It is currently Thu Oct 18, 2018 3:16 pm

All times are UTC - 7 hours



Forum rules





Post new topic Reply to topic  [ 97 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next
Author Message
PostPosted: Sat Sep 23, 2017 3:19 pm 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 653
LuigiBlood wrote:
Radio ON: Clear bit7 of $2197
Radio OFF: Set bit7 of $2197

Thanks, good to know! I had only figured out that it was somehow related to powerdown and/or soundlink.
So it seems to be simply soundlink related (assuming that the "radio" is the same as the "soundlink" feature).


Top
 Profile  
 
PostPosted: Sun Sep 24, 2017 6:19 pm 
Offline

Joined: Mon Aug 28, 2017 6:00 pm
Posts: 8
Here are two photos of a BSC-1J5M-01 with the Datapak connector removed, for reference.
(Needed the connector for something, figured I’d photograph the board)


Attachments:
back.jpg
back.jpg [ 1.48 MiB | Viewed 2546 times ]
front.jpg
front.jpg [ 1.39 MiB | Viewed 2546 times ]
Top
 Profile  
 
PostPosted: Fri Nov 03, 2017 4:20 pm 
Offline

Joined: Sat Apr 28, 2012 7:22 am
Posts: 18
A photo of the SameGame character cartridge PCB. Fullsnes.htm seemed to be missing verified info on these, so uploading if it's of any help.


Attachments:
BSMC-CR-01 PCB.jpg
BSMC-CR-01 PCB.jpg [ 796.2 KiB | Viewed 2385 times ]
Top
 Profile  
 
PostPosted: Mon Nov 06, 2017 11:50 am 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
nocash wrote:
LuigiBlood wrote:
Radio ON: Clear bit7 of $2197
Radio OFF: Set bit7 of $2197

Thanks, good to know! I had only figured out that it was somehow related to powerdown and/or soundlink.
So it seems to be simply soundlink related (assuming that the "radio" is the same as the "soundlink" feature).


I actually didn't say it much, but bit 0 of $2194 does enable the stream registers. In fact, I heard even a static sound when I enabled it (when SPC700 is unmuted... which I did).
Reading $218B (or $2191), because it isn't initialized properly, reads garbage, and the data is ORed at $218D (or $2193), that's done no matter what... but when I read it when $2194.0 is set, it does read once and then resets itself to 0x00. But when it isn't, when that bit is unset, it does not reset. That bit is simply the one that enables stream registers.


Top
 Profile  
 
PostPosted: Wed Nov 22, 2017 9:25 pm 
Offline

Joined: Sat Apr 28, 2012 7:22 am
Posts: 18
sanmaiwashi released a specialized SRAM dumper for Superufo Pro 8 just a few days ago so here's another fresh BS-X SRAM dump incoming.
This one's got a few SRAM patches too but I'm unable to tell if they differ from the previously discovered ones.
The player's got a ton of money and items with interesting descriptions and dialog boxes.
Maybe worth of translating, since the file seems to have lots of save data from different games.


Attachments:
bsx-blurayno.zip [4.64 KiB]
Downloaded 57 times
Top
 Profile  
 
PostPosted: Fri Nov 24, 2017 7:54 am 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 653
Thanks for the dump! Concerning SRAM Patches, it seems to be the newest version: with 9 patches, as found in "bsx3.srm".
The checksum is okay (and the byte at offset 0AAAh isn't corrupted, unlike as in a handful of other dumps).
And the game positions, you have something at 13E4h-13FFh, which was NOT known to be used by any games yet.
Many of the other addresses are used by two or more games, so it's hard to tell if a dump contains game positions from one of those games - or from yet another unknown game.


Top
 Profile  
 
PostPosted: Sat Dec 09, 2017 8:03 am 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
One mention about the header of Memory Pack contents:

Assuming 32-bit little endian:
Code:
FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)

Shigesato Itoi's Bass Fishing No. 1 literally just boots the content. If you can rewrite the Memory Pack you can actually mess with real SA-1 hardware :D


Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 2:34 pm 
Offline

Joined: Sat Apr 28, 2012 7:22 am
Posts: 18
LuigiBlood wrote:
Code:
FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)



Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.


Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 4:07 pm 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 653
LuigiBlood wrote:
Code:
FFB2h 4  Program Type
      - 0x???????? = 65C816
      - 0x00000100 = BS-X Script Tokens
      - 0x00000200 = SA-1 (Itoi Bass Fishing No. 1)

Nice finding. I had spotted the [7FB3h]=02h check somewhere in Itoi - but didn't knew what it was intended for. Are there any existing games/datapaks using that feature?

From what I can see, it's checking the byte at 7FB3h only. So it should work for LoROM only. And it should work with any "xxxx02xxh" value.

And if the 02h byte is there... then it's just booting the file as normal 65C816 code (which may then use SA-1 hardware if it wants to (provided that the cart does really contain SA-1 hardware), or leave the SA-1 stuff unused if it doesn't need it), right?


Top
 Profile  
 
PostPosted: Fri Dec 15, 2017 6:51 am 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
blurayno wrote:
Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.

It is. Satellaview Content does not use the header the same way as commercial cartridge games.

nocash wrote:
Nice finding. I had spotted the [7FB3h]=02h check somewhere in Itoi - but didn't knew what it was intended for. Are there any existing games/datapaks using that feature?

From what I can see, it's checking the byte at 7FB3h only. So it should work for LoROM only. And it should work with any "xxxx02xxh" value.

And if the 02h byte is there... then it's just booting the file as normal 65C816 code (which may then use SA-1 hardware if it wants to (provided that the cart does really contain SA-1 hardware), or leave the SA-1 stuff unused if it doesn't need it), right?

We don't have any content that uses this feature yet.
I assume there must be some kind of check at first to make sure it isn't Itoi booting it and simply tell the player "Please insert the Memory Pack into Itoi Bass Fishing cartridge" or something like that.


Top
 Profile  
 
PostPosted: Fri Dec 15, 2017 3:59 pm 
Offline

Joined: Sat Apr 28, 2012 7:22 am
Posts: 18
LuigiBlood wrote:
blurayno wrote:
Is this the correct address? All mempak images I checked just now had the byte 00 at 7FB2/FFB2h.
Commercial games seem to have the first character of the release code (e.x. ZBSJ) at that address.

It is. Satellaview Content does not use the header the same way as commercial cartridge games.


My bad. The value you gave was a little endian dword and I wasn't paying enough attention on what I was reading and looking at...


Top
 Profile  
 
PostPosted: Sun Dec 24, 2017 7:02 pm 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
According to patent JP3734532B2

Here is the full Time Channel format (including header AND using official terms):
Code:
Offset - Size (in bytes) - Description
0x00 - 1 - Data Group ID 1 (upper 4 bits) / Data Group Repetition (lower 4 bits)
0x01 - 1 - Data Group Link (bit7) / Data Group Continuity
0x02 - 3 - Data Group Size
0x05 - 1 - TYPE
0x06 - 1 - DGN
0x07 - 3 - Address

0x0A - 1 - Second
0x0B - 1 - Minute
0x0C - 1 - Hour (0-23)
0x0D - 1 - Day of Week (1-7) [1 = Monday, 7 = Sunday]
0x0E - 1 - Day
0x0F - 1 - Month
0x10 - 2 - Year
0x12 - 2 - Unused (Preliminary)
0x14 - 2 - CRC [Does not count in the Data Group Size]


Also, difference between time at 1.1.0.8 and 1.2.0.48:
- 1.1.0.8 is an absolute time. (1.1.X.X are all BS-X related, so it makes sense)
- 1.2.0.48 is relative to the start of the broadcast. (1.2.X.X are all game related)


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 5:59 am 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
So I've done a bit of research about Satellaview register $2198. While I did notice about the serial number being found, I admit I didn't try to find the nature of all the BIOS functions dedicated for it.
And eventually I found something in the Satellaview patents. Because Nintendo is nice to the people who reads those, they actually put the ID of chips used for a bunch of things, and all of them did correspond to what we got so far.

So I found that $2198 talks to a EEP-ROM chip manufactured by Seiko under the ID of "S-2913CR". While I did not find this specific chip, I found "2913C", and it fits the description completely, it is a 16-bit Serial EEPROM, manufactured by SEEQ Technology. A datasheet can be found here: http://datasheet.datasheetarchive.com/o ... 047710.pdf
When I tried to read the EEPROM's content, I needed bit7 to be set. This 100% corresponds to the read opcode.

Therefore, according to this information, I'll use nocash's documentation as a base and change the BIOS function names, while checking the disassembled routines that I got:

Code:
Port 2198h (serial port 1 to SPR-BSA EEPROM) (unused)
  1059B8 read_multiple_eeprom             [In: A = 6bit address, Out: read 16 bytes to [DB:0000h+Y]]
  1059BC read_single_eeprom               [In: A = 6bit address, Out: A]
  1059C0 write_verify_multiple_eeprom     [In: A = 6bit address, X = amount of words, [D+00h+Y] = data]
  1059C4 write_verify_single_eeprom       [In: A = 6bit address, X = word]
  1059C8 write_word_eeprom                [In: A = 6bit address, X = word]
  1059CC write_verify_first_word_eeprom   [In: X = word] (kinda weird, it does Write All opcode, but only writes and checks one word)
  1059D0 erase_word_eeprom                [In: A = 6bit address]
  1059D4 erase_all_eeprom
  1059D8 verify_address_20h_to_3Fh_eeprom [In: X = word, Out: Carry flag (if set = wrong, if clear = verified)]
  1059DC verify_single_eeprom             [In: A = 6bit address, X = word, Out: Carry flag (if set = wrong, if clear = verified)]
  1059E0 program_enable_eeprom
  1059E4 program_disable_eeprom
  1059E8 send_byte_eeprom                 [In: A = byte]
  1059EC wait_eeprom_ready


And because of that, I'm suspecting that $2199 has nothing to do with any audio output. I'm suspecting that $2199 is what manages that was supposed to be the hard drive for the EXT port which records audio and data as well, as the patent suggests.


Last edited by LuigiBlood on Sat Jul 14, 2018 11:00 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 9:46 am 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 653
Good finding!

What is the "serial number being found"? Is there a serial number stored in the eeprom... and is it used for something?

Now that you've discovered the SPR-BSA being a Seiko S-2913CR chip... there's also a Seiko datasheet for it
http://datasheet.datasheetarchive.com/o ... 144153.pdf - so no need to use the Seeq datasheet.

The read/write multiple functions don't do anything with 7E0000h. The source/dest address in RAM is in Y register.
For read_multiple it's using [DB:0000h+Y], with DB needed to be a "lorom" bank, as it's also used for [DB:2198h].
For write_multiple it's using [D+00h+Y], with the direct page... I guess it should be zero (or maybe the related functions survive other values).
If the D, DB, Y registers are all zero then it will use address 000000h, which will actually mirror to RAM at 7E0000h.

So well, there's an EEPROM and the BSX-BIOS has functions for accessing it - but I don't know of any games that would use that functions (nor does the BSX-BIOS itself use that functions (nor do any known games access 2198h directly)). If I didn't miss something: The EEPROM is there, but it was never ever actually used?

For the other serial port at 2199h: That port is actually used: by the BSX-BIOS, by BSX-BIOS patches, and by Itoi, and by BS Dragon Quest 1, and in respect to data in the Town Status packet. Being used that often, I have some doubts that it was used for any kind of yet unreleased expansion hardware.
I would have assumed that it goes to the MN88821 chip (there's a datasheet for a similar chip, which has a serial port). You do have a BSX unit, don't you? What happens when executing the 2199h reading functions? Does it return any data - despite of not having a HDD or whatever attached at the EXT port?
Or if it goes to the EXT port, if you attach an oscilloscope, a logic analyzer, a multimeter, or a bloody LED... can you see a pin getting toggled when toggling the 2199h clock bit by software? Going by DaveyPocket's findings, the five candidates for serial or other unknown features would be EXT pins 29, 30, 31, 33, 34.


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 10:52 am 
Offline
User avatar

Joined: Thu Jul 29, 2010 2:24 pm
Posts: 56
The serial number I was talking about that's in the EEPROM is something like this that I found:
Code:
BSA00???????   A4h FFh FFh FFh and so on...

Each byte is repeated twice on each 16-bit word. The ??????? matches my Satellaview's serial number.

Also I only gave a quick look and I admit that while Direct Bank and stuff crossed my mind I didn't quite bother...
I have never seen anything that uses 2198h so far. It's just there.

2199h is totally used, that I definitely saw. And considering the EEPROM access was treated as a bus in the patent, there's also a EX Bus, linked to the EXT port. There's potentially other registers directly linked to it as well according to that.
When I use it, I got it to return E00000h. Any command does not seem to change that. Also, unsetting 2194h.bit0 actually disables that register (alongside the streams that are stuck). Not 2198h however. I'll try to check with a LED at some point.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 97 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: nocash, Revenant and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group