Page 2 of 6

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun May 28, 2017 9:42 am
by kazblox
NewRisingSun wrote:The opposite is the case: The "CNROM version" is just a mapper hack of the TCU-02 version.
So, if the only actual Taiwanese Joy Van release of Weilaixiaozi appears to be using the TCU-02, and the mapper hack is unofficial, I guess the "GS63030-A" chips on Pongba's post represents the actual IC. Joy Van's Mahjong Trap also appears to be using the GS63030-A IC as well, but the current and ONLY dump is using CNROM and thus likely (I haven't exactly checked yet) a mapper hack.
viewtopic.php?t=2909

We REALLY need to organize our dumps, or else crap like this gets lost forever in a swarm of loose .NES files screaming "hacks, hacks, hacks. NESTIIICCCCLLEEEE!!!! copiers, copiers, hacks, hacks, hacks.".

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun May 28, 2017 10:06 am
by NewRisingSun
kazblox wrote:Joy Van's Mahjong Trap also appears to be using the GS63030-A IC as well, but the current and ONLY dump is using CNROM and thus likely (I haven't exactly checked yet) a mapper hack.
Confirmed. It starts off by writing to $4101, but then only writes to $8000-$FFFF, followed by RTS and some leftover garbage that looks similar to Mapper 136 code in Diebian. I suppose I could try to "unhack" it, but I won't, lest I would contribute to more hacks flying around.
kazblox wrote:We REALLY need to organize our dumps,
Theoretically, GoodNES would be the candidate here. Unfortunately it's so badly maintained that it's beyond useless except as a search term for torrents.

So, anyone still in contact with pongbashi?

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun May 28, 2017 10:15 am
by kazblox
NewRisingSun wrote:Unfortunately it's so badly maintained that it's beyond useless except as a search term for torrents.
And this is why I'm adding on to the Sachen stuff in the MAME softlist in private until I'm assured that the dumps are at least good and directly come from the actual ROM chips, or a Kazzo board.

MAME also does a horrible job at documenting Sachen stuff, considering that most of the knowledge in that area derives from GoodNES, but I'm planning to fix a big chunk of that. ;)

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun May 28, 2017 11:07 am
by kazblox
OK, my friend has an original Mahjong Trap cart and a Kazzo, yay! :D

If someone could write Kazzo scripts for all variants of the ASIC described in this thread, that would be great. Currently, I'm at an outing for a few hours, so I won't be able to do much.

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun May 28, 2017 11:53 am
by NewRisingSun
I have modified the CNROM dumping script for Mapper 136 (rename extension to .ad). Since I have no Kazzo, I cannot try it; just tell me if it does not work with Mahjong Trap. Mapper136 is the simple version, which should be enough according to my understanding of the IC, otherwise Mapper136a initializes all four registers.

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon May 29, 2017 2:12 pm
by Myask
kazblox wrote:Here you go:

The rest of the PCB's he has of some Sachen stuff is on his flickr page, including Rocman X (which seems to be wired up to a weird CHR ROM and CHR RAM variant, despite not showing any instance of Chinese text boxes in the game at all?)
https://www.flickr.com/photos/153392699 ... 2682439086
Needs PPU-accessible RAM to map four nametables. I keep reading that it's one of those that do, but now that we've got someone with the board handy, we should make sure…

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon May 29, 2017 4:53 pm
by lidnariq
Myask wrote:[Sachen's Rocman X] Needs PPU-accessible RAM to map four nametables. I keep reading that it's one of those that do, but now that we've got someone with the board handy, we should make sure…
The PCB pictures are good enough to successfully trace the 6264's /CE pin to the NOT PPU A13 signal on the card edge, so that's something.

Re: Sachen TCU-02 (Mapper 136)

Posted: Fri Dec 01, 2017 8:26 pm
by NewRisingSun
Rewriting yesterday's remarks now that all Idea-Tek games except for Venice Beach Volleyball have been redumped. These games share a similar IC (with different markings) as the one described for Mapper 36. But they are connected in different ways.

Mapper 173
This board connects the IC's data bits four bits rotated from the Mapper 36 description, so $4103's Mode bit is at bit 0, not at bit 4. $4102's D0 (IC Pin 3) is CHR A13, but $4102's D1 is NOT CHR A14. I cannot quite see which pin of the IC is connected to CHR A14 (I'd say Pin 4 or Pin 22), as the lead goes under the chip, but CHR A14 is always the inverse of the IC's XOR flag, e.g. a XOR flag of 1 selects CHR banks 0 and 1, while a XOR flag of 0 selects CHR banks 2 and 3, regardless of everything else. $4102's D3 must be latched to yield the expected $4100 read value.

小瑪琍 (Xiǎo Mǎlí, Nei-Hu and TXC versions): The GoodNES dumps have only 8 KiB of CHR-ROM. It turns out that the game actually has 32 KiB CHR-ROM, with the first two banks empty, and the second two banks identical. Normally, this would be considered an overdump. In this case, it's part of the copy protection: The game flips $4102 D1 all of the time but always keeps the XOR flag at 0, so CHR banks 2 and 3 are always selected. Incorrect emulation will cause the empty CHR banks 0 or 1 to be selected when D1 goes low. This applies to both the Nei-Hu and TXC versions. Additionally, the Nei-Hu version checks that the value read from $4100 has the correct post-adder value, otherwise PPU rendering is turned off. The C&E version on the other hand is simple NROM with no protection.

F15 City War/Puzzle (original Idea-Tek releases): Both use four CHR banks. In accordance with the above description, their bankswitching code uses a XOR flag of 1 for banks 0 and 1, and a XOR flag of 0 for banks 2 and 3. Puzzle is the only game that writes a value other than $00 or $FF to $4101: a value of $01. Given the $4100 result it expects, $4101 value $01 seems to still invert the entire byte written to $4102, so $4101 seems to be a "XOR $FF", or "invert" flag register rather than a XOR value register. $4102 D3 is expected to be latched rather than return zero or open bus.

撲克精靈 (Poker Jīnglíng): The same, except that this game for some odd reason also has a Mapper 3 compatibility write, so our redump matched GoodNES' dump, which we had believed to be a Mapper 3 hack. It will not run as Mapper 3 on emulators that emulate bus conflicts (such as FCEUX) though, nor will it run on a Nintendo CNROM board, for the same reason.

Mapper 136
Identical to Mapper 173, except that $4102's D1 is in fact CHR A14, allowing all four banks to be selected independently of the XOR flag value. Also unlike Mapper 173, $4100's D3 is expected to always be low even if a high value was written to $4102's D3. This may be the result of the adder being four bits rather then three bits wide, as I believed before and wrote yesterday, or more likely the result of D3 just not being connected and returning open bus (which would be zero if the address is $4100).

四川麻將 (Sìchuān Mahjong, aka Mahjong Trap), 蝶變 (Diébiàn, aka Incantation, aka Galactic Crusader), 未来小子 (Wèilái Xiǎozi, aka Joy Van Kid, aka Metal Fighter µ): The original Joy Van releases of those games use this mapper, checking not only the adder result, but that $4100 D3 reads back clear even when previously written with D3 set.

Rad Racket (TXC version): We dumped this cart with all four banks at the same XOR flag value, indicating that the board we used for dumping is Mapper 136, not Mapper 173. Yet the game's bankswitching code still uses a XOR flag of 1 for banks 0 and 1, and a XOR flag of 0 for banks 2 and 3, so it's obviously written to be compatible both with Mappers 136 and 173.

麻将方块 (Mahjong Block, TXC re-release, CRC32 0ACFC3CD): The current GoodNES dump of Mahjong Block is set to Mapper 173, which cannot be right because the game uses the same XOR flag value for all four CHR banks, which makes it Mapper 136. This GoodNES dump must be a TXC re-release of the game, even though the Super Mega copyright is retained on the title screen, as the actual Super Mega release, with a PCB that says Super Mega, uses Mapper 172 instead. It's not uncommon that TXC would re-release games without removing the original copyright --- the early TXC re-release of Xiǎo Mǎlí retains the Nei-Hu copyright, and the TXC re-release of Rad Racket retains the American Video Entertainment licensee.

Mapper 172
This board is used by 1991 賭馬 Racing and the original Super Mega release of 麻将方块 (Mahjong Block). It may have been used on the Super Mega Release of Venice Beach Volleyball (the current dump of which is a Mapper 3 hack). It is similar to Mapper 136 except that the IC's data bits are rotated by four bits, and are thus similar to Mapper 36, and that the CHR bits are reversed. In the end, §4102's D4 is CHR A14, and $4102's D5 is CHR A13. Games using this mapper take the desired bank number and reverse its bit order in software by using six LSR/ROL opcode pairs before writing it to $4102.

Mapper 132
Like Mapper 36 except that D0 is CHR A13, D1 is CHR A14, D2 is PRG A15. Used by 戰國四川省 (Zhànguó Sìchuān Shěng, aka Tiles of Fate) from C&E, Creatom and 棋王 (Qíwáng).

Why did Joy Van and one C&E game use an Idea-Tek mapper? Because Idea-Tek was founded by former Joy Van employees, and C&E's Tiles of Fate was initially distributed by Idea-Tek.

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun Dec 17, 2017 2:29 pm
by NewRisingSun
Here are PCB images of the original Idea-Tek release of F-15 City War, emulated as Mapper 173 according to the above description. Credit to MLX for opening his cartridge and taking the pictures.

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun Dec 17, 2017 2:37 pm
by lidnariq
That's a particularly persuasive job of deceptive marks on the IC. "20V8-10LP" strongly implies a specific programmable logic... but then pin 12 would have to be ground, and pins 2 and 3 would have to be inputs (and they instead go to CHR A13 and A14) pin 3 would have to be an input to be a PAL, and it instead goes to CHR A13.

Re: Sachen TCU-02 (Mapper 136)

Posted: Sun Dec 17, 2017 5:02 pm
by lidnariq
You know what's really funny? I just sat down and tried to trace the pinout of that IC.

It's almost the same as the pinout of the 05-00002-010 ASIC:

pins 1-12:
??
CHR A15
CHR A13
??
+5
??
+5
Gnd
CPU D3
CPU D2
CPU D1
CPU D0

Pins 13-21 appear to be the same as on the mapper 36 page.

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon Dec 18, 2017 11:47 am
by NewRisingSun
That's not quite what I see. I get:

Code: Select all

Pin Meaning
1   Unconnected
2   Connects to a pad that can lead +5V or not; for this cartridge, the connection is not made. Must be a configuration pin of some sort.
3   CHR A13
4   Unconnected
5   +5V
6   Unconnected
7   Connected to Pin 5, +5V
8   PRG CE
9   CPU D3
10  CPU D2
11  CPU D1
12  CPU D0
13  CPU A0
14  CPU A1
15  CPU A8
16  M2
17  CPU ROMSEL
18  Cannot see where this is going.
19  GND
20  CPU A14
21  CPU A13
22  *maybe* CHR A14
23  Unconnected
24  Unconnected
Here is how far I came in my amateurish tracing attempt using crayons (so to speak).

If you want to take out your mapper 36 cartridge, you should find that a XOR value of FF should lower the "defective" pin 22, while a XOR value of 00 should raise it. If that is so, then Pin 22 is definitely CHR A14 on F-15 City War and Xiao Mali, otherwise I'm wrong.

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon Dec 18, 2017 12:06 pm
by lidnariq
NewRisingSun wrote:2 Connects to a solder pad that can be +5V or not; for this cartridge, the connection is not made. Must be a configuration pin of some sort.
My bet is that that solderable jumper configures whether pin 1 of CHR ROM is connected to +5V or pin 2 of the ASIC.
8 PRG CE
Definitely not. PRG pin 20 is grounded (look at the via on the far left side of F15CityWarBack). /ROMSEL must go to PRG pin 22.
22 *maybe* CHR A14
I agree that topologically, CHR A14 could only go to 22 or 23.
If you want to take out your mapper 36 cartridge, you should find that a XOR value of FF should lower the "defective" pin 22, while a XOR value of 00 should raise it.
Pin 22 was always high; various values written caused it to switch between "sourcing more current" and "sourcing less current" when directly connected to a white LED to ground.

Getting the test clips onto my cart again is enough of a pain I'd prefer to not do so again, but I believe it was accurate to say that much as pin 23 ultimately relayed values from pin 6, pin 22 (had it not been defective) would have relayed values from pin 8 (or maybe pin 9?).

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon Dec 18, 2017 12:14 pm
by NewRisingSun
Either way, based on the game's code, CHR A14 must be the inverse of the XOR value.
My bet is that that solderable jumper configures whether pin 1 of CHR ROM is connected to +5V or pin 2 of the ASIC.
What would be the point of pulling pin 28 of the CHR chip low?

Re: Sachen TCU-02 (Mapper 136)

Posted: Mon Dec 18, 2017 12:22 pm
by lidnariq
NewRisingSun wrote:What would be the point of pulling pin 28 of the CHR chip low?
You're reading the solder jumper wrong:
solder-jumper.png
solder-jumper.png (573 Bytes) Viewed 8894 times
Depending on which pad is shorted, either X connects to Z, or Y connects to Z. (You don't short both and expect things to work afterwards)

On the F15 City War pictures you showed, "X" is +5V, "Y" is ASIC pin 2, and my hunch is that "Z" is pin 1 of the CHR, or A15.