It is currently Wed Sep 26, 2018 7:39 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Thu Jul 12, 2018 1:08 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
There is a cartridge called `92' Super Mario Family` (aka Mario Family 10-in-1). I got photos of it:
Image Image Image Image Image Image

It consists of the following games:
Code:
                                 mapper  PRG  CHR
1.Mario Bros Arcade (MB)              0  16k   8k
2.Super Mario Bros (SMB1)             0  32k   8k
3.Super Mario 2 USA (SMB2)            4 128k 128k
4.Super Mario 2 Japan (SMB2J)        43  80k   8k
5.Super Mario 3 (SMB3)                4 256k 128k
6.Super Mario 4 (Armadillo)         118 256k 128k
7.Mario Baby (Bio Miracle)           42 128k    0
8.Doctor Mario (Dr. Mario)            3  32k  64k
9.Mickey Mouse                        3  32k  64k
10. Bowling (Dynamite Bowl)           3  32k  64k


But it is not yet another stupid multicart where pirates just merged all games of same mapper and added ugly menu. Here, all games were converted to MMC3 (SMB2J in MMC3 version was something not to be available until loopy's releases his version).
Unfortunatelly, I have no access to dump of PRG/CHR chips, but.... I found on the interned something called `Mario Family 10-in-1.nes`. It repors to be MMC3 with 512kB PRG + 512kB CHR, but launching it starts SMB2J with garbled graphics. I have no idea how somebody dumped it (maybe it is good to assume that it was dumped as MMC3 from bank $8000-$9fff)

So I analyzed this file by dividing it into 8kB chunks and compared every of them to every chunk of one of above games and choosed the best match. Here is report:
Image

*There is no PRG of SMB3 and Armadillo, so I believe the PRG part of the ROM is not complete (it should be 1MB)
*.nes file, created from PRG/CHR chunks of the games mentioned below produces working game: SMB2, SMB1, Bio Miracle, Dr Mario, Mickey Mouse, Dynamite Bowl
*Making .nes with PRG from $40000-7ffff and CHR from $fe000-$fffff produces working SMB2J
*Part at $50000 and $70000 contains listing of source sode,
*Mario Bros (Arcade) when treated as standalone 16kB ROM at $74000 does not work - it is almost same like original version but with address of reset vector changed. When merged with menu ($54000 + $74000) it works.

*16 kB Menu ROM is at $54000, but it should be executed from $8000, not $c000. And NMI interrupt should be set to $809C and reset vector to $8000


My questions:
*Just after power up, how to jump-in into menu?
*Any idea how to describe this mapper in software? THen maybe later I would be able to deduce how it is built in hardware.


Attachments:
menu.nes [40.02 KiB]
Downloaded 32 times
Top
 Profile  
 
PostPosted: Fri Jul 13, 2018 9:25 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
I have this cartridge. So if one need photos or want it to be redumped (via kazzo)…


Top
 Profile  
 
PostPosted: Fri Jul 13, 2018 9:50 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
If you could dump what is after powerup at CPU $8000-$ffff and PPU $0000-$1fff,.

Also it would be good to check which of PAL pins 1-9, 11-19 connect to which PRG/CHR ROM pins and MMC3 (some might be connected to both of them). Unfortunatelly it can't be seen from phote.


Top
 Profile  
 
PostPosted: Fri Jul 13, 2018 11:22 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
Don't know how to write an anago script, sorry. But will dump if one is provided.

Code:
PAL.01 - 0001.05
PAL.02 - /ROMSEL (pin 44)
PAL.03 - CPU A14 (pin 35)
PAL.04 - MC3.05
PAL.05 - CPU R/W (pin 14)
PAL.06 - MC3.32
PAL.07 - MC3.29
PAL.08 - MC3.10
PAL.09 - PPU A13 (pin 56)
PAL.11  (split up through C1, D1, R1) - M2 (pin 32)
PAL.12 - CIRAM A10 (pin 18)
PAL.13 - NC
PAL.14 - 0002.22 + 6264-4D2.26
PAL.15 - 0001.01 + 0002.31
PAL.16 - 0002.30
PAL.17 - 0001.31
PAL.18 - MC3.04
PAL.19 - MC3.01


Sidenote, they used a 4.7k Ohm resistor rather than 10k (value printed below on the PCB)


Attachments:
92MF10in1-FC-PCBf.jpg
92MF10in1-FC-PCBf.jpg [ 1.04 MiB | Viewed 713 times ]
92MF10in1-FC-PCBb.jpg
92MF10in1-FC-PCBb.jpg [ 1.22 MiB | Viewed 713 times ]


Last edited by MLX on Sat Jul 14, 2018 3:59 am, edited 2 times in total.
Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 2:37 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 427
MLX wrote:
Don't know how to write an anago script, sorry. But will dump if one is provided.

Code:
PAL.01 - 0001.05
PAL.02 - /ROMSEL (pin 44)
PAL.03 - CPU A14 (pin 35)
PAL.04 - MC3.05
PAL.05 - CPU R/W (pin 14)
PAL.06 - MC3.32
PAL.07 - MC3.29
PAL.08 - MC3.10
PAL.09 - PPU A13 (pin 56)
I will check 11-19 later.


anago dump nrom. power on PRG32K,8KCHR


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 3:01 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 657
MLX wrote:
Don't know how to write an anago script, sorry. But will dump if one is provided.
Try. It is based on the menu ROM provided in the first post.


Attachments:
Mapper353v010.ad.txt [878 Bytes]
Downloaded 23 times
Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 3:34 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
This cartridge is another instance of the PAL chip heating up with the kazzo, even when not hot plugged.

Resulting dump is attached.


Attachments:
92MF10in1_v010.nes [384.02 KiB]
Downloaded 31 times
Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 3:42 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
What is 0001.1 connected to?


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 3:57 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
0002.31 + PAL.15


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 4:04 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 657
That only dumped Armadillo (block 0), which is okay, since we did not have that before. I think the outer bank locks after one write. Version v11a tries to unlock it via two write to E080 (which is what the startup code does), while version 11b only dumps PRG block 1, which is the only one we don't have so far. Better try version 11b first for safety, and let me see if I can combine the result with the GoodNES dump (which seems to contain blocks 2 and 3) and the previous block 0, before trying version 11a.

Edit: corrected the size specification in the A script.


Attachments:
Mapper353v012a.ad.txt [1.04 KiB]
Downloaded 20 times


Last edited by NewRisingSun on Sat Jul 14, 2018 8:26 am, edited 2 times in total.
Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 4:07 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
There are probably up to four registers ($8080/$a080/$c080/$e080), but only A14-A13 matters when writing.
Writing to them might alter:
Code:
* MMC3 behaviour
  - normal (lke mapper 004): PRG-A17/CHR-A17 controlled by MMC3
      versus
  - NROM mode (PRG-A17/CHR-A17 controlled by PAL and MMC3 is fooled to think that CPU_A14=0) so $8000-$9fff and $a000-$bfff are switchable and $c000=$8000 + 2, $d000=$a000+ 2, probably even further writes to MMC3 are ignored because MMC3`s !romsel is controlled by PAL

* mirroring:
 - normal: MMC3 controls mirroring (H/V)
   versus
 - single screen mirroring (overrided by PAL)


It would be good to make something like:
Code:
//set $ppu $0000-$1fff to sequential 8KB piece
cpu_write($8000, 0);
cpu_write($8001, 0);
cpu_write($8000, 1);
cpu_write($8001, 2);
cpu_write($8000, 2);
cpu_write($8001, 4);
cpu_write($8000, 3);
cpu_write($8001, 5);
cpu_write($8000, 4);
cpu_write($8001, 6);
cpu_write($8000, 5);
cpu_write($8001, 7);

for (int i = 0; i < 4; ++i) {
  cpu_write($8080 + $2000 * i, 0); //change mode
 
  //check how MMC3 behaves
  for (int j = 0; j < 32; ++j) {
    cpu_write($8000, 6);
   cpu_write($8001, j);
    cpu_write($8000, 7);
   cpu_write($8001, j);
   cpu_read($8000, $ffff);
   ppu_read($0000, $1fff);
  }
}


And M2 need to be toggled at 1.7MHZ, otherwize PAL internal state might reset.


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 4:23 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
A & B had the same CRC.


Last edited by MLX on Fri Sep 07, 2018 1:43 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 4:29 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 657
Then it's the M2 problem again, as kryziobal mentioned. :(


Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 7:07 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 657
For what it's worth, here is the combined ROM image --- GoodNES' banks 2 and 3, together with MLX' bank 0 ---, a Nintendulator-NRS build with Mapper 353 support, and a Mapper 353 source file. I have filled 256 KiB of 0x00 where bank 1 would go, so game 3 does not work with this incomplete ROM image. Given that most of the games seem to have hacked title screens, I have resisted the temptation to replace the missing bank with data from a standard SMB3 ROM image.

Edit: Added FDS expansion sound to Mapper 353 in the Nintendulator-NRS build. Use "Sound->Expansion Audio on Bootleg Carts" to get the authentic, expansion-sound-less bootleg experience.


Attachments:
mapper353.cpp [2.52 KiB]
Downloaded 24 times


Last edited by NewRisingSun on Mon Jul 23, 2018 9:43 pm, edited 3 times in total.
Top
 Profile  
 
PostPosted: Sat Jul 14, 2018 7:10 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 91
Would feeding pin 32 with a square signal at that frequency during the whole dumping sequence do the trick?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 25 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group