GB Bootleg 32-in-1 Cart

Discussion of programming and development for the original Game Boy and Game Boy Color.
Post Reply
skaman
Posts: 88
Joined: Fri Oct 24, 2014 1:56 am

GB Bootleg 32-in-1 Cart

Post by skaman »

I picked up a GB Bootleg 32-in-1 cart in a lot. The cart lists 32 games but there's actually only 15 games on it.

ImageImage

I finally got around to dumping the cart. It uses a modified ALLEYWAY ROM as the base. The cart writes to 0x1000 to switch games so the ROM won't work properly on an emulator (the menu loads but the games won't start).

The lookup table for the 0x1000 switch is located at 0x7EE9 [1C, 1A, 18, 16, 14, 00, 10, 0E, 0C, 0A, 08, 06, 04, 02, 12, 1C, 1A, 18, 16, 14, 00, 10, 0E, 0C, 0A, 08, 06, 04, 02, 12, 1C, 1A] .

Game List:

Code: Select all

SUPER MARIO.    1C
MOTO MANIACS.   1A
LODER RUNNER.   18
BOMB JACK.      16
DR MARIO.       14
ALLEY WAY.      00
SPACE INVADER.  10
PITMAN.         0E
POP UP.         0C
BATTLE CITY.    0A
TENNIS.         08
VOLLEY FIRE.    06
TETRIS.         04
PENGUIN LAND.   02
FLIPULL.        12
MARIO WORLD.    1C
MOTO BIKE.      1A
KINKONG ESCAPE. 18
BOMBER MAN.     16
VIRUS OF GB.    14
ARKANOID.       00
STAR GATE.      10
PITBOY.         0E
WOODY POP.      0C
TANK 94.        0A
TENNIS ACE.     08
GRADIUS 3.      06
SUPER TETRIS.   04
PENGUIN EGG.    02
EASY FLIPULL.   12
MARIOLAND.      1C
HANG ON         1A
Games sorted by ROM location (shows duplicates):

Code: Select all

ALLEY WAY.      00
ARKANOID.       00
PENGUIN LAND.   02
PENGUIN EGG.    02
TETRIS.         04
SUPER TETRIS.   04
VOLLEY FIRE.    06
GRADIUS 3.      06
TENNIS.         08
TENNIS ACE.     08
BATTLE CITY.    0A
TANK 94.        0A
POP UP.         0C
WOODY POP.      0C
PITMAN.         0E
PITBOY.         0E
SPACE INVADER.  10
STAR GATE.      10
FLIPULL.        12
EASY FLIPULL.   12
DR MARIO.       14
VIRUS OF GB.    14
BOMB JACK.      16
BOMBER MAN.     16
LODER RUNNER.   18
KINKONG ESCAPE. 18
MOTO MANIACS.   1A
MOTO BIKE.      1A
HANG ON         1A
SUPER MARIO.    1C
MARIO WORLD.    1C
MARIOLAND.      1C

Code: Select all

PCB serial:  GB-32-IN-1A
Chip type:   ICT PEEL18CV8P-25 

Size:   524288
CRC32:  2EBBF037
MD5:    7190D13728F498178FE1A39AFA66AE67
SHA-1:  4BE78D3D089150C761509A801545B372D6334822
Here's the file: http://www.mediafire.com/file/iwsjyeym9 ... 2-in-1.zip
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: GB Bootleg 32-in-1 Cart

Post by lidnariq »

How does the PAL work? (I see you desoldered it)

(In general, when one has a ROM hidden under epoxy, how does one know that one dumped it in the same order as the physical ROM?)

edit: PAL pinout appears to be

Code: Select all

 nc -> |01 20| -- +5v
A14 -> |02 19| ??
 D0 -> |03 18| ??
 D1 -> |04 17| -> Aa
 D2 -> |05 16| -> Ab
 D3 -> |06 15| -> Ac
 D4 -> |07 14| -> Ad
A13 -> |08 13| -> Ae
/WR -> |09 12| ??
Gnd -- |10 11| <- A15
ROM pinout is very shuffled:
(starting at 9 o'clock: +5V Ae Ad Aa A13 A7 A5 A3 A13 /RD A10 A15 D1 D3 D5 D6 D7 Gnd D4 D2 D0 A1 A12 A11 A9 A8 A6 A4 A2 A0 Ab Ac)
skaman
Posts: 88
Joined: Fri Oct 24, 2014 1:56 am

Re: GB Bootleg 32-in-1 Cart

Post by skaman »

Good points.

I didn't desolder the PEEL chip or do anything to the PCB. I also didn't bother to trace out all of the pins.

I modified my cart reader code to dump the ROM. The dumped ROM will start in an emulator and show the menu which is in the upper addresses of the modified Alleyway ROM. Alleyway is listed sixth in the menu (also mirrored as ARKANOID later in the menu). Selecting ALLEYWAY sets 0x1000 to 0 so I took that as confirmation that the full ROM order is structured in accordance with the assignment in the lookup table.

Pictures of the front and back of the PCB are in the archive with the dump.

EDIT: I should mention if you truncate the ROM to only the modified Alleyway ROM (1st 32K) then you can select Alleyway in the menu and it will switch to the game in an emulator.
lidnariq
Posts: 11429
Joined: Sun Apr 13, 2008 11:12 am

Re: GB Bootleg 32-in-1 Cart

Post by lidnariq »

skaman wrote:I didn't desolder the PEEL chip or do anything to the PCB.
*facepalm* of course they had to remove the through-hole bits, otherwise it wouldn't fit in the shell.
I modified my cart reader code to dump the ROM. [...] Selecting ALLEYWAY sets 0x1000 to 0
Since the PAL does connect to D0, but all the values in the menu are with D0 low, it makes me wonder what writing with D0 high does.

Given that the PAL is only connected to A13, A14, /WR, and "A15", the register has to be present over the entire $0000-$1FFF range, but I also wonder if it's present anywhere else.
skaman
Posts: 88
Joined: Fri Oct 24, 2014 1:56 am

Re: GB Bootleg 32-in-1 Cart

Post by skaman »

Tauwasser made a schematic for the cart:

Image
User avatar
Tauwasser
Posts: 4
Joined: Sun Oct 05, 2014 4:49 pm

Re: GB Bootleg 32-in-1 Cart

Post by Tauwasser »

Beware I made that schematic by eye! In hindsight, I should probably have written that the ROM is COB, and not in a package.
Post Reply