It is currently Thu Sep 19, 2019 6:13 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 28 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sat Jun 29, 2019 3:00 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
This Waixing FS006 PCB is used for Chinese translation of Namco's Sangokushi II: Haou no Tairiku released under their Fuzhou Coolboy brand. Based on debugging the game, the glob in the middle must be a VRC4 clone (identical registers $8000, $A000, $B000-$FFFF) but with the enhancement of a third selectable 8 KiB PRG-ROM bank and extended mirroring:
  • $9C00: Set 8 KiB PRG-ROM bank at CPU $C000-$DFFF
  • $9C0C.0: Set CIRAM bank at PPU $2000-$23FF
  • $9C0D.0: Set CIRAM bank at PPU $2400-$27FF
  • $9C0E.0: Set CIRAM bank at PPU $2800-$2BFF
  • $9C0F.0: Set CIRAM bank at PPU $2C00-$2FFF
With the VRC4 clone's A0 and A1 address lines connected to CPU A10 and A11 (i.e. the IRQ registers are at F000/F400/F800/FC00) and these enhancements, it is similar but not identical to iNES mappers 252 and 253.

The game has 256 KiB of PRG-ROM, 512 KiB of CHR-ROM, 8 KiB of battery-backed RAM, and at least 4 KiB of CHR-RAM. The first 256 KiB of CHR-ROM are the normal CHR-ROM data, the second 256 KiB of CHR-ROM contain additional Chinese characters that are first read via $2007 into CPU RAM, then written into CHR-RAM.

The unsolved mystery is how the game switches between CHR-ROM and CHR-RAM. During our dumping attempts, CHR-RAM was always located at 1 KiB CHR banks $28-$2F and $128-$12F, and only there. The game instead expects CHR-ROM at $28-$2F and wants to write to CHR-RAM at banks $04-$05, $7C-$7D, $4C-$4F, and they must point to the same 4 KiB, otherwise there will be missing character. This indicates to me that the CHR-RAM location must be somehow switchable, but I cannot tell from the game code how. I suspect it to be related to the 74LS157, 74LS174 and the two diodes on the top of the PCB front side.

PCB images from dragon2snow. Front:
Attachment:
FS306-front.png
FS306-front.png [ 898.53 KiB | Viewed 4666 times ]

Back:
Attachment:
FS306-back.png
FS306-back.png [ 1.44 MiB | Viewed 4666 times ]


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 3:49 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 541
Location: Poland
Those two DIL20 chips are PAL16L8 - if you want to be 100% sure how it works, unfortunatelly desoldering and analyzing them outside cartridge is needed.
Plus too many wires hidden underneath them.

I can try to guess and analyze the PCB from the pictures that you provided.


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 3:58 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
I thought they were two 8 KiB SRAM chips.


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 5:31 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 541
Location: Poland
DIP28 on the left is 8kB PRG-RAM (battery backed), DIP24 on the right is 2kB CHR-RAM.

PRG-ROM and CHR-ROM are smd chips, hidden under DIP ones.

74174 latches CPU-D0..D5, no idea at the moments whats the latched value drives.

P_1 is PAL
Inputs: CPU_A0..2, PPU-A10, PPU-A11
Outputs: CIRAM-A10

P2_1 is PAL
Inputs: PPU-!WE, PPU-A13


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 5:42 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 456
I'm out of town,

On July 2

Back to Beijing,I redump


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 6:09 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
Krzysiobal wrote:
DIP24 on the right is 2kB CHR-RAM.
Only 2? Dang.
Krzysiobal wrote:
PRG-ROM and CHR-ROM are smd chips, hidden under DIP ones.
Sneaky.
Krzysiobal wrote:
74174 latches CPU-D0..D5, no idea at the moments whats the latched value drives.
Six bits? Then the 74LS174 must be responsible for latching that the third PRG bank (register $9C00), the 74LS157 the address decoding, and P_1 the extended mirroring ($9C0C-$9C0F).


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 1:56 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 541
Location: Poland
I made some progress.
* Those PALs are probably only combinatory (no sign of any data pins going to them), so except VRC4, there are only 6 additional latched bits that come from 74174, but that would mean they belong to single register address, while in your description they're scattered over different addresses.

* D0..D3 definitely control the additional bank (PRG-A13..16), D4-D5 might control mirroring.

* 74157 switches PRG-A lines (PRG-A13..16) between those coming from 74174 and those coming from VRC4. That means PRG-A17 either is hardwired to VRC-PRG-A17 or it is multiplexed by P_1.

* P_1 is responsible for generating clock signal to the above latch, mirroring control and other glue logic

* P_2 is reponsible for selecting whether CHR-ROM or CHR-RAM should be enabled (depending on the CHR-A lines from VRC)

* CPU-A13 and CPU-A14 of VRC4 are controlled by P_1 which makes CPU memory map non standard (additional 3rd bank instead of the standard -2 bank?)

* blob chip pinout matches exactly the VRC4 one with one exception - there is something non standard with its pins 10/11/12 (CHR_!CE, PPU_A13, PPU_!RD). Normally those pins should function as OR gate, but because CHR-ROM/RAM enabling is no longer function of this chip, I think they reused the OR gate for different purpose (and CPU-A2 is wired there)

* VRC4's pin 18 (which oficcially is NC, but I found its hidden function there is wired to P_1.
Because this pin goes low only during writes to $9003 (when VRC-A0 = CPU-A0, VRC-A1=CPU-A1), in this configuration (VRC-A0 = CPU-A10, VRC-A1=CPU-A11) that would correspond to the $9c00 address


Top
 Profile  
 
PostPosted: Sat Jun 29, 2019 2:12 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
Thank-you, krzysiobal.

More debugging of the game code reveals a simple protection check:
  • Select CHR bank $C2 at PPU $0000, then write anything to $2007 with PPU address $0000-$03FF ->CHR-RAM is supposed to switch to be disabled during reads, always reading from CHR-ROM instead;
  • Select CHR bank $C8 at PPU $0000, then write anything to $2007 with PPU address $0000-$03FF ->CHR-RAM is supposed to switch to be enabled during reads of selected banks (see below).
  • Even when CHR-RAM is disabled during reading in this manner, writes must still go to CHR-RAM.

The second PAL must therefore:
  • If PPU-!WE is high and the "enable flag" is set, compare CHR address lines to an unknown mask and read from CHR-RAM, otherwise from CHR-ROM.
  • If PPU-!WE is low:
    • If CHR A10-A17=$C2, clear the "enable flag"
    • If CHR A10-A17=$C8, set the "enable flag"
    • Otherwise, leave the "enable flag" alone.
Can a simple PAL do such a thing, or is that unrealistic?

Given that during dumping, I got CHR-RAM at different banks than what the game needs, I suspect that selecting a $Cx bank while PPU !WE is low also selects among several CHR-RAM-enabling address masks.


Top
 Profile  
 
PostPosted: Sun Jun 30, 2019 2:47 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
Comparing this game with a few other mapper 253 and 195(!) games indicates:
  • There is no "enable" flag, but there is the ability to switch the CHR banks that are redirected to RAM by the PAL/GAL.
  • The way to switch the CHR banks that are redirected to RAM is to set a bank value in the $8x or $Cx range, then write to the corresponding PPU address range. The write is necessary since the PAL has no means of seeing any CPU data bits; it will instead make its evaluation based on the CHR address bits when PPU !WE is low.
  • There does not seem to be an arithmetic relationship between the bank value being written to trigger the change, and the banks this affects other than a 2 KiB/4 KiB switch in A16. But the values seem to be uniform across all games (VRC4- and MMC3-based) that use this method. The values I have seen so far are:
    • 0x80: Mask $FC, Compare $28: Used by Columbus (mapper 536) and Captain Tsubasa II (mapper 537)
    • 0x82: Mask $FC, Compare $00: Used by Sugoro Quest (mapper 195), Crystalis (mapper 195) and also Captain Tsubasa II (mapper 537)
    • 0x88: Mask $FC, Compare $4C: Used by Dragon Ball Z II (mapper 253), Sangokushi II (unassigned)
    • 0xC2: Mask $FE, Compare $7C: Used by Sangokushi II (unassigned)
    • 0xC8: Mask $FE, Compare $04: Used by Dragon Ball Z II (mapper 253), Dragon Ball Z Gaiden (mapper 253), Sangokushi II (unassigned)
    Captain Tsubasa II, Dragon Ball Z II and Sangokushi II therefore switch between settings.
  • The power-on setting seems to be $80, which explains why I got CHR-RAM at $28-$2F during dumping even though the game does not use that range for CHR-RAM.
  • Sangokushi II uses value $88 during battles, which given that the PCB only has 2 KiB of CHR-RAM mounted, must mean that banks $4E+$4F therefore become mirrors of $4C+$CD.
  • Note that some games normally listed as mappers 195, such as Traitor Legend and the later release of Columbus, actually use Mapper 176, which has no movable CHR-RAM banks, and are therefore not listed here.

This means that Mappers 536 and 537 are just different software settings of mapper 195 and thus should be reassigned back to 195. 195 therefore is just the Waixing FS303 board (PCB images: front, back) that now turns out to have movable CHR-RAM banks. Other games that also use mapper 253, such as Dragon Ball Z, as well as games using mappers 74, 191, 192, 194, 252, do not use this method of moving CHR-RAM to different CHR banks. I suspect that they use a simpler PCB with a fixed CHR-RAM bank mask.


Top
 Profile  
 
PostPosted: Sun Jun 30, 2019 4:23 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 456
NewRisingSun wrote:
Comparing this game with a few other mapper 253 and 195(!) games indicates:
  • There is no "enable" flag, but there is the ability to switch the CHR banks that are redirected to RAM by the PAL/GAL.
  • The way to switch the CHR banks that are redirected to RAM is to set a bank value in the $8x or $Cx range, then write to the corresponding PPU address range. The write is necessary since the PAL has no means of seeing any CPU data bits; it will instead make its evaluation based on the CHR address bits when PPU !WE is low.
  • There does not seem to be an arithmetic relationship between the bank value being written to trigger the change, and the banks this affects other than a 2 KiB/4 KiB switch in A16. But the values seem to be uniform across all games (VRC4- and MMC3-based) that use this method. The values I have seen so far are:
    • 0x80: Mask $FC, Compare $28: Used by Columbus (mapper 536) and Captain Tsubasa II (mapper 537)
    • 0x82: Mask $FC, Compare $00: Used by Sugoro Quest (mapper 195), Crystalis (mapper 195) and also Captain Tsubasa II (mapper 537)
    • 0x88: Mask $FC, Compare $4C: Used by Dragon Ball Z II (mapper 253), Sangokushi II (unassigned)
    • 0xC2: Mask $FE, Compare $7C: Used by Sangokushi II (unassigned)
    • 0xC8: Mask $FE, Compare $04: Used by Dragon Ball Z II (mapper 253), Dragon Ball Z Gaiden (mapper 253), Sangokushi II (unassigned)
    Captain Tsubasa II, Dragon Ball Z II and Sangokushi II therefore switch between settings.
  • The power-on setting seems to be $80, which explains why I got CHR-RAM at $28-$2F during dumping even though the game does not use that range for CHR-RAM.
  • Sangokushi II uses value $88 during battles, which given that the PCB only has 2 KiB of CHR-RAM mounted, must mean that banks $4E+$4F therefore become mirrors of $4C+$CD.
  • Note that some games normally listed as mappers 195, such as Traitor Legend and the later release of Columbus, actually use Mapper 176, which has no movable CHR-RAM banks, and are therefore not listed here.

This means that Mappers 536 and 537 are just different software settings of mapper 195 and thus should be reassigned back to 195. 195 therefore is just the Waixing FS303 board (PCB images: front, back) that now turns out to have movable CHR-RAM banks. Other games that also use mapper 253, such as Dragon Ball Z, as well as games using mappers 74, 191, 192, 194, 252, do not use this method of moving CHR-RAM to different CHR banks. I suspect that they use a simpler PCB with a fixed CHR-RAM bank mask.


我在DIScord和你说过.他们是一个大的mapper
但我希望进行更小的分化。
只有精细化最小后,才能真正的合并


Top
 Profile  
 
PostPosted: Sun Jun 30, 2019 11:23 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8560
Location: Seattle
NewRisingSun wrote:
is just the Waixing FS303 board (PCB images: front, back)
Because of how 16V8s work, the state that is selected by writing to a bank (per your notes, CHRB~[XY.. Y.Y.], X=1) must be exposed on three of its pins... so three of the pins (12-19) must be connected to nothing...

Looking at the PCB picture, CHR ROM A11...A17 (it's a 16-bit ROM, so pin names are off by one in an 8 bit context) are connected to GAL pins 2...8, and PPU /WR is connected to GAL pin 9. Pin 11(I/OE) is grounded, so it's probably operating in "Registered" mode and pin 1 is likely connected to pin 9. Pin 18 makes it way under the CHR RAM, and I can't tell for pins 12-17,+19, but it seems like there's plenty unused to both hold CHR ROM /CE, CHR RAM /CE, and the three bits of state above.


Top
 Profile  
 
PostPosted: Mon Jul 01, 2019 6:47 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 456
Attachment:
QQ图片20190701214332.jpg
QQ图片20190701214332.jpg [ 303.41 KiB | Viewed 4399 times ]

Attachment:
QQ图片20190701214324.jpg
QQ图片20190701214324.jpg [ 314.77 KiB | Viewed 4399 times ]


Top
 Profile  
 
PostPosted: Mon Jul 01, 2019 10:10 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
MLX and I did some experiments with the MMC3-based FS303 board. The result:
Code:
cmd   banks
80   28-2B
81   28-2B
82   00-03
83   00-03
84   28-2B
85   28-2B
86   00-03
87   00-03
88   4C-4F
89   4C-4F
8A   64-67
8B   64-67
8C   4C-4F
8D   4C-4F
8E   64-67
8F   64-67

90   none
A0   28-2B

C0   46-47
C1   46-47
C2   7C-7D
C3   7C-7D
C4   46-47
C5   46-47
C6   7C-7D
C7   7C-7D
C8   0A-0B
C9   0A-0B
CA   none
CB   none
CC   0A-0B
CD   0A-0B
CE   none
CF   none

D0   none
E0   46-47
F0   none
"cmd" means the 1 KiB CHR bank to which a PPU write is issued, "banks" the 1 KiB CHR banks which become CHR-RAM as a result. As lidnariq suspected, only a few bits are relevant: D1, D3, D6 select one of eight different configurations, with D6 also selecting between 4 KiB (clear) and 2 KiB (set). D4 however also makes a difference, disabling CHR-RAM altogether when set. This can either mean that there are sixteen settings, and the D4-set ones just are not filled (like the CA setting), or D4 is really just a CHR-RAM disable flag.

Sadly, the values are not completely identical to the VRC4-based FS306, where "cmd" $C8 causes CHR banks $04 and $05 to be come CHR-RAM instead. So although both boards use similar GAL chips (as zxbdragon's set of pictures with the peeled-off label shows), they are not identical.


Top
 Profile  
 
PostPosted: Mon Jul 01, 2019 11:54 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8560
Location: Seattle
One thing I find a little weird... In the picture "DuShenBack", the CHR RAM there appears to be a 256kibit (part number KM68257?). But A14 is tied to +5V, I can't see what happens with A13, and A12 connects to CHR ROM A12. So even though only 4 KiB of CHR RAM can be used to draw tiles on any given vertical refresh, it seems like at least 8 KiB can be stored, and the game could switch between different 4 KiB windows without having to reload tiles.


Top
 Profile  
 
PostPosted: Mon Jul 01, 2019 12:05 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
Now that you mention it... in addition to searching for patterns in the ROM dump that look like CHR-RAM (basically, sequences of FF 00 FF 00 FF 00...), I did write a little four-byte signature using setting $82 first. That signature was present in values $80/$82, but was gone in $88/$8A and all the $Cx ones. I initially paid no attention to it, thinking that CHR-RAM content must have been corrupted somehow. But with that comment in mind, CHR-RAM bankswitching would explain it.

Edit: On second thought, I don't think it's explicit bankswitching, but instead the CHR-RAM is just getting the same lower address lines as the CHR-ROM, so different "cmds" just implicitly select different sections of the 32 KiB CHR-RAM.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 28 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: Google [Bot] and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group