It is currently Fri Dec 15, 2017 3:27 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Tue Jun 20, 2017 3:31 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
In case anyone would like to rev-en. Unfortunately those photos are not mine, I waited half of year for one man to take them for me.

Top:
Image Image Image Image Image Image Image Image Image Image Image Image Image

Bottom:
Image Image Image Image Image Image Image Image Image Image Image Image

Shell:
Image Image Image Image Image Image Image Image Image Image


Last edited by krzysiobal on Sun Oct 22, 2017 4:17 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Tue Jun 20, 2017 3:45 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 362
this mapper 106,two version dumped rom.


Top
 Profile  
 
PostPosted: Tue Jun 20, 2017 4:07 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6526
Location: Seattle
Parts:
74LS161 74LS04 74LS670 74LS32
74LS161 74LS670 74LS670 23C1024
74LS74 74LS670 74LS374
74LS74 74LS32 74LS374
74LS138
74LS20 74LS157 GM76C88 23C1024 23C1024
4040 74LS86
74LS393 74LS00
74LS32 74LS74 74LS32 74LS08

Findings:
Presence of 4040 and 76C88 means this is not a N108 clone. There is some kind of IRQ source (the 4040) and PRG RAM (the 76C88)

Edit: Summarizing FCEUX's mapper 106 code:
Register mask: $800F.
Writes to $8000 through $8007: Set eight 1 KiB CHR banks. Bottom four banks deny use of LSbit, like MMC3, but allow upper 7 bits to be set differently.
Writes to $8008 through $800B: Set four 8 KiB PRG banks. Banks at $8000 (reg $8008) and $E000 (reg $800B) force $10s bit high.
Write to $800C: Identical to MMC3 $A000 mirroring control
Write to $800D: Acknowledge and disable IRQ
Write to $800E: Set upper byte of 16-bit terminal count
Write to $800F: Set lower byte of 16-bit terminal count, and enable counter. Counts M2 cycles.

I'm not entirely convinced the enumerated parts match the functional description. I don't think I see enough possible simple logic to compare every bit of the 4040's output against latches.


Top
 Profile  
 
PostPosted: Mon Jun 26, 2017 11:23 am 
Offline

Joined: Tue Apr 04, 2017 7:21 am
Posts: 7
That is awesome AF


Top
 Profile  
 
PostPosted: Fri Sep 01, 2017 5:03 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
I got the mapper 106 SMB3 version:
Image Image Image Image Image

Probably the one from first post is unmodified SMB3.


Top
 Profile  
 
PostPosted: Fri Sep 01, 2017 10:48 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 362
this mapper 106 or 56


Top
 Profile  
 
PostPosted: Sat Sep 02, 2017 3:47 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
zxbdragon wrote:
this mapper 106 or 56

Yes, this is mapper 106. This version works only in NTSC/Dendy mode.
What is mapper 56, as FCEUX does not have it implemented?


Top
 Profile  
 
PostPosted: Sat Sep 02, 2017 4:03 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 362
mapper 56 is KAISER_KS7022C or KAISER_KS202

ines or nes 2.0 is Chicken ribs!


Top
 Profile  
 
PostPosted: Fri Oct 20, 2017 1:07 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
After a lot of days spend on rev-in this based only on those diffrent angle photos, I got the following results, but I would like to ask for help rev-ing out the interrupt part as not all connections are probably OK (other parts are 100% certain)
Image Image Image

PRG banking, CHR banking, mirroring works exactly the same way like in MMC3 (which is really rare), with the exception that bit 7 and bit 6 of bank select register are trated as if b7=0 (CHR A12 inversion off) and b6=1 ($C000-$DFFF swappable, $8000-$9FFF fixed to second-last bank), but I think original SMB3 always uses the configuration above. (I dont have access to ROM of this bootleg so I don't have idea if the game was modified and how much). I think that probably the game was not modified at all, that's why the mapper is so much similar to MMC3.

Now the tricky part - interrupts and counters. This probably does not work in the same way as in MMC3 because there is only one 8 bit counter (2x74191) which is both preloaded and counted down. But again, as I have observed, original SMB3 preloads IRQ counter every frame in NMI.

I have doubts if all connections of interrupt part are OK (other parts are 100% ok).
Except those 2x74191 there is 4040 and 2x74393. Outputs of 4040 are connected to inputs of 7420 (those connections are certain).

I don't even know what is clocking this bootleg's counter. There is one modification on this PCB:
Image

So they put R+C instead on PPU-!A12 (probably some kind of filter, maybe they wanted to filter out those 8 consecutive edges on PPU_A12) - i dont know value of C, only R can be read.

Next modification is cut trace on IC3A input 5 (probably slight change in prescaling)

However, this filtered PPU-!A12 does not seem to be clocking the unit, it's probably ANDED with cpu-romsel (inverted cpu-!romsel from the connector) but this is not 100% sure as critical tracks are under chips and only deduction is available.


Top
 Profile  
 
PostPosted: Fri Oct 20, 2017 1:38 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6526
Location: Seattle
krzysiobal wrote:
There is one modification on this PCB [...] So they put R+C instead on PPU-!A12 (probably some kind of filter, maybe they wanted to filter out those 8 consecutive edges on PPU_A12) - i dont know value of C, only R can be read.
That's a highpass filter, not a lowpass filter. Wouldn't be suitable for filtering a PPU signal to generate a clock per scanline.

Quote:
However, this filtered PPU-!A12 does not seem to be clocking the unit, it's probably ANDED with cpu-romsel (inverted cpu-!romsel from the connector)
I can't fathom any reason to AND /PPUA12 with /ROMSEL. The phase from sprite tile fetch to the next will end up clocking the counter one or two times:
Code:
/PPUA12 ~~~~~~~~~~~~____~~~~____~~~~____~~~~
/ROMSEL ~__~__~__~__~__~__~__~__~__~__~__~__
    AND ~__~__~__~________~_____~__~_____~__
... maybe there's something clever such that that always ends up the same integer, and not 113+2/3 ?

I can't figure out how the half of the 74'393 that you've labelled IC1A would ever let the '4040 run at all. (Every 8 clocks it'd clear the '4040?)

Could you annotate over the IRQ section of your schematic what parts you're confident of vs not?


Top
 Profile  
 
PostPosted: Sat Oct 21, 2017 7:04 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 43
I have this variant, if you're unsure about some traces I can check them with my multimeter. Also can dump it with kazzo. I *think* I tried at a point to dump it with MMC3_v2 but it didn't work? I need to check again.


Top
 Profile  
 
PostPosted: Sat Oct 21, 2017 8:05 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
That would be really great, could you please chceck those connections (chip name.pin name)

1) IC25.12 == IC28.11
2) IC25.13 == R3.2
3) IC25.11 == IC1.13
4) IC25.11 == IC1.1
5) IC25.11 == IC2.10
6) IC1.6 == IC15.5
7) IC1.6 == IC28.9
8) IC6.9 == IC4.9
9) IC1.9 == IC6.10
10) IC5.10 - does connect to any of IC25 pins?
11) IC1.12 - any other pins it connect to?
12) IC1.2 - any other pins it connect to?


If you cend me mmc3_v2, then I can modify it to work with this game.


Top
 Profile  
 
PostPosted: Sat Oct 21, 2017 8:17 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 43
You can find the mmc3_v2 script in the kazzo file library.
I'll try it tonight if I have time. I'm not a techy person so I may get lost a bit with your drawing heh.


Top
 Profile  
 
PostPosted: Sat Oct 21, 2017 8:31 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 260
Location: Poland
MLX wrote:
You can find the mmc3_v2 script in the kazzo file library.
I'll try it tonight if I have time. I'm not a techy person so I may get lost a bit with your drawing heh.

Just use the chip & pin numbers from this photo:
Image


Attachments:
mmc3_smb3_asian.zip [982 Bytes]
Downloaded 21 times
Top
 Profile  
 
PostPosted: Sat Oct 21, 2017 12:19 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6526
Location: Seattle
MLX wrote:
I *think* I tried at a point to dump it with MMC3_v2 but it didn't work? I need to check again.
The default Kazzo script tries to switch the MMC3 into 8+8+16F mode, which Krzysiobal says isn't supported by this hardware, so... that's probably why.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group