Pirate Gemlins 2 RE

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Pirate Gemlins 2 RE

Post by Fisher »

Hi, I just got a pirate Gremlins 2 that uses an unindentified mapper + some glue logic IRQ circuit.
Some pictures:
Assembled board
Assembled board
Component side
Component side
Solder side
Solder side
As you can see, I accidently burned the board. :cry:
Since it was my first time with a hot air station, I think I should practice a little more. :oops:
I also dumped the PRG with the amazing Tapedump, and since I was not sure about the CHR I dumped it directly.

Edit: fixed the circuit function.
Last edited by Fisher on Sun Oct 08, 2017 6:27 pm, edited 1 time in total.
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Pirate Gemlins 2 RE

Post by Fisher »

I'm posting the PRG and CHR ROMs IPS.
For now they're complete, buit I'll generate an IPS from the original and erase them soon. Edit: Done!
If there's problem posting it here, please, erase them or tell me to do so.
Please, try to see if they're correctly dumped, so I can redump if necessary before reassembling the cartridge.
G2_PRG.ips
(1001 Bytes) Downloaded 275 times
G2_CHR.ips
(24 Bytes) Downloaded 270 times
Edit: Removed the original files and added the IPS, as promissed.
Better be safe than sorry!

Code: Select all

CRC32s:
    Original   Patched
PRG 11fc8686   80006759
CHR a13b9d3a   fc5f907d
These IPS were created against the original Japanese ROM files.
I'm not adding a .NES file IPS because I'm not sure what mapper this is.
Last edited by Fisher on Sun Oct 08, 2017 6:46 pm, edited 2 times in total.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Pirate Gemlins 2 RE

Post by lidnariq »

Fisher wrote:unindentified mapper
And pins 16-1920 aren't connected to anything. Almost certainly cloned VRC2.

The two '191s and the '393 probably make up the IRQ source.



No obvious errors in the PRG or CHR dumps. They only differ from the Japanese release of the game by PRG:604 bytes and CHR:614 bytes.

CHR is, as typical, just blanking out the rightsholders' names:
Gremlin 2 - Shinshu Tanjou (J) - differences.gif
Gremlin 2 - Shinshu Tanjou (J) - differences.gif (3.74 KiB) Viewed 7388 times


Now having traced the PCB:

* VRC2, but in the VRC4e pinout variant (addresses in order, 0/4/8/C)
* IRQ prescaler of ÷ 256
* Presettable up-counting IRQ, IRQ on overflow
* IRQ can be stopped and prescaler cleared, or running

Additional register map beyond VRC2:
mask $F00C,
$F000: load data bus to IRQ counters, no effect on prescaler
$F008: load D0 to IRQ enable(D0=1)/halt(D0=0)

If IRQ halted: prescaler ('393) is cleared (reset to 0). Counter is halted (/CountEnable is high). Counter is NOT cleared.
If IRQ enabled: prescaler counts up every M2 cycle (on the falling edge). Loads take precedence over counting, if both would (could?) happen at the same time.

Weird idiosyncrasies:
The '191s count on a rising edge of their clock input, so the first time the '191s will count will be 128 M2 cycles after the counter is enabled. (And every 256 M2 cycles thereafter)
IRQs will self-acknowledge after 128 cycles, because the literal logic for IRQ being asserted is "counter = 0xFF and ClockInput=0"
1/3 of the 74'10 calculates NAND3(div256,div128,div32): it looks like there had been some effort to use a prescaler of ÷208 instead of 256, but nothing happens with the result of this calculation

The prescaler is not affected by counter loads, so relative phase of the IRQ can be managed in way that won't care about IRQ latency.

Two worked examples:
* Stopping IRQ, loading counter with $FF, and then enabling IRQ will cause an immediate IRQ
* Stopping IRQ, loading counter with $FE, and then enabling IRQ will cause an IRQ in 256cy (Counter will increment in 128cy, and then ClockInput becomes 0 again in 256cy)

edit: grammar nits
Last edited by lidnariq on Sun Oct 08, 2017 2:10 pm, edited 1 time in total.
User avatar
byemu
Posts: 297
Joined: Mon Sep 05, 2011 5:56 pm
Contact:

Re: Pirate Gemlins 2 RE

Post by byemu »

It's VRC2 clone(mapper23),no irq.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Pirate Gemlins 2 RE

Post by lidnariq »

It's not the VRC4 IRQ, but the added 74'393 and 74'191s add an IRQ. One of the more interesting pirate IRQs, I think...
User avatar
naruko
Posts: 66
Joined: Mon Feb 09, 2009 9:10 am
Location: リムルダール Rimuldar
Contact:

Re: Pirate Gemlins 2 RE

Post by naruko »

I have researched pirate gremilins 2 cartridge last year.
IC placement is different on the PCB. It uses same ICs.
[attachment=0]20160716150640.jpg[/attachment]
Attachments
20160716150640.jpg
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Pirate Gemlins 2 RE

Post by Fisher »

naruko wrote:IC placement is different on the PCB. It uses same ICs.
The label is almost equal.
I think the case is the same:
Case
Case
byemu wrote:It's VRC2 clone(mapper23),no irq.
Yes, I dumped it by using TapeDump with the mapper 23 option.

I also dumped a pirate Jackie Chan wich had a build-in cheat.
Zxbdragon helped me to figure this out.
Thanks to him now I know how to cheat in this game.
Sould I share more details here or create another thread?
He also discovered that the first Gremlin's CHR dump was bad.

Looks like the pirates were trolled by Konami. :lol:
I think they made an VRC2 clone on the hope that many games would be made for it.
So they may have reused them by adding an IRQ circuit.
I think I have around 4 or 5 cartridges like this...

I don't think a Gimmick repro with additional sound can be done with this game.
Well, not without very extensive hacks.
Space would be an issue too.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Pirate Gemlins 2 RE

Post by lidnariq »

The label seems to just be just a lightly-edited OEM one — http://bootgod.dyndns.org:7777/profile.php?id=3805
Fisher wrote:I also dumped a pirate Jackie Chan which had a build-in cheat.
[...]Should I share more details here or create another thread?
Either way! It's nice to see hardware.

May as well make a new thread so that the topic is accurate, I guess.
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Pirate Gemlins 2 RE

Post by Fisher »

Done!
Created a new topic here.
I took a look. I have 4 games (counting this one) wich seems to be the same mapper + worked around IRQ circuit.
All of them are japanese versions of the games and were "dissected" here at NesDev:
Kid Dracula;
Gradius 2 and
Batman

The only one I still have issues is Batman, wich slows down alot.
I hope to be able to fix that one day... :roll:
Gradius 2 had a glitch fixed thanks to Lidnariq! :beer:
zxbdragon
Posts: 498
Joined: Mon Dec 12, 2011 8:15 pm

Re: Pirate Gemlins 2 RE

Post by zxbdragon »

emu....Failure
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Pirate Gemlins 2 RE

Post by Fisher »

zxbdragon wrote:emu....Failure
Is it caused by a bad dump or it's the IRQ circuit?
Damm! It can even be a combination of both!! :|
zxbdragon
Posts: 498
Joined: Mon Dec 12, 2011 8:15 pm

Re: Pirate Gemlins 2 RE

Post by zxbdragon »

Fisher wrote:
zxbdragon wrote:emu....Failure
Is it caused by a bad dump or it's the IRQ circuit?
Damm! It can even be a combination of both!! :|
dump ok.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Pirate Gemlins 2 RE

Post by krzysiobal »

Some schematic porn:
Image
User avatar
Fisher
Posts: 1249
Joined: Sat Jul 04, 2015 9:58 am
Location: -29.794229 -55.795374

Re: Pirate Gemlins 2 RE

Post by Fisher »

zxbdragon wrote:dump ok.
Great! Now it's reassembling time!!
Hope I've not fried the mapper when removing it. :shock:
krzysiobal wrote:Some schematic porn:
Great as ever!!

I was thinking in getting more/better naked board scans and properly catalog the ones I have.
Maybe I could make a site called NakedBoards, BoardPorn or something similar...
Damm, now I'm imaginating a logo that could be a board taking it's components out with its "arms", showing it's hidden circuits to the world with a dirty smile on its face!! :lol:
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Pirate Gemlins 2 RE

Post by lidnariq »

zxbdragon wrote:emu....Failure
How did you implement the IRQ?
Post Reply