It is currently Fri Nov 17, 2017 12:38 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 35 posts ]  Go to page 1, 2, 3  Next
Author Message
PostPosted: Sat Nov 04, 2017 2:56 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 311
Here's an odd one. This board type is used on the two Korean cartridges specified in the thread subject, each containing a handful of "educational" minigames. It consists of an AX5202P MMC3 clone, a 74LS174, and a Programmable Logic Array (PAL) chip. I don't know for sure how this board works internally, only what the Kazzo dumping script must look like to get a usable ROM image, and how to emulate it to make it work.

Apart from the usual MMC3 registers, there is an Outer Bank register at $8010-$801F which seems to latch the four lowest address bits. The outer bank register does not simply add additional bits to the MMC3 bank registers, but instead adds a start address that is not a power of two to whatever the MMC3 is addressing. The values written to the outer bank register are only #$00, #$05, #$0A, or #$0F.

In the CPU address space, the outer bank register simply functions as an additional 16K bank number, so a value of #$05 adds a start address of 0x14000. Of course, the MMC3 bank registers 6 and 7 can be set to access an inner bank address of 0x14000+ as well with values #$0A to #$0F. These values have a special meaning: they are hard-wired to access the last outer bank, regardless of the outer bank register, so an MMC3 bank register value of #0x0A will select a bank starting at 0x3C000 (the start address of outer bank #0x0F) plus 0x14000 (the inner bank start address) = 0x50000. This means in practice that outer banks #$00, #$05, #$0A are 80K in size (because the last 48K are taken from outer bank #$0F), while outer bank #$0F is 128 KiB in size, yielding a total PRG-ROM size of 368 KiB. This is the case for both cartridges.

PPU space mapping is different. The same outer bank register also selects an outer CHR-ROM bank, but its size (for the outer bank register's step size of 5) differs between the two cartridges. In the first pack, the outer CHR bank is 96 KiB (MMC3 bank register values #$00-#$5F are valid) yielding a total CHR-ROM size of 384 KiB, while in the second pack, the outer CHR bank size is 120 KiB (MMC3 bank register values #$00-#$77 are valid) yielding a total CHR-ROM size of 480 KiB. If an MMC3 CHR bank register contains a value higher than #$5F/#$77, then the beginning of the last hard-wired outer PRG-ROM bank is mapped into PPU space! The games do not seem to rely on that feature, but it allows me to determine what the outer CHR bank size actually is. Assuming a fixed number of four outer CHR banks, the outer CHR bank size can then be detected by an emulator by simply looking at the number of 8 KiB CHR-ROM banks in the NES header. I don't know how the board actually manages to derive values of #$60 or #$78 from an outer bank register value of #$05, though.


Attached find PCB images, a Nintendulator mapper source file, and Kazzo dumping scripts for the two cartridges. I do not know the Kazzo language enough to automatically determine the outer CHR bank size by looking for the PRG-ROM data appearing in PPU address space, so each pack has its own dumping script. Compiled mapper DLL here. I have tentatively assigned mapper number 516 for this board, as it is an Asia-only release. PCB images and cartridge dumping by MLX, whose prerogative it is to release the ROM images at an appropriate place. The previous ROM images that are floating around the internet disregarded the outer bank register and are thus incomplete.

Edit: See below.


Attachments:
BrilliantCom_PCB_Front.jpg
BrilliantCom_PCB_Front.jpg [ 3.02 MiB | Viewed 525 times ]
BrilliantCom_PCB_Back.jpg
BrilliantCom_PCB_Back.jpg [ 2.77 MiB | Viewed 525 times ]


Last edited by NewRisingSun on Mon Nov 06, 2017 3:06 pm, edited 1 time in total.
Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 11:56 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
NewRisingSun wrote:
cartridge dumping by MLX
Would MLX be willing to measure what the pins of the PAL are connected to?


Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 12:53 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
NewRisingSun wrote:
then the beginning of the last hard-wired outer PRG-ROM bank is mapped into PPU space!
There is literally no physical way that can possibly be true. The Kazzo (for pin count reasons) connects both the cart CPU and PPU address and data buses together, so you're necessarily seeing an artifact of that.


Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 12:55 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 311
Why and how would setting an MMC3 bank number higher than the board hardware expects suddenly expose a Kazzo artifact?


Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 1:03 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
There is no physical connection on the cart itself between the CPU's data bus and the PPU's data bus; not via the PAL, not via the MMC3 clone, not via the latch. There is absolutely no possible way, in any way shape or form, for data to get from one ROM to the other's bus.

In order to explain how it could possibly cause an artifact from the Kazzo, I'd need to know how the PAL is connected.

Another simpler possibility is that for some inscrutable reason, the CHR ROM literally contains a copy of some of the data from the PRG ROM.


Last edited by lidnariq on Sat Nov 04, 2017 1:06 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 1:05 pm 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
I'll try to see how it's wired. Give me some time.


Top
 Profile  
 
PostPosted: Sat Nov 04, 2017 5:21 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 350
thank you!!! wait rom..for test


Top
 Profile  
 
PostPosted: Sun Nov 05, 2017 1:30 pm 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
Most pins seems to be left unconnected.

I guess it's not very useful on how it is (since you'd need to know what pin 18 is doing with the rest of the '174…) but it's a start…


Attachments:
file.jpg
file.jpg [ 3.18 MiB | Viewed 359 times ]
file-1.jpg
file-1.jpg [ 2.95 MiB | Viewed 359 times ]
Top
 Profile  
 
PostPosted: Sun Nov 05, 2017 2:56 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
1 - M2? should also be on cart connector
2 - /ROMSEL in
3 - R/W
4 - A4
18 - 174 "latch the contents of the address bus".
19 - /ROMSEL to MMC3

So ... it looks like the mask for this outer bank register is actually $801F, not $E01F or anything else finer. And it also very likely changes the mask for the underlying MMC3 registers to $E011.

If the PAL and latch outputs don't get between the AX5202P and the address pins of the ROMs... that basically means there's no way for the purported not-power-of-2 offset.

Between MLX's connectivity, and tracing what else I can from the photos of the PCB, I can say for certain is that the latched copy of A0 (74'174 pin 2) goes to PRG ROM A17 (pin 30).

latched copy of A1 (pin 5) probably goes to PRG ROM A18; latched copy of A3 (pin 10) probably goes to CHR ROM A18.


MLX, would you be willing to see what pins 2, 5, 7, and 10 of the 74'174 connect to?


Top
 Profile  
 
PostPosted: Sun Nov 05, 2017 4:04 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 311
If I drop the whole "hard-wired" outer bank theory in favor of the last 48K of each 128K PRG ROM portion just having being copied into each bank during assembly of the ROM images for production, then the whole thing becomes much simpler.
Code:
8010+x  bits
00      0000
05      0101
0A      1010
0F      1111
        ||||
        |||+-------- PRG A17
        ||+--------- PRG A18
        |+---------- CHR A17
        +----------- CHR A18
       
       
        A00..A14        CPU     (0000-7FFF)
        A13..A16        MMC3    (8K 00-0F, A17/A18 unconnected?)
        A17..A18        latch   (128K 00-03)
       
        A00..A12        PPU     (0000-1FFF)
        A10..A16        MMC3    (1K 00-7F, A17 unconnected?)
        A17..A18        latch   (128K 00-03)
Which would simply give 512 KiB PRG and CHR ROM. I'm probably getting a few details wrong, but you get the idea.

lidnariq wrote:
Another simpler possibility is that for some inscrutable reason, the CHR ROM literally contains a copy of some of the data from the PRG ROM.
The PRG data at the end each 128K CHR ROM bank might be due to a buffer used by some ROM preparation program that, for each 128 KiB bank, was filled with user data. The same buffer may have been used for preparing CHR ROM bank data after it had been used for preparing PRG ROM bank data, and since the CHR ROM bank data did not fully fill up the buffer, whatever was left in the buffer from previous banks just got burnt into the ROM? Kind of like MS-DOS directory data ended up in the Beauty and the Beast NES ROM image.


Top
 Profile  
 
PostPosted: Sun Nov 05, 2017 4:43 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
I agree with everything you just said.


Top
 Profile  
 
PostPosted: Mon Nov 06, 2017 3:17 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 311
I have rewritten the Kazzo dumping script according to the simplified mapper description, and unsurprisingly, the redumped pack 1 ran flawlessly using a mapper source reflecting that simplified mapper. I have also verified again that the last 48 KiB are indeed identical between the four 128 KiB PRG banks. I have attached the updated Kazzo dumping script and Nintendulator mapper source file. Compiled mapper DLL here.

One question remains: while I can understand the need for an outer CHR-ROM bank given that the MMC3 can only address 256 KiB of CHR-ROM, why have an outer bank like this for 512 KiB PRG-ROM, which the MMC3 supports natively? I could understand it if one wanted to switch the otherwise fixed bank at E000, but that's the part that is identical between all banks' data.


Attachments:
mapper516.ad.txt [1.04 KiB]
Downloaded 11 times
mapper516.cpp [1.09 KiB]
Downloaded 11 times
Top
 Profile  
 
PostPosted: Mon Nov 06, 2017 3:26 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6437
Location: UK (temporarily)
I have no good guesses; my only thought is that maybe they designed the hardware before software development knew they'd want the same fixed bank thereafter.


Top
 Profile  
 
PostPosted: Mon Nov 06, 2017 6:36 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 350
dumped ok?


Top
 Profile  
 
PostPosted: Tue Nov 07, 2017 5:07 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 38
Can you release KS-7030 please? :beer:


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 35 posts ]  Go to page 1, 2, 3  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group