A menu with 600 games for selection, but around 32 unique ones.
Here's the cartridge board. I'd like to dump it.
Mapper 66 dumps only a bank of the PRG. I can handle the menu and 1 game loads (all with corrupted GFX, of course).
Can't see enough traces to reverse engineer the board; the ICs are in the way. You'll have to use a continuity meter to figure out the rest.
All I can tell for certain is that it latches the address bus (at the very least: A6, A7, A8, A9, and A13), and it appears to be one of those multicarts that supports 32K and 16K NROM games. (A13 connects to the ROM, but A14 doesn't).
It also doesn't entirely wire the PRG ROM in order: A0 through A3 are doing something awfully weird involving the 74'157.
Do you want them in an higher resolution?
Sadly, the information that I'd need is hidden is hidden between the "component" side of the PCB and the underside of the IC packages. So ... maybe if you can get some lighting in between (I have no idea how) such that I could see the traces through the PCB .. but otherwise all I can tell you is:
A6 is latched at some point, and becomes what would normally be PRG A18
A7, A8, A9, and A13 are latched at the same time as A6, but I can't see exactly where any of the traces go.
latched copy of A7 goes somewhere to the right
latched copy of A8 goes down under the mask ROM
latched copy of A9 goes to one of the pins on the leftmost 74'157
latched copy of A13 goes around, up, and between the legs of the leftmost 74'157
A5 and A4 are probably latched also
PRG ROM A0-A3 come from the rightmost 74'157
The 74'153 seems to be doing the standard "use it as two independent multiplexers" trick, one of which definitely controls mirroring (but I can't see where the control line comes from).
this card mapper 227?????
using nrom.ad, dump first 32K,sent me.
for int i=0;i<512/16;i++
write 8000+i*4, i*4
read 8000 4000
rom is maper 227,SIZE 512
multi menu ,exp: 600in1,450in1.....
I need a full script.
CHR ROM too? How much?
EDIT: the script gives error - ppu_rom does not exist. Argh.
Zepper wrote:
I need a full script.
CHR ROM too? How much?
EDIT: the script gives error - ppu_rom does not exist. Argh.
//www.nesbbs.com dragon2snow
board <- {
mappernum = 227,
cpu_rom = {
size_base = 1 * mega, size_max = 4 * mega,
banksize = 0x4000
},
ppu_rom = {
size_base = 0, size_max = 0,
banksize = 0x2000
}
};
function cpu_dump(d, pagesize, banksize)
{
local i;
for(i = 0; i < pagesize - 1; i +=1){
cpu_write(d, 0x8000+i*4, i*4);
cpu_read(d, 0x8000, banksize * 2);
}
}
. pagesize - 1 or pageszie
Classically, just try dumping it as NROM, and throw that into a debugging emulator to wait for writes to anywhere between $4018 and $FFFF
Odds are pretty good, given the kind of pirate cart that this looks like, and the diode in the upper left corner, that it will boot into the menu, and there will be a table mapping specific values to each of the banks.
Of course, if you sat down with a multimeter and explicitly measured which pins connect to which pins, I could tell you exactly what is happening, rather than taking a stab in the dark.
... huh, I see that zxbdragon has that PCB on hand. But ... the description on the wiki of mapper 227 has to be incomplete, then, because the PCB is definitely doing something with the latched result of address lines other than A0-A9.
There's a _63in1 script that would dump it too, but it gives ppu_bank error.
Here's the mapper 227 from RockNES.
Info from Mark Knibbs, ages ago...
Code:
; menu RAM at $5000-$5FFF - read/write
;write: values[ addr&3 ] = data & 0x0F;
;read: return values[ addr&3 ];
//
// 1200in1 (Mapper #227)
//
static void map227(const unsigned int addr, const unsigned char data)
{
int i;
/* mirroring
*/
if(addr & 2) {
set_hmirror();
} else {
set_vmirror();
}
/* PRG page select
*/
unsigned char pdata = (addr >> 3) & 0x0F;
if(addr & 0x100)
pdata |= 0x10;
/* PRG page cpu_swap
*/
if(addr & 1)
{
cpu_swap32k(pdata);
}
else
{
if(addr & 4) {
cpu_swap8k(4,(pdata<<2)+2);
cpu_swap8k(5,(pdata<<2)+3);
cpu_swap8k(6,(pdata<<2)+2);
cpu_swap8k(7,(pdata<<2)+3);
} else {
cpu_swap8k(4,(pdata<<2)+0);
cpu_swap8k(5,(pdata<<2)+1);
cpu_swap8k(6,(pdata<<2)+0);
cpu_swap8k(7,(pdata<<2)+1);
}
}
if(addr & 0x80) {
for(i=0; i<8; i++)
{
PPU_LOCKMEM(i);
}
} else {
for(i=0; i<8; i++)
{
PPU_UNLOCKMEM(i);
}
pdata = (pdata & 0x1C) << 2;
if(addr & 0x200) {
cpu_swap8k(6,pdata+0x0E);
cpu_swap8k(7,pdata+0x0F);
} else {
cpu_swap8k(6,pdata+0);
cpu_swap8k(7,pdata+1);
}
}
}
"860"?
Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:
lidnariq wrote:
"860"?
Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:
this cart is dip multi menu,
16 menu
420 460
500 560
600 660
700 860
900 920
940 960
980 400
380 360
zxbdragon wrote:
lidnariq wrote:
"860"?
Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:
this cart is dip multi menu,
16 menu
420 460
500 560
600 660
700 860
900 920
940 960
980 400
380 360
I checked the, I DUMP the five CARDS
fceux,nestopia mapper 227
rocknes mapper info imperfect
Zepper wrote:
How did you make it?
using my m227.ad dump.
这个ROM应该显示600in1,但我得到860in1。 为什么?
你的脚本是一样的,你以前在这个董事会张贴了?
This ROM should display 600in1, but I get 860in1. Why?
Is your script the same you've posted in this board earlier?
Zepper wrote:
这个ROM应该显示600in1,但我得到860in1。 为什么?
你的脚本是一样的,你以前在这个董事会张贴了?
This ROM should display 600in1, but I get 860in1. Why?
Is your script the same you've posted in this board earlier?
DIP开关
这个PCB不是硬件控制开关
是软件控制,简单分析
写8400,DIP开关选择开始,读8000到FFFF,切换开关
ROM DIP区域是ROM地址c00-cff
你发送DUMP的512KROM给我,我编译nestopia DIP支持给你测试、
DIP switch
this pcb not hardware ctrl.
is software ctrl, Simple analysis
write 8400, dip switch Select start , read 8000-FFFF,switch DIP
ROM
DIP area is rom address C00-CFF。
you sent me dump 512 rom,I build Nestopia to dip switch support for test.
support switch X-in-1
X in
viewtopic.php?f=9&t=15271#p185137
你为什么不分享信息映射器?看来你做出改进的Nestopia,但你不显示所做的更改。虽然我的模拟器是闭源的,我认为它是错误的。语言障碍是个大问题了。
所以,我会再次问你。显示你的映射器227的信息。
Why do not you share mapper information? It seems you make improvements to the nestopia, but you do not show the changes made. Although my emulator is closed source, I think its wrong. Language barrier is a big problem too.
So, I will ask you again. Show your mapper 227 information.
Zepper wrote:
你为什么不分享信息映射器?看来你做出改进的Nestopia,但你不显示所做的更改。虽然我的模拟器是闭源的,我认为它是错误的。语言障碍是个大问题了。
所以,我会再次问你。显示你的映射器227的信息。
Why do not you share mapper information? It seems you make improvements to the nestopia, but you do not show the changes made. Although my emulator is closed source, I think its wrong. Language barrier is a big problem too.
So, I will ask you again. Show your mapper 227 information.
ines,nes2.0是非常不科学的NES定义。可能多种PCB使用同一个MAPPER号,我的MAPPER127,就在https://github.com/rdanbrook/nestopia,我没有作227的修改。
我现在只是一个DUMPER,不更新模拟器
Ines, nes2.0 is very unscientific NES definition. May be a variety of PCB using the same MAPPER, my MAPPER127, at
https://github.com/rdanbrook/nestopia, I didn't make the 227 revision.
I'm just a DUMPER, not update the nestopia
Quote:
I'm just a DUMPER, not update the nestopia
You update Nestopia Plus.
Zepper wrote:
Quote:
I'm just a DUMPER, not update the nestopia
You update Nestopia Plus.
已停更了,Plus只用于我自己DUMP后,验证ROM的正确性
Has stopped updating, Plus is used only for myself after the DUMP, verifies the correctness of ROM
好,没问题。
我想知道的DIP开关。
你说写$ 8400,然后读 $8000-$FFFF。 什么具体地址在 $8000-$FFFF? 它不能是所有这个范围!
Fine, no problem.
i want to know about the DIP switch.
You said a write to $8400, then reading $8000-$FFFF. What specific address on $8000-$FFFF? It can't be ALL this range!
Zepper wrote:
好,没问题。
我想知道的DIP开关。
你说写$ 8400,然后读 $8000-$FFFF。 什么具体地址在 $8000-$FFFF? 它不能是所有这个范围!
Fine, no problem.
i want to know about the DIP switch.
You said a write to $8400, then reading $8000-$FFFF. What specific address on $8000-$FFFF? It can't be ALL this range!
......nestopia read 8000-ffff,different cart address is random .
only write 8400,read 8000,ffff,return dip number,write other address read 8000 fffff,cart data.
NESTOPIA是读取8000到FFFF,不同的卡带地址是随机。
只是在写8400时,读8000-FFFF时,返回dip,写其它地址,返回正在卡带值。
我已把这个卡所有的MAPPER信息都分享了,你还让我分享什么?
其实就是一个范围,并不是8000到FFFF地址有影响,而是8400的值当作返回DIP的值,写其它地址,返回正常卡带值
不同的卡带可能不是8400,你的卡带是8400,
if(address&0x400) dip=0到FF,else dip= 0;
if(dip>0)
return dip
else
return 8000-ffff(cartread)
我用中文说吧
这个帖子中,lidnariq和我
一个从硬件角度,一个从nestopia开源代码,已把这个卡带的MAPPER信息完全的暴露出来,编程是程序员的事,不是我这个被GPL封为亵渎者的事儿。我只dump我的卡带,说出卡带的模拟分析,其它的是模拟器开者的事,和我这个FC爱好者没有关系。我不会公开nestopia的测试代码,因为我公开了,那么,我这个GPL亵渎者的头衔不就没了吗?哈哈
高兴了就编码,会放到这https://github.com/dragon2snow/
在中国,生活是艰难的,临时在这里讨论一下,我在官方nestopia代码上分析了一下ROM,所有的东西NESTOPIA代码+我说的伪代码,所有我知道的MAPPER信息。
你的Nestopia使用不是我的问题。
EDIT: your implementation does NOT work. Returning the value written anytime from $8000-$FFFF brings an invalid opcde being executed (the value written). A specific read address IS required.
Cartread see fceux code! fceux CartBR
You don't know, what is cartread operate?
Mapper 227 is evidently another "combined pile of different but closely related" mapper. Better than the mapper 83 mess, but that's really a low bar.
As I said, we can tell you how your hardware works (if you use a continuity/ohm meter to finish tracing things beyond what I was able to via pictures), or we can tell you how the mapper 227 compatibility definition works, but you're not going to get both...
By the way, the "dip switch" on the chart probably is equivalent to exactly how the rightmost 74'157 is wired. It seems that there's a mode that forces PRG ROM A0-A3 to some constant 4-bit number (using this multiplexer) ... which I thought was awfully weird, but if that's how they control which multicart it claims to be, well, ok, I guess it makes any sense.
Code:
//------------------ Map 227 ---------------------------
uint8 trash = 0;
static DECLFR(M227Read) {
if (trash)
return trash;
else
return CartBR(A);
}
static void M227Reset(void) {
dipswitch++;
dipswitch &= 0x0F;
latche = 0;
M227Sync();
}
static void M227Sync(void) {
uint32 S = latche & 1;
uint32 p = ((latche >> 2) & 0x1F) + ((latche & 0x100) >> 3);
uint32 L = (latche >> 9) & 1;
trash = (latche & 0x400) ? dipswitch << 3 : 0x00;
if ((latche >> 7) & 1) {
if (S) {
setprg32(0x8000, p >> 1);
} else {
setprg16(0x8000, p);
setprg16(0xC000, p);
}
} else {
if (S) {
if (L) {
setprg16(0x8000, p & 0x3E);
setprg16(0xC000, p | 7);
} else {
setprg16(0x8000, p & 0x3E);
setprg16(0xC000, p & 0x38);
}
} else {
if (L) {
setprg16(0x8000, p);
setprg16(0xC000, p | 7);
} else {
setprg16(0x8000, p);
setprg16(0xC000, p & 0x38);
}
}
}
setmirror(((latche >> 1) & 1) ^ 1);
setchr8(0);
setprg8r(0x10, 0x6000, 0);
}
static DECLFW(M227Write) {
latche = A;
M227Sync();
}
static void M227Power(void) {
dipswitch = 0;
SetWriteHandler(0x8000, 0xFFFF, M227Write);
SetReadHandler(0x8000, 0xFFFF, M227Read);
M227Sync();
}
void Mapper227_Init(CartInfo *info) {
//Latch_Init(info, M227Sync, NULL, 0x0000, 0x8000, 0xFFFF, 1);
info->Reset = M227Reset;
info->Power = M227Power;
WRAMSIZE = 8192;
WRAM = (uint8*)FCEU_gmalloc(WRAMSIZE);
SetupCartPRGMapping(0x10, WRAM, WRAMSIZE, 1);
if (info->battery) {
info->SaveGame[0] = WRAM;
info->SaveGameLen[0] = WRAMSIZE;
}
GameStateRestore = StateRestore;
AddExState(WRAM, WRAMSIZE, 0, "WRAM");
AddExState(&latche, 2, 0, "LATC");
AddExState(&dipswitch, 1, 0, "DIPSW");
}
only add card read!! fceux mapper 227 Refactor
addlatch.cpp,is Not easy to add cartread
but not replace fceux mapper 227,reason mapper 227 is RPG and BMC blend mapper.
如果你这都不理解,我也没有办法,当8400(A&0x400),读8000到FFFF,返回DIP
以上代码,全在本帖之前的讨论中,你都不去看,我这是次最后一次给出完整代码。虽然只浪费了我2分钟。
FCEUX 2.2.3 and even the Interim Build 3324 2016/12/13 21:13:46 run exactly like RockNES. Still displays 860in1 and seems to have no dipswitch option.
I'm analysing the CPU code in order to get solid info, instead of spamming pseudo-info here.
Zepper wrote:
FCEUX 2.2.3 and even the Interim Build 3324 2016/12/13 21:13:46 run exactly like RockNES. Still displays 860in1 and seems to have no dipswitch option.
I'm analysing the CPU code in order to get solid info, instead of spamming pseudo-info here.
我给你的代码就是fceux的,自己编译,官方不接受我的代码!
http://v.youku.com/v_show/id_XMTg3ODA2OTk0MA==.html
This topic has been placed on hold pending completion of Zepper's analysis.