Info on a "new" pirate multi-cart, Teletubbies 420

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Info on a "new" pirate multi-cart, Teletubbies 420
by on (#55606)
I dumped this cart a little while back for Sardius. Nessie author got it working without much trouble and suggested 237 for the mapper number. I didn't add it to the NES DB yet, but I will eventually.

Here is the gist of how it works:

Code:
Info for "Teletubbies / Y2K" 420-in-1 pirate multicart.

2nd draft (01/23/2010)
BootGod

Thanks to Nessie author, Martin, for testing and emulating!

This cart has been assigned as iNES #237 (seems to be free) and for UNIF,
BMC-TELETUBBIES (someone feel free to come up with a better one!)

This cart is a typical handful of NROM/CNROM/UNROM games with each game
appearing multiple times. Each menu item has a 3-digit code after the game
name, I'm guessing this is some kind of config data for loading the game.

The menu doesn't always load the game you'd expect, for example, selecting
"Home Alone" ends up loading "Brush Roller".

PRG appears to be 1MB (8Mbit) in size, logically arranged as 2 512KB ROMs.
Cart also contains an 8K VRAM chip in DIP form.

All ROM and MMC logic is contained in a single epoxy blob. All known mapper
logic came from toying around in BankWatch and MicroBug. As such, mapper info
may be incomplete.

The PCB is ID-less and uninteresting, just a single epoxy blob and a VRAM in
DIP form. It's a 60-pin Famicom PCB, but the cart it was found in was a recycled
5-screw NES cart with an official 60 -> 72 pin converter (NES-JOINT-01) and a
poor quality printed label.

The menu system used by this cart seems to be configurable as 4 different types:

0: 42-in-1
1: 5,000-in-1
2: 420-in-1
3: 10,000,000-in-1 (lol)

So it may be possible other carts out there use this mapper as well. Although
the way the menu is chosen is weird and may not work under the same iNES number
(see line A0 function).

Register area is $8000 - $FFFF, no bus conflicts
MMC uses A0-A2 and D0-D7 lines.

Reset button goes back to initial loading screen, rather than title screen of
last game.


Address line functions:

Function of line A0 is weird, when A0 is high, the PRG address space goes into
a funny state. In this cart, it has the effect of forcing PRG A1 line high
(e.g. address is OR'd by $02). The menu init routine uses this to determine
which menu type to use by reading a byte from a specific location and using the
value that shows up. If other carts that use this menu exist, the behaviour of
A0 must be different. This must be emulated to make menu use the correct mode.

Setting A1 high will lock the MMC into its current mode until the system is
reset. When locked the MMC will only operate on the current 128KB segment
(e.g. only bits D0-D2 still function).

A2 controls which 512K ROM or segment is active. So when A2 is low, the lower
512K is accessible and vice-versa.


Data line functions:

The MMC has 4 mapping modes which operate on 128K segments of ROM.
D6 and D7 control the current mapping mode. This affects how D0-D2 operate.

D7 D6
-----
0   0 : "UNROM" mode. D0-D2 select 16K to appear at $8000. $C000 is fixed the
        last bank of current 128K segment.
0   1 : "CNROM??" mode. This works the same as UNROM mode, except only "even"
        banks can be selected (e.g. line D0 doesn't operate). $C000 is still
        fixed to last bank of segment.
1   0 : "16K NROM" mode. D0-D2 select 16K at $8000 and is mirrored to $C000 as well.
1   1 : "32K NROM" mode. D1-D2 select 32K at $8000. D0 has no effect in this mode.

D5 controls mirroring. Unset = horizontal, set = vertical

D4-D3 control which 128K segment of the current 512K is active.

D2-D0 control banking of the current 128K segment as described before.



You can also download the TXT here.

The ROM will probably show up over at Lost Levels sooner or later.

by on (#55608)
BNROM games in such a collection would probably get mapper-hacked to "32K NROM" mode. I'd almost recommend the name "NROM-256/BNROM".

The "CNROM??" mode is nothing like CNROM because CHR isn't switched. Based only on the description of the behavior, it appears to come from an interaction between the BNROM-like "32K NROM" mode and the UNROM mode, in the same way that unofficial 6502 instructions come from "don't care" entries in the instruction decoder.

If there are other A0 behaviors, I'd recommend using the same mapper number with different NES 2.0 submappers.

by on (#55644)
Quote:
The "CNROM??" mode is nothing like CNROM because CHR isn't switched.


Yeah, it was dumb to leave that in the description. When I did the initial writeup, I thought maybe I was missing something because I couldn't find any CHR related functions in the MMC at all. All the CHR ROM -> VRAM stuff must be handled by the game code rather than needing special MMC functions.

In any case, if you implement the described behavior and pretend I didn't call it that, it seems to work fine. :)
Re: Info on a "new" pirate multi-cart, Teletubbies 420
by on (#128535)
need more info to let it to worked.
Image
Re: Info on a "new" pirate multi-cart, Teletubbies 420
by on (#128574)
Perhaps Martin (author of Nessie) could help, he managed to get it working. I don't think I can be of any further help unfortunately, I wrote that up over 4 years ago and don't remember anything beyond what I wrote here :P

Do you have it working with the exception of being the wrong menu? If so, you must not be handling A0 function quite right. Here is a snippet from an email from Martin if it helps:

Quote:
Apparently the cart can be setup as 4 types of multicarts:

0: 42-in-1
1: 5,000-in-1
2: 420-in-1
3: 10,000,00-in-1 (lol)

At some point during startup it runs this sequence:

LDA #$00
STA $8001
LDA $C000
AND #$03
STA $01FF <- This is where the menu type is stored

The first 4 bytes at this location are 00 01 02 03
If your emu is ignoring A0 behavior, LDA $C000 will load the value 00 here
thus giving us a 42-in-1
If you implement the funny bus behavior of setting A0 high, it will return
02, giving us 420-in-1
Re: Info on a "new" pirate multi-cart, Teletubbies 420
by on (#128917)
BootGod wrote:
Perhaps Martin (author of Nessie) could help, he managed to get it working. I don't think I can be of any further help unfortunately, I wrote that up over 4 years ago and don't remember anything beyond what I wrote here :P

Do you have it working with the exception of being the wrong menu? If so, you must not be handling A0 function quite right. Here is a snippet from an email from Martin if it helps:

Quote:
Apparently the cart can be setup as 4 types of multicarts:

0: 42-in-1
1: 5,000-in-1
2: 420-in-1
3: 10,000,00-in-1 (lol)

At some point during startup it runs this sequence:

LDA #$00
STA $8001
LDA $C000
AND #$03
STA $01FF <- This is where the menu type is stored

The first 4 bytes at this location are 00 01 02 03
If your emu is ignoring A0 behavior, LDA $C000 will load the value 00 here
thus giving us a 42-in-1
If you implement the funny bus behavior of setting A0 high, it will return
02, giving us 420-in-1



Insufficient information , then please provide some DUMP scripts or working emu
Re: Info on a "new" pirate multi-cart, Teletubbies 420
by on (#129025)
I asked Martin if I he could post his mapper code and he obliged. His emulator is written in x86 asm though :P
Code:
Unreadable source code:
;
; Y2k 42-in-1
;
; $8000-$FFFF: mmMSSPPp  mirror horizontal/vertical
;   (address): -----RL?  (L = 1) lock SS bits in current state until reset
;
; (mm = 00) select 16k PROM at $8000/$C000: RSSPPp/RSS111
; (mm = 01) select 16k PROM at $8000/$C000: RSSPP0/RSS111
; (mm = 10) select 16k PROM at $8000/$C000: RSSPPp/RSSPPp
; (mm = 11) select 16k PROM at $8000/$C000: RSSPP0/RSSPP1

Mapper237:
 CPUWrite 08000, 0ffff, @8000_ffff
 CPURead  08000, 0ffff, @8000_ffff_read
 mov edx, 0
 mov eax, 0
 mov B$Register+1, 0
 jmp @8000_ffff

@8000_ffff:

 ; --M-----
 ifNotFlag. al 020
  mirror VERTICAL
 else
  mirror HORIZONTAL
 endif

 ; mm------
 mov ecx, eax
 shr ecx, 6

 ; -----R--
 and eax, 01f
 ifFlag. dl 04
  or eax, 020
 endif

 ; ------L-
 if. B$Register+1 != 0
  and eax, 07
  or al, B$Register+0
 else
  ifFlag.. dl 02
   mov B$Register+1, 1
   mov B$Register+0, al
   and B$Register+0, 038
  endif..
  test dl 01
  setnz B$Register+02
 endif


 mov edx, eax
 if. cl = 00
  or edx, 07
 else | if. cl = 01
  and eax, 03e
  or edx, 07
 else | if. cl = 02
 else | if. cl = 03
  and eax, 03e
  or edx, 01
 endif

 swap PROM, 16k, 08000, eax
 swap PROM, 16k, 0c000, edx
 ret

@8000_ffff_read:
    on B$Register+02 = 0, ReadPROM
    or eax, 02
    jmp ReadPROM
Re: Info on a "new" pirate multi-cart, Teletubbies 420
by on (#129162)
BootGod wrote:
I asked Martin if I he could post his mapper code and he obliged. His emulator is written in x86 asm though :P
Code:
Unreadable source code:
;
; Y2k 42-in-1
;
; $8000-$FFFF: mmMSSPPp  mirror horizontal/vertical
;   (address): -----RL?  (L = 1) lock SS bits in current state until reset
;
; (mm = 00) select 16k PROM at $8000/$C000: RSSPPp/RSS111
; (mm = 01) select 16k PROM at $8000/$C000: RSSPP0/RSS111
; (mm = 10) select 16k PROM at $8000/$C000: RSSPPp/RSSPPp
; (mm = 11) select 16k PROM at $8000/$C000: RSSPP0/RSSPP1

Mapper237:
 CPUWrite 08000, 0ffff, @8000_ffff
 CPURead  08000, 0ffff, @8000_ffff_read
 mov edx, 0
 mov eax, 0
 mov B$Register+1, 0
 jmp @8000_ffff

@8000_ffff:

 ; --M-----
 ifNotFlag. al 020
  mirror VERTICAL
 else
  mirror HORIZONTAL
 endif

 ; mm------
 mov ecx, eax
 shr ecx, 6

 ; -----R--
 and eax, 01f
 ifFlag. dl 04
  or eax, 020
 endif

 ; ------L-
 if. B$Register+1 != 0
  and eax, 07
  or al, B$Register+0
 else
  ifFlag.. dl 02
   mov B$Register+1, 1
   mov B$Register+0, al
   and B$Register+0, 038
  endif..
  test dl 01
  setnz B$Register+02
 endif


 mov edx, eax
 if. cl = 00
  or edx, 07
 else | if. cl = 01
  and eax, 03e
  or edx, 07
 else | if. cl = 02
 else | if. cl = 03
  and eax, 03e
  or edx, 01
 endif

 swap PROM, 16k, 08000, eax
 swap PROM, 16k, 0c000, edx
 ret

@8000_ffff_read:
    on B$Register+02 = 0, ReadPROM
    or eax, 02
    jmp ReadPROM

thank you ,nestopia plus! working...