It is currently Sun Nov 19, 2017 1:42 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 6 posts ] 
Author Message
PostPosted: Thu Aug 25, 2016 2:45 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 245
Location: Poland
Hello. One guy sent me famiclone cart to repair (probably 32-in-1).
Image Image

The cart won't run at all. I tried to read some bytes from CPU area ($8000-$FFFF) and PPU ($0000-$1FFF) using MyKazzo. The reads are repeatable (i.e. another read from the same address range returns the same data). However I found out weird issue - first read $80 bytes are zeros, next $80 bytes contains data, another $80 bytes contain zeros, etc. That is both in PRG & CHR.

Then I desoldered all chips. I tested 74XX chips (74174, 74139, 74153) using my homemade chip tester. They seems to be fine. Next, I dumped both PRG & CHR using memory programmer.
Image Image

I found out that this $80 bytes zeros/data pattern are in whole PRG / CHR rom.
Image

But the remaining bytes of PRG seems to be OK. For example, I found the following sequence:
Code:
ALPHABETAGAMMADELTAEPSILONZETAETATHETAIOTAKAPPALAMBDAMUNUXIOMICRONPIRHOSIGMATAUUPSILONPHICHIPSIOMEGAINFINITYTARGETATTACKGAME

It also appears in STAR FORCE game so this 32-in-1 set might contain this game.

If this rom would be available online, I would just replace the broken mask roms with preprogrammed EPROMS, but I doubt I can find this set. And the 31-in-1 (Pirate Cart) (J), available online doesn't seem to be this same set.

So the reason of not working is probably because of broken PRG & CHR. Are they mask-roms?
How is possible they are broken in such funny way? Did they broke them in factory during writing?


Attachments:
32in1-32r [chr].bin [256 KiB]
Downloaded 60 times
32in1-32l [prg].bin [512 KiB]
Downloaded 58 times
Top
 Profile  
 
PostPosted: Thu Aug 25, 2016 11:24 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6442
Location: UK (temporarily)
Well, I was able to RE the PCB from the photos.

No bus conflicts (PRG ROM is disabled when R/W=0)
Writes to $8000-$FFFF latch address bus:
Code:
A~[1.SM .PPP Pp.C CCCC]
     ||  ||| || | ||||
     ||  ||| || +-++++-- Select 8 KiB CHR bank for PPU $0000-$1FFF
     ||  +++-++--------- Select 16 KiB PRG bank for CPU $8000-$BFFF and $C000-$FFFF when S=1
     ||  +++-+---------- Select 32 KiB PRG bank for CPU $8000-$FFFF when S=0
     |+----------------- 0: NTRAM A10 is PPU A10 (vertical mirroring, horizontal layout)
     |                   1: NTRAM A10 is PPU A11 (horizontal mirroring, vertical layout)
     +------------------ 0: 32 KiB PRG ; 1: 16 KiB PRG
(edit: I forgot that '153s multiplexer inputs go the opposite direction of what I naively expected)
The 256 KiB CHR ROM is compatible with both EPROM and Flash pinouts. The 512 KiB PRG ROM is compatible with EPROM pinouts.

Quickly looking through FCEUX's addrlatch.cpp, I don't see anything that's exactly this.

krzysiobal wrote:
Are they mask-roms?
Probably, since they are engraved with unique tags
Quote:
How is possible they are broken in such funny way?
As you (probably?) know, ROMs are usually a square array of bits surrounded by one line of demultiplexers/row selectors and one line of multiplexers/column selectors. For a 4Mibit ROM, the central array will be 2048 bits on a side, or 256 bytes ... and the error stride you're seeing is every 256 bytes. I wouldn't be surprised if the multiplexers are somehow broken.

Since it's a pirate multicart, it should be practical to search for the extant 128-byte strings in existing corpora to piece together everything that "should" be there except the menu itself.


Last edited by lidnariq on Mon Aug 29, 2016 12:03 pm, edited 2 times in total.

Top
 Profile  
 
PostPosted: Thu Aug 25, 2016 3:15 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 352
this prg and chr is not correct.


Top
 Profile  
 
PostPosted: Mon Aug 29, 2016 10:44 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 245
Location: Poland
Thank you for the reply.
I reed the schematics:
Image

You made 2 mistakes - bits for setting mirroring and for banking mode have opposite meaning (0=V,1=H, 0=32KB, 1=16kB)


Top
 Profile  
 
PostPosted: Mon Aug 29, 2016 11:59 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 6442
Location: UK (temporarily)
I sat down and made a giant fingerprint database of every 128-byte slice of every game everywhere in GoodNES 3.14, and saw just how good of a match I could find.

So, I suppose the good news is that 32-in-1 is almost exactly a subset of what GoodNES calls "52 Games [p1].nes" and "58-in-1 [p1].nes". The down side is that only 1998 out of the 2048 128-byte slices from PRG have an exact match. Part of the reason for the missing 50 slices is that all the games have been modified for the necessary mapper hacks...

PRG contains, in order:
• (32KiB) Takahashi Meijin no Bouken Shima
• (32KiB) Star Soldier (J)
• (32KiB) Tengen's Tetris
• (32KiB) SMB1
• (≈4KiB) 4 Nin Uchi Mahjong ( containing a region with no matches; probably the menu? )
• (8KiB) Galaxian
• (16KiB) Bomberman
• (16KiB) Battle City
• (16KiB) Pac-Man
• (16KiB) Ice Climber
• (16KiB) Road Fighter
• (16KiB) Lode Runner
• (16KiB) Championship Lode Runner
• (16KiB) Galaga (J) [!]
• (16KiB) Gomoku Narabe
• (16KiB) Pinball (JU) [!]
• (16KiB) F-1 Race
• (16KiB) Yie Ar Kung-Fu (J) (V1.2) [!]
• (16KiB) Sky Destroyer
• (16KiB) Choujikuu Yousai - Macross (J) [!]
• (16KiB) Star Force
• (16KiB) Circus Charlie
• (16KiB) Popeye (J) (PRG0)
• (16KiB) Excitebike
• (16KiB) Mario Bros (not super)
• (16KiB) Ninja-Kun
• (16KiB) Donkey Kong Jr
• (16KiB) Kinnikuman - Muscle Tag Match (J) (PRG0) [!]
• (16KiB) Exerion (J)

CHR is a much less good match, because there's a lot of bonus 128-byte slices of all 0s (beyond the 256-byte pattern). Only 755 out of 1024 128-byte slices had an exact match. (Another 260 128-byte blocks were all zeros) Interestingly, it's almost the exact same order as PRG:
• (32KiB) Takahashi Meijin no Bouken Shima
• (16KiB) Star Soldier (J)
• (16KiB) Tengen's Tetris
• (8KiB) SMB1, one of the pirate CHR variants
• (8KiB) Galaxian, one of the pirate CHR variants
• (8KiB) Bomberman
• (8KiB) Battle City
• (8KiB) Pac-Man
• (8KiB) Ice Climber
• (8KiB) Road Fighter
• (8KiB) Lode Runner AND Championship Lode Runner (use the same CHR)
• (8KiB) Galaga
• (8KiB) Gomoku Narabe
• (8KiB) Pinball
• (8KiB) F-1 Race
• (8KiB) Yie Ar Kung-Fu
• (8KiB) Sky Destroyer
• (8KiB) Choujikuu Yousai - Macross (J) [!]
• (8KiB) Star Force
• (8KiB) Circus Charlie
• (8KiB) Popeye
• (8KiB) Mario Bros.
• (8KiB) Ninja-Kun
• (8KiB) Donkey Kong Jr
• (8KiB) Kinnikuman - Muscle Tag Match (J) (PRG0) [!]
• (8KiB) Exerion


Top
 Profile  
 
PostPosted: Wed Dec 07, 2016 4:54 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 245
Location: Poland
Thank you for help. I fixed the cart.
1. I replaced broken OTP ROMS with 27C4001 4Mbit EEPROMS
2. I merged the games and generated switch address that CPU should write at in order to switch to the game
Code:
$9000 "Bomberman "
$B041 "menu"
$B082 "Battle City "
$B0C3 "Pac-Man "
$8104 "Takahashi Meijin no Boukenjima"
$A188 "Star Soldier "
$A20A "Tetris "
$828B "Super Mario Bros "
$B30C "Ice Climber "
$B34D "Road Fighter "
$938E "Lode Runner "
$93CF "Championship Lode Runner "
$B410 "Galaga "
$9451 "Gomoku Narabe "
$B492 "Pinball "
$94D3 "F-1 Race "
$B514 "Yie Ar Kung-Fu "
$B555 "Sky Destroyer "
$9596 "Chou Jikuu Yousai - Macross "
$95D7 "Star Force "
$9618 "Circus Charlie "
$9659 "Popeye "
$969A "Excitebike "
$96DB "Mario Bros "
$B71C "Ninja Kun "
$975D "Donkey Kong Jr. "
$979E "Kinnikuman - Muscle Tag Match "
$B7DF "Exerion "


3. I writed some piece of code that would act as a menu

4. As you have noticed, all of the games were slightly modified. The modification is because the cart is in unknown state during power-up, so the value of internal register containing current prg/chr bank is unknown, so any game during bootup was modified to switch to the bank 0. I simply added R-C-D circuit to detect reset, so now prg bank 0 is the default state after powerup/reset.
Image Image

5. Two CNROM games "Takahashi Meijin no Boukenjima (Adventure Islanda 1)" and "Star Soldier " were slightly modified: I changed the addressess that these games write at to switch CHR-BANK.
Image

6. The only game I omit was galaxian because I did not have time and patience to embeed menu into galaxian code (Galaxian is 8 kB, the menu is also 8 kB so i should merge these two games into one 16 kB, change the galaxian reset's and nmi's address to my address and then decide whetether the menu or galaxian is running)

Eveything is working nice:
Image Image


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: Bing [Bot] and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group