TapeDump.NES: Dump NES/Famicom prototypes without any custom hardware!

This is a rudimentary program (but it works!!) that allows you to dump NES/FC cartridges to computer without anything more than an NES devcart (like the PowerPak, of course!) and a regular PC or digital audio player with sound recording function. I programmed it up when faced with a Famicom proto that had its EPROMs soldered to the PCB. Did I want to desolder the chips and risk frying them? Or, send the cart to someone else and wait a week for the ROM dump? No -- I was too impatient for that.

This is actually the 5th or 6th "poor-man's" dumper that I have made which itself runs on the FC/NES. Earlier dumpers of mine tried saving to the FDS via FDSLoader cable, or dumped ROM data to the screen for digitization. The former (and earlier programs) needed special hardware for dumping; the latter one worked well but of course required a game that had CHR-RAM. How stupid I was to not consider the NES' audio circuitry for output, something there to be used no matter what weird cartridge is inserted for dumping!

Getting Started...

You need a way to get this program loaded onto the NES, of course. Typical ways include running it on a PowerPak cartridge, or on an EPROM or EEPROM devcart. Once the program starts up, it loads the main code into RAM and runs from there, meaning it will (ideally) keep running even after you have removed the devcart and inserted your target cartridge for dumping.

 

 

 

 

 

When the program has loaded and is running in RAM, the screen will be a light blue (left). You can remove your EPROM/Dev cartridge and insert the cart to be dumped.

*1: Removal or insertion of cartridges while the NES/FC power is on runs the risk of damaging either the cartridge or console. Do so at your own risk!

*2: NES units that don't have their lockout chips disabled will reset when cartridges are removed. You need to have a lockout-disabled NES in order to dump carts.

After inserting the cartridge to be dumped, check the sanity of the program by tapping the U,D,L,R, A, or B buttons. The NES CPU can often crash when a cartridge is inserted too gradually.

If the dumping program appears to be running normally (background colours change on button presses), don't worry about garbled graphics; proceed to the controls below.

 

 

  

Inc. Start Address

                    

 

 

  
Up
        
Controls
  

Set 300 bps
Left
Right
 Set 600 bps                

 

 

  
Down
            
B
  
A
  
     
Select
Start
 

 

 

  
Set 1200 bps
    
Dump PPU
Dump CPU
Inc. CHR Bank
Inc. PRG Bank
  

Since removing and inserting cartridges changes CHR graphics between ROMs, open buses, and possibly empty RAM chips, there is no sure way to display graphics on-screen after a cartridge has been swapped in. Therefore, settings and dumping steps will be indicated through the background colour on-screen only.

Explanation of initial controls
Button Press
Colour Appears
Result

These settings select the data rate at which bits will spew out of the digital audio channel. 300 bps (default) is the most reliable but also the slowest, taking about 2:50 to transfer 4K of data.

1200 bps is four times faster, and still very reliable; however, occasional popping out of the NES' sound channel sometimes fools software on the computer decoding 1200 bps data into adding an "$FF" byte at the beginning of each dump. Not a big problem, but watch out for oddly-sized data files after dumping.

Left
Dumping speed will be set to 300 bits per second.
Right

 

 
" " " 600 bps
Down
" " " 1200 bps
"UP" button pressed
CPU dump address set to:

When dumping from CPU memory, the program does have a default starting address. To change this, press "UP" multiple times to skip to the next 4K range of memory in the CPU.

Pressing "UP" any number of times will also reset the CHR starting bank to 0.

On first load, and whenever you press "UP", the dumping routine (when started) will prepend a human-readable 2-byte header to the data being dumped. For example, "$80,$00" to show that dumping started at $8000 in the CPU space; or, for PPU dumping, "$CB,$xx", meaning "Character Bank" and the CHR bank number (for games with memory mappers) that was dumped. Subsequent continuous dumps will not have this header: it will be prepended only when this dump start address is reinitialized.
|
8000
|
9000
|
A000
|
B000
|
C000
|
D000
|
E000
V
F000
"B" button pressed: change CHR bank to:

These settings are for the example mapper (Konami VRC2b) which -- in the game I dumped -- has 128 1K CHR banks spread over PPU $0000-$1FFF, meaning banking in as many as possible at once (0..7, 8..F,10..17...), and reading the full 8K of CHR, sixteen times (hence the 16 bank settings.)

If the cart you dump has no CHR banking, or CHR-RAM, then you don't need to worry about this section at all.

To use a different mapper, you'll need to rewrite the PRG, CHR mapping routines which I've put at $600 in RAM in the source code. You'll also need to change the maximum # of banks and related banking logic too. Not too hard to do.
0->
1
2
3
4
5
6
7
8
9
A
B
C
D
E
F
"A" button pressed
PRG bank set to:

These settings are for the example mapper (Konami VRC2b) which has 16 8K PRG banks mappable to $8000-$BFFF, with $C000-$FFFF fixed. Thus, it takes 8 passes of $8000-$BFFF (basically) to dump the whole 128k of that particular game.

Since different mappers have different bank values and banking ranges, you'll probably need to write different mapping routines, and change the maximum # of banks and dumping range to suit your mapper.
|
0
|
1
|
2
|
3
|
4
|
5
|
6
V
7

Start Dumping!

If you have any experience with old home computers, the following won't be a surprise. If you don't, you might be amused at how low-tech it is. Old '70s and '80s home computers used audio cassette tapes as a storage device, saving files at rates of 300-1200 baud by sending each byte serially as 11 bits encoded into loops of 1200/2400 Hz tones. A standard was set for this method, known as the "Kansas City Standard" or "Byte" (the magazine, not the data size) standard.

My program should conform more or less to this standard as well, meaning you can use KCS decoding programs on the PC to retrieve cartridge dumps from the NES. When dumping starts, the NES/FC screen will go black, a ~5 sec. leader tone will sound, and the program will dump 4K/8K of data at a time starting at the initial address, at the selected bps rate, as a high-pitched screech through the digital audio channel of the NES/Famicom. Record this audio output to your PC sound card... or an old cassette tape if you really want to be retro.
Select Pressed
Start Pressed

Dumps 8K of CHR data from $0000-$1FFF in the PPU space. Once it's finished, it'll reset the read address back to $0000, and increment the memory mapper to the next 8K. I chose to do it this way so that you can dump multiple CHR banks of a cartridge by simply pressing "Select" each time the previous dump has finished.

Note that the very first CHR dump this program performs will prepend a 2-byte header "$CB, $xx" to identify it as PPU/CHR data and its bank number.

Dumps 4K of data from the default/specified address in the CPU space. Once dumping finishes, pressing "Start" again will dump 4K more from wherever the previous dump had left off.

Since different mappers map banks into different regions of memory, this dumping routine doesn't increase mapper banks or anything. It'll even wrap around to CPU $0000 if you dump past $F000. Might be useful for something.
dumping...

 

 

 
-->

 

 

 
finished.

Record the audio on your computer at 22050 Hz or higher, and be sure to save it in a lossless format, such as WAV or AIFF. (Lossy formats such as MP3 and others apparently introduce too many overtones and distortion in the signal to be useful for anything over 300 bps.) You can then use software to decode the audio file back into binary data (making sure not to forget to remove the 2-byte header after conversion...) I recommend the simple and effective KCS program for decoding on PCs.

Combining the data files the right way and adding an .NES header is an exercise I'll leave up to the user. Happy dumping!

-- Chris Covell