It is currently Sat May 27, 2017 7:58 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 8 posts ] 
Author Message
PostPosted: Fri May 19, 2017 10:51 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 195
This mapper is used by two games:
  • 蝶變 (Diébiàn, in most ROM sets nonsensically rendered in Japanese as "Chou Hen"), the original Joy Van version of Galactic Crusader, overall CRC32 B550B627
  • 未来小子 (Wèilái Xiǎozi), the original Joy Van version of Metal Fighter µ, overall CRC32 CEC28502

The unaltered ROM image of Diébiàn can be found as "Incantation (Dip Bin) (Joy Van)" in GoodNES v3.23b and is incorrectly set to Mapper 146, causing it to reset when pressing Start because of a simple copy protection.

FCEUX and Nestopia use the value written to $4102 plus three as the 8K CHR ROM bank. That is good enough for Wèilái Xiǎozi, but not for Diébiàn. The actual bank seems to be not $4102 plus a fixed "plus three", but "plus number of previous $4100 writes since the last $4101 write", which just happens to be three in the case of Wèilái Xiǎozi. Attached find a Nintendulator Mapper source file which runs both games in their unaltered form.


Attachments:
mapper136.cpp [1.47 KiB]
Downloaded 12 times
Top
 Profile  
 
PostPosted: Fri May 19, 2017 11:35 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5702
Location: Seattle
... That sounds extremely similar, but not identical, to how I discovered that Mapper 36 actually works.


Top
 Profile  
 
PostPosted: Fri May 19, 2017 4:29 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 261
viewtopic.php?f=9&t=15302

HI,NewRisingSun , help me,thank you.


Top
 Profile  
 
PostPosted: Sat May 27, 2017 11:04 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 195
I have updated my Mapper 136 source file on the assumption that it's like Mapper 36, only with CHR. Before, I was applying the RR value to CHR immediately after any $4100-$4103 write, instead of waiting for the $8000-$FFFF write. (This would obviously be fatal for a PRG switch.) Diébiàn and Wèilái Xiǎozi both indeed finish their bankswitching code with a write to $FFFF, which mystified me before I learned about Mapper 36.

If Mapper 36 did not have that simplified CHR ROM switch at $4200, one could maybe even have merged mappers 36 and 136. While the "start RR" value for PRG is loaded into bits 4 and 5 of $4102 in Mapper 36, the "start RR" value for CHR is loaded into bits 0 and 1 of $4102 in Mapper 136.

Edit: Forgot a break in a switch statement.


Attachments:
mapper136.cpp [1.7 KiB]
Not downloaded yet


Last edited by NewRisingSun on Sat May 27, 2017 11:39 am, edited 2 times in total.
Top
 Profile  
 
PostPosted: Sat May 27, 2017 11:31 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5702
Location: Seattle
Even if the ASIC is the same, the connections to the card edge look like they'll differ in an incompatible way...

But, yeah, I'll take a look at what the other three lines were intended to be. Since both Policeman and Strike Wolf include that write to $4101 I really have to wonder if i made an experimental error in claiming that writes to $4101 had no visible effect, or if it's a difference between the upper and lower nybbles of the IC, or if it's just a different IC altogether.


Top
 Profile  
 
PostPosted: Sat May 27, 2017 1:51 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 195
Debugging Pūkè Jīnglíng (the original version of Peek-a-Boo Poker), it seems that $4101 is a XOR mask that is applied to the value written to $4102 afterwards. I noticed that when I set that game to Mapper 136, my previous emulation selected the correct CHR bank when 00 was written to $4101, and the wrong CHR bank when FF was written to $4101, and the code does EOR the bank number in a similar fashion when writing FF to $4101. Attached find another update to Mapper136.cpp that incorporates this change.

With this $4101 behavior emulated, Pūkè Jīnglíng now runs at mapper 136 as well, though it also had CNROM compatibility code (provided that the CNROM emulation did NOT emulate bus conflicts). The game also writes to $4104, but as I understand the board's address mask, that should just be an alias for $4100 (it writes to $4104 in "direct CHR" mode and to $4104 in "CHR increment" mode). The same applies to the initial AVE release of F-15 City War (overall CRC32 88A6B192), though the address mask before comparison needs to be $E123 rather than $E103 (so that $4120 is NOT an alias for $4100), otherwise the NINA-03 compatibility write will interfere. (That particular ROM is strange --- it reads from $4100 to check if the current register has the correct value, quite similar to the Diébiàn/Wèilái Xiǎozi, but then ignores the result. I wonder if AVE just hacked the NINA-03 compatibility code into the mapper 136-targeted ROM image?)

Can you check whether writing FF to $4101 has a similar effect on the Mapper 36 board?

Edit: I noticed that this $4101-aware emulation of Mapper 136 also covers all games (Xiǎo Mǎlí Nei-Hu version, Mahjong Block Super Mega version) of Mapper 173, including the protection. It seems like FCEUX' mapper 173 emulation is a special case emulation for two games, whereas Mapper 136 as described is the general case, as Diébiàn and Wèilái Xiǎozi do not work under Mapper 173.

Mapper 172 (that silly Horse Racing game)'s protection read is passed as well, but the CHR bank is visibly wrong. Apparently, that game uses bits 4 and 5 instead of bits 0 and 1 for the CHR bank number, and messes up the order a bit. Probably the same IC but connected differently. Lastly, there is also Mapper 132 (Qiwang), which uses bits 0 and 1 for CHR, and bits 2 and 3 for PRG bank. Again, probably just a case of connecting the same IC in a different way.


Attachments:
mapper136.cpp [1.78 KiB]
Downloaded 2 times


Last edited by NewRisingSun on Sat May 27, 2017 2:47 pm, edited 7 times in total.
Top
 Profile  
 
PostPosted: Sat May 27, 2017 2:05 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 18361
Location: NE Indiana, USA (NTSC)
Image
I'd say look at the source code.

Oh wait: Now I see it. The name "Diébiàn" must be some off-brand knockoff without any sort of free software guidelines.


Top
 Profile  
 
PostPosted: Sat May 27, 2017 4:19 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 5702
Location: Seattle
NewRisingSun wrote:
I wonder if AVE just hacked the NINA-03 compatibility code into the mapper 136-targeted ROM image?)
Almost guaranteed.

Quote:
Can you check whether writing FF to $4101 has a similar effect on the Mapper 36 board?
The answer is "ew".

Doing my best to augment the contents of the m36 wiki page for what the full IC seems to do:
Code:
read $4100-$4103: [.RRR .XXX] - shows internal state; XXX←CCC⊕xxx
write $4100: When M=0, copy (PPP⊕yyy) to RRR; when M=1, RRR++ and also CCC++
write $4101: [.xxx .yyy] - XOR values
write $4102: [.PPP .CCC] - request 32 KiB PRG and 8KiB CHR
write $4103: [...M ....] - load-vs-increment mode (yes, still the upper nybble only)
write $8000-$FFFF: copy RRR and XXX to PRG and CHR banking pins


Take my results with a huge grain of salt... only pin 23 acts like CHR A13; pin 22 is always high no matter what I write. It could well be that this instantiation of the IC is buggy, which is why this PCB adds a 74'138 and 74'175. I can see the amount of current being sourced out of pin 22 changing (LED is changing brightness) depending on values written.

Pin 24 is really daft: you can only toggle it by loading the right value into RRR, and incrementing it until PRG A18 toggles. I haven't yet found a way to set it to a known value.

The full intended pinout seems to be
Code:
                .--\/--.
     PRG A17 <- |01  24| -> PRG A18 (yes really)
     PRG A16 <- |02  23| -> CHR A13
     PRG A15 <- |03  22| -> always high
         GND ?? |04  21| <- CPU A13 (rn)
          5V ?? |05  20| <- CPU A14 (rn)
      CPU D0 <> |06  19| ?? GND
          5V ?? |07  18| <- CPU R/W (n)
      CPU D1 <> |08  17| <- /ROMSEL (rn)
      CPU D2 <> |09  16| <- M2 (n)
      CPU D6 <> |10  15| <- CPU A8 (rn)
                :      :


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group