Help with 600in1 cart dumping?

[Zepper]

A menu with 600 games for selection, but around 32 unique ones.
Here's the cartridge board. I'd like to dump it.
Mapper 66 dumps only a bank of the PRG. I can handle the menu and 1 game loads (all with corrupted GFX, of course).

[lidnariq]

Can't see enough traces to reverse engineer the board; the ICs are in the way. You'll have to use a continuity meter to figure out the rest.

All I can tell for certain is that it latches the address bus (at the very least: A6, A7, A8, A9, and A13), and it appears to be one of those multicarts that supports 32K and 16K NROM games. (A13 connects to the ROM, but A14 doesn't).

It also doesn't entirely wire the PRG ROM in order: A0 through A3 are doing something awfully weird involving the 74'157.

[Zepper]

Do you want them in an higher resolution?

[lidnariq]

Sadly, the information that I'd need is hidden is hidden between the "component" side of the PCB and the underside of the IC packages. So ... maybe if you can get some lighting in between (I have no idea how) such that I could see the traces through the PCB .. but otherwise all I can tell you is:

A6 is latched at some point, and becomes what would normally be PRG A18
A7, A8, A9, and A13 are latched at the same time as A6, but I can't see exactly where any of the traces go.
latched copy of A7 goes somewhere to the right
latched copy of A8 goes down under the mask ROM
latched copy of A9 goes to one of the pins on the leftmost 74'157
latched copy of A13 goes around, up, and between the legs of the leftmost 74'157

A5 and A4 are probably latched also

PRG ROM A0-A3 come from the rightmost 74'157

The 74'153 seems to be doing the standard "use it as two independent multiplexers" trick, one of which definitely controls mirroring (but I can't see where the control line comes from).

[zxbdragon]

this card mapper 227?????

using nrom.ad, dump first 32K,sent me.

[zxbdragon]

for int i=0;i<512/16;i++
write 8000+i*4, i*4

read 8000 4000

rom is maper 227,SIZE 512
multi menu ,exp: 600in1,450in1.....

[Zepper]

I need a full script.
CHR ROM too? How much?

EDIT: the script gives error - ppu_rom does not exist. Argh.

[zxbdragon]

I need a full script.
CHR ROM too? How much?

EDIT: the script gives error - ppu_rom does not exist. Argh.

//www.nesbbs.com dragon2snow
board <- {
mappernum = 227,
cpu_rom = {
size_base = 1 * mega, size_max = 4 * mega,
banksize = 0x4000
},
ppu_rom = {
size_base = 0, size_max = 0,
banksize = 0x2000
}
};
function cpu_dump(d, pagesize, banksize)
{
local i;
for(i = 0; i < pagesize - 1; i +=1){
cpu_write(d, 0x8000+i*4, i*4);
cpu_read(d, 0x8000, banksize * 2);
}
}

. pagesize - 1 or pageszie

[lidnariq]

Classically, just try dumping it as NROM, and throw that into a debugging emulator to wait for writes to anywhere between $4018 and $FFFF

Odds are pretty good, given the kind of pirate cart that this looks like, and the diode in the upper left corner, that it will boot into the menu, and there will be a table mapping specific values to each of the banks.


Of course, if you sat down with a multimeter and explicitly measured which pins connect to which pins, I could tell you exactly what is happening, rather than taking a stab in the dark.

... huh, I see that zxbdragon has that PCB on hand. But ... the description on the wiki of mapper 227 has to be incomplete, then, because the PCB is definitely doing something with the latched result of address lines other than A0-A9.

[Zepper]

There's a _63in1 script that would dump it too, but it gives ppu_bank error.

[Zepper]

Here's the mapper 227 from RockNES.
Info from Mark Knibbs, ages ago...

Code: Select all

; menu RAM at $5000-$5FFF - read/write
;write:   values[ addr&3 ] = data & 0x0F;
;read: return values[ addr&3 ];

//
// 1200in1 (Mapper #227)
//
static void map227(const unsigned int addr, const unsigned char data)
{
   int i;

   /* mirroring
    */
   if(addr & 2) {
      set_hmirror();
   } else {
      set_vmirror();
   }

   /* PRG page select
    */
   unsigned char pdata = (addr >> 3) & 0x0F;
   if(addr & 0x100)
      pdata |= 0x10;

   /* PRG page cpu_swap
    */
   if(addr & 1)
   {
      cpu_swap32k(pdata);
   }
   else
   {
      if(addr & 4) {
         cpu_swap8k(4,(pdata<<2)+2);
         cpu_swap8k(5,(pdata<<2)+3);
         cpu_swap8k(6,(pdata<<2)+2);
         cpu_swap8k(7,(pdata<<2)+3);
      } else {
         cpu_swap8k(4,(pdata<<2)+0);
         cpu_swap8k(5,(pdata<<2)+1);
         cpu_swap8k(6,(pdata<<2)+0);
         cpu_swap8k(7,(pdata<<2)+1);
      }
   }

   if(addr & 0x80) {
      for(i=0; i<8; i++)
      {
         PPU_LOCKMEM(i);
      }    
   } else {
      for(i=0; i<8; i++)
      {
         PPU_UNLOCKMEM(i);
      }
      pdata = (pdata & 0x1C) << 2;
      if(addr & 0x200) {
         cpu_swap8k(6,pdata+0x0E);
         cpu_swap8k(7,pdata+0x0F);
      } else {
         cpu_swap8k(6,pdata+0);
         cpu_swap8k(7,pdata+1);
      }
   }
}

[Zepper]

Find the error in this screenshot.

[lidnariq]

"860"?

Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:

[zxbdragon]

"860"?

Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:

this cart is dip multi menu,
16 menu

420 460
500 560
600 660
700 860
900 920
940 960
980 400
380 360

[zxbdragon]

"860"?

Seriously, though, I'd appreciate it if you traced out where pins 12-15 on the leftmost 74174 are going/coming from:

this cart is dip multi menu,
16 menu

420 460
500 560
600 660
700 860
900 920
940 960
980 400
380 360

I checked the, I DUMP the five CARDS