« on: August 03, 2018, 03:36:14 am »
Games that use the SA-1 chip can technically go up to 8MB (64 mbit). However, ROM access is controlled through the chip using registers $2220-$2223 to allow for bank switching. The low bits set where to get banks C0-CF, D0-DF, E0-EF, F0-FF while the high bit lets you choose if banks 00-1F, 20-3F, 80-9F, A0-BF will mirror the same place that the first 4 areas do or just get fixed to the first 4MB of the ROM.
That means ROM expansion for an SA-1 game can sometimes get tricky. Ideally you'd want to be able to access your expanded ROM data without messing with banks that the game is already reading ROM data from, but also without having to fall back on writing ASM to dynamically switch banks to access your data then switching back before the game needs it again.
So based on just a very quick glance with an SNES tracer, I can see ROM banks 00, 01, 07, CA, CB, D1, EF, F0 being accessed. There's probably lots more, but it looks like there's a chance they may not of used many of the "LoROM" type banks. So if I were you, I'd try the following: at 0x300000 PC in the ROM (assuming it has no copier header), insert (NOT OVERWRITE!) 1MB of zeros. Yes, that will move the last 1MB of the existing ROM to 0x400000 PC. This is going to be an unusual expansion for an SNES game.
Next, we need to find where the game sets up the banks. If you're lucky they just set it up once and leave it that way. A quick trace gave me this:
$00/80C3 9C 20 22 STZ $2220 [$00:2220] A:00A0 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:eNvMxdIzC
$00/80C6 A9 01 LDA #$01 A:00A0 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:eNvMxdIzC
$00/80C8 8D 21 22 STA $2221 [$00:2221] A:0001 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:envMxdIzC
$00/80CB A9 02 LDA #$02 A:0001 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:envMxdIzC
$00/80CD 8D 22 22 STA $2222 [$00:2222] A:0002 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:envMxdIzC
$00/80D0 A9 03 LDA #$03 A:0002 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:envMxdIzC
$00/80D2 8D 23 22 STA $2223 [$00:2223] A:0003 X:1FFF Y:0000 D:3700 DB:00 S:1FFF P:envMxdIzC
Note that it seems there's also a LDA #$01 STA $2221 at $DBF0 SNES, which you might want to keep in mind if you play with things later.
Anyway, change the byte at 0xD1 PC (or $80D1 SNES, again assuming no copier header) from 03 to 04. Then try playing through as much of the game as you can to see if any problems show up. If everything seems fine, congrats! You can access your new 1MB of space at $A0:8000-BF:FFFF SNES (32KB LoROM type banks). You could possibly go up to 6 or 7MB this way by playing with 20-3F and 80-9F along with inserting space at the required locations while setting the right registers, depending on if the game accessed those areas already or not.
If it isn't fine, well... the original game probably accessed that area after all. You could try messing with one of 20-3F or 80-9F instead, but I doubt your chances would be any better. You may just end up having to do dynamic switching with ASM in this case, though you'll have to know what you're doing.
For testing, just be careful which emulator and version you use. I'd suggest Snes9x 1.54 or higher (older versions do not fully implement those SA-1 registers).