Mario Kart Arcade GP 2 Dump Stuff

From ChainSwordCS's website, the mostly one person -driven video game encyclopedia.
< Go back Home

My Writeup

I don't rember what all I did with this project...

Part 1: Summary of stuff

First I obtained the bin files from tmbinc (and others)'s dump. They are the same format as the MAME format dump of mkartag2, and are still encrypted.
According to tmbinc, the dump is 100% accurate to the best of their knowledge. They de-soldered the flash chips from the NAND board, and dumped them in a Flash programmer.
I ran a modified version of combine.py (original by tmbinc, modified by Eiim) to get MKGP2_OUT.bin
Then I ran a modified version of decrypt.py (original by tmbinc, modified by Eiim) with the known key of the Japanese MKAGP2 to get MKGP2_OUT.bin.gcm
This GCM file can simply be renamed to ISO or BIN as needed. It runs fine in Dolphin. However it has a different checksum to the original "known good" dump from September 2010.

At the time of writing, FIX94's TriNandExtract and TriHdrPatcher programs do not support this dump.
It appears they were hard-coded a certain way, and TriHdrPatcher requires a certain USA MKAGP2 dump to function.

So as for the differences between tmbinc's dump and the Spain (previous "known good") dump…
In tmbinc's dump, one byte in boot.id is changed from 0E to 02. I don't know, some kind of flag maybe.
I don't know if the credit cost stuff is actually written to NAND but maybe so.
Also in the tmbinc dump one area of bytes was 00'd out. It appears this had no effect on the filesystem, maybe it was garbage data. Dunno yet.

I tried to use the same method to Combine and decrypt the Japanese MAME dumps, and I guess I concur with FIX94's findings (as evident by his code).
The finding is that mkartag2, and also mkartag2a for that matter, are bad dumps.
When extracted via tmbinc's original tools, they would not boot. But some areas are clearly decrypted and align properly with a good dump.
Well, some large areas of bytes are filled with a repeating pattern "CC B9 FD 59 DF 57 5B 3B" in the MAME dumps.
FIX94's TriNandIsoExtract tool patches these areas with data from the Spain dump.
At this point I don't know exactly what parts of the MAME dumps are good, and whether FIX94's patch is authentic to what a good dump would look like.

Part 2: Attempting to sort the dumps

I will only be sorting the dumps I actually have archive copies of, unless otherwise specified...
The spreadsheet(s) of my findings can be found here: https://docs.google.com/spreadsheets/d/1XYBBjhsa8DVox1A7apbBGb9D_TgRXh96FwCRAdW3YeU/edit#gid=533597423

Note: It seems to be the case that only the USA/International version of MKAGP2 is supported in Dolphin Triforce branch. Of course it's so hacky it'd be significant effort to add support, and it hasn't been updated in literally 7 years.

So, the "extracted ISO" files are decrypted for compatibility with mainly Dolphin.
The rom is encrypted on the storage media, and the Triforce actually loads it encrypted, and decrypts it on the fly when reading.
So the MAME dumps are actually still encrypted. FIX94's tools are decrypting the data.
The extracted ISOs are not exactly "modified" dumps. The patched headers are, but on a smaller scale.
Regardless, this all is still worth documenting in some capacity, so we know which ROMs to archive.
(I didn't realize it for a few days, but it's actually a good sign that a lot of the hand-modified ROMs are no longer in circulation. A few still are though.)

Thanks

Huge thanks to tmbinc for helping me with these!
Medium size thanks to my friends herronjo, Eiim, and bologna for helping analyze stuff and get scripts to work.
Big thanks to MrSporty, ElSemi, Serantes, TheGuru, and BoboPJ64 for working on Triforce stuff, and Rob Watts for documenting GD-ROM Ripping.
Big thanks to Crediar for developing Quadforce and to Cheatfreak47 for documenting it.
Big thanks to MetalliC and others who worked on Dolphin and Dolphin-Triforce-Branch.
Big thanks to FIX94 (among others) for adding Triforce support to Nintendont, and for creating tools for uniformly extracting and patching Triforce roms.

Triforce Arcade Blog by tmbinc

This is my collection of posts about Triforce Arcade hacking formerly available at debugmo.de
By the way, you might still be able to contact tmbinc (aka Felix Domke) via tmbinc@elitedvb.net

The following are links to Archive.org (Year/Month/Day):

Tools and other Resources

Aaaand buried at the bottom of the page is my release!

Thank you for reading!