Mapper hacking and debugging.

Discuss technical or other issues relating to programming the Nintendo Entertainment System, Famicom, or compatible systems.

Moderator: Moderators

DrWho198
Posts: 25
Joined: Mon Feb 23, 2015 8:05 pm

Re: Mapper hacking and debugging.

Post by DrWho198 » Tue Feb 24, 2015 4:32 pm

lidnariq wrote:This is really straightforward hardware to add. It's a 74'138 and a latch such as a (74'74 or 74'161) on top of a board already containing an MMC3.

Wire the 74'138 to detect writes to $41xx by connecting:
R/W to /G1a
A13 to /G1b
M2 to G2
/ROMSEL to A
A8 to B
A14 to C
Then
74'138 /Y7 to latch CLK
CPU D2 to latch data in
latch data out to CHR A18.
wow, thanks... I didn't expect this. I'll still have to check if the rom depends on the other mappers. But this information might make a repro possible again.

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Tue Aug 06, 2019 2:49 am

lidnariq wrote:This is really straightforward hardware to add. It's a 74'138 and a latch such as a (74'74 or 74'161) on top of a board already containing an MMC3.
Seems it's not so simple. Trying to make repro of AV Mei Shao Nv Zhan Shi (Unl)
20190612_215858.jpg
If mmc3 completely ignore writing to $41xx then this game should work on mapper 04 (just with broken graphics).
Probably 116 mapper do something with mmc3 registers on writing to $41xx because game behaves wrong (on character selection screen and during fight I have freeze and garbled graphics).

For easier reproduction we can change code and move control register for CHR to $6000, because no WRAM in this game and we can use signals from mmc3 instead of 74'138 (like in mapper 189).
If only we can make the rest code work on mapper 4.

lidnariq
Posts: 9690
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Mapper hacking and debugging.

Post by lidnariq » Tue Aug 06, 2019 1:28 pm

If it crashes like that, odds are good that it's using MMC1 mode in order to change what would be MMC3's fixed bank, and so I fear an MMC3 mapper hack would be impossible.

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Tue Dec 17, 2019 1:01 am

I've managed to remove protection from this rom, now it doesn't change mapper modes to vrc and mmc1. But circuit suggested earlier in this topic doesn't work properly (probably due to bus conflicts). So I 'm going to implement my idea to utilize wram /ce
Attachments
AV Mei Shao Nv Zhan Shi (Unl)[deprotected].ips
Removes copy protection from original game. Now can be run on MMC3
(105 Bytes) Downloaded 124 times

User avatar
nintendo2600
Posts: 355
Joined: Mon Mar 30, 2009 4:40 pm

Re: Mapper hacking and debugging.

Post by nintendo2600 » Tue Jan 14, 2020 8:41 pm

pakosup wrote:
Tue Dec 17, 2019 1:01 am
I've managed to remove protection from this rom, now it doesn't change mapper modes to vrc and mmc1. But circuit suggested earlier in this topic doesn't work properly (probably due to bus conflicts). So I 'm going to implement my idea to utilize wram /ce
Any chance you have mapper hacks to something more conventional like MMC1 or MMC3 for Lethal Weapon (enforcers) or Cobra Mission pirate famicom games? They both use crazy stuff (mapper 90 or 118 I think?) I wanna play them on my real nintendo and not just on an emulator. Zapper and a CRT for lightgun games or GTFO right? :)

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Fri Jan 17, 2020 8:47 am

I thought about mmc5 because it supports 512KB of chr.
But I've done this game on mmc3 with additional logic.
20200103_195518~01.jpg
By the way Cobra Mission can be easily converted to mmc3, I can give you the patch.

User avatar
aquasnake
Posts: 114
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper hacking and debugging.

Post by aquasnake » Sun Jan 19, 2020 1:45 am

Mapper 115 is more suitable

just ignore the writes to $6000 and fetch $6001.bit[0] as mapped A18

because the standard MMC3 uses cpu_a[14:13] and cpu_a[0] to write the registers, but mapper116 needs to access $4100, which means it takes cpu_a[8]. by changing mapper116 to 115, we can save the number of addintional discrete components, and save the cost meanwhile

User avatar
aquasnake
Posts: 114
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper hacking and debugging.

Post by aquasnake » Tue Jan 28, 2020 1:38 am

i have reversed this cart. it works well on a pal/dendy console, but it crashes on another ntsc famiclone.

this game was developped by hummer team in taiwan in 1994. i guess this released version is for pal system only

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Mon Feb 03, 2020 10:33 am

aquasnake wrote:
Sun Jan 19, 2020 1:45 am
Mapper 115 is more suitable
Do you know any donor with this mapper?
aquasnake wrote:
Tue Jan 28, 2020 1:38 am
i have reversed this cart. it works well on a pal/dendy console, but it crashes on another ntsc famiclone.

this game was developped by hummer team in taiwan in 1994. i guess this released version is for pal system only
This game works fine on any ntsc console. Probably you have faulty cartridge.

User avatar
aquasnake
Posts: 114
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper hacking and debugging.

Post by aquasnake » Tue Feb 04, 2020 10:21 am

I don't have this cart

All my works were verified on my development board

cardiff
Posts: 9
Joined: Wed Feb 12, 2020 3:14 pm

Re: Mapper hacking and debugging.

Post by cardiff » Wed Feb 12, 2020 3:19 pm

pakosup wrote:
Fri Jan 17, 2020 8:47 am
I thought about mmc5 because it supports 512KB of chr.
But I've done this game on mmc3 with additional logic.
20200103_195518~01.jpg
Hello! A few days trying to make this game on mmc3. The image is buggy. Could you tell me how to connect?

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Sun Feb 16, 2020 2:24 am

I've changed mapper register address from $4100 to $6100.
You can change bytes in ROM by addresses $1e021 and $1e198 ($41 to $61)
Also you need 74hc161 as latch and 74hc00 for signal inversion (you can use any other logic or transistor for this purpose).

PRG RAM /CE (pin30 MMC3) -> pin12+pin13 74hc00 (to invert signal)
pin11 74hc00 -> pin9 74hc161
PRG RAM +CE (pin41 MMC3) -> 150R -> pin2 74hc161
pin2 74hc161 -> 5nF -> GND (RC circuit to delay signal)
PRG D2 -> pin3 74hc161
pin14 74hc161 -> CHR A18

don't forget to connect
pin1 74hc161 -> VCC
pin7 74hc161 -> GND
pin11 74hc161 -> GND

cardiff
Posts: 9
Joined: Wed Feb 12, 2020 3:14 pm

Re: Mapper hacking and debugging.

Post by cardiff » Tue Feb 25, 2020 12:53 pm

pakosup wrote:
Sun Feb 16, 2020 2:24 am
I've changed mapper register address from $4100 to $6100.
You can change bytes in ROM by addresses $1e021 and $1e198 ($41 to $61)
Also you need 74hc161 as latch and 74hc00 for signal inversion (you can use any other logic or transistor for this purpose).

PRG RAM /CE (pin30 MMC3) -> pin12+pin13 74hc00 (to invert signal)
pin11 74hc00 -> pin9 74hc161
PRG RAM +CE (pin41 MMC3) -> 150R -> pin2 74hc161
pin2 74hc161 -> 5nF -> GND (RC circuit to delay signal)
PRG D2 -> pin3 74hc161
pin14 74hc161 -> CHR A18

don't forget to connect
pin1 74hc161 -> VCC
pin7 74hc161 -> GND
pin11 74hc161 -> GND
Did everything as you wrote. I changed the addresses in ROM. A lot of glitches. The menu and pictures normally shows. Glitch combat and character selection

pakosup
Posts: 40
Joined: Mon Apr 24, 2017 10:23 pm

Re: Mapper hacking and debugging.

Post by pakosup » Wed Feb 26, 2020 6:46 am

Seems latch signal doesn't match to clock signal. If you have logic analyzer, you can check signals. Or you can choose the right capacitor.

Post Reply