It is currently Wed Nov 22, 2017 10:47 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 23 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sun May 29, 2016 6:26 pm 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
Hello.
I got a pirate Gradius 2, and it's very weird!!
Instead of a VRC clone, it has an unidentified mapper, a PAL, a 74HC4020 and an extra EPROM:
Attachment:
File comment: Mounted pirate Gradius 2
Gradius 2 Pirata - montado LR.png
Gradius 2 Pirata - montado LR.png [ 316.01 KiB | Viewed 2302 times ]

Better resolution: https://drive.google.com/open?id=0B0OtM ... WZZWk4wM1U

Board, componnent side:
Attachment:
File comment: Pirate Gradius 2, component side
Gradius 2 Pirata - Componentes - LR.png
Gradius 2 Pirata - Componentes - LR.png [ 382.73 KiB | Viewed 2302 times ]

Better resolution: https://drive.google.com/open?id=0B0OtM ... VFDWEFIWFk

Board, solder side:
Attachment:
File comment: Pirate Gradius 2, solder side
Gradius 2 Pirata - Solda LR.png
Gradius 2 Pirata - Solda LR.png [ 367.57 KiB | Viewed 2302 times ]

Better resolution: https://drive.google.com/open?id=0B0OtM ... mVOQ1h6VVE

So far, so good! The game is playable and I could finish it (cheating), but it has this annoying bug:
https://youtu.be/x1Dpdv9KTlg

And a interesting fact about it is that with the GameGenie the bug is very less noticeable:
https://youtu.be/aPpO6EAS2ns

I've dumped the ROMS and CRC32 checked them against the originals, the CRC32 matches.
I've dumped the extra ROM, I'll put on the next post.
Could this bug possibly be fixed? How?
What does the extra ROM does? Is it sort of a trainer? Is it used to initialise the PRG RAM?
Why the Game Genie, even without inputing any codes, does this? I have even seem some pirate games just crash or reset while with the Genie. Does it causes some kind of delay?
Many thanks in advance!!


Last edited by Fisher on Fri Jun 03, 2016 3:50 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sun May 29, 2016 6:27 pm 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
As promised, the extra ROM.


Attachments:
File comment: Pirate Gradius 2, extra ROM
GR2EXT.bin [2 KiB]
Downloaded 76 times
Top
 Profile  
 
PostPosted: Sun May 29, 2016 7:04 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6448
Location: UK (temporarily)
Fisher wrote:
an unidentified mapper, a PAL, a 74HC4020
Which means that the unidentified mapper is almost assuredly a VRC2.

It tentatively looks like the UVEPROM contains a 2 KiB monolithic (CPU A0..A10 are connected to the UVEPROM pins in order) patch that the PAL swaps in when necessary, containing whatever magic is necessary to make this work with a 4020 counter instead of a real VRC4 IRQ generator.


Do you have the ability to dump the contents of the PAL?


Top
 Profile  
 
PostPosted: Mon May 30, 2016 2:36 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 352
this rom,I guess emu in nestopia plus!
Attachment:
20160530173613.png
20160530173613.png [ 31.37 KiB | Viewed 2271 times ]


If you feel there is a problem, please provide the DUMP :PRG.BIN, CHR.BIN, EXT data to me.

PRG.BIN Must be different from the original !


Top
 Profile  
 
PostPosted: Mon May 30, 2016 2:48 am 
Offline
User avatar

Joined: Mon Sep 05, 2011 5:56 pm
Posts: 287
The biggest DIP40 IC is the vrc clone(without IRQ)


Top
 Profile  
 
PostPosted: Mon May 30, 2016 4:50 am 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
Sorry Lidnariq... I tink I just can't dump the PAL contents :-(
Unless there's a way to dump it like a ROM, with some pin modification on the reader. I just could not find a good reader that's simple enough to build myself...
Please, if you know some simple one, preferably that connects to the paralel port, tell me. :wink:
Maybe the mapper and the circuit is similar to his one: viewtopic.php?f=28&t=13270

Zxbdragon, I think the ROMs are already dumped and are fine, since they have the same CRC32 that's listed on BootGod's site. Maybe the bug is a problem wih the cartridge's IRQ generation.
The weirdest thing about this is that the bug is almost gone when the game is used with a Game Genie. :shock:

Byemu, I suspected this. I even think that this mapper chip is the 23c269, like the one in the post I linked above. I think a good test would be to try that Batman's ROMs on this board, to see if my theory is correct.


Top
 Profile  
 
PostPosted: Mon May 30, 2016 5:28 am 
Offline

Joined: Mon Apr 01, 2013 11:17 pm
Posts: 437
The 2kB EEPROM looks like it makes a nice patch over the last 2kB of the PRG ROM.

I haven't looked at the board layout yet, but I suspect the PAL could be dumped like a ROM once we figure out which pins are inputs and outputs.


Top
 Profile  
 
PostPosted: Mon May 30, 2016 10:28 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6448
Location: UK (temporarily)
Because it's a PAL16L8, I was going to say what Joe said; you should be able to read its contents as though it were a ROM. Hopefully they're not using any of the internal feedback paths in the logic matrix.


Top
 Profile  
 
PostPosted: Mon May 30, 2016 12:46 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6448
Location: UK (temporarily)
Here's the traced pinout of the PAL16L8:
Code:
           .--V--.
     M2 -> | 1 20| -- +5
/ROMSEL -> | 2 19| -> PRG /OE
CPU A14 -> | 3 18| -> PATCH /OE
CPU A13 -> | 4 17| -> RAM /CE
CPU A12 -> | 5 16| ?? nc
CPU A11 -> | 6 15| -> 4020 CLR
CPU R/W -> | 7 14| <- 4020 Q11
PPU A13 -> | 8 13| -> /IRQ
PPU /RD -> | 9 12| -> CHR /OE
    Gnd -- |10 11| <- nc
           '-----'


I'm really not clear why they didn't use the VRC2 knockoff's CHR/OE output. (PRG/OE makes sense given the patch ROM)

The 4020 is clocked by M2, so Q11 should go high after 2048 cycles; approximately 18 scanlines.


Quote:
Why the Game Genie, even without inputing any codes, does this? I have even seem some pirate games just crash or reset while with the Genie. Does it causes some kind of delay?
If you look at the Game Genie PCB, they've got a funny little circuit (R1 & D2) to keep the cart from seeing M2 while it's still in the code entry screen. Once it's in normal operation, the diode becomes a tiny varicap (reverse biased diodes are effectively voltage-dependent capacitors) which will delay M2 just a teensy bit ... in simulation, it's only about 1ns.


Top
 Profile  
 
PostPosted: Tue May 31, 2016 5:25 am 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
Cool!!
So I just need to plug the inputs on the adress bus and the outputs on the data bus to dump it, right?
Does the sequence I assign the pins matter? I'm thinking to use the lower bits of the address and data bus first, so I may end with a duplicated memory dump, wich don't matters much, I think...
I'll try to dump it as soon as I can!! :P

So, in this case seems like the pirates are basically making a VRC4 game work with a VRC2 clone!!
I' ve read somewhere that this game has some kind of protection that if not matched the ship simply explodes!! :shock:
The patch may be to avoid this and keep the game playable on the different mapper.
Maybe the key to fix this Gradius 2's bug should be to add a delay on M2 or on the IRQ?

About the games bugging with Game Genie, one of the games is Rockman 1, the other is Gradius 1.
Do they ever use M2? Does this M2 delay affects them somehow?

If needed I have scans of this Rockman's board here:
https://drive.google.com/open?id=0B0OtM ... zViWURYN2M
And here:
https://drive.google.com/open?id=0B0OtM ... nl5U1VScnM
I don't hava a scan of it assembled, but I remember it being made of LS chips, instead of HC ones and having a quartz window ROM, I think it was a 27C010.

I don't have scans for this Gradius, but it's a small 72 pin board with 2 blobs and a 74LS161.


Top
 Profile  
 
PostPosted: Tue May 31, 2016 5:57 am 
Offline

Joined: Mon Apr 01, 2013 11:17 pm
Posts: 437
Fisher wrote:
So I just need to plug the inputs on the adress bus and the outputs on the data bus to dump it, right?

That's right.

Fisher wrote:
Does the sequence I assign the pins matter?

Nope. Choose whatever makes sense to you.

Fisher wrote:
About the games bugging with Game Genie, one of the games is Rockman 1, the other is Gradius 1.
Do they ever use M2? Does this M2 delay affects them somehow?

Rockman and Gradius both use simple discrete logic mappers (UNROM and CNROM) that don't require M2, so there's no reason for the pirate boards to connect M2.

Your Rockman board doesn't connect M2 to anything.


Top
 Profile  
 
PostPosted: Tue May 31, 2016 10:13 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6448
Location: UK (temporarily)
Fisher wrote:
I'll try to dump it as soon as I can!!
I'd be idly curious to know if pin 16 (labeled "nc") is an input, output, or, just to be maximally inconvenient, both.

Quote:
I don't have scans for this Gradius, but it's a small 72 pin board with 2 blobs and a 74LS161.
The original Gradius is CNROM, so that sounds like it's the same.


Top
 Profile  
 
PostPosted: Mon Jul 25, 2016 3:08 pm 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
Finally I could get some free time and "dumped" this PAL chip. :P
Attachment:
File comment: Pirate Gradius 2 PAL16L8 "dump"
PALGRAD2.BIN [128 KiB]
Downloaded 56 times

I have not touched the file after the dump, so it has the full 128KB on it.
Here is the pinout I used to dump:

Code:
           .--V--.
     A0 -> | 1 20| -- +5
     A1 -> | 2 19| -> D5
     A2 -> | 3 18| -> D4
     A3 -> | 4 17| -> D3
     A4 -> | 5 16| ?? A10
     A5 -> | 6 15| -> D2
     A6 -> | 7 14| <- A9
     A7 -> | 8 13| -> D1
     A8 -> | 9 12| -> D0
    Gnd -- |10 11| <- nc
           '-----'

Hope I've done everything correctly and this helps solve this "riddle", and maybe fix the bug.
Thanks in advance!!


Top
 Profile  
 
PostPosted: Mon Jul 25, 2016 3:27 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6448
Location: UK (temporarily)
Well, easy thing first: pin 16 (that you've connected to A10) is NOT used as an input. If it's easy for you to dump it again treating it as an output that might be informative. (Maybe, maybe not)

CHR/OE is just (PPUA13 OR PPU/RD), as expected.
/IRQ is just (NOT 4020Q11)
4020CLR is AND(M2, /ROMSEL, CPUA14, CPUA13, CPUA12, NOT CPUR/W) ... i.e. writes to $7xxx???
RAM/CE is NAND(M2, /ROMSEL, A14, A13, NOT A12), i.e. I/O to $6xxx.
PATCH/OE is NAND(M2, NOT /ROMSEL=0, CPUA14, CPUA13, CPUA12, CPUA11, CPUR/W), i.e. reads from $Fxxx
PRG/OE is NAND(M2, NOT /ROMSEL, CPUR/W, NOT PATCH/OE), i.e. reads from $8000-$efff.

Other than the IRQ acknowledgement (4020CLR), everything else makes sense.


Last edited by lidnariq on Mon Jul 25, 2016 4:11 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jul 25, 2016 4:10 pm 
Offline
User avatar

Joined: Sat Jul 04, 2015 9:58 am
Posts: 568
Location: -29.794229 -55.795374
Great work!!
So... It seems that pin 16 was nc.
I just messed up a little and soldered it to A10. :oops:
Would be easy to unsolder it from A10 and put it on D6 if needed. :)

I also would like to know how to figure these things out, if possible.
Is there some kind of software or it's just a matter or putting the binary data on a truth table and try to simplify the equations?
I 've read something about Karnaugh's map, but for now my work is consuming lots of time... :cry:
Well, at last I have a work and have some little time to search for random things on the web. :lol:
But to study and do some hacks/mods is a little difficult, because I need to pay attention on what I'm doing/reading and interruptions are error inductors to me. Maybe it's because I'm a newbie... :mrgreen:
Other problem is that most of the reliable information is in english, that's not my mother language, but looks like I'm becoming better on reading and understanding it!!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 23 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: Yahoo [Bot] and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group