Someone reported this emulation bug a few days ago here
I traced out the extra LS chips to see what they were for, but they ended up not being related. LS20 for WRAM CE control and LS139 for supporting a 2nd PRG ROM and something A12 related (more on this later)
Anyways the bug here is mainly due to the piggybacking of 2 wiring configs into mapper 25 (A0,A1) and (A2,A3). This game uses the A0,A1 config but at the end of the game for whatever reason writes to C004-C007 instead C000-C003. If the emulator was using the correct address mask (F003), this wouldn't an issue, but instead they combine the masks for both configs something like:
addr = (addr & F003h) | ( (addr & 0Ch) >> 2)
Which in this case causes the wrong banking routines to be called.
Nestopia (which can tell the difference between the 2 using its DB) still suffers from this problem because it doesn't use an address mask and instead assigns handlers directly to C000,C001,C002,C003 so the writes to C004-C007 go unnoticed.
On a side note, this cart doesn't seem to support one-screen mirroring for some reason. Writing to 9000h, bit 0 is for H/V as usual but bit 1 is ignored.
Here is rough routing of the relevant LS pins if anyone cares. I wasn't real thorough, could be missing something. If someone with a better understanding of electronics than me can tell me what the point of the 1st LS139 decoder is, I'm curious to know. It seems like A12 would just pass thru it in all cases.
LS20 pinout (2nd set of IO not used)
1 (1A) -> VRC 15 -> CON 32 (M2)
2 (1B) -> VRC 1 -> CON 34 (PRG A13)
4 (1C) -> VRC 2 -> CON 35 (PRG A14)
5 (1D) -> VRC 14 -> CON 44 (PRG /CE) -> LS139 1 (/1E)
6 (1Y) -> diode / resistor -> WRAM 20 (/CE)
LS139 pinout
1 (/1E) -> LS20 5 (1D) -> VRC 14 -> CON 44 (PRG /CE)
2 (1DA) -> PRG 4 -> WRAM 2 -> CON 33 (PRG A12)
3 (1DB) Fixed High
4 (/1Y0) NC
5 (/1Y1) NC
6 (/1Y2) -> VRC 37 (PRG A12)
7 (/1Y3) NC
15 (/2E) -> PRG 24 -> VRC 8 (PRG /CE)
14 (2DA) -> PRG 30 -> VRC 39 (PRG A17)
13 (2DB) Fixed High
12 (/2Y0) NC
11 (/2Y1) NC
10 (/2Y2) NC (Goes to solder pad, unjumped, to GND)
9 (/2Y3) NC (Goes to PRG /CE on unused PRG slot)
I traced out the extra LS chips to see what they were for, but they ended up not being related. LS20 for WRAM CE control and LS139 for supporting a 2nd PRG ROM and something A12 related (more on this later)
Anyways the bug here is mainly due to the piggybacking of 2 wiring configs into mapper 25 (A0,A1) and (A2,A3). This game uses the A0,A1 config but at the end of the game for whatever reason writes to C004-C007 instead C000-C003. If the emulator was using the correct address mask (F003), this wouldn't an issue, but instead they combine the masks for both configs something like:
addr = (addr & F003h) | ( (addr & 0Ch) >> 2)
Which in this case causes the wrong banking routines to be called.
Nestopia (which can tell the difference between the 2 using its DB) still suffers from this problem because it doesn't use an address mask and instead assigns handlers directly to C000,C001,C002,C003 so the writes to C004-C007 go unnoticed.
On a side note, this cart doesn't seem to support one-screen mirroring for some reason. Writing to 9000h, bit 0 is for H/V as usual but bit 1 is ignored.
Here is rough routing of the relevant LS pins if anyone cares. I wasn't real thorough, could be missing something. If someone with a better understanding of electronics than me can tell me what the point of the 1st LS139 decoder is, I'm curious to know. It seems like A12 would just pass thru it in all cases.
LS20 pinout (2nd set of IO not used)
1 (1A) -> VRC 15 -> CON 32 (M2)
2 (1B) -> VRC 1 -> CON 34 (PRG A13)
4 (1C) -> VRC 2 -> CON 35 (PRG A14)
5 (1D) -> VRC 14 -> CON 44 (PRG /CE) -> LS139 1 (/1E)
6 (1Y) -> diode / resistor -> WRAM 20 (/CE)
LS139 pinout
1 (/1E) -> LS20 5 (1D) -> VRC 14 -> CON 44 (PRG /CE)
2 (1DA) -> PRG 4 -> WRAM 2 -> CON 33 (PRG A12)
3 (1DB) Fixed High
4 (/1Y0) NC
5 (/1Y1) NC
6 (/1Y2) -> VRC 37 (PRG A12)
7 (/1Y3) NC
15 (/2E) -> PRG 24 -> VRC 8 (PRG /CE)
14 (2DA) -> PRG 30 -> VRC 39 (PRG A17)
13 (2DB) Fixed High
12 (/2Y0) NC
11 (/2Y1) NC
10 (/2Y2) NC (Goes to solder pad, unjumped, to GND)
9 (/2Y3) NC (Goes to PRG /CE on unused PRG slot)