It is currently Wed Aug 21, 2019 7:13 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 30 posts ]  Go to page Previous  1, 2
Author Message
PostPosted: Thu Feb 28, 2019 5:44 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
I'd like to try to help you rev-en this board but it seems to be 3 (or 4 layer) - at least at top side the ground polygon is covering many trases in the cartridge connector region :(


Top
 Profile  
 
PostPosted: Thu Feb 28, 2019 7:43 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
It is okay krzysiobal, I am working on it slowly but surely. I have the front and back lined up in Photoshop and I started manually tracing the things that we know. It will be a while to get through it. Eventually, all that will be left is the unknown stuff. From what I can tell, the inner 2 layers are only used for signals in really dense areas, otherwise most stuff is on the top and bottom.

Also I plan to eventually trace the card. I am intrigued to see how they hooked up a microwire EEPROM.


Top
 Profile  
 
PostPosted: Fri Mar 01, 2019 7:11 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
I am not sure what to make of this 44-pin LH5323 chip. It is very mysterious. I identified 2 pins, when grounded, cause it to drive the CPU data bus, seemingly 2 /CSs. Pin 25, which tied directly to GND on the PCB, and also pin 27, which is normally controlled by the 5C66. The remaining unknown pins 37, 41, 7, 8, 9, and 13 (corresponding to 5C66 pins 57,56,55,54,53,52) appear as inputs.

I tied both /CS pins low, then attempted to "dump" the chip like a ROM chip. I hooked up D0-D7 normally, A0-A11 normally, then:

A12 = 5323-37 = 5C66-57
A13 = 5323-41 = 5C66-56
A14 = 5323-7 = 5C66-55
A15 = 5323-8 = 5C66-54
A16 = 5323-9 = 5C66-53
A17 = 5323-13 = 5C66-52

It appears that all of those additional inputs affect the data that spits out from this chip. The data is very periodic looking, I was monitoring D7 with my scope during dumping and it had a definite cyclic pattern. I can dump repeatedly and get identical results. I also dumped in reverse, then reversed the file, and it too was identical. I removed power for 10 seconds, dumped again, and it was still identical.

I opened the file in yy-chr, 1-bit mode, and it contains what looks like tons of misaligned Japanese characters, possibly intended to be 4x4 tiles each, and graphics to construct large brackets / curly braces. I am not really seeing anything at all in terms of numbers, english letters, or other graphics. 2-bit mode won't work, it doesn't align right. I am not really sure what to make of this, it seems like a very unusual ROM chip. It is directly on the CPU address and data busses, not on the card data bus.

The Russian Wikipedia says that the Famicom Network System has a hardware encryption scheme, not sure what that entails or whether this chip is involved. I think I would expect less periodic and less predictable/repeatable data from this chip if that was the case though.

My Famicom Network System did nothing without a card inserted, I got a gray screen. But admittedly, I did not try closing the lid without a card in it. It does have a switch that tells it if the lid is open or not.


Top
 Profile  
 
PostPosted: Fri Mar 01, 2019 7:27 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 526
Location: Poland
Here is reverse-engineered schematic of the small PCB:
Image

* Is pin 12 of this connector connected to the pin 14 of famicom slot?

MMC1 CHR and MIRRORING (CIRAM-A10) lines are used as latches to drive lines of some chips (CHR bank 0 is used / mirroring is set to single screen B to output 1)

So basically:
* MMC1 PRG-A14..A17 controls sixteen 16 kB banks of PRG-ROM (which is mapped at $8000-$ffff)
* MMC1 CHR-A14/A15 controls four 8kB banks of PRG-RAM (which is mapped at $6000-7fff)
* MMC1 CHR-A16 acts as a chip enable to the PRG-RAM (0=enabled)
* MMC1 CHR-A13 acts as clock to EEPROM
* MMC1 CIRAM-A10 acts as chip select to EEPROM
* MMC1 CHR-A12 acts as data input to EEPROM
* CPU-D0 is driven with EEPROM data output (only when reading form $6000-$7fff and CIRAM-A10=1 and MMC1-CHR-A16=1)

---

Updated due to suggestion from Ben Boldt


Last edited by krzysiobal on Sat Mar 02, 2019 5:30 am, edited 2 times in total.

Top
 Profile  
 
PostPosted: Fri Mar 01, 2019 9:56 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
Thanks so much for doing this krzysiobal.

One small glitch is that VCC is both pins 1 & 2, and GND is both pins 41 & 42. It is confusing because the card just has one big finger for both pins in these cases. (The cut-out area does not count as pin numbers.) So actually you are asking if pin 13 is CPU R/W, and I can confirm that it is not, at least not directly. It is very strange, it goes through the lid switch.

P6 is the connector for the lid switch:
P6-1 -> 5C66-15, 5A18-84
P6-2 -> Card Pin 13, with 10k pull-up to 5V
P6-3 -> GND (RF shield), not going to the switch at all.

When the card is clicked down, P6-1 and P6-2 close together. When it is up, they are not connected.

It is conceivable that the 5C66 buffers CPU R/W and sends it out on pin 15. I am not sure why the 5A18 would be connected. It seems 5C66-15 is the output, and 5A18-84 and Card-13 would both then be inputs.


Top
 Profile  
 
PostPosted: Tue Mar 05, 2019 1:13 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
I found today that the 5C66 responds to reads to these addresses (Address bits A0-A7, A12-A14, /ROMSEL, fits nicely to the hex form $NxNN):

Address - Values observed on CPU data bus

$4xA1 - $FF
$4xA2 - $20 with pull-downs, $2C with pull-ups
$4xA5 - $00 with pull-downs, $78 with pull-ups
$4xA6 - Different every time
$4xA7 - Different every time
$4xA9 - $00
$4xAA - $00
$4xAD - $00 with pull-downs, $7F with pull-ups
$4xB1 - $FF
$4xC0 - $00 with pull-downs, $70 with pull-ups

Note that the card data bus and all other pins were floating during this test, possibly lending itself to differences with pull-ups vs. pull-downs.

Also: the 5C66 would not talk without its crystal attached.


Top
 Profile  
 
PostPosted: Tue Mar 05, 2019 6:48 pm 
Offline
Site Admin
User avatar

Joined: Mon Sep 20, 2004 6:04 am
Posts: 3703
Location: Indianapolis
I stumbled into an interesting bit of info about the JRA-PAT software. The dial-up service existed until 2015, and there is a video of it working in 2008 (both links are the same video). I couldn't read the text of course, except where it mentioned Windows Vista, which is funny to see on Famicom. I'd bet that a small number people were still using this.
https://www.nicovideo.jp/watch/sm3351267
https://www.youtube.com/watch?v=ks0JeyhZsR4

Also saw these things:
https://twitter.com/jironosuke99/status/1102054128266539008
https://twitter.com/jironosuke99/status/1102055161260793856
https://twitter.com/jironosuke99/status/1102056386265899013


Top
 Profile  
 
PostPosted: Tue Mar 05, 2019 7:29 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
That is absolutely hilarious.

I have been poking a lot at this RF5C66 chip and found a few things. I determined if each pin is an input or output with using pull-up / pull-down resistors. This doesn't exclude the possibility that some of them are bidirectional. I found that pin 29 should be pulled up to prevent the RF5C66 being reset by the CIC chip. That was a breakthrough of a discovery because I couldn't get it to do much before that. I found 4 /CEs and ranges:

Pin 50 - LH5323M1 /CE: Range $5000-5FFF. Range of size $1000 jives with CPU A0-A11 being connected directly.
Pin 40 - Card Bus RAM /CE (for the ram chip in the network system, not in the card): Range $6000-7FFF
Pin 42 - Modem (RF5A18) /CE, Range $4xD0-4xDF, $CxD0-CxDF
Pin 41 - Normally n/c, Range $4xE0-4xEF, $CxE0-CxEF

The plot thickened a little bit for the LH5323M1. I believe pins 52-56 are akin to PRG A12-A16. These pins toggle on counting M2 falling edges when the CPU address bus is in range $5000-5FFF.
52 - Inverts on each M2 falling edge
53 - Inverts each 2 M2 falling edges
54 - each 4
55 - 8
56 - 16
57 - Always low, I have not gotten this pin to ever go high. (I figure this would be like PRG A17, I was pretty sure that it does reveal different data when set 0 vs 1.)

SOO I should dump it toggling like that and see what happens I guess.


Top
 Profile  
 
PostPosted: Tue Mar 05, 2019 7:37 pm 
Offline
User avatar

Joined: Tue Jun 24, 2008 8:38 pm
Posts: 2309
Location: Fukuoka, Japan
The twitter post, which I saw recently, show a device that seems called "micro core" which has the capability of communication and uses cards that seems similar to pc-engine one. The name of the controller is "daiwa my trade", which seems to imply about stock trading but this is me just speculating.

And what make me speculating about it is this book on amazon ホームトレード最前線―ファミコン200%活用法 (home trade forefront, 200% usage on famicom, 1988). The picture on the book is exactly the same device.

Here's the picture, just in case the link get lost on amazon:
Attachment:
51-khv2aAuL._SX347_BO1,204,203,200_.jpg
51-khv2aAuL._SX347_BO1,204,203,200_.jpg [ 44.41 KiB | Viewed 12159 times ]


So it may be possible that people did trading with it for a long time, even though the famicom itself didn't have any game anymore. I wouldn't be surprised, since we still had geocities until recently here :lol:

edit:

and the book on amazon is sold under 大和証券マイトレード推進室 (Daiwa securities 'my trade' promotion office) so this real means it was for trading stocks.


Top
 Profile  
 
PostPosted: Thu Mar 07, 2019 12:05 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
Banshaku wrote:
The twitter post, which I saw recently, show a device that seems called "micro core" which has the capability of communication and uses cards that seems similar to pc-engine one. The name of the controller is "daiwa my trade", which seems to imply about stock trading but this is me just speculating.

And what make me speculating about it is this book on amazon ホームトレード最前線―ファミコン200%活用法 (home trade forefront, 200% usage on famicom, 1988). The picture on the book is exactly the same device.

Here's the picture, just in case the link get lost on amazon:
Attachment:
51-khv2aAuL._SX347_BO1,204,203,200_.jpg


So it may be possible that people did trading with it for a long time, even though the famicom itself didn't have any game anymore. I wouldn't be surprised, since we still had geocities until recently here :lol:

edit:

and the book on amazon is sold under 大和証券マイトレード推進室 (Daiwa securities 'my trade' promotion office) so this real means it was for trading stocks.

This must be just about the least secure possible way to do something like this, but I guess it is obscure, and that makes it sort of secure... It is very interesting and curious to say the least.

I inspected the breakout board that I used to dump the JRA-PAT ROM chip against your schematic/pinout krzysiobal, and it seems I had A15 incorrect. That pin had a short to GND. I re-dumped it today and now all 3 of the vectors go to places that make sense. It still just sits waiting for bit 7 of register $40C0 to get set. If I skip that, proceeds with the code, not jumping back to the reset vector like I thought before with the bad dump. Nothing ever appears on the screen though, it is probably getting stuck waiting for something else somewhere.

Edit:
I found these registers being written to by JRA-PAT:
40A3
40A6
40A7
40A8
40AB
40AD
40AE
40B1
40C0
40D3 (RF5A18 (Modem) address space 4xD0-4xDF)
40D4 (RF5A18 (Modem) address space 4xD0-4xDF)


Top
 Profile  
 
PostPosted: Sat Mar 16, 2019 8:42 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
Update - I have mounted the RF5A18 onto a breakout board, powered it, and found whether each pin appears to be and input or output. I updated the information here:

https://wiki.nesdev.com/w/index.php/User:Ben_Boldt

Does anyone have ideas how/where to store this information in the wiki in a more permanent way? I am not sure if I should just create a new article named "Famicom Network System" and dump it in there? It is more a collection of pinouts at the moment I guess. I don't think it is necessarily ready for that yet but just something to think about ahead of time I guess.


I am still making daily progress on tracing out the PCB. It is a monumental amount of work. I am doing this with Photoshop on my Macintosh. Each signal gets its own layers for top and bottom.

Attachment:
Picture 15.png
Picture 15.png [ 1.22 MiB | Viewed 11488 times ]


I have carefully used a flashlight and double-checking with a continuity tester to trace out MOST of the bottom inner layer traces, which really only exist around the Famicom connector AFAIK. I have all of these dumped onto 1 single photoshop layer currently, because I started with just bits and pieces of traces until I built them up figuring out what was what.

The top inner layer does contain some traces, but not near as many. Whatever it contains is almost entirely obscured by ground planes. Since there is a cutout around each thru-hole, I will still be able to use the flashlight trick to see if a trace exists and what direction it goes. As a last resort, I thought it might be possible to pass a controlled amount of current through an unknown trace and see if I can draw any additional data with a thermal camera. But I do not think it will come to that.

Surprisingly, I have found NO new or incorrect connections or signals this way at all yet.


Top
 Profile  
 
PostPosted: Sat Mar 16, 2019 8:52 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 21559
Location: NE Indiana, USA (NTSC)
The typical pattern is to create a draft in your user space, titled something like "User:Ben Boldt/Famicom Network System".

_________________
Pin Eight | Twitter | GitHub | Patreon


Top
 Profile  
 
PostPosted: Wed May 22, 2019 10:37 am 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
tepples wrote:
The typical pattern is to create a draft in your user space, titled something like "User:Ben Boldt/Famicom Network System".

I am thinking about moving this over to an actual wiki article at this point, any objections?
https://wiki.nesdev.com/w/index.php/User:Ben_Boldt/Famicom_Network_System


Top
 Profile  
 
PostPosted: Wed May 22, 2019 1:36 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 4208
Location: A world gone mad
Assuming I survive this week at work, I'll be trying to get scans of the product manuals1 (in PDF) up and available. Once I make those available, if there are any pages or sections people want translated2, please let me know and I'll have them done.

1 -- Famicom Network System manual will be first. JRA-PAT will come later (manual is huge/long).
2 -- Already met with the translator a few weeks ago. He's willing to do the Famicom Network System manual (esp. parts of it which we're interested in), but the entire JRA-PAT manual is out of the question (long, boring, lot of screenshots, and it's not like we can even test/try it here in the US anyway). However, there is a lengthy section in the JRA-PAT manual for error codes which he's agreed to translate, since I figured those might come in handy (not sure if they're generic Famicom Network system error codes or specific to JRA-PAT; I suspect a little of both).


Top
 Profile  
 
PostPosted: Thu May 23, 2019 1:40 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 339
Location: Minnesota, USA
koitsu wrote:
Assuming I survive this week at work, I'll be trying to get scans of the product manuals1 (in PDF) up and available. Once I make those available, if there are any pages or sections people want translated2, please let me know and I'll have them done.

1 -- Famicom Network System manual will be first. JRA-PAT will come later (manual is huge/long).
2 -- Already met with the translator a few weeks ago. He's willing to do the Famicom Network System manual (esp. parts of it which we're interested in), but the entire JRA-PAT manual is out of the question (long, boring, lot of screenshots, and it's not like we can even test/try it here in the US anyway). However, there is a lengthy section in the JRA-PAT manual for error codes which he's agreed to translate, since I figured those might come in handy (not sure if they're generic Famicom Network system error codes or specific to JRA-PAT; I suspect a little of both).

Sounds awesome! Other than the custom CIC, it should be possible to make these cards - they are very much like GameBoy carts. It just needs a small thin PCB printed and a plastic shell via 3d-printer. I think that developing software for this thing could be a major challenge though. Other than the fact that it would be SUPER COOL to get use out of a Famicom Modem, I was not able to find any indication of fancy features other than the known modem abilities itself. I would have kind of hoped for extra sound channels or PPU magic or something like that but signs point strongly to no. For development purposes, time might be better spent designing a regular cart with networking abilities... But as a historical item, we all benefit knowing more about the Famicom Modem and how it works, and I am excited to see what you share with us.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 30 posts ]  Go to page Previous  1, 2

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group