It is currently Mon Nov 12, 2018 5:41 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 81 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6  Next
Author Message
PostPosted: Sun May 28, 2017 9:42 am 
Offline

Joined: Thu Feb 23, 2017 2:27 pm
Posts: 34
NewRisingSun wrote:
The opposite is the case: The "CNROM version" is just a mapper hack of the TCU-02 version.

So, if the only actual Taiwanese Joy Van release of Weilaixiaozi appears to be using the TCU-02, and the mapper hack is unofficial, I guess the "GS63030-A" chips on Pongba's post represents the actual IC. Joy Van's Mahjong Trap also appears to be using the GS63030-A IC as well, but the current and ONLY dump is using CNROM and thus likely (I haven't exactly checked yet) a mapper hack.
viewtopic.php?t=2909

We REALLY need to organize our dumps, or else crap like this gets lost forever in a swarm of loose .NES files screaming "hacks, hacks, hacks. NESTIIICCCCLLEEEE!!!! copiers, copiers, hacks, hacks, hacks.".


Top
 Profile  
 
PostPosted: Sun May 28, 2017 10:06 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
kazblox wrote:
Joy Van's Mahjong Trap also appears to be using the GS63030-A IC as well, but the current and ONLY dump is using CNROM and thus likely (I haven't exactly checked yet) a mapper hack.
Confirmed. It starts off by writing to $4101, but then only writes to $8000-$FFFF, followed by RTS and some leftover garbage that looks similar to Mapper 136 code in Diebian. I suppose I could try to "unhack" it, but I won't, lest I would contribute to more hacks flying around.
kazblox wrote:
We REALLY need to organize our dumps,
Theoretically, GoodNES would be the candidate here. Unfortunately it's so badly maintained that it's beyond useless except as a search term for torrents.

So, anyone still in contact with pongbashi?


Top
 Profile  
 
PostPosted: Sun May 28, 2017 10:15 am 
Offline

Joined: Thu Feb 23, 2017 2:27 pm
Posts: 34
NewRisingSun wrote:
Unfortunately it's so badly maintained that it's beyond useless except as a search term for torrents.

And this is why I'm adding on to the Sachen stuff in the MAME softlist in private until I'm assured that the dumps are at least good and directly come from the actual ROM chips, or a Kazzo board.

MAME also does a horrible job at documenting Sachen stuff, considering that most of the knowledge in that area derives from GoodNES, but I'm planning to fix a big chunk of that. ;)


Top
 Profile  
 
PostPosted: Sun May 28, 2017 11:07 am 
Offline

Joined: Thu Feb 23, 2017 2:27 pm
Posts: 34
OK, my friend has an original Mahjong Trap cart and a Kazzo, yay! :D

If someone could write Kazzo scripts for all variants of the ASIC described in this thread, that would be great. Currently, I'm at an outing for a few hours, so I won't be able to do much.


Top
 Profile  
 
PostPosted: Sun May 28, 2017 11:53 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
I have modified the CNROM dumping script for Mapper 136 (rename extension to .ad). Since I have no Kazzo, I cannot try it; just tell me if it does not work with Mahjong Trap. Mapper136 is the simple version, which should be enough according to my understanding of the IC, otherwise Mapper136a initializes all four registers.


Attachments:
Mapper136a.txt [615 Bytes]
Downloaded 100 times
mapper136.txt [477 Bytes]
Downloaded 100 times
Top
 Profile  
 
PostPosted: Mon May 29, 2017 2:12 pm 
Offline
User avatar

Joined: Sat Jul 12, 2014 3:04 pm
Posts: 965
kazblox wrote:
Here you go:

The rest of the PCB's he has of some Sachen stuff is on his flickr page, including Rocman X (which seems to be wired up to a weird CHR ROM and CHR RAM variant, despite not showing any instance of Chinese text boxes in the game at all?)
https://www.flickr.com/photos/153392699 ... 2682439086

Needs PPU-accessible RAM to map four nametables. I keep reading that it's one of those that do, but now that we've got someone with the board handy, we should make sure…


Top
 Profile  
 
PostPosted: Mon May 29, 2017 4:53 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7714
Location: Seattle
Myask wrote:
[Sachen's Rocman X] Needs PPU-accessible RAM to map four nametables. I keep reading that it's one of those that do, but now that we've got someone with the board handy, we should make sure…
The PCB pictures are good enough to successfully trace the 6264's /CE pin to the NOT PPU A13 signal on the card edge, so that's something.


Top
 Profile  
 
PostPosted: Fri Dec 01, 2017 8:26 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
Rewriting yesterday's remarks now that all Idea-Tek games except for Venice Beach Volleyball have been redumped. These games share a similar IC (with different markings) as the one described for Mapper 36. But they are connected in different ways.

Mapper 173
This board connects the IC's data bits four bits rotated from the Mapper 36 description, so $4103's Mode bit is at bit 0, not at bit 4. $4102's D0 (IC Pin 3) is CHR A13, but $4102's D1 is NOT CHR A14. I cannot quite see which pin of the IC is connected to CHR A14 (I'd say Pin 4 or Pin 22), as the lead goes under the chip, but CHR A14 is always the inverse of the IC's XOR flag, e.g. a XOR flag of 1 selects CHR banks 0 and 1, while a XOR flag of 0 selects CHR banks 2 and 3, regardless of everything else. $4102's D3 must be latched to yield the expected $4100 read value.

小瑪琍 (Xiǎo Mǎlí, Nei-Hu and TXC versions): The GoodNES dumps have only 8 KiB of CHR-ROM. It turns out that the game actually has 32 KiB CHR-ROM, with the first two banks empty, and the second two banks identical. Normally, this would be considered an overdump. In this case, it's part of the copy protection: The game flips $4102 D1 all of the time but always keeps the XOR flag at 0, so CHR banks 2 and 3 are always selected. Incorrect emulation will cause the empty CHR banks 0 or 1 to be selected when D1 goes low. This applies to both the Nei-Hu and TXC versions. Additionally, the Nei-Hu version checks that the value read from $4100 has the correct post-adder value, otherwise PPU rendering is turned off. The C&E version on the other hand is simple NROM with no protection.

F15 City War/Puzzle (original Idea-Tek releases): Both use four CHR banks. In accordance with the above description, their bankswitching code uses a XOR flag of 1 for banks 0 and 1, and a XOR flag of 0 for banks 2 and 3. Puzzle is the only game that writes a value other than $00 or $FF to $4101: a value of $01. Given the $4100 result it expects, $4101 value $01 seems to still invert the entire byte written to $4102, so $4101 seems to be a "XOR $FF", or "invert" flag register rather than a XOR value register. $4102 D3 is expected to be latched rather than return zero or open bus.

撲克精靈 (Poker Jīnglíng): The same, except that this game for some odd reason also has a Mapper 3 compatibility write, so our redump matched GoodNES' dump, which we had believed to be a Mapper 3 hack. It will not run as Mapper 3 on emulators that emulate bus conflicts (such as FCEUX) though, nor will it run on a Nintendo CNROM board, for the same reason.

Mapper 136
Identical to Mapper 173, except that $4102's D1 is in fact CHR A14, allowing all four banks to be selected independently of the XOR flag value. Also unlike Mapper 173, $4100's D3 is expected to always be low even if a high value was written to $4102's D3. This may be the result of the adder being four bits rather then three bits wide, as I believed before and wrote yesterday, or more likely the result of D3 just not being connected and returning open bus (which would be zero if the address is $4100).

四川麻將 (Sìchuān Mahjong, aka Mahjong Trap), 蝶變 (Diébiàn, aka Incantation, aka Galactic Crusader), 未来小子 (Wèilái Xiǎozi, aka Joy Van Kid, aka Metal Fighter µ): The original Joy Van releases of those games use this mapper, checking not only the adder result, but that $4100 D3 reads back clear even when previously written with D3 set.

Rad Racket (TXC version): We dumped this cart with all four banks at the same XOR flag value, indicating that the board we used for dumping is Mapper 136, not Mapper 173. Yet the game's bankswitching code still uses a XOR flag of 1 for banks 0 and 1, and a XOR flag of 0 for banks 2 and 3, so it's obviously written to be compatible both with Mappers 136 and 173.

麻将方块 (Mahjong Block, TXC re-release, CRC32 0ACFC3CD): The current GoodNES dump of Mahjong Block is set to Mapper 173, which cannot be right because the game uses the same XOR flag value for all four CHR banks, which makes it Mapper 136. This GoodNES dump must be a TXC re-release of the game, even though the Super Mega copyright is retained on the title screen, as the actual Super Mega release, with a PCB that says Super Mega, uses Mapper 172 instead. It's not uncommon that TXC would re-release games without removing the original copyright --- the early TXC re-release of Xiǎo Mǎlí retains the Nei-Hu copyright, and the TXC re-release of Rad Racket retains the American Video Entertainment licensee.

Mapper 172
This board is used by 1991 賭馬 Racing and the original Super Mega release of 麻将方块 (Mahjong Block). It may have been used on the Super Mega Release of Venice Beach Volleyball (the current dump of which is a Mapper 3 hack). It is similar to Mapper 136 except that the IC's data bits are rotated by four bits, and are thus similar to Mapper 36, and that the CHR bits are reversed. In the end, §4102's D4 is CHR A14, and $4102's D5 is CHR A13. Games using this mapper take the desired bank number and reverse its bit order in software by using six LSR/ROL opcode pairs before writing it to $4102.

Mapper 132
Like Mapper 36 except that D0 is CHR A13, D1 is CHR A14, D2 is PRG A15. Used by 戰國四川省 (Zhànguó Sìchuān Shěng, aka Tiles of Fate) from C&E, Creatom and 棋王 (Qíwáng).

Why did Joy Van and one C&E game use an Idea-Tek mapper? Because Idea-Tek was founded by former Joy Van employees, and C&E's Tiles of Fate was initially distributed by Idea-Tek.


Top
 Profile  
 
PostPosted: Sun Dec 17, 2017 2:29 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
Here are PCB images of the original Idea-Tek release of F-15 City War, emulated as Mapper 173 according to the above description. Credit to MLX for opening his cartridge and taking the pictures.


Attachments:
F15CityWarFront.jpg
F15CityWarFront.jpg [ 488.98 KiB | Viewed 1852 times ]
F15CityWarBack.jpg
F15CityWarBack.jpg [ 678.35 KiB | Viewed 1852 times ]
Top
 Profile  
 
PostPosted: Sun Dec 17, 2017 2:37 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7714
Location: Seattle
That's a particularly persuasive job of deceptive marks on the IC. "20V8-10LP" strongly implies a specific programmable logic... but then pin 12 would have to be ground, and pins 2 and 3 would have to be inputs (and they instead go to CHR A13 and A14) pin 3 would have to be an input to be a PAL, and it instead goes to CHR A13.


Last edited by lidnariq on Sun Dec 17, 2017 2:46 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sun Dec 17, 2017 5:02 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7714
Location: Seattle
You know what's really funny? I just sat down and tried to trace the pinout of that IC.

It's almost the same as the pinout of the 05-00002-010 ASIC:

pins 1-12:
??
CHR A15
CHR A13
??
+5
??
+5
Gnd
CPU D3
CPU D2
CPU D1
CPU D0

Pins 13-21 appear to be the same as on the mapper 36 page.


Top
 Profile  
 
PostPosted: Mon Dec 18, 2017 11:47 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
That's not quite what I see. I get:
Code:
Pin Meaning
1   Unconnected
2   Connects to a pad that can lead +5V or not; for this cartridge, the connection is not made. Must be a configuration pin of some sort.
3   CHR A13
4   Unconnected
5   +5V
6   Unconnected
7   Connected to Pin 5, +5V
8   PRG CE
9   CPU D3
10  CPU D2
11  CPU D1
12  CPU D0
13  CPU A0
14  CPU A1
15  CPU A8
16  M2
17  CPU ROMSEL
18  Cannot see where this is going.
19  GND
20  CPU A14
21  CPU A13
22  *maybe* CHR A14
23  Unconnected
24  Unconnected
Here is how far I came in my amateurish tracing attempt using crayons (so to speak).

If you want to take out your mapper 36 cartridge, you should find that a XOR value of FF should lower the "defective" pin 22, while a XOR value of 00 should raise it. If that is so, then Pin 22 is definitely CHR A14 on F-15 City War and Xiao Mali, otherwise I'm wrong.


Top
 Profile  
 
PostPosted: Mon Dec 18, 2017 12:06 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7714
Location: Seattle
NewRisingSun wrote:
2 Connects to a solder pad that can be +5V or not; for this cartridge, the connection is not made. Must be a configuration pin of some sort.
My bet is that that solderable jumper configures whether pin 1 of CHR ROM is connected to +5V or pin 2 of the ASIC.
Quote:
8 PRG CE
Definitely not. PRG pin 20 is grounded (look at the via on the far left side of F15CityWarBack). /ROMSEL must go to PRG pin 22.
Quote:
22 *maybe* CHR A14
I agree that topologically, CHR A14 could only go to 22 or 23.

Quote:
If you want to take out your mapper 36 cartridge, you should find that a XOR value of FF should lower the "defective" pin 22, while a XOR value of 00 should raise it.
Pin 22 was always high; various values written caused it to switch between "sourcing more current" and "sourcing less current" when directly connected to a white LED to ground.

Getting the test clips onto my cart again is enough of a pain I'd prefer to not do so again, but I believe it was accurate to say that much as pin 23 ultimately relayed values from pin 6, pin 22 (had it not been defective) would have relayed values from pin 8 (or maybe pin 9?).


Top
 Profile  
 
PostPosted: Mon Dec 18, 2017 12:14 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 691
Either way, based on the game's code, CHR A14 must be the inverse of the XOR value.

Quote:
My bet is that that solderable jumper configures whether pin 1 of CHR ROM is connected to +5V or pin 2 of the ASIC.
What would be the point of pulling pin 28 of the CHR chip low?


Top
 Profile  
 
PostPosted: Mon Dec 18, 2017 12:22 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7714
Location: Seattle
NewRisingSun wrote:
What would be the point of pulling pin 28 of the CHR chip low?
You're reading the solder jumper wrong:
Attachment:
solder-jumper.png
solder-jumper.png [ 573 Bytes | Viewed 1752 times ]

Depending on which pad is shorted, either X connects to Z, or Y connects to Z. (You don't short both and expect things to work afterwards)

On the F15 City War pictures you showed, "X" is +5V, "Y" is ASIC pin 2, and my hunch is that "Z" is pin 1 of the CHR, or A15.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 81 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: Gilbert and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group