nesdev.com

Here's an odd one. This board type is used on the two Korean cartridges specified in the thread subject, each containing a handful of "educational" minigames. It consists of an AX5202P MMC3 clone, a 74LS174, and a Programmable Logic Array (PAL) chip. I don't know for sure how this board works internally, only what the Kazzo dumping script must look like to get a usable ROM image, and how to emulate it to make it work.

Apart from the usual MMC3 registers, there is an Outer Bank register at $8010-$801F which seems to latch the four lowest address bits. The outer bank register does not simply add additional bits to the MMC3 bank registers, but instead adds a start address that is not a power of two to whatever the MMC3 is addressing. The values written to the outer bank register are only #$00, #$05, #$0A, or #$0F.

In the CPU address space, the outer bank register simply functions as an additional 16K bank number, so a value of #$05 adds a start address of 0x14000. Of course, the MMC3 bank registers 6 and 7 can be set to access an inner bank address of 0x14000+ as well with values #$0A to #$0F. These values have a special meaning: they are hard-wired to access the last outer bank, regardless of the outer bank register, so an MMC3 bank register value of #0x0A will select a bank starting at 0x3C000 (the start address of outer bank #0x0F) plus 0x14000 (the inner bank start address) = 0x50000. This means in practice that outer banks #$00, #$05, #$0A are 80K in size (because the last 48K are taken from outer bank #$0F), while outer bank #$0F is 128 KiB in size, yielding a total PRG-ROM size of 368 KiB. This is the case for both cartridges.

PPU space mapping is different. The same outer bank register also selects an outer CHR-ROM bank, but its size (for the outer bank register's step size of 5) differs between the two cartridges. In the first pack, the outer CHR bank is 96 KiB (MMC3 bank register values #$00-#$5F are valid) yielding a total CHR-ROM size of 384 KiB, while in the second pack, the outer CHR bank size is 120 KiB (MMC3 bank register values #$00-#$77 are valid) yielding a total CHR-ROM size of 480 KiB. If an MMC3 CHR bank register contains a value higher than #$5F/#$77, then the beginning of the last hard-wired outer PRG-ROM bank is mapped into PPU space! The games do not seem to rely on that feature, but it allows me to determine what the outer CHR bank size actually is. Assuming a fixed number of four outer CHR banks, the outer CHR bank size can then be detected by an emulator by simply looking at the number of 8 KiB CHR-ROM banks in the NES header. I don't know how the board actually manages to derive values of #$60 or #$78 from an outer bank register value of #$05, though.

Attached find PCB images, a Nintendulator mapper source file, and Kazzo dumping scripts for the two cartridges. I do not know the Kazzo language enough to automatically determine the outer CHR bank size by looking for the PRG-ROM data appearing in PPU address space, so each pack has its own dumping script. Compiled mapper DLL here. I have tentatively assigned mapper number 516 for this board, as it is an Asia-only release. PCB images and cartridge dumping by MLX, whose prerogative it is to release the ROM images at an appropriate place. The previous ROM images that are floating around the internet disregarded the outer bank register and are thus incomplete.

Edit: See below.

Would MLX be willing to measure what the pins of the PAL are connected to?

There is literally no physical way that can possibly be true. The Kazzo (for pin count reasons) connects both the cart CPU and PPU address and data buses together, so you're necessarily seeing an artifact of that.

Why and how would setting an MMC3 bank number higher than the board hardware expects suddenly expose a Kazzo artifact?

There is no physical connection on the cart itself between the CPU's data bus and the PPU's data bus; not via the PAL, not via the MMC3 clone, not via the latch. There is absolutely no possible way, in any way shape or form, for data to get from one ROM to the other's bus.

In order to explain how it could possibly cause an artifact from the Kazzo, I'd need to know how the PAL is connected.

Another simpler possibility is that for some inscrutable reason, the CHR ROM literally contains a copy of some of the data from the PRG ROM.

I'll try to see how it's wired. Give me some time.

thank you!!! wait rom..for test

Most pins seems to be left unconnected.

I guess it's not very useful on how it is (since you'd need to know what pin 18 is doing with the rest of the '174…) but it's a start…

1 - M2? should also be on cart connector
2 - /ROMSEL in
3 - R/W
4 - A4
18 - 174 "latch the contents of the address bus".
19 - /ROMSEL to MMC3

So ... it looks like the mask for this outer bank register is actually $801F, not $E01F or anything else finer. And it also very likely changes the mask for the underlying MMC3 registers to $E011.

If the PAL and latch outputs don't get between the AX5202P and the address pins of the ROMs... that basically means there's no way for the purported not-power-of-2 offset.

Between MLX's connectivity, and tracing what else I can from the photos of the PCB, I can say for certain is that the latched copy of A0 (74'174 pin 2) goes to PRG ROM A17 (pin 30).

latched copy of A1 (pin 5) probably goes to PRG ROM A18; latched copy of A3 (pin 10) probably goes to CHR ROM A18.


MLX, would you be willing to see what pins 2, 5, 7, and 10 of the 74'174 connect to?

If I drop the whole "hard-wired" outer bank theory in favor of the last 48K of each 128K PRG ROM portion just having being copied into each bank during assembly of the ROM images for production, then the whole thing becomes much simpler.Which would simply give 512 KiB PRG and CHR ROM. I'm probably getting a few details wrong, but you get the idea.

The PRG data at the end each 128K CHR ROM bank might be due to a buffer used by some ROM preparation program that, for each 128 KiB bank, was filled with user data. The same buffer may have been used for preparing CHR ROM bank data after it had been used for preparing PRG ROM bank data, and since the CHR ROM bank data did not fully fill up the buffer, whatever was left in the buffer from previous banks just got burnt into the ROM? Kind of like MS-DOS directory data ended up in the Beauty and the Beast NES ROM image.

I agree with everything you just said.

I have rewritten the Kazzo dumping script according to the simplified mapper description, and unsurprisingly, the redumped pack 1 ran flawlessly using a mapper source reflecting that simplified mapper. I have also verified again that the last 48 KiB are indeed identical between the four 128 KiB PRG banks. I have attached the updated Kazzo dumping script and Nintendulator mapper source file. Compiled mapper DLL here.

One question remains: while I can understand the need for an outer CHR-ROM bank given that the MMC3 can only address 256 KiB of CHR-ROM, why have an outer bank like this for 512 KiB PRG-ROM, which the MMC3 supports natively? I could understand it if one wanted to switch the otherwise fixed bank at E000, but that's the part that is identical between all banks' data.

I have no good guesses; my only thought is that maybe they designed the hardware before software development knew they'd want the same fixed bank thereafter.

dumped ok?

Can you release KS-7030 please?