Waixing mapper 249

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Waixing mapper 249

Post by NewRisingSun »

We finally obtained a circuit board of Mapper 249, used on original Waixing games from 1996. It is basically TKROM/TLROM but with an additional register at $5000 taking values from 0-3 that select one of three patterns in which the PRG and CHR ROM address lines are scrambled. I am focusing only on PRG address line scrambling for now.

All known games write $02 to $5000, so that when one dumps these cartridges without writing to $5000, defaulting to $00, these dumps cannot be run as TKROM. Dumping as TKROM after having written $02 to $5000 makes the dumps work as mapper 4. Later re-releases of these games that use a simple TKROM-compatible board likewise have the banks arranged matching the $5000=$02 bank order. Games with only 128 KiB of PRG ROM will repeat exactly once within a 256 KiB address space when $5000=$02, with other $5000 values, the repetition pattern is more complex. These are the scrambling patterns, with the PRG bank numbers chosen to reflect the assumption that $5000=$02 is the true ROM content:

Code: Select all

5000=00		5000=01		5000=02*	5000=03
PRG bank 08	PRG bank 10	PRG bank 02	PRG bank 04	(PRG A14)
PRG bank 10	PRG bank 08	PRG bank 04	PRG bank 02	(PRG A15)
PRG bank 04	PRG bank 02	PRG bank 08	PRG bank 10	(PRG A16)
PRG bank 02	PRG bank 04	PRG bank 10	PRG bank 08	(PRG A17)
Here is the PCB (code 43-319) from one of these 128 KiB PRG plus 256 KiB CHR games, Super Justice King (later re-released as "Impartial Judge"):
20221229_094234.jpg
20221229_094244.jpg
Baoqingtian.png
Baoqingtian.png (11.11 KiB) Viewed 1406 times
You see the PRG ROM in the bottom left clearly marked "1M" and the CHR ROM "2M", the MMC3 clone labelled "C3" in the top left, and a mystery chip labelled "T9552" in the top right, the latter probably responsible for the scrambling.

I am a bit unsure how such games should be stored in .NES format. Currently, mapper 249 ROMs are stored as the banks appear with $5000=$00, and emulators only emulate the $5000=$02 functionality. This also implies that games with only 128 KiB PRG ROM must be stored in overdumped form, which I find extremely undesirable. I also doubt that this is how they are physically stored in the ROM chip/blob; they are much more likely to be stored in $5000=02 bank order. That would make them runnable simply as mapper 4, which is why nes20db considers those "mapper 4 hacks", losing the information that these games boot with $5000=$00, meaning with address line scrambling enabled. Mapper 249 cannot describe that either however, since mapper 249 as already emulated assumes scrambled and possibly overdumped bank order. The following games are affected (and possibly more that I have not checked):
  • 三十六計 - The Thirty-Six Tricks
  • 夺宝小英豪꞉ 光明與黑暗傳説 (Duóbǎo Xiǎoyīngháo ꞉ Guāngmíng yǔ Hēi'àn Chuánshuō)
  • 封神榜 - Myth Struggle
  • 楚留香꞉ 香帥傳奇之血海飘零 (Chǔliúxiāng꞉ xiāngshuài chuánqí zhī xuè hǎi piāolíng)
  • 水滸傳 - Marsh Outlaws
  • 魔法门之英雄无敌 (Mófǎmén zhī yīngxióng wúdí)
  • 基督山恩仇记 - Le Comte de Monte Cristo
  • 戰斧 - Golden Axe
  • 新包青天 II (武鬥篇) - Super Justice King
Last edited by NewRisingSun on Fri Dec 30, 2022 12:01 pm, edited 1 time in total.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Waixing mapper 249

Post by lidnariq »

Tracing the COB photos shows that the mystery blob T9552 is only connected to D0-D2.

Going clockwise from the pin that's ground:
Ground PRGA14 PRGA15 PRGA16 CHRA12 CHRA13 CHRA14 CHRA15 CHRA16 CHRA17 /ROMSEL M2(via under the epoxy) R/W CPUD2 CPUD1 CPUD0 +5V MMC3PRGA14OUT A15 A16 A17 MMC3CHRA12OUT A14 A15 (two traces that are parallel to but not wire-bonded) A16 A17 CPUA12 CPUA13 CPUA14
Attachments
mapper249-t9552.png
mapper249-t9552.png (39.07 KiB) Viewed 1345 times
User avatar
aquasnake
Posts: 515
Joined: Fri Sep 13, 2019 11:22 pm

Re: Waixing mapper 249

Post by aquasnake »

accroding to FCEUX,i used the simplest conversion to migrate to verilog:

Code: Select all

`ifdef MAPPER_249
		(bit_reverse && !prg_addr_pre_mapped[18]) ? {prg_addr_pre_mapped[20:18], prg_addr_pre_mapped[15], prg_addr_pre_mapped[14], prg_addr_pre_mapped[16], prg_addr_pre_mapped[17], prg_addr_pre_mapped[13]} : 
		(bit_reverse && prg_addr_pre_mapped[18]) ? {1'b0, prg_addr_pre_mapped[17], prg_addr_pre_mapped[15], prg_addr_pre_mapped[19], prg_addr_pre_mapped[20], prg_addr_pre_mapped[16], prg_addr_pre_mapped[14:13]} : 
`endif


NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Waixing mapper 249

Post by NewRisingSun »

Yes, I can look at FCEUX source code myself.

I think I would want to do the following: preserve mapper 249 ROM files as legacy dumps, but consider the 5000=02 bank order as the true unscrambled bank order, for the reasons stated above, and define the "good" dumps as mapper 4 with a new submapper 5. This will allow them to run normally in all emulators, but also allow accuracy-minded emulator authors to have them boot with scrambling pattern 0; all games immediately write 02 to 5000 anyway. Doing so would maximize both compatibility and accuracy.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Waixing mapper 249

Post by NewRisingSun »

Since lidnariq indicated that D2 is also connected to the mystery blob, I checked and found out that there are eight, not just four, scrambling patterns, all selected via $5000. Only one seems to have ever been used by any known game though.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Waixing mapper 249

Post by NewRisingSun »

And here are the complete PRG and CHR scrambling patterns for all eight $5000 values. As before, I assume that $5000=$02 is the unscrambled bank order. Assume a different value as being the unscrambled bank order only requires resorting the rows in each table.

For PRG banks, only $5000.0-1 are considered, meaning that patterns 4-7 are identical to patterns 0-3.

Code: Select all

$5000 value
0/4             1/5             2/6             3/7
PRG A16         PRG A17         PRG A14         PRG A15
PRG A17         PRG A16         PRG A15         PRG A14
PRG A15         PRG A14         PRG A16         PRG A17
PRG A14         PRG A15         PRG A17         PRG A16
For CHR banks, $5000.0-2 are considered, resulting in eight different scrambling patterns.

Code: Select all

$5000 value
0               1               2               3               4               5               6               7
CHR A15         CHR A14         CHR A12         CHR A16         CHR A15         CHR A14         CHR A13         CHR A12
CHR A12         CHR A15         CHR A13         CHR A14         CHR A13         CHR A12         CHR A16         CHR A15
CHR A16         CHR A13         CHR A14         CHR A12         CHR A17         CHR A15         CHR A14         CHR A16
CHR A17         CHR A12         CHR A15         CHR A13         CHR A16         CHR A16         CHR A15         CHR A17
CHR A14         CHR A17         CHR A16         CHR A17         CHR A12         CHR A17         CHR A12         CHR A13
CHR A13         CHR A16         CHR A17         CHR A15         CHR A14         CHR A13         CHR A17         CHR A14
These two tables are the result of comparing the ROM image data obtained from dumping the cartridge after having written each $5000 value.

I still am undecided about in which bank order and mapper/submapper number the "good" dumps of these games should be. As currently implemented in emulators, mapper 4 calls for the bank order obtained from the 43-319 PCB by setting $5000=$02, while mapper 249 calls for the bank order obtained from the 43-319 PCB by setting $5000=$00.

Existing emulation attempts also use a different set of PRG scrambling patterns for the second 256 KiB half of a 512 KiB PRG ROM. This is puzzling since there do not seem to be any 512 kiB mapper 249 titles at all.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: Waixing mapper 249

Post by lidnariq »

NewRisingSun wrote: Sun Jan 01, 2023 8:01 am I still am undecided about in which bank order and mapper/submapper number the "good" dumps of these games should be. As currently implemented in emulators, mapper 4 calls for the bank order obtained from the 43-319 PCB by setting $5000=$02, while mapper 249 calls for the bank order obtained from the 43-319 PCB by setting $5000=$00.
From what you've said:
Later re-releases of these games that use a simple TKROM-compatible board likewise have the banks arranged matching the $5000=$02 bank order.
I'd ask whether mapper 249 should be the canonical dump at all, since the games only ever try to run in native TKROM ordering in the first place. It's apparently not like some games where the copy protection verifies that it gets the wrong ordering with the "wrong" unlock value.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Waixing mapper 249

Post by NewRisingSun »

All right. So the only remaining question is: is it even worth allocating a submapper (5 would be the next) for mapper 4 just to denote the 43-319 PCB that powers on with scrambling enabled, even as the games immediately write to disable it?
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: Waixing mapper 249

Post by NewRisingSun »

I have added mapper 4 submapper 5 per my indicated intention. For nes20db, this deprecates the scrambled mapper 249 dumps, and makes the unscrambeld dumps, denoted as mapper 4 submapper 5, the "good" dumps, allowing them to run in emulators that do not emulate the address scrambling at all. Accurate emulators will of course scramble the bank order until the point at which $5000=$02 is written.

Because the scrambling pattern always involves PRG A17, this meant that several mapper 249 dumps that only had 128 KiB of PRG-ROM had to be weirdly overdumped as 256 KiB PRG-ROM to store them in the scrambled bank order. Storing them as mapper 4.5 nicely alleviates that unsightliness as well.
Post Reply