NES ROM image inside Steam version of `Changeable Guardian ESTIQUE Demo` / `超翼戦騎エスティーク Demo` and `Changeable Guardian ESTIQUE` / `超翼戦騎エスティーク`

[f-fix]

I was able to extract usable NES/FC ROM's from memory snapshots taken from Cat Hui Traiding/Amata's freely downloadable Steam demo versions of Changeable Guardian ESTIQUE / 超翼戦騎エスティーク / ちょうよくせんきエスティーク (Chouyoku Senki Estique, i.e. "Super Winged Knight Estique") in order to play them in a better emulator. I have read that these demo versions are restricted to the first of six levels, but I haven't yet played far enough to hit the demo wall. I also haven't done any comparison or analysis with Broke Studio's Famicom cartridge Japanese version of the game which I have and dumped previously. The hashes don't match.
ROM fingerprint information:

256K Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [CHR].rom crc32:d38675dd md5:7c7e5c8520f61f10340cb9e16ce2731c sha1:7d89742d49fb9196a943f25d5ab5372e5d4731ea sha256:1dc0caa843e50d322a10ecaf0a66d30930c0e1b717cdae262ff2599226afc3a6 size:262144

256K Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [PRG].rom crc32:d71f45c5 md5:be16089b9e765546ac6ecfea2b4f98fd sha1:141885abb924cdf2462ddf1d51c4a795e602558f sha256:bdcc3883f99e9ff7ec0442c6e2a5726054ee30fbf27731422e51d8bde302e137 size:262144

512K Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [UNHEADERED] [MMC3] [V-MIRRORED] [PRG-256K-CHR-256K].unh crc32:e041cdab md5:a16c0c1bb1d60de5cb531c26285076e2 sha1:208b25220e44d12a6d61b10f271385bad0bde264 sha256:157249d6c46f918ac81996e767d9b825c88c564458ebe90df402c4592b86cbec size:524288

513K Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES].nes crc32:0e6bb012 md5:357c6026e8989634bce149d2bf6b6065 sha1:625cdc13c00ec3cfcdf9f7157914f08334b7c1c2 sha256:fe7b8d04bea869d9fbd060a6a792162a495e9ad544071f0671c1ae0661314283 size:524304

256K Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [CHR].rom crc32:e55fab75 md5:02b757128b3a277e82375a1fd3b2a99f sha1:9f8b4b105f1aeb0a69df49b38f033758f2820461 sha256:94b5f2e4faab73117e07df58e9611edf975792290fb55fc5bc970e00b896952f size:262144

256K Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [PRG].rom crc32:fd37d57c md5:32d476a88b6f4eb64d1f90a28946d48d sha1:37a972764252036d7e4d8887587f106ba3e01386 sha256:080d3b03247cbccb59b4e757631a9f8eb02c243b0d400626a259a104b196ff15 size:262144

512K Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [UNHEADERED] [MMC3] [V-MIRRORED] [PRG-256K-CHR-256K].unh crc32:bf61905f md5:145436cafa977578f331045920df0deb sha1:45501dce68dcf70b17e43f0fef267e9f35af70d9 sha256:002aad7a8b0960ba9d37c761274a47643147aed604aa769e10c0f008e0bdfbcb size:524288

513K Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES].nes crc32:514bede6 md5:6982b47ccf51bd3545d37642946b93e9 sha1:e9068d6b12a9ae13afb11a9ebb901bb5dfb79a26 sha256:0c1322b8a923310a642dffeb6ead39783239d9dff22a5d6e88102476af162a87 size:524304

iNES headers are identical:

• Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES].hdr: 4e 45 53 1a 10 20 41 00 00 00 00 00 00 00 00 00
• Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES].hdr: 4e 45 53 1a 10 20 41 00 00 00 00 00 00 00 00 00
  ROM images were extracted from Windows DMP files using:

(for x in *.DMP;do python3 -c 'import struct,sys;_,ifn=sys.argv;buf=open(ifn,"rb").read();hdrm=b"NES\x1A";j=0'$'\nwhile True:\n i=buf.find(hdrm)\n if not (i>=0): break\n j=j+1\n hdr,buf=buf[i:i+16],buf[i+16:]\n prgsz,chrsz=hdr[4]*16384,hdr[5]*8192\n ofn=ifn.rsplit(".",1)[0]+"_"+str(j)+".nes";\n print(ofn, prgsz, chrsz)\n open(ofn,"wb").write(hdr+buf[:prgsz+chrsz])' "$x";done)

edit: I am full of typos today. Estique Demo should have the first of 6 stages accessible. 6 is the total stage count in the full version, AFAIK

[Hergog]

Can confirm the rom is the demo rom. Only the first stage is playable. Tested both US and JP roms

[f-fix]

Toggling the SRAM bit in the iNES header allowed the Estique demos to run in EverDrive too:

• Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES] [SRAM].hdr: 4e 45 53 1a 10 20 42 00 00 00 00 00 00 00 00 00
• Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES] [SRAM].hdr: 4e 45 53 1a 10 20 42 00 00 00 00 00 00 00 00 00
  ROM fingerprint information: (PRG, CHR, UNH unchanged from before)

513K Changeable Guardian Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES] [SRAM].nes crc32:46077f13 md5:a3ac2fc04f5350831c2ce5d52ffe02fd sha1:928bf8c4677fec0793f7ca80929ddd91b8305c3e sha256:22ec76dd7b32d384e73aae96e132e7db70027a99ee1c3264e46fe46fde072f51 size:524304

513K Chouyoku Senki Estique - Demo (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES] [SRAM].nes crc32:192722e7 md5:22ccc3bc29198b68538cc57ec611a578 sha1:a0e69c12e638cb1a8abbfa8ae54f975b7b29c50e sha256:e5603278f4dcb7746f78903d79704a0667744e51884d9a3837550b53bdbc17c8 size:524304

The physical cartridge for the full version of this game contains an SRAM IC but no battery for it, so I think they just use it as additional work RAM or something like that.

... and now i see i flipped the mirroring bit at the same time. the reason i did that is because that's what tapedump set it to when dumping the physical cartridge, along with the SRAM bit, and it seems to work fine too. tapedump does check mirroring behavior of the physical cartridge, and also checks for SRAM.

[farmerbb]

@f-fix Thanks!

I had downloaded the demo for this game last night and was also successful in extracting the NES and Famicom ROMs from the memory dumps. I was confused though when my ROM hashes didn't match up with the ones posted above. Turns out that the demo was updated after I had downloaded it and this update included changes to both ROMs.

In the original release there is a small 304-byte section that differs starting at 0x18D39 in both the English and Japanese version of the ROMs. Byte 0x18D39 is 82 and the rest of the bytes (0x18D3A - 0x18E68) are all FFs.

Hashes for English original release:

• MD5: 5c6b1e2bd480457c644f074600ddd222
• SHA1: 442f25c47c298a9d9bcf7d51696ec962204d39bc
• SHA256: 2bba36455100b89c08b91efcca3d38629f3eb2ae8b54bbb8a5b0a0db72cb8f9a

Hashes for Japanese orignal release:

• MD5: 607e7c7f95324d4f6f6083dd6ade164d
• SHA1: 0d9073f6f2d5860324f0f8ede40d110a485e4e1f
• SHA256: 40df482534399b0d2aede12ef553d6f93d09b94b021753fb23834448150682d0

Also, it looks like these files are also stored (encrypted) inside of Changeable Guardian ESTIQUE_Data\StreamingAssets\aa\StandaloneWindows64\defaultlocalgroup_assets_all_<hash>.bundle. Using AssetStudio to open this file, we can see the original file names of the ROMs: EQ1_USA_V2_251003_FIX.nes and EQ1_JAP_V2_251003_FIX.nes.

[f-fix]

that's pretty fast verson cycling! it's indeed good to know which file they get stored in. unfortunately i have zero clue about how to extract them directly from there without running the game

[SlashEraser]

the full game is out

https://store.steampowered.com/app/4078160/Changeable_Guardian_ESTIQUE/

[f-fix]

the full game is out

https://store.steampowered.com/app/4078160/Changeable_Guardian_ESTIQUE/

Same technique worksfor the full game:

I was able to extract usable NES/FC ROM's from memory snapshots taken from Cat Hui Trading/Amata's Steam versions of Changeable Guardian ESTIQUE / 超翼戦騎エスティーク / ちょうよくせんきエスティーク (Chouyoku Senki Estique, i.e. "Super Winged Knight Estique") in order to play them in a better emulator. Some fairly large ROM regions are non-identical with Broke Studio's Famicom cartridge Japanese version of the game which I have and dumped previously.

ROM fingerprint information:

256K Changeable Guardian Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [CHR].rom crc32:b4010888 md5:5987457d4a08b016ca8fc34e11d761b7 sha1:fc67b849b04f6c30c097930e26975da4f806f264 sha256:810bb70d3dcb0755bb32eaf798b60ee1c792b35daf6ae33d0087527ce33e14d2

256K Changeable Guardian Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [PRG].rom crc32:1508aef8 md5:3ecd6f7f6c1f26dcd101cfb44cf5a1bf sha1:c11c538d9644d27d292212592dc59d757b458014 sha256:6dd9f6d26bf25f36541a68db23d773a54a9384587096967978b879e7e353904e

512K Changeable Guardian Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [UNHEADERED] [MMC3] [H-MIRRORED] [PRG-256K-CHR-256K] [SRAM].unh crc32:9a2ab03b md5:fbf7f3e02fd028b24c274b6c6dec40be sha1:7015de9ba42d326b636812779b70a43c6e9a4dd6 sha256:38f60751192499de6ca3b0cb0f0254cc1670519acd23ed2162778f14db53a1f5

513K Changeable Guardian Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES].rom crc32:3c6c0283 md5:0aa430e3f6e47a4dc4da7ffb80e20a72 sha1:0cab3e556f22413e5fbd096cce06bc11603d83f3 sha256:096059653db4c0d16932460ae2541069d34630d36c0ea103cc0a951bde9f5671

256K Chouyoku Senki Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [CHR].rom crc32:557cedc2 md5:a4e10cbf742491a59a07ddf937520b54 sha1:729f340e5f158e7c70d9431a28e5a981ccb59382 sha256:2814755670ba504dd4d2a5cac92e6e8779e3505daa5e36ef8aa81e23f08edeef

256K Chouyoku Senki Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [PRG].rom crc32:3e6e60b0 md5:ffdc4c065ed9cffb820cb280a837e86e sha1:f6b4895833fb558c3c11eabe09305db107ba5d4f sha256:d85e867f10da3703a4815042900534246a296a67d394f6b3c9158bcbf06de5f6

512K Chouyoku Senki Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [UNHEADERED] [MMC3] [H-MIRRORED] [PRG-256K-CHR-256K] [SRAM].unh crc32:20e595f9 md5:517e785371912d0f432cfd174dfd108c sha1:c23ddfde2a2f43d9649490d8a0a0a035a491d1fc sha256:0798e46b9642ff9fc9b03a184942060b9bf14bae9f68eb40203d5a3e7002c090

513K Chouyoku Senki Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES].nes crc32:86a32741 md5:ccb576e350815c4592e187270d0c279a sha1:2e940657a4468481a0d9af81757bf4760332eaa8 sha256:e17650f98616c9f544a36b327947fb621b38a86fc3315036bf49d8ea34aaf664

iNES headers are identical:

• Changeable Guardian Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (En) (World) [_] [iNES].hdr: 4e 45 53 1a 10 20 42 00 00 00 00 00 00 00 00 00
• Chouyoku Senki Estique (2023 - 2026) (Cat Hui Trading) (Amata) (Valve) (Ja) (World) [_] [iNES].hdr: 4e 45 53 1a 10 20 42 00 00 00 00 00 00 00 00 00

I had to flip the SRAM bit on compared to the broken iNES headers found inside the DMP files.

ROM images were extracted from Windows DMP files using:

(for x in *.DMP;do python3 -c 'import struct,sys;_,ifn=sys.argv;buf=open(ifn,"rb").read();hdrm=b"NES\x1A";j=0'$'\nwhile True:\n i=buf.find(hdrm)\n if not (i>=0): break\n j=j+1\n hdr,buf=buf[i:i+16],buf[i+16:]\n prgsz,chrsz=hdr[4]*16384,hdr[5]*8192\n ofn=ifn.rsplit(".",1)[0]+"_"+str(j)+".nes";\n print(ofn, prgsz, chrsz)\n open(ofn,"wb").write(hdr+buf[:prgsz+chrsz])' "$x";done)