* 1MB blob PRG-ROM
* 8kB blob PRG-RAM (no battery back-up)
* 93C46 based EEPROM PRG-RAM
* 8kB blob CHR-RAM
* blob mapper chip, which is exactly the same one as used in previously analyzed games (Diablo 2, Harvest Moon, Warcraft). If treating the chip as black-box, then it has the same pin-out and behaves identically inside. However, it is wired differently which changes the cartridge behavior significantly:
Code: Select all
pin | canonical meaning | Diablo 2 | Wacraft | Harvest Moon | Dahua Sanguo |
| | | | | Yancheng YC-03-09 PCB |
| | (mapper 163) | (mapper 163) | (mapper 163) | (mapper 558) |
----+-------------------+----------------------+-----------------+----------------+-----------------------+
01 | -- NC | ommited | ommited | test point | ommited |
02 | -> WRAM /CE | * | * | * | * |
03 | -> $5200.0 | PRG A19, blob p.7 | PRG A19 | PRG A19 | EPR DI |
04 | -> $5100.0 | blob p.12 | ommited | test point | PRG A19 |
05 | -> $5000.3 | PRG A18, blob p.8 | PRG A18 | PRG A18 | PRG A18 |
06 | <- PPU A13 | jumper (closed) | jumper (closed) | * | * |
07 | <- PPU A9 | * | * | * | * |
08 | <- PPU /RD | * | * | * | * |
09 | <- PPU A12 | * | * | * | * |
10 | -> CHR A12 | * | * | * | * |
11 | -- VBAT | * | * | * | test point |
12 | -- RAM VCC | * | * | * | * |
13 | -- VCC | +5V | +5V | -[100R]--+5V | +5V |
14 | -> $5000.2 | PRG A17, blob p.10 | PRG A17 | PRG A17 | PRG A17 |
15 | -> $5000.1 | PRG A16 | PRG A16 | PRG A16 | PRG A16 |
16 | -> $5000.0 | PRG A15 | PRG A15 | PRG A15 | PRG A15 |
17 | <- CPU A8 | * | * | * | * |
18 | <- CPU A9 | * | * | * | * |
19 | <- CPU R/W | R/W or CPU A10 | R/W or CPU A10 | R/W or CPU A10 | CPU A10 |
20 | <- CPU A12 | * | * | * | * |
21 | <- CPU A13 | * | * | * | * |
22 | <- CPU A14 | * | * | * | * |
23 | <- CPU /ROMSEL | * | * | * | * |
24 | <- CPU M2 | M2, blob p.5 | * | * | * |
25 | -- GND | * | * | * | * |
26 | <- CPU D7 | * | * | * | * |
27 | <- CPU D3 | * | * | * | * |
28 | <> CPU D2 | * | * | * | * |
29 | <- CPU D1 | * | * | * | CPU D0 |
30 | <- CPU D0 | * | * | * | CPU D1 |
31 | <- $5100.2 | jumper | ommited | test point | EPR DO |
32 | -> $5200.2 | blob p.1 | ommited | test point | EPR CS |
33 | -> $5200.1 | PRG A20, blob p.6 | ommited | PRG A20 | EPR CLK |
34 | <- /RESET | +5V | +5V | +3.3V | M2 toggle detect |
* = connected canonically
1) CPU-D0 and CPU-D1 are wired differently which effectively swaps bit 0 and bit 1 in every of its register
2) Pin 19, which used to be "CPU-A10 | CPU-R/W", now it is just CPU-A10. This means that all access (read/write) to registers:
* $5000/$5100/$5200/$5300 is treated as write
* $5400/$5500/$5600/$5700 is treaded as read
3) Pin 34, which was wired to VCC, is in fact /RESET. When this pin is held LOW, all bits of internal registers ($5000, $5100, $5200, $5300) are cleared (and writing to those registers is ignored until it is driven HIGH. It is externally connected to M2-cycle detector, which put the chip in reset during power-up or after reset button is pressed
Answering NRS questions
* What exactly do bits 4-6 of register $5000 do?
Those data pins are not wired so they don't matter
*Does mapper 558 have the 1 bpp mode that mapper 164 has? You can see it being used in "Final Fantasy V" in-game by pressing SELECT, then choosing the bottom option (手記).
It can't as it does not have PPU-A3/CHR-A3 wired in
*Does register $5300 in mapper 558 really function in the same way as you found it on the Nanjing mapper 163, in particular, the bit swap?
Yes, with the exception that because of different wiring, the bit order is now [.....AB.], not [.....A.B]
*I wrote my description based on that assumption. Did I describe the consequences of the D0/D1 bit swap for the Microwire Interface register $5200 correctly?
I don't think so. There are no counter-acting effects as you described, just swaping bit order before latching when $5300.1 = 1
ROM dump: https://gofile.io/d/6vc36e
