MMC5 Hacking Adventures

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

I don't remember now exactly what happened but I had to hold /CS high with the cart off or something and the mapper chip didn't hold that signal high. Something like that. Not completely sure it was the MMC5 cart either TBH. The RAM chip was HM62256BLP-7, which I recall being several dollars each. I love this bargain you found, I plan to take a chance on 5 of the 128k. The bigger ones you linked to are a little bigger risk having 0 orders and 0 reviews.

Someone from Russia ordered one of the SMB2J carts and posted a picture of the inside in his review:
inside smb2j.jpg
Sort of interesting these days to see the ROMs and RAM as DIPs. I suspect the mapper is that glob between the ROMs.

Here are the 2.50mm 72-pin edge connectors (top-load / Game Genie type, not ZIF):
https://www.aliexpress.com/item/item/32827561164.html

This is from Aliexpress store Kingworld, I have ordered loads of parts from them. They are great. One time they goofed up an order (missing some things that I ordered). They fixed it.

Overall I have very mixed success on AliExpress. I would say that about 1 in 20 orders goes wrong. I have ordered "new" chips that were obviously scavenged on a way-too-hot solder pot and didn't work on top of that... So you never know. I tend to rely on number of orders and reviews, but also willing to take a chance and be the first reviewer. If ever you get screwed and open a dispute, my advice, never apply for a full refund. AliExpress will decide that you need to send it back and wait for you to provide a tracking number, and if you don't, no refund, done deal. Always leave at least 1 cent not requested in your refund. I am a big fan of AliExpress though. I get all sorts of junk there, flashlights, burning lasers, sunglasses, zip ties, parts for my bicycle, fidget spinners (still addicted), basically any lightweight made in China junk.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: MMC5 Hacking Adventures

Post by krzysiobal »

Overall I have very mixed success on AliExpress. I would say that about 1 in 20 orders goes wrong. I have ordered "new" chips that were obviously scavenged on a way-too-hot solder pot and didn't work on top of that... So you never know. I tend to rely on number of orders and reviews, but also willing to take a chance and be the first reviewer. If ever you get screwed and open a dispute, my advice, never apply for a full refund.
Luckiliy I demanded full return only few times (in all cases the item has not been delievered).

But from my experience I can say that there are few kinds of items you can get:
* Original chips (no idea where they got them, probably the factories that make original chips for for example Altera sell them chips not meeting 100% requirements).
* Some old savaged stuff (for example I bought one time HM62512 SO32 SRAMS that had curved legs, all of them were stored lose, or CPU/PPU for Famicom - those looks like brand new, the legs did not have markings of solder, but around 20% of them were not working)
* Some refubrished stuff - they paint old chips with new markings (I bought one time TSOP48 29LV640 memories, which had.. pin 1 dot painted on the wrong side ;)

I think this presentation shows greatly how China integrated circuit business works :D
http://asq.org/asd/2009/03/compliance/c ... -parts.pdf


Someone from Russia ordered one of the SMB2J carts and posted a picture of the inside in his review:
This PCB indeed looks like it was made by some russian hackers, here is link to their site with other similar cartridges, also built-in using old DIP chips, but with new PCBs: https://vk.com/retronicaru

As I can recall, there is SMB2J hack ported to MMC4 so no big deal.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

I have been to China for work before, I can't say I'm surprised by those photos. More wishing I could happen upon some of those heaps of parts for sale! :) I think for hobbyist purposes, where is the harm. Most of my junk used to be in something else already anyway, I just do it on a smaller scale. But if a business thought they were buying legit parts and got those, I see where that is a bad deal. That is a really big difference.

I was looking into building an SMB2J cart, but the ROM file I had was some strange mapper. I sort of gave up on it. So just for the purpose of having that game on a cart is mostly what I am sort of after. I wouldn't be against trying to dump it either though just for curiosity. I have heard that often times SMB2J ROM conversions are lacking a wind effect, it will be interesting to see if that works or not in this cartridge.

No new progress on the MMC5 cart build. Will see what I can do this weekend on it.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

Today's progress, CHR-ROM is done except for /CE and A19 logic. It looks like PRG-ROM only uses 1 /CE, so I can probably directly use A19 (and /A19) for the other /CE.
chr-rom.jpg
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

It is all wired now. When I get home tonight, I will burn some ROMs and try it. Wish me luck!

Note: I did tie the inputs of the extra NANDs to GND after this photo.
IMG_1584.JPG
Closed:
IMG_1585.JPG
Edit:
Success! No problems!

Here it is running on a Famicom:
https://youtu.be/-B6YsU2MyHw

Here it is running on my Hi-Def NES front-loader:
https://youtu.be/S0E5zq3l_kg
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

Now that we know the answers to your questions about glitches and shaking do exist on NTSC in a cart krzysiobal, I tried an experiment with Just Breed in this cartridge. I burned a ROM with all writes to $5800 replaced by NOPs. I played the game a fair ways, all the way to the next town with the wizard and I found no particular difference. I then burned another ROM with only the write of $00 to $5800 replaced by NOPs. Again, no difference found. At no point did I see any graphics that would have used scanline counting though, not sure if this game ever does that or not.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

I decided to lay out all know addresses of the MMC5 address range $5000 - $5FFF visually to look for patterns. I noticed that $5800 is offset back from the expansion RAM by exactly the size of an additional expansion RAM. Also it seems very odd that registers $5110,11,12 are skipped. In addition, the register just before CL3/SL3 status ($5207): oddly skipped as well. These are some open mysteries worth thinking about/investigating.

Code: Select all

$5000 -+-------------------------------------------------+----------------
       | Audio Registers                                 | vv 1st Quarter
$5120 -+-------------------------------------------------+
       |                                                 |
       |   (unused)                                      |
       |                                                 |
$5100 -+-------------------------------------------------+
       | PRG Banking Mode Registers                      |
$5110 -+-------------------------------------------------+
       | PRG Bank Select Registers, skipping $5110,11,12 |
$5120 -+-------------------------------------------------+
       | CHR Banking Mode Registers                      |
$5130 -+-------------------------------------------------+
       | CHR Bank Select Register                        |
$5140 -+-------------------------------------------------+
       |                                                 |
       |   (unused)                                      |
       |                                                 |
$5200 -+-------------------------------------------------+
       | Vertical Split Mode, Multiplier, Hardware Timer |
$5210 -+-------------------------------------------------+
       |                                                 |
       |                                                 |
       |   (unused)                                      |
       |                                                 |
       |                                                 | ^^ 1st Quarter
$5400 -+-------------------------------------------------+----------------
       |                                                 | vv 2nd Quarter
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |   (unused)                                      |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 | ^^ 2nd Quarter
$5800 -+-------------------------------------------------+----------------
       | Just Breed writes to $5800 each v-blank.        | vv 3rd Quarter
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       | Note: Section $5800 - $5BFF                     |
       |       Same size as expansion RAM.               |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 | ^^ 3rd Quarter
$5C00 -+-------------------------------------------------+----------------
       |                                                 | vv 4th Quarter
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       | Expansion RAM                                   |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 |
       |                                                 | ^^ 4th Quarter
$6000 -+-------------------------------------------------+----------------
Edit:
Another experiment, I inverted all 3 values written to $5800 in Just Breed and tried it in the cart. Still no difference found.

Edit 2:
Referring to what definitely appears to be Nintendo's patent on the MMC5 DAC:
https://patents.google.com/patent/US5317714?oq=5317714

This makes it look very discouraging that there would be a way for the MMC5 to play audio directly out of its own RAM. Though it talks very specifically about DAC read mode and write mode, no function having to do with automatic playing from its own RAM is ever mentioned sadly. But coming to save the day with a bit of humor, "The analog sound source circuit 11a [referring to the sound generators in the 2A03] comprises four types of sound generators for generating two types of square waves, a triangular wave and a sine wave." LOL.

Back to $5800:
We could suppose that the $5800 stuff was for debug or was left in there developing with an earlier version of the MMC5. Things like that could explain it away. That is so strange to have half of the address space in the center go unused though, or used just only for 1 seemingly pointless register right exactly smack in the very center. It seems reasonable that they would have used half of the total space:

$5000
Registers
$5400
Expansion RAM
$5800

or

$5800
Registers
$5C00
Expansion RAM
$6000

Too strange for me, I have a feeling there is something there. It could be write-only RAM (for what purpose, who knows) or enabled somehow by $5104 or $5108 - 5112... I need to fix my setup so I can reliably write to PRG mode registers and see if I can do anything to get some data bus action when reading in $5400-5BFF.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

Looking graphically at the PRG banking registers, pretty sure I found a pattern to explain away the missing $5110/11/12:

Code: Select all

+------+----------++-------------+-----------+-----------+-----------+
| Bank | Register ||   Mode 3    |  Mode 2   |  Mode 1   |  Mode 0   |
+------+----------++-------------+-----------+-----------+-----------+
|  [0] |  [5110]  || [0000-1FFF] |    [X]    |    [X]    |    [X]    |
|  [1] |  [5111]  || [2000-3FFF] |    [X]    |    [X]    |    [X]    |
|  [2] |  [5112]  || [4000-5FFF] |    [X]    |    [X]    |    [X]    |
|   3  |   5113   ||  6000-7FFF  |     ?     |     ?     |     ?     |
|   4  |   5114   ||  8000-9FFF  |  v[5115]  |  v[5115]  |  v[5117]  |
|   5  |   5115   ||  A000-BFFF  | 8000-BFFF | 8000-BFFF |  v[5117]  |
|   6  |   5116   ||  C000-DFFF  | C000-DFFF |  v[5117]  |  v[5117]  |
|   7  |   5117   ||  E000-FFFF  | E000-FFFF | C000-FFFF | 8000-FFFF |
+------+----------++-------------+-----------+-----------+-----------+
It would be interesting to see if the MMC5 PRG output address bits reflect $5110/11/12 even though /CS would be disabled. Also, special attention to $5112 for experiments with accessing possibly mysterious RAM at $5800. Also, I am not sure if anyone has ever checked $5113 behavior versus PRG mode.

Edit:
I have a question for you guys that may have a very obvious answer, I feel embarrassed to ask. Why are there separate address pins for PRG-RAM versus PRG-ROM? For example, why is there a PRG A13 pin and also a separate PRG-RAM A13 pin? How and in what conditions would those ever need to be different than each other?
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: MMC5 Hacking Adventures

Post by lidnariq »

Ben Boldt wrote:It would be interesting to see if the MMC5 PRG output address bits reflect $5110/11/12 even though /CS would be disabled.
[...]
Why are there separate address pins for PRG-RAM versus PRG-ROM? For example, why is there a PRG A13 pin and also a separate PRG-RAM A13 pin? How and in what conditions would those ever need to be different than each other?
These are actually the same question: The MMC5 actually has two 4-way multiplexers instead. This means they don't have to detect whether it's a write to $6000 or to $E000, so can avoid the problem with setup times on the RAM's address bus. The other option (for use with a single 8-way multiplexer) would need a lot more delay before /RAMCE goes true.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

I had not thought about setup delays, that is very intriguing and I had a VERY hard time grasping what you said. I am still not quite sure I get it. Maybe it is easier for me to explain the way I understand and you can correct errors or fill in gaps.

No matter what, CPU A0 - A12 is always connected directly to PRG-RAM and ROM. Those are out of the picture.

PRG A13+ are set by PRG bank registers. I was stuck here -- it seems when you write to a bank register, those A13+ just stay set until you change them again, so I was thinking that it took at least a couple cycles to fetch an LDA $6000 instruction for example, plenty of setup time on A13+. It occurred to me that there are indeed separate PRG banks and when you cross the boundary from one bank into another, the A13+ need to update to that other bank super speedy. So in that case, I definitely see where setup delays are a big deal.

I guess I still don't understand how that would be different for RAM and ROM, why not just use the super speedy ones intended for RAM for ROM too? Sorry I think I just don't get it still.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: MMC5 Hacking Adventures

Post by krzysiobal »

PRG-RAM-A are dependent only on:
* CPU-A14/A13,
* The value stored at bank register, let's call them: $5113.0-3, $5114.0-3, $5115.0-3, $5116.0-3
* Current PRG-mode (let's call them $5100.0-1)

Because when in 16K mode, lowest bit of bank register is ignored, input-output dependence looks like:
PRG-RAM-A13 = f(CPU-A14, CPU-A13, $5113.0, $5114.0, $5115.0, $5116.0, $5100.0, $5100.1)
PRG-RAM-A14 = f(CPU-A14, CPU-A13, $5113.1, $5114.1, $5115.1, $5116.1, $5100.0, $5100.1)
PRG-RAM-A15 = f(CPU-A14, CPU-A13, $5113.2, $5114.2, $5115.2, $5116.2, $5100.0, $5100.1)
PRG-RAM-A16 = f(CPU-A14, CPU-A13, $5113.3, $5114.3, $5115.3, $5116.3, $5100.0, $5100.1)

If they wanted to make just single PRG-A13 (that would combine both PRG-RAM-A13 and PRG-ROM-A13), the decoder would also need to take into account M2 and CPU_!ROMSEL, cause assess to $E000-$FFFF and $6000-$7FFF is indistinguishable without them
So
PRG-A13 would be f(CPU-A14, CPU-A13, M2, CPU_!ROMSEL, $5113.0, $5114.0, $5115.0, $5116.0, $5117.0, $5100.0, $5100.1))

And same for PRG-A14-A16, so it would probably cost more resources and that's why separating those pins.

Now as I suspect (I havent't tested that yet)
PRG-ROM-A13 is just f(CPU-A14, CPU-A13, $5114.1, $5115.1, $5116.1, $517.1, $5100.0, $5100.1)

I don't think it is a problem of the delay between !ROMSEL and M2 change, cause:
* MMC5 does not have write registers at $E000-FFFF
* logic for decoding PRG-!CE / WRAM-!CE is already responsible for that
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

krzysiobal wrote:If they wanted to make just single PRG-A13 (that would combine both PRG-RAM-A13 and PRG-ROM-A13), the decoder would also need to take into account M2 and CPU_!ROMSEL, cause assess to $E000-$FFFF and $6000-$7FFF is indistinguishable without them
I thought that M2 and /ROMSEL would only be considered in PRG/CE and PRG RAM/CE, I guess I don't see how this would be a factor in the address bits. With $E000 vs. $6000, aren't all the address bits out there to the ROMs and RAMs the same and then the /CE's make the choice?
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: MMC5 Hacking Adventures

Post by krzysiobal »

But $5113 is for $6000-$7fff and $5117 is for $e000-$fff so if u won't take !ROMSEL/M2 into account, how u will know which one of those regs to use?
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: MMC5 Hacking Adventures

Post by lidnariq »

Ben Boldt wrote:With $E000 vs. $6000, aren't all the address bits out there to the ROMs and RAMs the same and then the /CE's make the choice?
Only because there are two independent multiplexers. Otherwise, the bankswitching hardware would have to detect whether A15 was high or low, and delay the /CEs until after it had determined which it was.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: MMC5 Hacking Adventures

Post by Ben Boldt »

krzysiobal wrote:But $5113 is for $6000-$7fff and $5117 is for $e000-$fff so if u won't take !ROMSEL/M2 into account, how u will know which one of those regs to use?
OHHHHH I get it now, thanks! :)
lidnariq wrote:
Ben Boldt wrote:With $E000 vs. $6000, aren't all the address bits out there to the ROMs and RAMs the same and then the /CE's make the choice?
Only because there are two independent multiplexers. Otherwise, the bankswitching hardware would have to detect whether A15 was high or low, and delay the /CEs until after it had determined which it was.
Man you guys are smart, I don't know if I would have ever figured that out.
Post Reply