Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
krzysiobal
Posts: 793
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by krzysiobal » Fri Sep 04, 2020 6:14 pm

Analysis requested by NewRisingSun. This PCB contains:
* 1MB blob PRG-ROM
* 8kB blob PRG-RAM (no battery back-up)
* 93C46 based EEPROM PRG-RAM
* 8kB blob CHR-RAM
* blob mapper chip, which is exactly the same one as used in previously analyzed games (Diablo 2, Harvest Moon, Warcraft). If treating the chip as black-box, then it has the same pin-out and behaves identically inside. However, it is wired differently which changes the cartridge behavior significantly:
Image Image Image

Code: Select all

pin | canonical meaning | Diablo 2             | Wacraft         | Harvest Moon   | Dahua Sanguo          |
    |                   |                      |                 |                | Yancheng YC-03-09 PCB |
    |                   | (mapper 163)         | (mapper 163)    | (mapper 163)   | (mapper 558)          |
----+-------------------+----------------------+-----------------+----------------+-----------------------+
 01 | -- NC             | ommited              | ommited         | test point     | ommited               |
 02 | -> WRAM /CE       | *                    | *               | *              | *                     |
 03 | -> $5200.0        | PRG A19, blob p.7    | PRG A19         | PRG A19        | EPR DI                |
 04 | -> $5100.0        |          blob p.12   | ommited         | test point     | PRG A19               |
 05 | -> $5000.3        | PRG A18, blob p.8    | PRG A18         | PRG A18        | PRG A18               |
 06 | <- PPU A13        | jumper (closed)      | jumper (closed) | *              | *                     |
 07 | <- PPU A9         | *                    | *               | *              | *                     |
 08 | <- PPU /RD        | *                    | *               | *              | *                     |
 09 | <- PPU A12        | *                    | *               | *              | *                     |
 10 | -> CHR A12        | *                    | *               | *              | *                     |
 11 | -- VBAT           | *                    | *               | *              | test point            |
 12 | -- RAM VCC        | *                    | *               | *              | *                     |
 13 | -- VCC            | +5V                  | +5V             | -[100R]--+5V   | +5V                   |
 14 | -> $5000.2        | PRG A17, blob p.10   | PRG A17         | PRG A17        | PRG A17               |
 15 | -> $5000.1        | PRG A16              | PRG A16         | PRG A16        | PRG A16               |
 16 | -> $5000.0        | PRG A15              | PRG A15         | PRG A15        | PRG A15               |
 17 | <- CPU A8         | *                    | *               | *              | *                     |
 18 | <- CPU A9         | *                    | *               | *              | *                     |
 19 | <- CPU R/W        | R/W or CPU A10       | R/W or CPU A10  | R/W or CPU A10 | CPU A10               |
 20 | <- CPU A12        | *                    | *               | *              | *                     |
 21 | <- CPU A13        | *                    | *               | *              | *                     |
 22 | <- CPU A14        | *                    | *               | *              | *                     |
 23 | <- CPU /ROMSEL    | *                    | *               | *              | *                     |
 24 | <- CPU M2         | M2, blob p.5         | *               | *              | *                     |
 25 | -- GND            | *                    | *               | *              | *                     |
 26 | <- CPU D7         | *                    | *               | *              | *                     |
 27 | <- CPU D3         | *                    | *               | *              | *                     |
 28 | <> CPU D2         | *                    | *               | *              | *                     |
 29 | <- CPU D1         | *                    | *               | *              | CPU D0                |
 30 | <- CPU D0         | *                    | *               | *              | CPU D1                |
 31 | <- $5100.2        | jumper               | ommited         | test point     | EPR DO                |
 32 | -> $5200.2        |          blob p.1    | ommited         | test point     | EPR CS                |
 33 | -> $5200.1        | PRG A20, blob p.6    | ommited         | PRG A20        | EPR CLK               |
 34 | <- /RESET         | +5V                  | +5V             | +3.3V          | M2 toggle detect      |
 
 * = connected canonically
Info:
1) CPU-D0 and CPU-D1 are wired differently which effectively swaps bit 0 and bit 1 in every of its register
2) Pin 19, which used to be "CPU-A10 | CPU-R/W", now it is just CPU-A10. This means that all access (read/write) to registers:
* $5000/$5100/$5200/$5300 is treated as write
* $5400/$5500/$5600/$5700 is treaded as read
3) Pin 34, which was wired to VCC, is in fact /RESET. When this pin is held LOW, all bits of internal registers ($5000, $5100, $5200, $5300) are cleared (and writing to those registers is ignored until it is driven HIGH. It is externally connected to M2-cycle detector, which put the chip in reset during power-up or after reset button is pressed

Answering NRS questions
* What exactly do bits 4-6 of register $5000 do?
Those data pins are not wired so they don't matter

*Does mapper 558 have the 1 bpp mode that mapper 164 has? You can see it being used in "Final Fantasy V" in-game by pressing SELECT, then choosing the bottom option (手記).
It can't as it does not have PPU-A3/CHR-A3 wired in

*Does register $5300 in mapper 558 really function in the same way as you found it on the Nanjing mapper 163, in particular, the bit swap?
Yes, with the exception that because of different wiring, the bit order is now [.....AB.], not [.....A.B]

*I wrote my description based on that assumption. Did I describe the consequences of the D0/D1 bit swap for the Microwire Interface register $5200 correctly?
I don't think so. There are no counter-acting effects as you described, just swaping bit order before latching when $5300.1 = 1

ROM dump: https://gofile.io/d/6vc36e
Last edited by krzysiobal on Sat Sep 05, 2020 2:46 am, edited 3 times in total.

NewRisingSun
Posts: 1237
Joined: Thu May 19, 2005 11:30 am

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by NewRisingSun » Fri Sep 04, 2020 9:57 pm

Thank you. Comments:

CPU A8 and CPU A9 must be swapped compared to mapper 163 as well, to make the Microwire interface appear at $5200 instead of mapper 163's $5100.
* What exactly do bits 4-6 of register $5000 do?
Those data pins are not wired so they don't matter
Them being set by the game must be a remnant of code for Yancheng's previous mapper 164, then, which would be an interesting counterpoint to study.
I don't think so. There are no counter-acting effects as you described, just swaping bit order before latching when $5300.1 = 1
I understood it that way because of this part from here:

Code: Select all

   1   1   0   1   0   1  $5100 [......BA]
                                       ++- bit output on pin 4 (when $5300.0 = 0)
                                       +-- bit output on pin 4 (when $5300.0 = 1)
... which was necessary to get two Nanjing games working, whose PCB still has to be studied. The "counteracting effect" in the case of this game will be the fact that D0/D1 are generally swapped through wiring, before they're swapped again by $5300. (My head hurts). :D

The ROM dump has CPU D5 permanently held high, unfortunately.

krzysiobal
Posts: 793
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by krzysiobal » Sat Sep 05, 2020 1:27 am

CPU A8 and CPU A9 must be swapped compared to mapper 163 as well, to make the Microwire interface appear at $5200 instead of mapper 163's $5100
No, CPU-A8/CPU-A9 is wired the same way compared to the three previously analyzed games (Diablo2, Warcraft, Harvest Moon). The blob's pins "$5200.x" are connected to EPROM input lines, "$5100.2" to eprom data out (which can be read from $5500 address) and "$5100.0" to PRG A19, as in table above.
The ROM dump has CPU D5 permanently held high, unfortunately.
Sorry, there had to be some dirty pin, I cleaned it and now it dumps correctly (fixed the link above)
BTW. it looks like the blob PRG is 512kB, not 1MB, because despite PRG-A19 toggling, the second half is the same as first one):
Last edited by krzysiobal on Sat Sep 05, 2020 2:44 am, edited 1 time in total.

NewRisingSun
Posts: 1237
Joined: Thu May 19, 2005 11:30 am

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by NewRisingSun » Sat Sep 05, 2020 2:11 am

That is the dump I got with $5300=$07, not $04.

krzysiobal
Posts: 793
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by krzysiobal » Sat Sep 05, 2020 2:41 am

NewRisingSun wrote:
Sat Sep 05, 2020 2:11 am
That is the dump I got with $5300=$07, not $04.
Yea, my dump is equivalent of read-back the ROM content as it would be desoldered.
So this is the same as of dumping the cartridge with $5300.0=1 because D0/D1 are swapped externally.

NewRisingSun
Posts: 1237
Joined: Thu May 19, 2005 11:30 am

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by NewRisingSun » Sat Sep 05, 2020 2:43 am

You mean $5300.1=1 ;)

krzysiobal
Posts: 793
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by krzysiobal » Sat Sep 05, 2020 2:47 am

Yup.

To sum up:

Code: Select all

-Mapper 163-----------------------------------------------------------
-WR $5000-- -WR $5100-- -WR $5200-- -WR $5300-- -RD $5100--
[c... SRQP] [.... ...#] [.... .#UT] [.... .A.B] [.... .#..] (when B=0)
[c... SRPQ] [.... ..#.] [.... .#TU] [.... .A.B] [.... .#..] (when B=1)

-Mapper 558-----------------------------------------------------------
-WR $5000-- -WR $5100-- -WR $5200-- -WR $5300-- -RD $5500--
[c... SRPQ] [.... ..T.] [.... .EDC] [.... .AB.] [.... .d..] (when B=0)
[c... SRQP] [.... ...T] [.... .ECD] [.... .AB.] [.... .d..] (when B=1)

A=mode of PRG A15/A16
B=bit swap
c=CHR A12 auto switch
P=PRG A15
Q=PRG A16
R=PRG A17
S=PRG A18
T=PRG A19
U=PRG A20
C=EPROM CLK
D=DATA TO EPROM
E=EPROM CS
d=DATA FROM EPROM
#=this pin is routed out from blob to test-point

NewRisingSun
Posts: 1237
Joined: Thu May 19, 2005 11:30 am

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by NewRisingSun » Sat Sep 05, 2020 3:19 am

I can see that I will have to rewrite the wiki pages for mappers 162-164+558 many times to come. :oops:

There are still four more boards using this mapper blob, probably all with strange little wiring variants. :shock:

pakosup
Posts: 41
Joined: Mon Apr 24, 2017 10:23 pm

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by pakosup » Fri Sep 18, 2020 10:55 pm

When I tried to make Pokemon Yellow from FF VII board then it has freezed when screen is scrolled outside a home. So I have to bought original Pokemon Yellow cart.
By the way, I have several design of pcb with mapper 163.
NJ-1, NJ-1B, NJ-1C
20180421_143142~01.jpg

krzysiobal
Posts: 793
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by krzysiobal » Fri Sep 18, 2020 11:34 pm

pakosup wrote:
Fri Sep 18, 2020 10:55 pm
When I tried to make Pokemon Yellow from FF VII board then it has freezed when screen is scrolled outside a home.
I spotted the issue when making reproduction based on FPGA chip and protection bits were implemented not 100% correctly. After fixing it according to wiki, it started to work, maybe there is some wiring differences your PCBs.

NewRisingSun
Posts: 1237
Joined: Thu May 19, 2005 11:30 am

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by NewRisingSun » Sat Sep 19, 2020 1:15 am

pakosup wrote:By the way, I have several design of pcb with mapper 163.
Great! Do you have the PCBs of these particular game/title screen variants?
162-1.png
162-1.png (3.75 KiB) Viewed 2424 times
162-2.png
162-2.png (3.14 KiB) Viewed 2424 times
163.png
163.png (1.96 KiB) Viewed 2424 times
These are the variants that still need to be studied, because they have some unique protection features.

pakosup
Posts: 41
Joined: Mon Apr 24, 2017 10:23 pm

Re: Dahua Sanguo (Yancheng YC-03-09 PCB, mapper 558)

Post by pakosup » Sat Sep 19, 2020 6:31 am

I've never seen these games. Actually nj-1b and nj-1c for Final Fantasy VII. I made Diablo II from one of them.
Nj-1 for Pokemon Yellow.

Post Reply