencrypted" system used by Sintax for their bajillion GBA platformers, presumably to make sure no other enterprising bootleggers could horn in on their tiny window of opportunity.

The cartridge label does make it quite obvious that this was done before official US release materials were available - it's actually using pre-release cover art for the game, complete with the "RP" (rating pending) ESRB rating. This same artwork was also used for the "New Game Color Advance" release of Sintax's GBC strategy game "Pocket Monster Saphire".

The actual translation has a bit in common with the so-called "Chinese Emerald", and was probably done by the same people, but lots of the text is different (and weirder!).

Protection and dump assemblage

Now, as I mentioned, this cartridge is copy protected - but not in the same way GBC carts were commonly protected, where the game could often be fully dumped but just wouldn't run without the company's specific mapper being present. Oh no: "YJencrypted" carts have proper read protection and are gigantic bastards to extract data from.

As a quick summary: you can't read from the cart at all unless it's properly initialised by the GBA boot sequence (which I was never able to replicate manually, so had to fudge a way to reset without losing power), and then if you manage to bypass that, each cart has numerous "trap" addresses whereby reading from them will lock you out of reading any further data. And these differ for each cartridge, so the only way to determine which addresses these are is through trial and error.

If you do manage to dump the ROM from one of these cartridges, it will mostly work as a standard GBA ROM, with the exception that they use funky addressing/mirroring within the unused parts of the 32MB ROM address space, and again that differs per cartridge and I'm not sure of any pattern to it.

Another unusual thing it does is, after normal initialisation, replaces a few bytes of the Nintendo logo in the ROM header; this doesn't seem to serve any protection-related purposes as far as I know, but does prevent a GBA from somehow booting the game in this state. In this case, the substituted data is "90 AE 17 4E 59 4A" - the last two bytes are "YJ" in ASCII, so this may be some kind of "signature" for the protection...

Anyway, what all that means is I haven't been able to do my usual GBC thing of releasing a "raw dump" and then a "cracked" version where possible - instead what I'm presenting here is kind of a best effort at extracting a full, usable ROM from this thing.

This ROM was constructed as follows:

I was unsure about that last point at first, as it means hacking away a bit of the originally dumped data; but we know it actually does present the proper Nintendo logo at boot, since the game does boot with that logo, so restoring the logo is essentially restoring the normal boot state of the cart. Which is reasonable, I think.

(I did consider also releasing the less-rejiggered ROM e.g. the one with the skipped data still skipped, and the Nintendo logo partially-overwritten, but I don't believe that is any more of a "true"/"full" dump than this one, and would only cause confusion if I put it out into the wild - but if anyone is interested in taking a look at it, let me know)

I've tagged this as a "YJ restored" dump, which signifies basically that it was dumped and patched back up using the technique described above. It's not really a true "raw dump", since it was patched together and there's known repeated/overdumped data. But nor is it really cracked/hacked, since all the data patched in should, in theory, be present on the original cartridge.

Saving issues

Another caveat to be aware of: while the original Pokemon games used flash memory to save game data, this cart instead uses SRAM with a battery (as pirate copies commonly do), and is hacked to save to SRAM instead of flash. Official cartridges using SRAM only used 32 kilobytes. However, the original Pokemon Sapphire used 128 kilobytes of flash memory, and I believe (but have not verified) that this cartridge uses 64 kilobytes of SRAM (and, again, I haven't verified it, but based on the original save data structure, this would mean it definitely would not have the second "backup" save, and may also omit one or more of Hall of Fame, Mystery Gift/e-Reader or recorded battle data).

Since the GBA ROM header does not contain any save type information, emulators and flash carts have to autodetect the save type per ROM, and since this cartridge apparently uses a non-standard save type, it is fairly likely that you will encounter problems when saving or loading data. For example, the Everdrive detects it as using flash (which causes it to fail when saving), and mGBA and no$gba both detect it as using SRAM but only provide the 32KB an official game would have (which causes it to fail when loading). VisualBoyAdvance both detects it as using SRAM and provides the full 64KB, so it works there. In fact, it seems to provide 64KB for all SRAM-using games, which is inaccurate for official games, but correct for this one... so it may be working by accident. Your mileage may (and probably will) vary.

The actual ROM

Pokemon - Sapphire Version (Unl) (Eng) [YJ restored].zip

Thanks to Lightning of Twitch Plays Pokémon/RainbowDevs for lending the cart!

Update: The box!

Here are some pics of the box, thanks again to Lightning:

Amazingly, they used screenshots of the official translation on the back, I guess pre-release ones. And the text on the back... seems to be some kind of Telefang story? In decent English? I wonder where they got that from.

25 Comments