But it's not like other cheap keyboard-famiclones (GLK-2004). It's the first famiclone that doesn't make you want to throw the keyboard out of window after pressing few keys. But primarily the most interesting fact is presence of standard 3.5" floppy disk (!) and printer port, so I thought of making extensive reverse-engineer.
Also it was kind-of broken (internal cartridge showed no graphics like you would remove SRAM chip from CHR-RAM game) - as it turned out later, the resistor that pulled-up to VCC the line used to detect presence of external cartridge has too much resistance causing too big voltage drop.
This is probably either first-release or low quantity product:
* there are few patches applied to the PCB (cut traces + wires) - I marked them on schematics to see what they changed, they even cutted one track in two places
* overal designs looks weird - mixed glob + DIP chips and goldpin add-on boards with another addon boards.
--
Reverse engineering
The entire console consists of primary PCB (with cartridge slots) and secondary one (with DC A/V jacks), connected by a 22 pin ribbon cable (whose pinouts is different than any one I ever saw before). They even put two 7805's (one for powering floppy and the other for rest of chips). Both red & yellow wires of floppy are powered from 5V (maybe early floppy drives needed +12/+5V, but this one seems to be normal HD floppy, reads standard FAT12 1.44MB disks). Most hard part was to desolder those goldpins cause they're extremely fited to the holes, but it was succes.
Primary PCB:
Primary PCB - addon board:
Secondary PCB:
Keyboard layout:
--
Overal design:
There are tons of chips:
*NES-on-chip blob (with exact same pinout as UM6561)
*40 pin Mapper blob:
Code: Select all
+--------+
!ENABLE ->| MAPPER | -> PRG_A14..A19
| BLOB | -> ROM_!CE
CPU_D0..D7 ->| | -> RAM1_!CE
CPU_A14..A8 ->| | -> RAM2_!CE
!ROMSEL ->| | -> CIRAM_A10
M2 ->| |
R/W ->| | -> !LPT_REG
| | -> !LPTSTRB_REG
PPU_A13..A10->| | -> !FDD_REG
| | -> !AUDIO_REG
| | -> AUDIO_LATCH
+--------+
*GM82C765B which is floppy controler
*74273/74139/7308/7404/74161 for glue logic & interfacing with LPT port
*128 kB PRG-RAM1
*addon-board with 1MB PRG-ROM, 8kB PRG-RAM2 and some mysterious audio (?) blob-chip
Code: Select all
+--v--|
CPU-D3 |01 16| CPU-D4
CPU-D2 |02 15| CPU-D5
CPU-D1 |03 14| CPU-D6
CPU-D0 |04 13| CPU-D7
GND |05 12| Audio output2
AUDIO_LATCH |06 11| Audio output1
GND |07 10| +5V
!AUDIO_REG |08 09| CPU-R/!W
+-----+
*SB02 for driving columns of keyboard-matrix
Code: Select all
+--v--|
OUT2 |01 20| +5V
!EXT/INT |02 19| OUT0
!KBEN |03 18| OUT1
ROW6 |04 17| ROW11
ROW12 |05 16| ROW10
COL1-|>- |06 15| ROW4
ROW8 |07 14| ROW1
ROW7 |08 13| ROW9
ROW2 |09 12| ROW3
GND |10 11| ROW5
+-----+
Falling edge of OUT0 causes next ROWn line to become low (others are high) in the following order:
ROW11, ROW2, ROW3, ROW8, ROW6, ROW1, ROW9, ROW7, ROW10, ROW4, ROW5, ROW12
*74158 for multiplexing lines of keboard rows
*Chip called SUBOR.
This is a small glob pcb whose purpose is to play a one second welcome text (?) after console is started, no matter if the external cartridge is present or not.
Code: Select all
+------------+
|1 +5V |
|2 NC |
|3 PLAY |
|4 NC |
|5 RESET |
|6 NC |
|7 AUDIO_OUT |
|8 GND |
+------------+
- When pin 5 is held low, voice become muted (but after releasing it, it starts playing where it stopped)
Dumping the PRG-ROM.
I created a small adapter which converts the add-on board to standard 27801 pinout and thus allow read using EPROM programmer.
Firstly I got very incosistent reads. Later it turned out that the blob chip placed with the ROM is causing bus-conflicts. I disabled it.
--
Analyzing the mapper chip
It's hard to analyze chip built-in console. I did it by creating a special cartridge UNROM-like cartridge which controls pin 31 (used for detection of external cartridge).
Code: Select all
$08xx-0fxx = !LPT_STRBREG (during read/write cycle, this pin is held down)
$48xx-$4fxx = !LPT_REG (during read/write cycle, this pin is driven low)
$50xx = [MMpppppp] $8000 bank + configuration register1
||||||||
||++++++- select 16 kB ROM/RAM1 bank at $8000-$bfff
++------- mode
$52xx = [pppppp.V] $c000 bank + configuration register2 + AUDIO_LATCH latch
|||||| |
|||||| +- mode
++++++--- select 16 kB ROM/RAM1 bank at $c000-$ffff
+--- value latched on AUDIO_LATCH pin
$53xx = !AUDIO_REG (during read/write cycle, this pin is held down)
$54xx-57xx = !FDD_REG (during read/write cycle, this pin is held down)
CPU memory map PPU memory map
V MM | $6000 | $8000 | $c000 | $0000 | $1000
x 00 | RAM2 | ROM | ROM | c c
0 01 | RAM2 | - | ROM |
0 1x | RAM2 | RAM1 | ROM |
1 01 | RAM2 | - | - |
1 1x | RAM2 | RAM1 | RAM1 |
ROM is enabled even during write cycles;
"-" is open bus
What is left to do:
* PPU banking & mirroring: internal CHR-RAM's A0-A11 are wired to PPU. A12 is wired to CIRAM-A10 (which is controlled by mapper), but mapper blob has access to PPU_A13..A10 (so theoreticaly it can do V/H/0/1 mirroring and use 4kB/8kB ROM bank granurality).
Which I found extremely weird is that on powerup CIRAM-A10 follows PPU-A10 and there does not seem to be any register which changes that. However, when I looked at the behaviour of CIRAM-A10 for internal cartridge, it is strange. Looks like not CPU controls mirrorig/banking of CHR-RAM, but rather it is done by PPU-itself (like in MMC2, by looking at specific tiles) or it changes automatically after certain rises of PPU-A10/A11/A12/A13. I need to find that out.
I attach the ROM + modified FCEUx that supports it.
---
The built-in semi operating system called SB DOS Version 1.0 for managing flopppy drive has very limited set of commands. It can't even enter folders, but is able to execute COM/EXE (they need to be in subor format, whatever that means).
Note that in attached ROM, DOS (which is the center choice) cannot be run - probably communication with floppy-controler chip need to be implemented in emulator for that to work, but on real hardware the floppy disk can ever be disconnected and it still lets DOS to be executed.