It is currently Sat Apr 21, 2018 1:07 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 27 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Mapper 133 (Jovial Race)
PostPosted: Wed Dec 13, 2017 2:14 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
The wiki page for this mapper describes it as one register at address $4100 (the game writes to $4120). That indeed is all there is to it for the later (72-pin?) version of the game Jovial Race (headerless CRC32: 5AEFBC94). The early 60-pin version of the game (headerless CRC32: A923E441) is different however. It does have the $4120 write as the later version and so can be emulated as mapper 133, the actual cartridge however does not respond to writes at that address. Instead, it has a chip labelled "AX-24G" which responds at addresses $8000/$8001:
Attachment:
JovialRace_PCB.JPG
JovialRace_PCB.JPG [ 1.86 MiB | Viewed 1130 times ]

After doing the usual write to $4120, the game proceeds with the following write sequence:
Code:
PRG: 32 KiB PRG bank number
CHR: 8 KiB CHR bank number

val = CHR | (((CHR & 1) << 4) ^ 0x10) | ((CHR & 2) << 2) | (PRG << 2);
write(0x8000, 0x01); write(0x8001, val);
write(0x8000, 0x04); write(0x8001, val);
write(0x8000, 0x21); write(0x8001, val);
write(0x8000, 0x24); write(0x8001, val);
These strange $8000 register numbers remind me of the Toy Story mapper 219, although the numbers are not the same. The original Joy Van release of Master Chu and the Drunkard Hu (盜帥, Dàoshuài ) has the same chip. The only known dump of that release is a mapper 3 hack, but even that one retains the same $8000/$8001 writes. The attached Kazzo dumping script, which worked well with that early Jovial Race cart, should produce a working dump of Dàoshuài as well. The AX-24 chip seems to switch too slowly for the Kazzo, so a delay loop was necessary to get a usable dump.


Attachments:
Mapper133-AX24.ad.txt [1.31 KiB]
Downloaded 30 times
Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 2:21 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7001
Location: Seattle
Don't suppose you have a pinout for the chip?


Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 2:23 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
Other than a picture of the front and back sides of the Dàoshuài cart, no, sorry.


Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 3:24 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7001
Location: Seattle
Here's a partial pinout of the ASLIC AX-24G:
Code:
      nc 01 28 CPU A14
      nc 02 27 CPU A13
      nc 03 26 ??
      nc 04 25 nc
      ?? 05 24 /ROMSEL
 /rom2ce 06 23 both PRG /OE
 CHR A14 07 22 M2
 CHR A13 08 21 R/W
  CPU D0 09 20 CPU D5
  CPU D1 10 19 CPU D4
  CPU D2 11 18 CPU D3
     Gnd 12 17 +5V
      ?? 13 16 ??
      nc 14 15 ??


Weirdly, I don't see an obvious place for a connection from CPU A0 to it.


Top
 Profile  
 
PostPosted: Wed Dec 13, 2017 3:33 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 314
Location: Poland
What about this:
Image Image Image


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 10:34 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
So apparently, the AX-24G can only output PRG A15 and CHR A13 and A14, as the other pins are labelled CPU A0/A13/A14 instead of PRG..., so they are just inputs, and bank granularity is therefore limited to 32 KiB PRG and 8 KiB CHR. This makes it only more mysterious why the game writes the bank value four times to four different oddly-numbered registers ($01,$04,$21,$24). Another mystery is why the game goes through the trouble of setting bank value bits 3 and 4 as I specified (the game uses a lookup table for that). The cartridge dumped just fine when we attempted to dump it with those bits always at 0.

Also, since there are only CPU-A0, CPU-A13, CPU-A14 and CPU-ROMSEL address inputs, do I conclude correctly that the address mask evaluated by the chip must be $E001?


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 12:36 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 314
Location: Poland
Other unconnected lines might as as outputs of higher PRG/CHR lines. Its rather uncommon for chip to have so many unused lines, otherwise they would use smaller package (DIP24)

There is definitely some unknown conncetion for pins 4/5/13/15/16/17/25. They might be connected to VCC/GND/between them to force chip to some mode. Also, internal chip structure is also not known.
Wiring D3-D5 suggests that chip probably takes them into account, just this single game might not take use of them or might use in unknown for us way.

Granularity not neccesary have to be fixed to 32 kB.

Finally, M2 line is also wired for some reason, but current discovered chip functionality does not need it.


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 12:48 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7001
Location: Seattle
Yeah, the strictest the mask could be is $E001. (It's possible that some of the inputs are unused; only testing against the hardware can tell us)

Honestly, I'm more confused by the required delays in the dumper script than anything else.


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 12:53 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
We first dumped it without any delays. CHR would dump fine, but the first 32 KiB PRG bank would have the first 2,668 bytes read incorrectly, meaning that only every second byte is read and then doubled. That count of 2,668 was consistent between attempts. I don't know the Kazzo enough to know how many nanoseconds, or how many M2 cycles, that amounts to.


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 1:27 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 314
Location: Poland
Look at Dragon Slayer 4's NTDEC8701 chip:
Image

PIN24, PIN21, PIN12 - same like in this chip.
PIN5 connects to the EPROM PIN 27 (=CHR A14), PIN7 connects to EPROM's CHR A13.
Maybe it's INES Mapper 206 - MMC3 predecessor.
$8000/$8001 registers would match.


Top
 Profile  
 
PostPosted: Thu Dec 14, 2017 1:37 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
That pirate board may well use the same chip as AX-24G, but then cannot use mapper 206, as mapper 206 does not do 32 KiB PRG-ROM banking.

Of course, I suppose one could connect an MMC3 clone/predecessor in a non-standard way so that it does do 32 KiB banking. One would have to know the normal way that an NTDEC8701 is connected. Can you show the back side of that Dragon Slayer 4 pirate board?


Top
 Profile  
 
PostPosted: Sat Dec 16, 2017 8:06 am 
Offline

Joined: Tue Apr 11, 2006 4:08 am
Posts: 262
I've dumped the cartridge and it was 100% identical to the original (J) rom. The pirate version had absolutely no changes in ROM relative to the original.

I can not take a better picture now, but if some connections are poorly visible on the photo, please show which and then I will check.


Attachments:
File comment: dragon slayer 4
PICT0004.JPG
PICT0004.JPG [ 1.04 MiB | Viewed 799 times ]
PICT0003.JPG
PICT0003.JPG [ 685.25 KiB | Viewed 799 times ]
Top
 Profile  
 
PostPosted: Sat Dec 16, 2017 8:39 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
Thank-you very much. I will try to trace it and compare its connections with the AX-24G's on the Jovial Race board.


Top
 Profile  
 
PostPosted: Sat Dec 16, 2017 1:56 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 497
I'm having trouble figuring out how CPU D0 reaches the NTDEC8701 on that Dragon Slayer IV board.


Top
 Profile  
 
PostPosted: Sat Dec 16, 2017 2:29 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 314
Location: Poland
Here is the pinout of that dragon slayer that I rev-ed just a moment before
Code:
PRG-A13  1  28 CPU-A14
PRG-A14  2  27 CPU-A13
?        3  26 CPU-A0
?        4  25 PRG-A16
CHR-A14  5  24 CPU-!ROMSEL
PRG-A15  6  23 PRG-!OE
CHR-A13  7  22 M2
?        8  21 CPU-R/!W
PU-D2    9  20 CPU-D0
CPU-D3  10  19 CPU-D5
CPU-D1  11  18 CPU-D4
GND     12  17 VCC
?       13  16 ?
CHR-A10 14  15 ?

Unknown pins are CHR-A11, CHR-A12, CHR-A15, PPU-A10, PPU-A11, PPU-A12


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 27 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group