It is currently Mon Sep 16, 2019 1:49 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Weird pirate MMC3 PCB
PostPosted: Wed Sep 11, 2019 2:09 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 101
While checking the original releases of the infamous Super Bros. hacks, I remembered that my two copies of the Jackie Chan one (Super Bros. 10) had different PCBs. The small one revealed to be M196, like most of those hacks. However the large one, which at first was a candidate for an original print with an obscure mapper, showed to be just standard MMC3.

Was this meant to be a 2-in-1 MMC3 multicart with two 2x128kB games? Clues on the reason for the 4kB UVEPROM?


Attachments:
SB10A-fc-pcbB.jpg
SB10A-fc-pcbB.jpg [ 1.43 MiB | Viewed 340 times ]
SB10A-fc-pcbF.jpg
SB10A-fc-pcbF.jpg [ 1.2 MiB | Viewed 340 times ]
Top
 Profile  
 
PostPosted: Wed Sep 11, 2019 2:59 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 540
Location: Poland
The small PCB:
very similar (if not identical) to Super Mario Bros 16 which has PRG/CHR address lines mixed and MMC3.A0=CPU.A3

The big PCB:
Hard to tell without knowing how the signals underneath 74.. chips go.
* 2C and 2D are 128k PRG/CHR mask roms with pin1 = A16 and pin 22 = A15
* 27C512 is 64k CHR one-time programmable EPROM with regular pinout (pin1 = A15)
* tracks under 2732 shows it was not prepared for more than 8k
* blob is MMC3 with standart pinout & connections

I think 2C and 2D are PRG/CHR of regular Jackie Chan, 27512 adds mario graphics to it and 4k EPROM is some patch for PRG that allows the game with altered MMC3 registers (MMC3.A0=CPU.A3) to work on regular connection.
Similar patch in additional EPROM like in Don Doko Don 2.


Top
 Profile  
 
PostPosted: Wed Sep 11, 2019 7:57 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
You mean Don Doko Don, not Don Doko Don 2. (That thread is the most headache-inducing piece of confusing chatter I have seen in a long time. First four cartridges, then two additional variations of one of the four, one of which gets its CHR data replaced with that of yet another game version.)

I can definitely say that there is no jump or vector into the $6000-$7FFF area. It dumps as normal TLROM.

Edit: Trying to dump the $6000-$7FFF area results in 6000 being 00 and the rest of the range having $ff on the first read, and on any of the subsequent reads, the whole range containing solely $ff, which I assume is open bus behavior.


Top
 Profile  
 
PostPosted: Sun Sep 15, 2019 1:25 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 540
Location: Poland
Quote:
You mean Don Doko Don

Yes, sorry.

Quote:
I can definitely say that there is no jump or vector into the $6000-$7FFF area. It dumps as normal TLROM.

I think the "patch" is done on the fly, without jumping, that is - when accessing to some range of ROM address, the additional logic enables the "patched ROM" instead of the original one, this probably occurs for PRG and CHR.

Do you have dump of the cartridge? I would like to compare it against:
Country_Unk\Super Bros 10 Kung Fu Mari.nes
Japan\Jackie Chan (J) [a1].nes
Japan\Jackie Chan (J).nes

For example, looking at the ROM offsett 1FFE0 shows that the signature ("JACKIE CHAN") is in different offsets. So those 2 versions of Jackie Chan are probably complete different builds and Super Bros 10 is a patched "Jakcie Chan" of yet another built.

Image

--

I compared Super Bros 10 Kung Fu Mari.nes against USA\Jackie Chan's Action Kung Fu (U).nes and they seems to be almost same, differences, here are difference regions:

PRG:
D65B-D698 copyright information cut off
F85F-F861 ?
FB06-FB08 ?
FB0E ?
FDF9 ?
1C284, 1C292, 1C737 (*)
1CA8D ?
1CA91 ?
1CAE8 ?
1CF1E ?
1CF23 ?

1DD18, 1E1AB, 1E1B1, 1E1DF, 1E20F, 1E215, 1E29B, 1E2D0, 1E3AC, 1F53B, 1F548, 1F6E8, 1F83A, 1FD72 (*)

(*) = those refers to the fact that Jackie Chans Use 8001/E001/C001 while Super Bros 10 - 8005/E005/C005 (which is irrelevant cause for MMC3 is the same)


CHR:
2E111-38B9A (less than 64k)

No idea why the patch and whole logic instead of just putting EPROMs with altered PRG/CHR.


Top
 Profile  
 
PostPosted: Sun Sep 15, 2019 10:48 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 540
Location: Poland
Ok I think I got it.

PRG:
Assuming they wanted to patch the above regions marked as (?), they needed to cover those 2 regions:
Code:
$0f800-$0ffff = 011111xxxxxxxxxxx
$1c800-$1cfff = 111001xxxxxxxxxxx
                ||||||
                |||||+- CPU A11
                ||||+-- CPU A12
                |||+--- MMC3 PRG A13
                ||+---- MMC3 PRG A14
                |+----- MMC3 PRG A15
                +------ MMC3 PRG A16

Which is perfectly done using the following circuit:
Image
Connecting 2732.A11 to MMC.A16 causes the first 2 kB of 2732 EPROM to store the first region and the second 2kB the other.

-

CHR:
By dividing the whole CHR into eight 16k regions and counting how many bytes in that regions differ shows that there are only four regions that need to be patched.
Code:
   region      # diffs
$00000-$03fff: 0       000
$04000-$07fff: 0       001
$08000-$0bfff: 0       010
$0c000-$0ffff: 2747    011 - fourth 16k in 27c512
$10000-$13fff: 4660    100 - first 16k in 27c512
$14000-$17fff: 3248    101 - second 16k in 27c512
$18000-$1bfff: 1118    110 - third 16k in 27c512
$1c000-$1ffff: 0       111
                       |||
                       ||+- MMC3 CHR A14
                       |+-- MMC3 CHR A15
                       +--- MMC3 CHR A16

Which is perfectly done using the following circuit:
Image

The missing 7402, if soldered (without 74138/7432/7400) makes the PCB usable as regular MMC3 with two 64K standard CHR-EPROMS. There must be some jumpers underneath CHR-ROM however that disconnects MMC3-CHR-A16 from its pin1.

There is no way to read-back unmodified parts of 2C and 2D mask roms without cutting some traces or desoldering them.

Image Image


Top
 Profile  
 
PostPosted: Sun Sep 15, 2019 12:50 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 975
So does this imply that the "patched" MMC3 cartridge is the original version of that port Mario hack, and the mapper 196 version is not the original one? Or does it only say that somebody might have had a surplus of Jackie Chan mask ROMs and might have wanted to re-use them for a better-selling Mario hack?


Top
 Profile  
 
PostPosted: Sun Sep 15, 2019 1:45 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 540
Location: Poland
I think this is rather independent hack, just like many different SMB2J hacks floating around.

If this cartridge was from 88 or earlier, I would say that huge EPROMs were expensive and making all that "patching" using smaller ROMs was more economical to save money than using four 27512 (or two 27010) chips.

But basing on the manufacturing dates of chips (1992) plus all the 74 logic which costs and time needed to design PCB makes me think that this is rather some kind of copy-protection - author assumed that somebody who would like to duplicate this cartridge will need not only to read-back eproms, but also analyze the circuitry. I doubt this PCB can be used for any other game.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: Bregalad and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group