Some light on mapper 3 vs mapper 185

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Some light on mapper 3 vs mapper 185
by on (#20350)
I've always wondered why m185 games, which are also CNROM, are able to disable VROM, and even more so, the fact they all use different values to do it. So I broke down and bought a few of them to see if I could figure anything out.

As I expected, the HVC-CNROM boards are the same as the NES-CNROM boards, except they don't have the CIC stuff of course. Any CNROM game could have made use of this "feature" if they wanted too. The LS161 uses not only D0 and D1, but also D4 and D5. Which, if used, connect to CHR A12 and CHR A10 respectively.

Here's a pic of a NES-CNROM board. As you can see, the traces for the 2 lines are not connected.

Image

Anyways, mapper 185 games actually do use this, and the values they use are different because they use different diode configurations as a "key" so to speak.

Here are the carts I have:

Mighty Bomb Jack
Image

B-Wings
Image

Sansuu 2 Nen
Image

Bird Week
Image

Notice that Bird Week does not have diodes installed, so it technically can't do this technique, but it still checks to make sure it's not mirrored into bank 0, and thus locks if it is.

Personally, I think m185 should be done away with, it's basically a hack anyways. There are 2 ways I can think of to do so.

First way would require no changes in emulation, but IMO it's still a hack way to do it. Basically these games fail normally because they check a cetrain bank, usually 0, to make sure data isn't mirrored there. So to avoid this, the CHR ROM of the dump could simply be padded with dummy data and only have the real data in the bank it expects.

The second, better way, would be to have emulators not mirror the CHR data for CNROM carts, but fill unused banks with either typical open bus noise: 01,02,03...FF repeated thoughout like you'd get on the real thing, or you could just fill them with FF. It really doesn't matter what is in the unused banks as long as it's not a mirror of the real data. This way however would require that the emulator know which bank it needs to load into. Since the NES 2.0 spec is still on the table, I think a couple of bits should be added for this purpose.

Actually, it'd be nice if the NES 2.0 spec had some space allocated to context sensitive info like this rather than having the bits taken up no matter what.

Back to the diode thing, emulators really don't need to know the config of these as long as they map the memory out like above. You do need to set D4 and D5 properly when dumping them though.

by on (#20351)
Probably simpler yet would be to have NES 2.0 indicate the setup of the diodes (having 5 possibilities in all), then emulate the mapper accordingly.

One thing you should also note is that the solder pad in the upper-right corner is filled on Bird Week (pulling some signal to GND) but unconnected on the others - this is probably why it can disable the ROM even without the diodes.

by on (#20352)
I think these games should still use mapper 185, as that's what they've been using all along AFAIK. An emulator would see mapper 3 as "no CHR disable" and mapper 185 as "CHR disable." As I recall, NES 2.0 has a sub-mapper field that can be used to select which banks should be deemed invalid.

by on (#20354)
Quietust wrote:
One thing you should also note is that the solder pad in the upper-right corner is filled on Bird Week (pulling some signal to GND) but unconnected on the others - this is probably why it can disable the ROM even without the diodes.


I noticed that too when I was looking at it, but actually, that only has to do with PRG A14, when the solder pads are in the config bird week is, A14 is tied to +5V. Bird Week is not able to disable CHR ROM like the others, when it writes F0h to disable it, it does nothing.

Quietust wrote:
Probably simpler yet would be to have NES 2.0 indicate the setup of the diodes (having 5 possibilities in all), then emulate the mapper accordingly.


You could get away with 4 possibilities I think, if the diodes were in the opposite config of B-Wings, which is what Bird Week would have used according to the values it uses, it is the same as them not being present at all, because the 161 couldn't affect the state of A10 and A12. They really could have gotten away with using 1 diode in the cases where it's 2 opposites as well.

dvdmth wrote:
I think these games should still use mapper 185, as that's what they've been using all along AFAIK. An emulator would see mapper 3 as "no CHR disable" and mapper 185 as "CHR disable."


185 is written to work specifically for a few games, if a new one were to come along, it probably wouldn't work. Emulators I've looked at generally just go by this table:

Off On Title
F0h 0Fh Bird Week
00h 33h B-Wings
00h 11h Mighty Bomb Jack
20h 22h Sansuu 1 Nen - Keisan Game
20h 22h Sansuu 2 Nen - Keisan Game
00h FFh Sansuu 3 Nen - Keisan Game
13h 21h Spy vs Spy

by on (#20355)
Would you mind drawing a schematic of the relevant parts of the board as a reference?

by on (#20359)
Heh, not exactly sure what your asking for :P Just drawings of each possible diode setup and what value would be have to be used to enable the CHR ROM? I don't have a schematic drawing program, but I could handle the above in mspaint I suppose, if thats what your looking for :)

by on (#20360)
Something to make clear the path of the latched D4 and D5, such as how they connect to the diode pads and how the CHR ROM addresses connect to the pads. I don't understand why diodes are even being used. Why is Sansuu 2 Nen's diode on the right reverse biased?

by on (#20361)
I'm guessing that biased one way means that 1 disables the ROM, while biased the other way means that 0 disables the ROM.

by on (#20378)
I think that more or less answers to my question.
I'm still not understanding anything to the behaviour of this. Recent CNROM boards seems to have no slot for diodes, and the only other solder pad aside of mirroring forces A14 of the ROM to GND for games using 16kb PRG I assume. It's marked 'CL1' as MMC5 games, hehe.

by on (#20382)
Yep that pad is for 16K PRG, it's used to select where it's mapped in, either $8000 (default) or $C000, like Bird Week uses.

I really don't understand how this works from a technical standpoint either. Maybe kevtris could explain it better? I'll try to draw something about how the diodes are used though.

by on (#20383)
BootGod wrote:
Yep that pad is for 16K PRG, it's used to select where it's mapped in, either $8000 (default) or $C000, like Bird Week uses.

16K ROMs aren't mapped, they will appear in BOTH $8000 and $C000 because they are only partially decoded (toggling A14 has no effect on a ROM without A14) so that couldn't be it.

by on (#20385)
That's true, not sure what the point of that pad is then. In it's default state, it simply connects the PRG ROMs A14 to the cart edge. When it's in the other state, it's not connected to the cart edge, but just tied to +5V. Wouldn't that have the effect of only being able to access $C000 - $FFFF?

What is A14 defined as on a 16K chip anyways?

by on (#20386)
BootGod wrote:
That's true, not sure what the point of that pad is then. In it's default state, it simply connects the PRG ROMs A14 to the cart edge. When it's in the other state, it's not connected to the cart edge, but just tied to +5V. Wouldn't that have the effect of only being able to access $C000 - $FFFF?

What is A14 defined as on a 16K chip anyways?


It looks like the actual intent is for handling 16K games stored in 32K ROMs (so they wouldn't have to make a CNROM-128 board as well as CNROM-256).

by on (#20402)
I know that the issue of emulating mapper 185 was discussed a while back on the Nestopia part of R. Bannister's Emuversal Bulletin Board (and somebody came up with some logic that is cleaner than that table), but I'm too lazy to search for it since something screwed up with my account when they changed the forum software. Any ideas?

by on (#20403)
BootGod wrote:
What is A14 defined as on a 16K chip anyways?

N/A? Pin 27 which is A14 on a 27256 is /PGM on a 27128 which should be held high...

by on (#20407)
kyuusaku wrote:
N/A? Pin 27 which is A14 on a 27256 is /PGM on a 27128 which should be held high...

That would make sense then for Bird Week, it is a 16K chip, the others are all 32K.

85cocoa wrote:
I know that the issue of emulating mapper 185 was discussed a while back on the Nestopia part of R. Bannister's Emuversal Bulletin Board (and somebody came up with some logic that is cleaner than that table), but I'm too lazy to search for it since something screwed up with my account when they changed the forum software. Any ideas?


I believe I know what your refering to, but again it's tailored specifically for those few games. If there are others out there (who the hell knows), it could easily break it.

by on (#20413)
Here you are what I think the effect of those diodes would be.

1 - If the cathode is on the HC161 side (on the mapper side) :

The diode will prevent current to go from the mapper to the ROM.
Here you are the trurth table for one single bit :
Code:
A B  OUT
0 0  0
0 1  ###
1 0  1
1 1  1

Legend :
A = NES connector CHR-Ax from the PPU
B = Output of the HC161 mapper
OUT = Voltage that will be applied to the ROM pin CHR-Ax
0 = Logic 0 (0 to 0.8 V)
1 = Logic 1 (2.4 to 5 V)
### = Bus conflicts will appear. Avoid this state at all costs.

2 - If the cathode is on the CHR-Ax side :

The diode will prevent current to go from the CHR-Ax signal to the HC161 mapper.
Trurth table :
Code:
A B  OUT
0 0  0
0 1  1
1 0  ###
1 1  1


In other words, in the fist case, a '1' should always be written to the mapper, and the diode has no effect. If '0' is written, bus conflicts will alsmost certainly appear, unless only one pattern table is acedded or something.
In the second case, a '0' should always be written to the mapper, else bus conflicts will almost certainly appear. However, when zero logic is written, the mapper direcly controls the CHR adress lines, and the PPU has no effect. This allow for software pattern table swapping, and the PPU has no effect. This is interesting, however, I'm not sure of the accuracy of this since I've no board with slot for diodes. The only CNROM boad I have has it's mapper D4 and D5 tied to VCC and no slot for any diodes. I think it's a more recent board, because it's something like 'NES-CNROM-09' instead of 'NES-CNROM-256-01'.[/code]

by on (#20424)
Looks like NES-CN-ROM-256-05 was the last pcb revision to have spots for the diodes, -06 and onward do not.
Probably isn't going to help at this point but...
by on (#20427)
BootGod wrote:
85cocoa wrote:
I know that the issue of emulating mapper 185 was discussed a while back on the Nestopia part of R. Bannister's Emuversal Bulletin Board (and somebody came up with some logic that is cleaner than that table), but I'm too lazy to search for it since something screwed up with my account when they changed the forum software. Any ideas?


I believe I know what your refering to, but again it's tailored specifically for those few games. If there are others out there (who the hell knows), it could easily break it.
In the FCEU-mm changelog (19 Mar 2006), CaH4e3 wrote:
181 mapper - (...) defined for "Seicross (J)(Redump) [!].nes", this mapper have opposite protection bits values than normal 185.
The good dump of "Seicross (J)" was originally and is currently assigned to mapper 185, but CaH4e3 temporarily assigned it to mapper 181 when he couldn't get it to work properly under mapper 185. The logic I'm talking about allowed for the elimination of mapper 181.

by on (#20428)
Oh, that was some guesswork, I doubt it's accurate:
http://www.bannister.org/forums/ubbthre ... mber=22723

by on (#20430)
Err... I am the only one who undestand nothing about the utility of those diodes ? I really cannot understand anything from what people say. And why only FC games used this (while NES games had early boards with provisions for diodes) ?

by on (#20432)
If someone could trace out a schematic, it could be made quite clear how the circuit works.

Most likely the reason that only FC carts used this mechanism was because in Japan around 1986 there was a primitive NROM/CNROM copying device; it consisted of a base unit which would simply copy the ROM from a source cart to an erasable (ultraviolet) EPROM cart. The rest of the world (even China) wasn't keen on NES piracy at the time.

by on (#20435)
Well from what I can get, all CNROM games using those diodes actually are NROM games on a CNROM board. (I mean they could run on NROM without that protection stuff, the '161 is used ONLY for protection and not for bankswitching).
Now I really don't understand the effect of those diodes. To disable the CHR, the mapper would have to connect to CHR /OE on the CHROM, and it doesn't seem to do so. Also, since those games check one bank and make sure it doesn't work before selecting the bank wich is supposed to work, it sounds like the banking bits (D0-D1) are being used somewhere. But, if the CHRROM is always 8kb on those weird games, those latches are not used, and connects to nowhere.
A system to disable the CHROM would basically have a gate from the latched mapper value and leave the chip of its tristate mode only if the values matches. But those diodes seems to rather fool the PPU when attempting to communicate with it's CHROM chip. I think those games relies on bus conflicts to work, tough I really make no sense of this without shematics.

I think this method was so bad that Nintendo did give it up fastly, and developped the lockout chip for the NES instead. On a CNROM game one could just disolder the ROMs and dump them since they have standard pinout. With one of those tools that can grip ICs, it could be dumped without even being disoldered.

by on (#20442)
Have you tried tracing D0 and D1 on those boards?

by on (#20447)
I haven't been home in a couple days, won't be back until tommorow night. I will try to get you guys the info you want. Is a schematic of just the 161 connections sufficient?

As for reading the ROM directly, I actually have done this. I originally only bought Mighty Bomb Jack, when I saw those diodes on there, I suspected it had something to do with them. So I bought some more games that I thought would have different diode patterns according to that table, and they did. But I still was (am) unclear exactly what is going on. I desoldered the CHR ROM and first tried to read it as an 8K ROM (27C64) and got nothing but noise. Then I tried 16K, and the data showed up in the upper 8K. I also read it as a 32K to see if it would be in the uppermost 8K of that, but it wasn't, it was all noise except for the 2nd bank. What the hell does that mean? The pinout must not be standard? The ROMs (LH2367xx) are certainly 8K, so I do not understand why they would read like that.

BTW, if you try to read these ROMs thru CopyNES, without setting the proper "key", you get odd results too. For instance with MBJ, if you dump it as a 32K ROM, you get the same results as above. banks 1,3,4 are typical open-bus reads, and the 2nd bank is the real data, interleaved with a bunch of shit. The noise it's mixed with will always be different too. I'm guessing there is a full-blown conflict going on, probably not too good for the cart :/

by on (#20449)
Quote:
Is a schematic of just the 161 connections sufficient?

Yeah, and where they lead if possible.

Maybe Nintendo did just replace the upper adress lines by additionnal output enable pins, and that all must be set correctly to be enabled. Then, in function of how the internal logic mixes output enable to actually enable the output, a certain configuration should be set to have the ouptut enabled.
Typically, on mighty bomb jack, A13 is instead OE and A14 is /OE. So if and only if A13 is high and A14 is low the output is enabled.

by on (#20462)
OK here are the '161 connections:

Code:
           ------
    +5V - |01  16| - +5V
PRG /CE - |02  15| - NC
 PRG D0 - |03  14| - CHR ROM pin 26
 PRG D1 - |04  13| - CHR ROM pin 27
 PRG D4 - |05  12| - Diode D2 - CHR A12
 PRG D5 - |06  11| - Diode D1 - CHR A10
    GND - |07  10| - GND
    GND - |08  09| - PRG R/W
           ------


I also found a doc for this particular CHR ROM, the LH2367. I am not sure wtf the meaning of pins 26 and 27 are though. S1//S1/N and S2//S2/N? :?

Code:
    +--()--+
 NC | 1  28| VCC
A12 | 2  27| S2//S2/N
A07 | 3  26| S1//S1/N
A06 | 4  25| A08
A05 | 5  24| A09
A04 | 6  23| A11
A03 | 7  22| G//G/N
A02 | 8  21| A10
A01 | 9  20| E//E
A00 |10  19| D7
 D0 |11  18| D6
 D1 |12  17| D5
 D2 |13  16| D4
GND |14  15| D3
    +------+

by on (#20466)
The diodes are just in series? There are no other components?

by on (#20489)
That is correct, the diodes complete the connection between the 2 '161 pins and the 2 CHR ROM pins. Nothing else is between them.

by on (#20490)
I think the only purpose of the diodes is to make it difficult to dump the cartridge without removing the ROMs - the real protection appears to be embedded within the CHR ROM itself, responding only to a single 8KB bank and disabling output for all other combinations, and that is what needs to be recorded.

by on (#20491)
Yep I agree, that's why I originally mentioned the bank position should be stored rather than the diode config. The diodes along with the latches on D4/5 seem to only used for disabling the bus conflicts to allow proper reading from the CHR ROM. For emulation purposes, I don't think it should be necessary to handle D4/5 at all.