It is currently Tue Sep 25, 2018 3:36 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 8 posts ] 
Author Message
PostPosted: Sun Jun 24, 2018 4:02 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
Image Image Image Image Image Image Image

I got photos of this cartridge + ROM dumps. Is is made probably by the same manufacturer that the series of pirate MMC5 games. From photos and without access to PAL chip, I could find out that this is subset of mapper 19 (Namco 163). Here goes rev-en of the mapper:

Code:
---------------------------------- CPU ----------------------------------
CPU bank : $6000 | $8000 | $a000 | $c000 | $e000 
register :  RAM  | $e000 | $e800 | $f000 |   -1 
value    : [...P PPPP]
mask     : $fc00 1111110000000000
   
---------------------------------- PPU ----------------------------------
PPU bank : $0000 | $0400 | $0800 | $0c00 | $1000 | $1400 | $1800 | $1c00
register : $8000 | $8800 | $9000 | $9800 | $a000 | $a800 | $b000 | $b800
value    : [CCCC CCCC]
mask     : $fc00

------------------------------- NAMETABLES ------------------------------
PPU bank : $2000 | $2400 | $2800 | $2c00
register : $c000 | $c800 | $d000 | $d800
value:   : [.... ...M]
mask     : $fc00

---------------------------------- IRQs ---------------------------------
$8400 [LLLL LLLL] - load low counter byte
$a400 [EHHH HHHH] - load high counter byte
mask: $e400

There is 15 bit counter, which increments every M2 cycle only if E=1. When counter wraps from $7fff to $0, it stops and IRQ is triggered . Reloading high counter byte acknowledges interrupt.


As always, I am quite amazed with the bootleg solutions, this time the brilliant use of counter bit 15 (E) as 74161's ENT, which allows incrementing only when it is 1 and also E is automatically set to 0 when counter overflows.

What is also interesting are the fake chip names on the PCB:
Image

As I said, I did not have access to examine the PAL
Image, but it is the one with feedback outputs which is hard to analyze without special effort.

My guessing is that three of unconnected outputs latches the bit 4 of PRG bank which is fed into PRG_A17
Code:
O3 <= CPU_D4 when PRG_nGW=0 and CPU_A12=0 and CPU_A11=0
O4 <= CPU_D4 when PRG_nGW=0 and CPU_A12=0 and CPU_A11=1
O5 <= CPU_D4 when PRG_nGW=0 and CPU_A12=1 and CPU_A11=0
PRG_A17 <= O3 when CPU_A14=0 and CPU_A13=0 else
           O4 when CPU_A14=0 and CPU_A13=1 else
         O5 when CPU_A14=1 and CPU_A13=0 else
         1


Other combinatorial outputs are probbaly:
PRG_nGR <= 1 when CPU_A14=1 and CPU_A13=1 else 0
RAM_nCS <= 0 when CPU_A14 = 1 and CPU_A13=1 and CPU_nROMSEL = 1 else 1 //M2 is not taken into account, it is wired to RAM's positive chip enable
nIRQ <= not IRQPEN

I have no idea:
* Why M2 has pull-down resistor to GND? Were they affraid of floating when console is held in reset (during powerup)?

* When 74161 is clocked, !LOADH /!LOADL need to be low just before CLK rises. If
CLK <= M2
that wouldnt work because 74138 gives small delay which would cause !LOADH / !LOADL to fall after CLK. And
CLK <= not M2 probably wont work either due to hazard reasons (unless PAL is really slow)
Image


* Is
nIRQ <= not IRQPEN
or is there any other way of acknowledging IRQ? Why is !LOADH fed into PAL.


Attachments:
rom+emu.rar [1.06 MiB]
Downloaded 62 times
Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 5:47 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 427
this irq clock is original ?


Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 11:05 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7558
Location: Seattle
krzysiobal wrote:
Why M2 has pull-down resistor to GND? Were they afraid of floating when console is held in reset (during powerup)?
Guessing: save protection.


Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 7:04 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 427
lidnariq wrote:
krzysiobal wrote:
Why M2 has pull-down resistor to GND? Were they afraid of floating when console is held in reset (during powerup)?
Guessing: save protection.


save not working?


Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 8:05 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7558
Location: Seattle
I have no idea what you're asking. Could you add more words?


Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 8:41 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 427
lidnariq wrote:
I have no idea what you're asking. Could you add more words?


Sorry, I mean,this game in emulator save not working,because save protection?

Chinese translation:
对不起,我的意思,这个游戏在模拟器中存档功能不能使用,是因为存档保护?


Top
 Profile  
 
PostPosted: Sun Jun 24, 2018 11:18 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7558
Location: Seattle
Now I understand.

My suggestion is unrelated.

The external resistor pulling M2 down guarantees that the save RAM is disabled whenever the cassette wasn't in an operating console, protecting save data. But not a separate logical control.


Top
 Profile  
 
PostPosted: Mon Jun 25, 2018 3:55 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 377
Location: Poland
I got news from the owner of the cartridge. Looks like "CLK <= not M2". PAL adds around 24 ns of delay.
Image


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group