Mapper227's multi-menu display

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Mapper227's multi-menu display

Post by aquasnake » Thu Nov 12, 2020 9:59 pm

This mapper can realize a dynamic display of different menus to deceive users to buy repeatedly.

The dynamic menu has a basic algorithm, to a certain extent, the program is constantly circulating, and through reading the hardware jumper point settings to generate seemingly different menu lists.

The description on wiki is very detailed, but it is not clear when reading dip settings. The following supplementary instructions are provided:

Code: Select all

Dip Register ($8000-$FFFF, read, when m = 1)
Mask: $8000

D~7654 3210
  ---------
  0DDD D...
  |||| |
  |+++ +--- Dip switch setting
  +--- ---- Must be 0, 16~31 are reserved
If m = 0, read the normal RPG-rom

 +-------+----------------------------+
 | value | number of selectable games |
 +-------+----------------------------+
 |   0   | 420 in 1                   |
 |   1   | 460 in 1                   |
 |   2   | 500 in 1                   |
 |   3   | 560 in 1                   |
 |   4   | 600 in 1                   |
 |   5   | 660 in 1                   |
 |   6   | 700 in 1                   |
 |   7   | 860 in 1                   |
 |   8   | 900 in 1                   |
 |   9   | 920 in 1                   |
 |  10   | 940 in 1                   |
 |  11   | 960 in 1                   |
 |  12   | 980 in 1                   |
 |  13   | 400 in 1                   |
 |  14   | 380 in 1                   |
 |  15   | 360 in 1                   |
 +-------+----------------------------+
 | 16~31 | blue screen or glitches    |
 +-------+----------------------------+
Associated thread: viewtopic.php?f=9&t=15271

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Thu Nov 12, 2020 10:22 pm

Using 74157 to confuse is also the cunning of pirate. If the high or low level control is realized by solder joint, it is easy to be guessed by hacker

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Fri Apr 02, 2021 6:05 am

Code: Select all

Banks
CPU $5000-$5FFF: 4 KiB extra PRG-RAM, for manu loader use only
CPU $6000-$7FFF: 8 KiB unbanked PRG-RAM, battery-backed for Nanjing games
CPU $8000-$FFFF: 16/32 KiB switchable PRG-ROM bank
PPU $0000-$1FFF: 8 KiB unbanked CHR-RAM
Nametable mirroring: mapper setting

Registers
When reset/power on: bank mode is set to 32 KiB, prg_14 is forced to "0". Which means only "O=1" and other registers are initialized to $00.

Last edited by aquasnake on Sat Apr 03, 2021 1:18 am, edited 3 times in total.

NewRisingSun
Posts: 1292
Joined: Thu May 19, 2005 11:30 am

Re: Mapper227's multi-menu display

Post by NewRisingSun » Fri Apr 02, 2021 9:52 am

Which Nanjing games use mapper 227?
Last edited by NewRisingSun on Sat Apr 03, 2021 12:10 am, edited 2 times in total.

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Fri Apr 02, 2021 10:08 pm

NewRisingSun wrote:
Fri Apr 02, 2021 9:52 am
Which Nanjing game use mapper 227?
Xiang Shuai Chuan Qi (NJxxx) (Ch).nes

Mei Guo Fu Hao (Waixing) (Ch) [a1].nes

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Fri Apr 02, 2021 10:16 pm

To ensure that when reading the dip setting, it is recommended to access $8000 - $BFFF only. If the read address is in the vfixrom segment, it will cause a crash.

Another method is to copy the menu loader to xram ($5000 - $5fff) and execute from there, and then read DIP setting from any address of $8000 - $FFFF freely

lidnariq
Posts: 10423
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Mapper227's multi-menu display

Post by lidnariq » Fri Apr 02, 2021 10:53 pm

aquasnake wrote:
Fri Apr 02, 2021 10:16 pm
To ensure that when reading the dip setting, it is recommended to access $8000 - $BFFF only. If the read address is in the vfixrom segment, it will cause a crash.
There's no obvious reason that would happen, based on the PCB photos that Zepper shared a while back. Do you have any ideas how?

NewRisingSun
Posts: 1292
Joined: Thu May 19, 2005 11:30 am

Re: Mapper227's multi-menu display

Post by NewRisingSun » Sat Apr 03, 2021 12:03 am

aquasnake wrote:
Fri Apr 02, 2021 10:08 pm
NewRisingSun wrote:
Fri Apr 02, 2021 9:52 am
Which Nanjing game use mapper 227?
Mei Guo Fu Hao (Waixing) (Ch) [a1].nes
That's not a Nanjing game though. It's a Henggedianzi version of a Waixing game. When used for single-game cartridges, it was mostly used by Waixing --- as mapper 242 for 512 KiB games, and mapper 227 for 1 MiB games.

There is an unsolved problem that the multicart version of the mapper has a CHR-RAM protection feature while single-game version doesn't, and the single game do not set the CHR-RAM protect bit correctly as a result.

For all the talk about a multicart version with DIP-dependent menus supposedly circulating, every mapper 227 multicart ROM that I have come across does not read any DIP switches.

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Sat Apr 03, 2021 1:28 am

Instead of reading the dip switch, most emulators just set a counter and accumulate after each reset to switch the menu.Or do not emulate this part of logic at all, just display the default menu
For single-cart games, they have no menulist, dip switch accessing can be completely ignored

Waixing's mapper227 is very simple. It doesn't even switch to 16KiB PRG mode.In 32KiB mode, prg_a14 is generated from whether a bank register bit or cpu_a14:

Code: Select all

prg_base[14] = ~cpu_addr_in[0] & cpu_addr_in[2];
prg_mask[14] = ~cpu_addr_in[0];
I believe Nanjing is the same.
Last edited by aquasnake on Sun Apr 04, 2021 6:50 pm, edited 1 time in total.

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Sat Apr 03, 2021 5:35 am

CRAM write protection only affects the cart without memory saving function, while Chinese RPG games such as Waixing / Nanjing all have backup batteries, so it can be judged heuristically by identifying the battery flag bit of ines header. These carts only work in 32K mode, and "O = 1" conflicts with write protection.

1. For carts with backup battery, CRAM write protection is invalid.
2. If none of carts using this mapper rely on cram write protection, we don't need to consider its emulation. Actually, I suspect that this bit is write protection or mapper lockout?

lockout = ~cpu_addr_in[7];

The menu works in 32K mode and forces PRG_14 to 0, that is, the menu ROM is 16KB in size
When the register "O" is set to 0, it will enter 16K mode and lock the mapper at the same time. After that, it will not be able to write the registers(except bank register?) until NEXT reset to clear the lockout.

In 16K mode, multiple mappers can be combined to form a cart. In theory, it is a combination of maximum 8x128K UxROMs or mapper180 ROMs(and so on). Entering 16K mode is visually represented as entering one of the games selected from the menu.

outer bank: cpu_addr_in[8], cpu_addr_in[6], cpu_addr_in[5];
inner bank: cpu_addr_in[4], cpu_addr_in[3], cpu_addr_in[2];

NROM-128 like: O=1, S=0;
BxROM/NROM-256 like: O=1, S=1;
UNROM like: O=0, S=0, L=1;
inverted UNROM like: O=0, S=0, L=0;

S=1 only works in BxROM like mode;

Part behaves much like mapper59:

https://wiki.nesdev.com/w/index.php/INES_Mapper_059
Last edited by aquasnake on Mon Apr 05, 2021 5:21 am, edited 1 time in total.

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Sun Apr 04, 2021 8:21 pm

Mapper242 is a subset of mapper227. The difference between them is the power on value of "S".

Mapper242 is initialized to BxROM like mode by default. (Write registers at the odd address only??)

Mapper227/mapper242 they can be directly compatible if the 16KB granularity page is copied from bank0 to bank1(from the perspective of game development, not for rom dumping or reproduction).

NewRisingSun
Posts: 1292
Joined: Thu May 19, 2005 11:30 am

Re: Mapper227's multi-menu display

Post by NewRisingSun » Mon Apr 05, 2021 2:29 am

The wiki article says "Bit 11 of the address written activates the menu list selection.", but the bitfield shows the "m" bit, described as "Menu list (see below)", as bit 10 rather than 11.

With no public dump of a multi-menu mapper 227 cart available, none of this information can be verified.

User avatar
aquasnake
Posts: 223
Joined: Fri Sep 13, 2019 11:22 pm

Re: Mapper227's multi-menu display

Post by aquasnake » Mon Apr 05, 2021 4:15 am

NewRisingSun wrote:
Mon Apr 05, 2021 2:29 am
The wiki article says "Bit 11 of the address written activates the menu list selection.", but the bitfield shows the "m" bit, described as "Menu list (see below)", as bit 10 rather than 11.

With no public dump of a multi-menu mapper 227 cart available, none of this information can be verified.
dip_read_enabled = cpu_addr_in[10]; // $84xx

Post Reply