NES-SFEXPROM-01: Anyone have a clue what the hell this is?

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
BootGod
Posts: 359
Joined: Wed Jul 13, 2005 3:14 pm

NES-SFEXPROM-01: Anyone have a clue what the hell this is?

Post by BootGod »

I came across this oddball board in Bases Loaded (revision 0) today. It's some sort of SFROM board, except it has an extra 42-pin chip labeled "NES-LD-0-EXP283". It's labeled on the PCB as "EXP IC".

My other Bases Loaded carts do not use this, revision A uses plain SFROM and revision B uses SF1ROM.

Here's a bad picture of it:
Image

Anyone have any idea what its purpose is?
User avatar
kevtris
Posts: 504
Joined: Sat Oct 29, 2005 2:09 am
Location: Indianapolis
Contact:

Re: NES-SFEXPROM-01: Anyone have a clue what the hell this i

Post by kevtris »

BootGod wrote:I came across this oddball board in Bases Loaded (revision 0) today. It's some sort of SFROM board, except it has an extra 42-pin chip labeled "NES-LD-0-EXP283". It's labeled on the PCB as "EXP IC".

My other Bases Loaded carts do not use this, revision A uses plain SFROM and revision B uses SF1ROM.

Here's a bad picture of it:
Image

Anyone have any idea what its purpose is?
I'm curious too as to what it does. I have a cart board somewhere with one of those on it. I was gonna poke around some time but I haven't had the chance to do it yet.
/* this is a comment */
CaH4e3
Posts: 71
Joined: Thu Oct 13, 2005 10:39 am

Post by CaH4e3 »

Japan version have extra sound chip.
http://cah4e3.shedevr.org.ru/misc/MOEPRO.TXT
http://cah4e3.shedevr.org.ru/misc/MoeProSound.zip

controlled by 0x7000 register, don't know what exactly, but it plays digital samples, selected by writing to register. (VirtuaNES supports it as I know)...

Bases loaded uses 0x7000 address too...
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

Given that any game that uses expansion speech in 60-pin has to be converted to DMC for 72-pin, perhaps the DMC samples are in one chip and the code is in another.
User avatar
kevtris
Posts: 504
Joined: Sat Oct 29, 2005 2:09 am
Location: Indianapolis
Contact:

Post by kevtris »

OK, I think I know what the chip does.

I pinned it out tonight. A0-A17 and D0-D7 of the PRG ROM connect to it, along with /CE and WRAM /CE from the MMC1, and then /CE comes out of the chip and goes to the PRG ROM.

R/W and M2 are not connected to it. I suspect the chip is some kind of patcher, and possibly returns stuff at 6000-7FFFh. Some more examination on copyNES will be required.

I will then remove the ROM and drop in a resistor network to pull the data lines high or low, and then we'll see which bytes it replaces. Should be an interesting little experiment.
/* this is a comment */
BootGod
Posts: 359
Joined: Wed Jul 13, 2005 3:14 pm

Post by BootGod »

So he was right, someone else suggested this theory the other day. The byte it patches is 0x180 in each 8K bank. The value on the ROM is 0x60, it replaces it with 0x05.

Why is it that copynes wouldn't read it as the patched value? Doesn't it see it just as the NES would?
User avatar
kevtris
Posts: 504
Joined: Sat Oct 29, 2005 2:09 am
Location: Indianapolis
Contact:

Post by kevtris »

BootGod wrote:So he was right, someone else suggested this theory the other day. The byte it patches is 0x180 in each 8K bank. The value on the ROM is 0x60, it replaces it with 0x05.

Why is it that copynes wouldn't read it as the patched value? Doesn't it see it just as the NES would?
I'd be very suprised if it didn't read the patched value... HOWEVER, the chip also watches 6000-7FFFh. So viewing the ROM might shed some clues on it. They hooked up WRAM /CE to the chip also, so maybe some accesses to 6000-7FFFh trigger the "fix". This way, the ROM gets patched after it executes code /loads data once maybe. Just a guess.
/* this is a comment */
BootGod
Posts: 359
Joined: Wed Jul 13, 2005 3:14 pm

Post by BootGod »

That could be, worth a shot anyways. The data dumped using normal sxrom plugin actually does not boot. It also may be patching more than that one address, I figured the value is supposed to be 0x05 because the code nearby suggests that's what it should be and changing it to this allows the game to seemingly run fine.

On a side note, why the heck would they go thru this trouble to fix a bad ROM run? Wouldn't it be more cost effective just too run a new batch, rather than create a specialized PCB and throwing in the patch chip?
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

Copy protection.
User avatar
kevtris
Posts: 504
Joined: Sat Oct 29, 2005 2:09 am
Location: Indianapolis
Contact:

Post by kevtris »

tepples wrote:Copy protection.
I highly doubt it- the lockout chip is pretty much all the copy protection you need.

No, I'm fairly certain it's a "ROM fixer" at this point.
/* this is a comment */
tepples
Posts: 22705
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

kevtris wrote:
tepples wrote:Copy protection.
I highly doubt it- the lockout chip is pretty much all the copy protection you need.
Not for famiclones, which use the 60 pin connector.
Post Reply