Saturn Memory Dumping (Yabause)

[Hacc]

This guide should be feasible for now. On to the guide...

We'll start off with the basics. This will aid you in the future when creating codes and finding those undiscovered button cheats.

Any time during emulation go to File -> Memory Transfer:


File: Enter a name for the file with the ".bin" extension (without quotes) and browse to where you want it saved. You can also just enter a name for the file and click 'OK'. It will be saved to the root directory of the Yabause folder.

Start Address*: Specify the start address of your memory dump.

End Address*: Specify the end address of your memory dump.

* Personally, I don't dump any other area of memory. This area is sufficient for your RAM cheating needs. The reason for the preset start address "06004000" is because of this:

Source: http://saturndev.emuvibes.com/faq.html

Q: 	What is the starting address of a demo? 
A: 	Demos written in C/C++ are usually 06004000. The files written by Yasushi Tanaka ([email protected]) are usually 06002000. If you recompile the demo it will tell you the starting address.

You can analyze the contents of the file afterwards with your favorite hex editor or ps2dis, just for the fun of it. To view it in ps2dis, do the following:

1) Drag-and-drop the .bin file into ps2dis.

2) When it asks for "Load from" or "Address from", enter "06004000" (without quotes) in the "Address from" box and click 'OK'.

This is a memory map of the SH-2 that you can use to specify the area of memory you want to dump:

Source: http://cgfm2.emuviews.com/sat/sattech.txt

SH-2 Memory Map
 ----------------------------------------------------------------------------

 All addresses are in hexadecimal.

 00000000-000FFFFF : Boot ROM (512K, mirrored every 512K)
 00100000-0017FFFF : SMPC registers (128 bytes, mirrored every 128 bytes)
 00180000-001FFFFF : Backup RAM (64K, mirrored every 64K) [1]
 00200000-002FFFFF : Work RAM Low (1MB)
 00300000-003FFFFF : Random data on every read (mostly $00)
 00400000-007FFFFF : Always returns $0000.
 00800000-00FFFFFF : Always returns $00000001000200030004000500060007.
 01000000-01FFFFFF : Always returns $FFFF. [4]
 02000000-03FFFFFF : A-Bus CS0
 04000000-04FFFFFF : A-Bus CS1
 05000000-057FFFFF : A-Bus Dummy
 05800000-058FFFFF : A-Bus CS2 [2]
 05900000-059FFFFF : Lockup when read
 05A00000-05AFFFFF : 68000 Work RAM (512K) [9]
 05B00000-05BFFFFF : SCSP registers (4K, mirrored every 4K)
 05C00000-05C7FFFF : VDP1 VRAM (512K)
 05C80000-05CFFFFF : VDP1 Framebuffer (256K, mirrored every 256K) [7]
 05D00000-05D7FFFF : VDP1 Registers [6]
 05D80000-05DFFFFF : Lockup when read
 05E00000-05EFFFFF : VDP2 VRAM (512K, mirrored every 512K)
 05F00000-05F7FFFF : VDP2 CRAM (4K, mirrored every 4K) [8]
 05F80000-05FBFFFF : VDP2 registers (512 bytes, mirrored every 512 bytes)
 05FC0000-05FDFFFF : Always returns $000E0000
 05FE0000-05FEFFFF : SCU registers (256 bytes, mirrored every 256 bytes)
 05FF0000-05FFFFFF : Unknown registers (256 bytes, mirrored every 256 bytes) [3]
 06000000-07FFFFFF : Work RAM High (1MB, mirrored every 1MB)

The CS0 and CS1 regions of the A-bus are mapped to the cartridge port.
 These areas are set up differently depending on what kind of cart is used.

 Memory regions that return a constant value do so at all addresses within
 that region, in units of whatever size was specified.

 Notes:

 [1] Has 32K of battery backed RAM mapped to odd bytes only, even bytes
     return $FF. Writing to even bytes is the same as writing to odd ones.

 [2] The CD-ROM registers are mapped here, in 64 byte units mirrored
     every 64 bytes.

 [3] These registers are not mirrors of the SCU registers and are for
     something different. Not sure exactly what.

 [4] The SCU manual says $01000000 is the MINIT region and $01800000
     is the SINIT region. More specifically:

     The Dual CPU User's Guide says that the on-chip Free Running Timer (FRT)
     input capture signal of each SH-2 are connected to this region:

     01000000-017FFFFF : Data written goes to slave SH-2 FRT
     01800000-01FFFFFF : Data written goes to master SH-2 FRT

     The data size is 16-bits, and the area is write-only. When data is
     written, the corresponding SH-2's FRT will set a status flag and
     optionally (if programmed to) cause an interrupt. The SH-2 can wait
     for interrupts or poll the FRT to see when data is available.

     This feature is primarily used for communication between the
     two CPUs. I have not tried using it myself. :)

 [5] Some of the random data returned are 68000 opcodes. Maybe it's
     corrupted data taken from the 68000 work RAM.

 [6] Apart from the read-only registers at 05D00010-05D00017, all locations
     return garbage data which is usually $55AA on power-up.

 [7] The framebuffer that isn't being displayed is mapped to this region.
     On power-up it is filled with the value $55555AAAAA, though the BIOS
     will clear the upper-left 352x240 area.

 [8] Doing byte writes to even addresses overwrites the odd byte of the
     same word with a garbage value. Byte writes to odd addresses overwrite
     the even byte of the same word with a garbage value. Byte reads work
     normally.

 [9] If MEM4MB is cleared (bit 9 of $05B00400) the first 256K of work RAM
     is mirrored four times throughout the 05A00000-05AFFFFF range.

     Normally this bit should be set, which maps all 512K of work RAM to
     addresses 05A00000-05A7FFFF. The 05A80000-05AFFFFF region returns
     random data when read, some of which are words from the work RAM.

     I think this is whatever data was last left on the data bus, though
     that can be generated by several sources (DRAM refresh, 68000 fetches,
     and SCSP accesses).

 The SH7604 has a 32-bit address space. Of this, the lower 27 bits are mapped
 to the address bus, which give it a 128MB physical address space. Bits 28,27
 are not used, and bits 31-29 select special memory regions, which are as
 follows:

 31 30 29
  0  0  0 = Cache used (only if CE bit in CCR is set, otherwise no cache)
  0  0  1 = Cache not used
  0  1  0 = Associative purge area (Always returns $2312)
  0  1  1 = Direct access to cache addresses (1K data, mirrored every 1K)
  1  0  0 = Same as Cxxxxxxx
  1  0  1 = Same as 2xxxxxxx
  1  1  0 = Direct R/W access to cache data (4K data mirrored every 4K)
  1  1  1 = On-chip registers

 The on-chip register area is officially located at FFFFFE00-FFFFFFFF.
 The actual layout of the on-chip register area is as follows:

 MSB                                 LSB
 111x ???? ???? ???? ?1?x ???r rrrr rrrr

 x : See table below
 r : On-chip register offset
 ? : Bit value doesn't matter

 28 12
  0  0 : On-chip register offsets 0-255 map to garbage data.
  0  1 : On-chip register offsets 0-255 map to garbage data.
  1  0 : On-chip register offsets 0-255 map to garbage data.
  1  1 : On-chip register offsets 0-255 map to the registers.

 Offsets 256-511 always map to their respective registers regardless of the
 two above bits.

 The garbage data is $00000001000200030004000500060007.
 If bit 14 is cleared the SH-2 locks up when accessing this address.