It is currently Fri Nov 17, 2017 12:24 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 44 posts ]  Go to page Previous  1, 2, 3  Next
Author Message
PostPosted: Wed Oct 25, 2017 11:20 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
Here's some footage.

Can somebody help me dump this cartridge with a kazzo? Usually I don't ask publicly but I think the hardware is of interest to some people here.
I can provide NROM and uorom readouts by PM (it's giving some early signs of life on uorom. I guess there's some shared register or something?)

PCB photo attached.


Attachments:
IMG_5962.JPG
IMG_5962.JPG [ 1.88 MiB | Viewed 394 times ]
IMG_5960.JPG
IMG_5960.JPG [ 1.6 MiB | Viewed 394 times ]
Top
 Profile  
 
PostPosted: Wed Oct 25, 2017 12:00 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
Without having yet sit down to trace the images, the single '374 implies there's a single bankswitching register that contains (almost?) all of the state.

The PAL could hold some state also, and it may be hard to reverse-engineer what it's doing without desoldering it.

Just for reference:
the GM0832 is a "successive approximation ADC", the KA22134 is a "dual pre-power amplifier with volume control" and two power amplifiers, the K-633A is unknown.


Top
 Profile  
 
PostPosted: Wed Oct 25, 2017 2:15 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
It really looks like there should "just" be a 1 MiB UNROM dump. (The '374 and the SIP resistor work together to emulate UNROM)

All the other logic (e.g. the sound ICs) goes through the PAL, so reverse-engineering the rest will require describing the behavior the software expects, or desoldering the PAL.

PAL pinout:
Code:
 M2 -> | 01 20 | -- 5v
A13 -> | 02 19 | -> to PRG /OE
A14 -> | 03 18 | -> to '374 /OE (buffered copy of A14?)
/RS -> | 04 17 | -> latch clock to '374
R/W -> | 05 16 | ?> D7
 A0 -> | 06 15 | <> SPI Data to/from the ADC
 A1 -> | 07 14 | -> SPI CS to the ADC
 A2 -> | 08 13 | -> SPI clock to the ADC
 A3 -> | 09 12 | -> K-663A chip enable
gnd -- | 10 11 | <- PRGA21


"K-663A" "Sound IC" pinout:
Code:
gnd -- | 01 18 | <> D1
 D2 <> | 02 17 | <> D0
 D3 <> | 03 16 | -- +5
 D4 <> | 04 15 | ??
 D5 <> | 05 14 | ??
 D6 <> | 06 13 | ??
 D7 <> | 07 12 | <- from PAL pin 12
 X1 -- | 08 11 | <- R/W
 X2 -- | 09 10 | <- A0
<watches the video> OH, there's an FM synth. The above is the same pinout as the YM2413.


Top
 Profile  
 
PostPosted: Wed Oct 25, 2017 5:38 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 244
Location: Poland
Sch, but no idea what's goin on here with analog part.
Those tracks near pot, under MIC/AUX jack and near R8, C5, R13.1 need confirmation. Btw what should be connected to the upper 45-pin header? Keyboard?

Image Image


Top
 Profile  
 
PostPosted: Wed Oct 25, 2017 5:48 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
Yeah, there were too many parts hidden under the electrolytic capacitors for me to figure that out to my satisfaction either.

Datasheet for the GM0832 says its pinout is
Code:
/CS -> | 1 8 | -- Vcc
Ch0 -> | 2 7 | <- CLK
Ch1 -> | 3 6 | -> DOut
Gnd -- | 4 5 | <- DIn
and that it expects, after /CS falls, three configuration bits clocked in on rising edges (i.e. change on falling edge), one padding bit, and then will emit successive 8-bit conversion results serially, MSB first, until CS rises.

So ... Ch0 and/or Ch1 really should be connected to the microphone jack, somehow.



Code:
Btw what should be connected to the upper 45-pin header? Keyboard?
Expansion pack for extra songs. This is similiar to Bandai's Karaoke Studio.



MLX wrote:
Can somebody help me dump this cartridge with a kazzo?
So ... if you're starting with INL's script in arantius's repository ... and you actually get a real dump when you try to run it as uorom (i.e. the first 16 K don't just repeat over and over) ...

just try changing the bit that says cpu_romsize = 2 * mega to say 8 instead of 2.


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 1:42 pm 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
krzysiobal wrote:
Sch, but no idea what's goin on here with analog part.
Those tracks near pot, under MIC/AUX jack and near R8, C5, R13.1 need confirmation. Btw what should be connected to the upper 45-pin header? Keyboard?


Traces on R8 are wrong, C7.1-R8 is wrong. C7.1 goes to R6.2.
R4.1 to C6.1
C5.1 to R7.1
R13 is correct.


As for the dump, looks like it's the same whatever the size, so yeah, it's repeating the banks :/


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 1:53 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
So, the PAL is connected to /ROMSEL, A13, A14, M2, ... and A0, A1, A2, and A3. There could be as many as 80 different registers ... but my hunch is that A0-A3 are only for interfacing with the ADC.

Try changing the number in cpu_write(d, 0x8000, i); to 0x6000, 0xA000, 0xC000, and 0xE000.


It's also remotely conceivable that the hardware here could actually be mapper 180 (bottom bank fixed) instead of "ordinary" UNROM (top bank fixed)—the PAL could possibly put the bankswitch register contents in any combination of lower and upper halves.

You could PM me the NROM subset.


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 2:23 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
Ok, yeah, that's definitely something like UNROM.

I think I see. Try changing cpu_write(d, 0x8000, i); to 128+i

(It looks like 0≤i≤127 map to the external ROM on the option slot; 128≤i≤255 should be the internal ROM)

Additionally, it looks like the FM synthesizer is mapped to addresses $6000 and $6001.

(I bet PAL pin 19 is something like (0 if /ROMSEL=0 AND R/W=1 AND PAL11=1))


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 6:22 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 350
dump first 32K data. send me.


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 6:26 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
Already on it.


Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 10:48 pm 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
On the first try, thanks!! But no music. I guess this has to be fixed in the emulator or handled in a new mapper?


Attachments:
familynoraebang.png
familynoraebang.png [ 49.34 KiB | Viewed 205 times ]


Last edited by MLX on Fri Oct 27, 2017 7:03 am, edited 1 time in total.
Top
 Profile  
 
PostPosted: Thu Oct 26, 2017 11:16 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
This definitely requires a new mapper. While it's quite similar to both UNROM and to Mapper 188 (which is basically UNROM plus a microphone), I'd be uncomfortable saying it's appropriate to designate it as a submapper of either. (On the other hand, if someone else has an opinion that it should be filed as a submapper, I'd be all ears)

And we don't know whether the K-633A is using the same patches as the YM2413; certainly we already have the precedent that the VRC7 uses different baked-in ones.


To get the expansion cart, put it in the cart and and dump using the original UNROM script, but scan for up to 32 * mega. The expansion cart (probably overdumped) will be the first 2 MiB of the dump; the upper 2 MiB of the dump will definitely be an overdumped copy of the base game. The resultant 4 MiB image will be an overdump, but you (or someone, anyway) could shave it down.


It'd be nice to verify whether the PRG bankswitching register is present all over the entire range from $8000 through $E00F. I'd hunch it is, but ... if you'd be willing to (and I know bothering with 32 dumps is ridiculous), would you try replacing the cpu_write(d,0x8000,128+i) with 8001, 8002, ..., 800E, 800F, A000, &c ?

(If the board designer was feeling particularly sadistic ... since the board decoding mask is $E00F, they could have hidden writeable registers at $2002, $200A, $4009, and $400D... and readable ones overlaying $4000-$4004, $4008-$400F. But I really doubt they were)


Top
 Profile  
 
PostPosted: Fri Oct 27, 2017 12:23 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
Well if anyone want the rom to try to implement the sound, they can PM me. I'll release it anyway at some point. Otherwise if it proves to be too complicated I'll send the cart to someone interested to RE it and emulate it fully.

I'll try your suggestions later today, have to find the time.


Top
 Profile  
 
PostPosted: Fri Oct 27, 2017 3:40 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 350
make an all out effort!!!


Top
 Profile  
 
PostPosted: Sat Oct 28, 2017 8:14 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 311
It uses the default YM2413 instrument set indeed. I have implemented it in Nintendulator as Mapper 515 (512+ plane since it's an Asian-only release). Will post Nintendulator source code and Mapper DLL later. Nintendulator's YM2413 emulation was so VRC7-specific that all rhythm mode emulation code had been removed, and had to be re-added for this game. All that is left for me to investigate is to fix an issue with the rhythm channels not playing properly after loading a save state.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 44 posts ]  Go to page Previous  1, 2, 3  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group