Hey everyone I'm back??? With something pretty different!
It's Pokémon! Sapphire! For GBA! In English!
Now, you might be wondering: wasn't English Sapphire just a regular, boring, official release? Well, it was... but not like this.
This is an unofficial English translation, done between the game's Japanese and North American releases. The gap between those two releases was only four months, meaning the makers of this translation had to really rush it out the door to have any semblance of a viable market before the proper English version hit the shelves.
Not only that, they saw fit to copy protect it, using the same "YJencrypted" system used by Sintax for their bajillion GBA platformers, presumably to make sure no other enterprising bootleggers could horn in on their tiny window of opportunity.
The cartridge label does make it quite obvious that this was done before official US release materials were available - it's actually using pre-release cover art for the game, complete with the "RP" (rating pending) ESRB rating. This same artwork was also used for the "New Game Color Advance" release of Sintax's GBC strategy game "Pocket Monster Saphire".
The actual translation has a bit in common with the so-called "Chinese Emerald", and was probably done by the same people, but lots of the text is different (and weirder!).
Protection and dump assemblage
Now, as I mentioned, this cartridge is copy protected - but not in the same way GBC carts were commonly protected, where the game could often be fully dumped but just wouldn't run without the company's specific mapper being present. Oh no: "YJencrypted" carts have proper read protection and are gigantic bastards to extract data from.
As a quick summary: you can't read from the cart at all unless it's properly initialised by the GBA boot sequence (which I was never able to replicate manually, so had to fudge a way to reset without losing power), and then if you manage to bypass that, each cart has numerous "trap" addresses whereby reading from them will lock you out of reading any further data. And these differ for each cartridge, so the only way to determine which addresses these are is through trial and error.
If you do manage to dump the ROM from one of these cartridges, it will mostly work as a standard GBA ROM, with the exception that they use funky addressing/mirroring within the unused parts of the 32MB ROM address space, and again that differs per cartridge and I'm not sure of any pattern to it.
Another unusual thing it does is, after normal initialisation, replaces a few bytes of the Nintendo logo in the ROM header; this doesn't seem to serve any protection-related purposes as far as I know, but does prevent a GBA from somehow booting the game in this state. In this case, the substituted data is "90 AE 17 4E 59 4A" - the last two bytes are "YJ" in ASCII, so this may be some kind of "signature" for the protection...
Anyway, what all that means is I haven't been able to do my usual GBC thing of releasing a "raw dump" and then a "cracked" version where possible - instead what I'm presenting here is kind of a best effort at extracting a full, usable ROM from this thing.
This ROM was constructed as follows:
- Dumped the full 32MB ROM area (actual ROM size is 8MB, same as the Japanese versions)
- "Trap" addresses were skipped initially
- Skipped data was patched back in from the mirrored copies of that same data
- ROM left as the full 32MB, to allow it to be played without the weird mirroring being emulated (as I haven't fully figured out how it works)
- Overwritten part of Nintendo logo in header patched back over with the real Nintendo logo
I was unsure about that last point at first, as it means hacking away a bit of the originally dumped data; but we know it actually does present the proper Nintendo logo at boot, since the game does boot with that logo, so restoring the logo is essentially restoring the normal boot state of the cart. Which is reasonable, I think.
(I did consider also releasing the less-rejiggered ROM e.g. the one with the skipped data still skipped, and the Nintendo logo partially-overwritten, but I don't believe that is any more of a "true"/"full" dump than this one, and would only cause confusion if I put it out into the wild - but if anyone is interested in taking a look at it, let me know)
I've tagged this as a "YJ restored" dump, which signifies basically that it was dumped and patched back up using the technique described above. It's not really a true "raw dump", since it was patched together and there's known repeated/overdumped data. But nor is it really cracked/hacked, since all the data patched in should, in theory, be present on the original cartridge.
Another caveat to be aware of: while the original Pokemon games used flash memory to save game data, this cart instead uses SRAM with a battery (as pirate copies commonly do), and is hacked to save to SRAM instead of flash. Official cartridges using SRAM only used 32 kilobytes. However, the original Pokemon Sapphire used 128 kilobytes of flash memory, and I believe (but have not verified) that this cartridge uses 64 kilobytes of SRAM (and, again, I haven't verified it, but based on the original save data structure, this would mean it definitely would not have the second "backup" save, and may also omit one or more of Hall of Fame, Mystery Gift/e-Reader or recorded battle data).
Since the GBA ROM header does not contain any save type information, emulators and flash carts have to autodetect the save type per ROM, and since this cartridge apparently uses a non-standard save type, it is fairly likely that you will encounter problems when saving or loading data. For example, the Everdrive detects it as using flash (which causes it to fail when saving), and mGBA and no$gba both detect it as using SRAM but only provide the 32KB an official game would have (which causes it to fail when loading). VisualBoyAdvance both detects it as using SRAM and provides the full 64KB, so it works there. In fact, it seems to provide 64KB for all SRAM-using games, which is inaccurate for official games, but correct for this one... so it may be working by accident. Your mileage may (and probably will) vary.
The actual ROM
Thanks to Lightning of Twitch Plays Pokémon/RainbowDevs for lending the cart!
Update: The box!
Here are some pics of the box, thanks again to Lightning:
Amazingly, they used screenshots of the official translation on the back, I guess pre-release ones. And the text on the back... seems to be some kind of Telefang story? In decent English? I wonder where they got that from.