The ROM seems to expect this behavior:
Code:
Mask: $E003:
R/W 6000, 6001: YM2413 clone (thank you NewRisingSun)
R 6003: [D... ....] - SPI (ADC) data
Mask $E00F:
W 8000: [RBBB BBBB] - R:0-select external ROM; 1-select internal ROM; B-select bank at $8000-$BFFF
$C000-$FFFF is always last bank of internal ROM
Mask not yet known:
W C002: [S... ....] - SPI (ADC) chip select
W C003: [K... ....] - SPI clock / ADC conversion clock
The strictest address mask possible is $E00F, per the hardware, but specific functions could be more lenient.
I'd really like to find out by how much, but ... we'll see what MLX says.MLX says that the PRG banking register cares about all seven address lines. How odd.
Interestingly, the game doesn't seem to ever explicitly drive SPI data; something must be pulling the node high in order for the SPI ADC to get its required "start" bit. (And then, since there's no obvious way to get the data line to change, it must be clocking in "1 1" for "single-ended conversion" and "pin 3=Ch1")
The ADC code is:
Code:
LDA #0
LDY #$FF
STA $C002 ; chip select falls
STA $C003 ; SPI clock falls
STY $C003 ; rises; clock in start bit here
STA $C003 ; falls
STY $C003 ; rises; clock in 1:Single or 0:differential here
STA $C003 ; falls
STY $C003 ; rises; clock in (Single:1:Ch1 or 0:Ch0) or (Differential:1:Ch1 minus Ch0 or 0:Ch0 minus Ch1)
STA $C003; falls
LDX #8
-
STY $C003; rises
STX $C003 ; falls; data now valid
LDA $6003 ; read data
ASL A
ROL $00
DEX
BNE -
LDA #$80
STA $C002 ; raise chip select
and it only runs at 60Hz.
The other interesting bit is that the cart
doesn't mix in the audio from the 2A03. All the sound can only come from the FM synthesizer.
—
To check for an expansion cart, the game checks for a sixteen-byte header ("OPEN FAMILY SONG") mapped at $8000 in the very first bank, and if present, will JSR to $8010. It's possible in intercept NMI partway through by feeding an invalid value to one of the jump table indexes (after it's already done a bunch of random other things). IRQs will cause a spinlock—the IRQ vector points to an RTI.
FAQ
Search
Register
Login
