It is currently Sun Aug 25, 2019 7:25 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 18 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Thu Jan 18, 2018 11:56 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
I got some interesting carts recently so I thought of sharing them, as the design is quite rare & interesting.

1. Don Doko Don 3
Image Image Image Image Image

Game:
Don Doko Don 3 (Dok Doko Don 2 hack)

My comments:
* It is mapper 33 with mirroring register moved from $8000.6 to $e000.6
* Quite elegant hardware solution - everything stored in 74*670, while combinatorial logic is provided by PAL. Also, one bit of mirroring which should be packed somewhere is stored in PAL.
Code:
---------------------------------PAL-------------------------------------------
Automatic analysis:
 !REG2GR! <= (!PPU-A12);
CIRAM-A10 <= (CPU-D6 & PPU-A11) | (!CPU-D6 & PPU-A10);
       O2 <= (I12);    //unused input
       O3 <= Probably non-combinatorial
 !REG2GW! <= (!CPU-A13) | (CPU-!ROMSEL!) | (CPU-R/!W!) | (CPU-A14);
 !REG1GW! <= (!CPU-A1) | (CPU-!ROMSEL!) | (CPU-R/!W!) | (CPU-A14) | (CPU-A13);
 !REG0GW! <= (CPU-!ROMSEL!) | (CPU-R/!W!) | (CPU-A1) | (CPU-A14) | (CPU-A13);
 PRG-!CE! <= (!CPU-R/!W!) | (CPU-!ROMSEL!);
Additional manual analysis for feedback looped outputs:
       O3 <= CPU-D6 when CPU-!ROMSEL!=0 and CPU-R/!W=0 and CPu-A13=1 and CPU-A14=1 and CPU-A1=0 and CPU-A0=0
CIRAM-A10 <= PPU-A10 when O3='0' else PPU-A11
---------------------------------MEMORY MAP------------------------------------
PRG-ROM: 128 kB
CHR-ROM: 256 kB
Bus conflicts: no

CPU:
$8000|$a000|$c000|$e000
-----+-----+-----+-----
$8000|$8001|    -1     

PPU:
$0000|$0400|$0800|$0c00|$1000|$1400|$1800|$1c00
-----+-----+-----+-----+-----+-----+-----+-----
  $8002    |  $8003    |$a000|$a001|$a002|$a003

---------------------------------REGISTERS-------------------------------------
[....pppp] $8000/$8001 [mask: $e003]
     ||||
    ++++- 8 kB PRG at $8000-$9fff/$a000-$bfff

[.ccccccc] $8002/$8003 [mask: $e003]
  |||||||
  +++++++- 2 kB CHR at $0000-$07ff/$0800-$0fff (lowest bit is NOT ignored)
 
[cccccccc] $a000/$a001/$a002/$a003 [mask: $e003]
 ||||||||
 ++++++++- 1 kB CHR at $1000-$13ff/$1400-$17ff/$1800-$1bff/$1c00-$1fff

[.m......] $e000 [mask: $e003]
  |
  +------- mirroring (0=V, 1=H)
-------------------------------------------------------------------------------



2. Dragon Ball Z 2
Image Image Image Image Image Image

Game: Dragon Ball Z 2 (ported from Bandai 24C02)
One of the very few games that uses VRC2+DIP8 EPROM. AX5705 is VRC2 (this chip can also be seen under name 23C269 which also has functional EPROM lines)
Due to different time of changing ROMSEL/M2, they added circuit for delaying rising edge of M2.

PAL has 3 latches so research is in progress.

3. Don Doko Don
Image Image Image Image Image Image

Game:
Don Doko Don (ported from mapper 33 to VRC2)

Mapper:
VRC2
PRG-ROM: 128 kB
CHR-ROM: 256 kB

My comments:
There is additional 2 kB ROM mapped at $6000-$7fff (only A0-A9 wired). It is some kind of patch,
that game jumps and executes code from here (probably modified routine to switch bank,
which cannot be modified in original rom due to insufficient free space)


4. Dragon Ball Z 3
Image Image Image Image Image Image

Same situation like with Dragon Ball Z2, but the way they enhances VRC2 this time to be quite different. Also, some of PRG/CHR lines are reversed. They also ommited the M2 delaying circuit (but this PCB I saw previously on this forum which HAS this circuit)

PAL has latches so research is in progress.


Top
 Profile  
 
PostPosted: Thu Jan 18, 2018 12:03 pm 
Online

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8539
Location: Seattle
krzysiobal wrote:
* It is mapper 33 with mirroring register moved from $8000.6 to $e000.6
It's worth pointing out that it's Taito that did that.

Mapper 33 has the mirroring control register at $8000.6, and one board (DDD1) supports but doesn't use IRQs
Mapper 48 has the mirroring control register at $E000.6, and several boards use the TC0190 (without IRQs) and a PAL to move the mirroring control register to $E000.6


Top
 Profile  
 
PostPosted: Thu Jan 18, 2018 3:05 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 454
Dragon Ball Z 2
Dragon Ball Z 3
I DUMPED,BUT eeprom.not emu.

Don Doko Don 3 is mapper 222.not IRQ
Dragon Ninija is mapper 222, have IRQ


Top
 Profile  
 
PostPosted: Thu Jan 18, 2018 3:23 pm 
Online

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8539
Location: Seattle
The board that Krzysiobal reverse engineered that held DDD"3" is exactly mapper 48, not mapper 222.


Top
 Profile  
 
PostPosted: Fri Jul 05, 2019 2:21 am 
Offline

Joined: Tue Apr 11, 2006 4:08 am
Posts: 282
Location: Poland
krzysiobal wrote:
Don Doko Don 3 (Dok Doko Don 2 hack)

I have another DDD2 bootleg, have PBC the same.
The AAAAAAAB button code for selection of levels also works.


Attachments:
2019-07-05-1349.jpg
2019-07-05-1349.jpg [ 207.03 KiB | Viewed 1492 times ]
2019-07-05-1350.jpg
2019-07-05-1350.jpg [ 896.41 KiB | Viewed 1492 times ]
Top
 Profile  
 
PostPosted: Wed Aug 14, 2019 4:16 am 
Offline
User avatar

Joined: Mon Feb 04, 2013 10:47 pm
Posts: 34
Location: NTDEC
Hey people... since i saw DDD2 here....
there are chances to re-convert Super bros 8 into DDD2?
i assume that SB8 prg is different than original, so PRG IC is untouched.
i try to replace SB8 CHR by the DDD2 original one and game works well on emulators (using BTL DRAGON NINJA mapper rom). but it fails in real hardware.

the board:
https://imgur.com/aTIsOfK.jpg
https://imgur.com/f8dJP5n.jpg

thanks in advance.

_________________
The 100 Mega Shock


Top
 Profile  
 
PostPosted: Wed Aug 14, 2019 4:50 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
I analyzed your PCB. Mapper blob matches VRC2 (or VRC4). The unpopulated DIP32 over mapper blob is interesting - it suggests that there existed VRC2 (or VRC4) in smaller package (DIP40 minus 8 original pins).

Code:
           .--\/--.
   CPU A13 |01  32| +5V
   CPU A14 |02  31| PRG A15
    CPU Ax |03  30| CPU A12
    CPU Ay |04  29| PRG A14
   PPU A12 |05  28| PRG A13
   PPU A11 |06  27| PRG A16
   PPU A10 |07  26| CPU D0
   PRG /CE |08  25| CPU D1
   CPU R/W |09  24| CPU D2
 CIRAM A10 |10  23| CPU D4
   /ROMSEL |11  22| CPU D3
        M2 |12  21| CHR A17
       GND |13  20| CHR A15
   CHR A10 |14  19| CHR A12
   CHR A16 |15  18| CHR A14
   CHR A11 |16  17| CHR A13
           '------'


Image Image Image


PRG and CHR-ROM address lines are shuffled, so if you're burning eprom with different graphics, you also need to mix them.

Code:
PRG has one chip enable (at pin 20)
CPU-A0 -> ROM-A1
CPU-A1 -> ROM-A0
VRC-A14 -> ROM-A13 (ROM.PIN26)
VRC-A13 -> ROM-A14 (ROM.PIN27)
VRC-A15 -> ROM-A16 (ROM.PIN22)
VRC-A16 -> ROM-A15 (ROM.PIN3)

But there are number of jumpers that allow you to use either DIP32 or DIP28 ROM:
      JP1 JP3 JP8 JP7 JP6 JP2
DIP28 OPN CLS OPN CLS OPN CLS
DIP32 CLS OPN CLS OPN CLS OPN

CHR:
VRC-A11 -> ROM-A10
VRC-A10 -> ROM-A11
VRC-A12 -> ROM-A12
VRC-A14 -> ROM-A13
VRC-A13 -> ROM-A14
VRC-A16 -> ROM-A15
VRC-A15 -> ROM-A16
VRC-A17 -> ROM-A17


Last edited by krzysiobal on Thu Aug 15, 2019 1:17 pm, edited 2 times in total.

Top
 Profile  
 
PostPosted: Wed Aug 14, 2019 8:59 pm 
Offline
User avatar

Joined: Mon Feb 04, 2013 10:47 pm
Posts: 34
Location: NTDEC
krzysiobal wrote:
I analyzed your PCB.

Always rocking, sir.

krzysiobal wrote:
PRG and CHR-ROM address lines are shuffled, so if you're burning eprom with different graphics, you also need to mix them.

any clue how its composed? here is a dump of my chr rom. hope it helps


Attachments:
BROS8-SNACKS.CHR.bin [256 KiB]
Downloaded 10 times

_________________
The 100 Mega Shock
Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 12:16 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
Quote:
any clue how its composed? here is a dump of my chr rom. hope it help

Look above.


Last edited by krzysiobal on Thu Aug 15, 2019 12:54 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 12:43 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 454
Snacks wrote:
Hey people... since i saw DDD2 here....
there are chances to re-convert Super bros 8 into DDD2?
i assume that SB8 prg is different than original, so PRG IC is untouched.
i try to replace SB8 CHR by the DDD2 original one and game works well on emulators (using BTL DRAGON NINJA mapper rom). but it fails in real hardware.

the board:
https://imgur.com/aTIsOfK.jpg
https://imgur.com/f8dJP5n.jpg

thanks in advance.


hack SB8 to DDD2 ....ROM

I guess

Your programmer using the wrong chip program

you dump chr is bad.


Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 1:17 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
zxbdragon wrote:
Snacks wrote:
Hey people... since i saw DDD2 here....

Your programmer using the wrong chip program

you dump chr is bad.

Dump is perfectly OK, just shuffle the address lines as I wrote.
I replaced the CHR from my `Don Doko Don 3`, that I described above with yours SMB8 CHR and it works:
Image Image Image

BTW. Because the mine dump above is mapper 48 and it works perfectly with your chr, so either:
* your blob chips despite having the same pinout at VRC2 seems to be TAITO chip (with reduced pinout that need the external 74157 mux)
or
* ours PRG differs.
Can you please dump the PRG chip aswell?


Attachments:
BROS8-SNACKS.CHR_demixed.bin [256 KiB]
Downloaded 11 times
Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 2:09 am 
Offline
User avatar

Joined: Mon Feb 04, 2013 10:47 pm
Posts: 34
Location: NTDEC
that was great, what i need to make a "mixed" chr from legit DDD2? i want to patch into english then "mix" to make workable on my board. thanx in advance !

_________________
The 100 Mega Shock


Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 2:38 am 
Offline
User avatar

Joined: Mon Feb 04, 2013 10:47 pm
Posts: 34
Location: NTDEC
lol.. i need a adapter to dump 28pin maskroms
readed as 27c010, by lifting 22, then routed to hole2, 1,31 32 same as 30 and hole 24 to gnd. right?

rom machine claims for pin32 but its connected. i dump 5 files and they are the same. so i compare with real DDD2 and it has some changes.


Attachments:
BROS8-SNACKS.PRG.bin [128 KiB]
Downloaded 13 times

_________________
The 100 Mega Shock
Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 7:10 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
PRG ROM dump seems to be OK, but A0 and A1 were also mixed (which I did notice in the PCB layout). I am not sure in what order they are connected to VRC-A0 an VRC-A1. I will analyze it later.


Attachments:
BROS8-SNACKS.PRG_demixed.bin [128 KiB]
Downloaded 9 times
Top
 Profile  
 
PostPosted: Thu Aug 15, 2019 1:14 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
Oh, increasing gamma correction on your photos revealed the A0/A1 shuffle.

Image
Ok, the VRC-A0 -> CPU->A0, VRC-A1 -> CPU-A1, MUX-SEL -> CPU-A0
So this is regular VRC2 (mapper 23) with the exception that odd registers (probably used only chr bank registers) use D4-D7 instead of D0-D3.

I applied the english IPS into your ROM (which was intended to use over original DD2) and it even works.

I made a special program to allow you to mix/demix the ROM.
Code:
Usage: ./AddressMixer <type> <input_file> <output_file> where type = PRG or CHR


Attachments:
AddressMixer.zip [2.76 KiB]
Downloaded 9 times
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 18 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group