It is currently Thu Sep 20, 2018 4:47 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: GB Bootleg 32-in-1 Cart
PostPosted: Tue Aug 28, 2018 3:23 am 
Offline

Joined: Fri Oct 24, 2014 1:56 am
Posts: 80
I picked up a GB Bootleg 32-in-1 cart in a lot. The cart lists 32 games but there's actually only 15 games on it.

ImageImage

I finally got around to dumping the cart. It uses a modified ALLEYWAY ROM as the base. The cart writes to 0x1000 to switch games so the ROM won't work properly on an emulator (the menu loads but the games won't start).

The lookup table for the 0x1000 switch is located at 0x7EE9 [1C, 1A, 18, 16, 14, 00, 10, 0E, 0C, 0A, 08, 06, 04, 02, 12, 1C, 1A, 18, 16, 14, 00, 10, 0E, 0C, 0A, 08, 06, 04, 02, 12, 1C, 1A] .

Game List:
Code:
SUPER MARIO.    1C
MOTO MANIACS.   1A
LODER RUNNER.   18
BOMB JACK.      16
DR MARIO.       14
ALLEY WAY.      00
SPACE INVADER.  10
PITMAN.         0E
POP UP.         0C
BATTLE CITY.    0A
TENNIS.         08
VOLLEY FIRE.    06
TETRIS.         04
PENGUIN LAND.   02
FLIPULL.        12
MARIO WORLD.    1C
MOTO BIKE.      1A
KINKONG ESCAPE. 18
BOMBER MAN.     16
VIRUS OF GB.    14
ARKANOID.       00
STAR GATE.      10
PITBOY.         0E
WOODY POP.      0C
TANK 94.        0A
TENNIS ACE.     08
GRADIUS 3.      06
SUPER TETRIS.   04
PENGUIN EGG.    02
EASY FLIPULL.   12
MARIOLAND.      1C
HANG ON         1A


Games sorted by ROM location (shows duplicates):
Code:
ALLEY WAY.      00
ARKANOID.       00
PENGUIN LAND.   02
PENGUIN EGG.    02
TETRIS.         04
SUPER TETRIS.   04
VOLLEY FIRE.    06
GRADIUS 3.      06
TENNIS.         08
TENNIS ACE.     08
BATTLE CITY.    0A
TANK 94.        0A
POP UP.         0C
WOODY POP.      0C
PITMAN.         0E
PITBOY.         0E
SPACE INVADER.  10
STAR GATE.      10
FLIPULL.        12
EASY FLIPULL.   12
DR MARIO.       14
VIRUS OF GB.    14
BOMB JACK.      16
BOMBER MAN.     16
LODER RUNNER.   18
KINKONG ESCAPE. 18
MOTO MANIACS.   1A
MOTO BIKE.      1A
HANG ON         1A
SUPER MARIO.    1C
MARIO WORLD.    1C
MARIOLAND.      1C


Code:
PCB serial:  GB-32-IN-1A
Chip type:   ICT PEEL18CV8P-25

Size:   524288
CRC32:  2EBBF037
MD5:    7190D13728F498178FE1A39AFA66AE67
SHA-1:  4BE78D3D089150C761509A801545B372D6334822

Here's the file: http://www.mediafire.com/file/iwsjyeym9 ... 2-in-1.zip


Top
 Profile  
 
PostPosted: Tue Aug 28, 2018 10:49 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7532
Location: Seattle
How does the PAL work? (I see you desoldered it)

(In general, when one has a ROM hidden under epoxy, how does one know that one dumped it in the same order as the physical ROM?)

edit: PAL pinout appears to be
Code:
 nc -> |01 20| -- +5v
A14 -> |02 19| ??
 D0 -> |03 18| ??
 D1 -> |04 17| -> Aa
 D2 -> |05 16| -> Ab
 D3 -> |06 15| -> Ac
 D4 -> |07 14| -> Ad
A13 -> |08 13| -> Ae
/WR -> |09 12| ??
Gnd -- |10 11| <- A15


ROM pinout is very shuffled:
(starting at 9 o'clock: +5V Ae Ad Aa A13 A7 A5 A3 A13 /RD A10 A15 D1 D3 D5 D6 D7 Gnd D4 D2 D0 A1 A12 A11 A9 A8 A6 A4 A2 A0 Ab Ac)


Top
 Profile  
 
PostPosted: Tue Aug 28, 2018 6:24 pm 
Offline

Joined: Fri Oct 24, 2014 1:56 am
Posts: 80
Good points.

I didn't desolder the PEEL chip or do anything to the PCB. I also didn't bother to trace out all of the pins.

I modified my cart reader code to dump the ROM. The dumped ROM will start in an emulator and show the menu which is in the upper addresses of the modified Alleyway ROM. Alleyway is listed sixth in the menu (also mirrored as ARKANOID later in the menu). Selecting ALLEYWAY sets 0x1000 to 0 so I took that as confirmation that the full ROM order is structured in accordance with the assignment in the lookup table.

Pictures of the front and back of the PCB are in the archive with the dump.

EDIT: I should mention if you truncate the ROM to only the modified Alleyway ROM (1st 32K) then you can select Alleyway in the menu and it will switch to the game in an emulator.


Top
 Profile  
 
PostPosted: Tue Aug 28, 2018 6:59 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7532
Location: Seattle
skaman wrote:
I didn't desolder the PEEL chip or do anything to the PCB.
*facepalm* of course they had to remove the through-hole bits, otherwise it wouldn't fit in the shell.

Quote:
I modified my cart reader code to dump the ROM. [...] Selecting ALLEYWAY sets 0x1000 to 0
Since the PAL does connect to D0, but all the values in the menu are with D0 low, it makes me wonder what writing with D0 high does.

Given that the PAL is only connected to A13, A14, /WR, and "A15", the register has to be present over the entire $0000-$1FFF range, but I also wonder if it's present anywhere else.


Top
 Profile  
 
PostPosted: Wed Aug 29, 2018 9:50 pm 
Offline

Joined: Fri Oct 24, 2014 1:56 am
Posts: 80
Tauwasser made a schematic for the cart:

Image


Top
 Profile  
 
PostPosted: Thu Aug 30, 2018 11:14 am 
Offline
User avatar

Joined: Sun Oct 05, 2014 4:49 pm
Posts: 2
Beware I made that schematic by eye! In hindsight, I should probably have written that the ROM is COB, and not in a package.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group