About a month ago I was working on fixing a bug when writing 1Mbit flash saves back to a GBA cart when I decided to plug in a “24 in 1” Flash cart to see if it had flash memory as the save option (it doesn’t, it has 512Kbit SRAM) but when I saved the SRAM and then re-read the header something strange happened, the game title changed to another game. I tried it a few more times and could replicate it fine, turns out there was another bug, I was switching banks (512K to 1M) even for SRAM carts too. This is just a quick post about my findings.
After some quick investigation of what was happening when switching banks on the Flash cart, I narrowed it down to the 0x2AAA, 0x55 command which could be run by itself to switch the game title. I started testing bits on that address and byte, I found that if you gave it a wrong address or byte, it could potentially lock up and only give you the same game title over and over again or the game title could have a random character or two.
2 = 17, 3 = 24, 4 = 0, Game title: BOF2 2 = 17, 3 = 24, 4 = 1, Game title: BOF2 2 = 17, 3 = 24, 4 = 2, Game title: BOF2 2 = 17, 3 = 24, 4 = 3, Game title: BOF2 2 = 17, 3 = 24, 4 = 4, Game title: BOF2 2 = 17, 3 = 24, 4 = 5, Game title: BOF2 2 = 17, 3 = 24, 4 = 6, Game title: BOF2 2 = 17, 3 = 24, 4 = 7, Game title: BOF2 ... 2 = 17, 3 = 24, 4 = 16, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 17, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 18, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 19, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 20, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 21, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 22, Game title: BOF EUR 2 = 17, 3 = 24, 4 = 23, Game title: BOF EUR
I found that at address 2, you could write the high bits of the byte and it would switch banks, like 0x10, 0x20, but it didn’t change all the time. Later on I played around with writing any number to it and it would change on even numbers. Address 0 and 1 didn’t seem to do anything. See a bigger list here of addresses / game titles here: Address-to-game-titles
2 = 0, 3 = 0, 4 = 0, Game title: POKEMON RUBY 2 = 0, 3 = 16, 4 = 16, Game title: GBAZELDA 2 = 0, 3 = 32, 4 = 32, Game title: GBAZELDA MC 2 = 16, 3 = 0, 4 = 0, Game title: BOF2 2 = 16, 3 = 16, 4 = 16, Game title: BOF EUR 2 = 16, 3 = 32, 4 = 32, Game title: HM MFOM USA 2 = 32, 3 = 0, 4 = 0, Game title: RAREDKC1 2 = 32, 3 = 24, 4 = 24, Game title: JIMMY NEUTRO 2 = 32, 3 = 32, 4 = 32, Game title: RAREDKC2 2 = 32, 3 = 56, 4 = 56, Game title: NBA JAM 2002 2 = 48, 3 = 0, 4 = 0, Game title: RAREDKC3 2 = 48, 3 = 40, 4 = 40, Game title: ICE AGE 2 = 48, 3 = 48, 4 = 48, Game title: MEDABOTS 2 = 64, 3 = 0, 4 = 0, Game title: KINGOFSWINGE 2 = 64, 3 = 40, 4 = 40, Game title: MONSTERS 2 = 64, 3 = 48, 4 = 48, Game title: SONICGENESIS 2 = 80, 3 = 0, 4 = 0, Game title: SONIC ADVANC 2 = 80, 3 = 32, 4 = 32, Game title: ERAGON 2 = 96, 3 = 40, 4 = 40, Game title: PLANETOFAPES 2 = 96, 3 = 48, 4 = 48, Game title: LADY SIA 2 = 112, 3 = 40, 4 = 40, Game title: FINDINGNEMO2 2 = 112, 3 = 48, 4 = 48, Game title: AVATAR
Playing around with it more, I could find most of the games on the flash cart, found that Address 3 and 4 can be different but most games will show up if you keep these numbers the same. It looks like you should switch in multiples of 8 but not go higher than 128 otherwise it will lock up.
The games you would dump would be patched for flash saving, it appears that some games won’t start at all, just a white screen on VBA while others do load the save file from the ROM file but saving in game doesn’t work as the emulator doesn’t know what to do.
I decided to add this functionality to the GBxCart RW console interface, just as something interesting, it may or may not work for any other carts. I’ve made it able to do an automatic scan of the addresses and the resulting game title. You can enter in address 2 and address 3/4 and specify the ROM size to dump.
