- $9C00: Set 8 KiB PRG-ROM bank at CPU $C000-$DFFF
- $9C0C.0: Set CIRAM bank at PPU $2000-$23FF
- $9C0D.0: Set CIRAM bank at PPU $2400-$27FF
- $9C0E.0: Set CIRAM bank at PPU $2800-$2BFF
- $9C0F.0: Set CIRAM bank at PPU $2C00-$2FFF
The game has 256 KiB of PRG-ROM, 512 KiB of CHR-ROM, 8 KiB of battery-backed RAM, and at least 4 KiB of CHR-RAM. The first 256 KiB of CHR-ROM are the normal CHR-ROM data, the second 256 KiB of CHR-ROM contain additional Chinese characters that are first read via $2007 into CPU RAM, then written into CHR-RAM.
The unsolved mystery is how the game switches between CHR-ROM and CHR-RAM. During our dumping attempts, CHR-RAM was always located at 1 KiB CHR banks $28-$2F and $128-$12F, and only there. The game instead expects CHR-ROM at $28-$2F and wants to write to CHR-RAM at banks $04-$05, $7C-$7D, $4C-$4F, and they must point to the same 4 KiB, otherwise there will be missing character. This indicates to me that the CHR-RAM location must be somehow switchable, but I cannot tell from the game code how. I suspect it to be related to the 74LS157, 74LS174 and the two diodes on the top of the PCB front side.
PCB images from dragon2snow. Front: Back: