Super Mario Bros 3
| Type | single | | Mapper | 4 | | Original mapper | 4 | | PCB marks | 047 | | Tags: | #smb3 | | Uploaded: | 2020-12-04 08:27:28 |
|  |
Elements:
Chip signature:
88(MMC3)(88(MMC3))+V008(MASKROM_1M_DIP28)+74139+9112(MMC3)+V009(MASKROM_1M_DIP28)+6264+V010(MASKROM_1M_DIP28)
PCB top:
PCB bottom:
Shell top:
Shell bottom:
Screenshoots:
Extra info:
Weird SMB3 pirate cart
I got this cart from a friend for checking. It interested me for two reasons.
* First - it is based on the rare pirate MMC3 chip called "88", which has two GND pins and it made me curious if one of them is some kind of mysterious input that, for example, allows to switch it between different modes.
* Second - because this friend said that the game behaves weirdly and sometimes on the first level it warps the player to the final boss scene.
[url=https://obrazki.elektroda.pl/8646872700_1607066846_org.jpg][img]https://obrazki.elektroda.pl/8646872700_1607066846_thumb.jpg[/img][/url] [url=https://obrazki.elektroda.pl/4450343000_1607066848_org.jpg][img]https://obrazki.elektroda.pl/4450343000_1607066848_thumb.jpg[/img][/url] [url=https://obrazki.elektroda.pl/2591974700_1607066850_org.jpg][img]https://obrazki.elektroda.pl/2591974700_1607066850_thumb.jpg[/img][/url] [url=https://obrazki.elektroda.pl/9150329700_1607066852_org.jpg][img]https://obrazki.elektroda.pl/9150329700_1607066852_thumb.jpg[/img][/url]
Here are the results:
1) The answer for first question is unfortunately "no". Both of those pins are shorted internally in the chip, so no extra function.
2) I tried different tricks, was going and messing around in the first level but I was not able to warp myself to the end of game, maybe it needs some kind of special condition
3) Anyway, the RO of the gae is almost identical to the japanese version with a few diffferences (and no, they're not related to copyrights removal). Here are all regions tht different bytes lie:
A -> $20010
B -> $30a20
C -> $3442a - $3442c, $3df11 - $3df3b
[b]3C)[/b] Modification in those bytes alters the behaviour of function called when user presses B button in the world selection map:
[img]https://obrazki.elektroda.pl/5238681300_1607067117.png[/img]
[code]
----------oryginal-------------------- ----------this hack--------------------
0D:A417: 4C FC A4 JMP $A4FC 0D:A417: 4C FC A4 JMP $A4FC
0D:A41A: AD 18 00 LDA $1800 0D:A41A: 20 01 9F JSR $9F01 <---- !!!
0D:A41D: 29 50 AND #$50 0D:A41D: 29 50 AND #$50
0F:9F01: A5 18 LDA $0018
0F:9F03: 29 20 AND #$20
0F:9F05: D0 03 BNE $9F0A
0F:9F07: A5 18 LDA $0018
0F:9F09: 60 RTS ------
0F:9F0A: AD 80 7D LDA $7D80
0F:9F0D: 18 CLC
0F:9F0E: 69 01 ADC #$01
0F:9F10: C9 0E CMP #$0E
0F:9F12: D0 02 BNE $9F16
0F:9F14: A9 01 LDA #$01
0F:9F16: 8D 80 7D STA $7D80
0F:9F19: A5 18 LDA $0018
0F:9F1B: 60 RTS ------
[/code]
So the jump to routine at $9f01 was injected to detect if the 5th bit of cell at $0018 is 1 an dif yes, increase the ram value at $7d80 (and wrap it past $0e to $1)
Cell $0018 contain state of currently pressed button and 5th bit = SELECT, so if you first press B and then SELECT, you are able to select ANY from the special utils.
[img]https://obrazki.elektroda.pl/2408850300_1607067338.png[/img]
Sorry, I haven't played SMB3 so no idea what those object can be used for but as I see, there is even a "warp" object that teleports you to warp mode world.
[img]https://obrazki.elektroda.pl/4888248800_1607067405.png[/img]
[b]3B)[/b] Modification of this byte (which is data) is responsible for altering the behaviour of splash screen animation. In normmal rom, when the curtine goes up, the background is black for a few seconds and then the scenery appears. Here, the background stays black until you press start (but the characters are still walking and jumping, just in different way).
[url=https://obrazki.elektroda.pl/8069260300_1607067521.png][img]https://obrazki.elektroda.pl/8069260300_1607067521_thumb.jpg[/img][/url]
[b]3 A)[/b] I wasn't able to figure yet if this byte is data or code and when it is executed or read.
Comments:
Want to leave a comment?
