nesdev.com

Here's some footage.

Can somebody help me dump this cartridge with a kazzo? Usually I don't ask publicly but I think the hardware is of interest to some people here.
I can provide NROM and uorom readouts by PM (it's giving some early signs of life on uorom. I guess there's some shared register or something?)

PCB photo attached.

Without having yet sit down to trace the images, the single '374 implies there's a single bankswitching register that contains (almost?) all of the state.

The PAL could hold some state also, and it may be hard to reverse-engineer what it's doing without desoldering it.

Just for reference:
the GM0832 is a "successive approximation ADC", the KA22134 is a "dual pre-power amplifier with volume control" and two power amplifiers, the K-633A is unknown.

It really looks like there should "just" be a 1 MiB UNROM dump. (The '374 and the SIP resistor work together to emulate UNROM)

All the other logic (e.g. the sound ICs) goes through the PAL, so reverse-engineering the rest will require describing the behavior the software expects, or desoldering the PAL.

PAL pinout:


"K-663A" "Sound IC" pinout:
<watches the video> OH, there's an FM synth. The above is the same pinout as the YM2413.

Sch, but no idea what's goin on here with analog part.
Those tracks near pot, under MIC/AUX jack and near R8, C5, R13.1 need confirmation. Btw what should be connected to the upper 45-pin header? Keyboard?

Yeah, there were too many parts hidden under the electrolytic capacitors for me to figure that out to my satisfaction either.

Datasheet for the GM0832 says its pinout is
and that it expects, after /CS falls, three configuration bits clocked in on rising edges (i.e. change on falling edge), one padding bit, and then will emit successive 8-bit conversion results serially, MSB first, until CS rises.

So ... Ch0 and/or Ch1 really should be connected to the microphone jack, somehow.

—

Expansion pack for extra songs. This is similiar to Bandai's Karaoke Studio.

—

So ... if you're starting with INL's script in arantius's repository ... and you actually get a real dump when you try to run it as uorom (i.e. the first 16 K don't just repeat over and over) ...

just try changing the bit that says cpu_romsize = 2 * mega to say 8 instead of 2.

Traces on R8 are wrong, C7.1-R8 is wrong. C7.1 goes to R6.2.
R4.1 to C6.1
C5.1 to R7.1
R13 is correct.


As for the dump, looks like it's the same whatever the size, so yeah, it's repeating the banks :/

So, the PAL is connected to /ROMSEL, A13, A14, M2, ... and A0, A1, A2, and A3. There could be as many as 80 different registers ... but my hunch is that A0-A3 are only for interfacing with the ADC.

Try changing the number in cpu_write(d, 0x8000, i); to 0x6000, 0xA000, 0xC000, and 0xE000.


It's also remotely conceivable that the hardware here could actually be mapper 180 (bottom bank fixed) instead of "ordinary" UNROM (top bank fixed)—the PAL could possibly put the bankswitch register contents in any combination of lower and upper halves.

You could PM me the NROM subset.

Ok, yeah, that's definitely something like UNROM.

I think I see. Try changing cpu_write(d, 0x8000, i); to 128+i

(It looks like 0≤i≤127 map to the external ROM on the option slot; 128≤i≤255 should be the internal ROM)

Additionally, it looks like the FM synthesizer is mapped to addresses $6000 and $6001.

(I bet PAL pin 19 is something like (0 if /ROMSEL=0 AND R/W=1 AND PAL11=1))

dump first 32K data. send me.

Already on it.

On the first try, thanks!! But no music. I guess this has to be fixed in the emulator or handled in a new mapper?

This definitely requires a new mapper. While it's quite similar to both UNROM and to Mapper 188 (which is basically UNROM plus a microphone), I'd be uncomfortable saying it's appropriate to designate it as a submapper of either. (On the other hand, if someone else has an opinion that it should be filed as a submapper, I'd be all ears)

And we don't know whether the K-633A is using the same patches as the YM2413; certainly we already have the precedent that the VRC7 uses different baked-in ones.


To get the expansion cart, put it in the cart and and dump using the original UNROM script, but scan for up to 32 * mega. The expansion cart (probably overdumped) will be the first 2 MiB of the dump; the upper 2 MiB of the dump will definitely be an overdumped copy of the base game. The resultant 4 MiB image will be an overdump, but you (or someone, anyway) could shave it down.


It'd be nice to verify whether the PRG bankswitching register is present all over the entire range from $8000 through $E00F. I'd hunch it is, but ... if you'd be willing to (and I know bothering with 32 dumps is ridiculous), would you try replacing the cpu_write(d,0x8000,128+i) with 8001, 8002, ..., 800E, 800F, A000, &c ?

(If the board designer was feeling particularly sadistic ... since the board decoding mask is $E00F, they could have hidden writeable registers at $2002, $200A, $4009, and $400D... and readable ones overlaying $4000-$4004, $4008-$400F. But I really doubt they were)

Well if anyone want the rom to try to implement the sound, they can PM me. I'll release it anyway at some point. Otherwise if it proves to be too complicated I'll send the cart to someone interested to RE it and emulate it fully.

I'll try your suggestions later today, have to find the time.

make an all out effort!!!

It uses the default YM2413 instrument set indeed. I have implemented it in Nintendulator as Mapper 515 (512+ plane since it's an Asian-only release). Will post Nintendulator source code and Mapper DLL later. Nintendulator's YM2413 emulation was so VRC7-specific that all rhythm mode emulation code had been removed, and had to be re-added for this game. All that is left for me to investigate is to fix an issue with the rhythm channels not playing properly after loading a save state.