Sangokushi II - Haou no Tairiku hack - N163 bootleg

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220157)
Image Image Image Image Image Image Image

I got photos of this cartridge + ROM dumps. Is is made probably by the same manufacturer that the series of pirate MMC5 games. From photos and without access to PAL chip, I could find out that this is subset of mapper 19 (Namco 163). Here goes rev-en of the mapper:

Code:
---------------------------------- CPU ----------------------------------
CPU bank : $6000 | $8000 | $a000 | $c000 | $e000 
register :  RAM  | $e000 | $e800 | $f000 |   -1 
value    : [...P PPPP]
mask     : $fc00 1111110000000000
   
---------------------------------- PPU ----------------------------------
PPU bank : $0000 | $0400 | $0800 | $0c00 | $1000 | $1400 | $1800 | $1c00
register : $8000 | $8800 | $9000 | $9800 | $a000 | $a800 | $b000 | $b800
value    : [CCCC CCCC]
mask     : $fc00

------------------------------- NAMETABLES ------------------------------
PPU bank : $2000 | $2400 | $2800 | $2c00
register : $c000 | $c800 | $d000 | $d800
value:   : [.... ...M]
mask     : $fc00

---------------------------------- IRQs ---------------------------------
$8400 [LLLL LLLL] - load low counter byte
$a400 [EHHH HHHH] - load high counter byte
mask: $e400

There is 15 bit counter, which increments every M2 cycle only if E=1. When counter wraps from $7fff to $0, it stops and IRQ is triggered . Reloading high counter byte acknowledges interrupt.


As always, I am quite amazed with the bootleg solutions, this time the brilliant use of counter bit 15 (E) as 74161's ENT, which allows incrementing only when it is 1 and also E is automatically set to 0 when counter overflows.

What is also interesting are the fake chip names on the PCB:
Image

As I said, I did not have access to examine the PAL
Image, but it is the one with feedback outputs which is hard to analyze without special effort.

My guessing is that three of unconnected outputs latches the bit 4 of PRG bank which is fed into PRG_A17
Code:
O3 <= CPU_D4 when PRG_nGW=0 and CPU_A12=0 and CPU_A11=0
O4 <= CPU_D4 when PRG_nGW=0 and CPU_A12=0 and CPU_A11=1
O5 <= CPU_D4 when PRG_nGW=0 and CPU_A12=1 and CPU_A11=0
PRG_A17 <= O3 when CPU_A14=0 and CPU_A13=0 else
           O4 when CPU_A14=0 and CPU_A13=1 else
         O5 when CPU_A14=1 and CPU_A13=0 else
         1


Other combinatorial outputs are probbaly:
PRG_nGR <= 1 when CPU_A14=1 and CPU_A13=1 else 0
RAM_nCS <= 0 when CPU_A14 = 1 and CPU_A13=1 and CPU_nROMSEL = 1 else 1 //M2 is not taken into account, it is wired to RAM's positive chip enable
nIRQ <= not IRQPEN

I have no idea:
* Why M2 has pull-down resistor to GND? Were they affraid of floating when console is held in reset (during powerup)?

* When 74161 is clocked, !LOADH /!LOADL need to be low just before CLK rises. If
CLK <= M2
that wouldnt work because 74138 gives small delay which would cause !LOADH / !LOADL to fall after CLK. And
CLK <= not M2 probably wont work either due to hazard reasons (unless PAL is really slow)
Image


* Is
nIRQ <= not IRQPEN
or is there any other way of acknowledging IRQ? Why is !LOADH fed into PAL.
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220162)
this irq clock is original ?
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220169)
krzysiobal wrote:
Why M2 has pull-down resistor to GND? Were they afraid of floating when console is held in reset (during powerup)?
Guessing: save protection.
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220191)
lidnariq wrote:
krzysiobal wrote:
Why M2 has pull-down resistor to GND? Were they afraid of floating when console is held in reset (during powerup)?
Guessing: save protection.


save not working?
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220198)
I have no idea what you're asking. Could you add more words?
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220199)
lidnariq wrote:
I have no idea what you're asking. Could you add more words?


Sorry, I mean,this game in emulator save not working,because save protection?

Chinese translation:
对不起,我的意思,这个游戏在模拟器中存档功能不能使用,是因为存档保护?
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220202)
Now I understand.

My suggestion is unrelated.

The external resistor pulling M2 down guarantees that the save RAM is disabled whenever the cassette wasn't in an operating console, protecting save data. But not a separate logical control.
Re: Sangokushi II - Haou no Tairiku hack - N163 bootleg
by on (#220212)
I got news from the owner of the cartridge. Looks like "CLK <= not M2". PAL adds around 24 ns of delay.
Image