Bootleg FC carts: Exciting Basket & Mike Tyson's Punch-Out!!

[TakuikaNinja]

I recently obtained bootleg carts for "Exciting Basket" and "Mike Tyson's Punch-Out!!" which somehow ended up in New Zealand. I just wanted to document them here, mainly so I can figure out how to dump them. (Click on the photos to get the full size preview)

Exciting Basket: Appears to be the Kaiser conversion using the KS7016 board (NES 2.0 Mapper 306).

IMG_20250423_104500.jpg

IMG_20250423_104935.jpg

The title screen in this cart fully scrubs the Konami logo at the bottom, as opposed to the version documented in nointro which missed a few tiles.

exciting_basket_title.png

Mike Tyson's Punch-Out!!: Board is labelled as N-46. Front label is similar to this pirate cart but there are significantly fewer components on the board. It would be nice to know how the MMC2 functionality is recreated here.

IMG_20250424_115504.jpg

IMG_20250424_115539.jpg

mtpo_title.png

[krzysiobal]

Your MMC2:
I would assume presence of the registers at:
$8000, $a000, $c000, $e000, $e400, $e800, $ec00

Code: Select all

        543210
        ------
$8000 (%100xxx) : PRG1 (used at $8000)                         [....PPPP]
$a000 (%101xxx) : PRG2 (used at $a000)                         [....PPPP]
$c000 (%110xxx) : PRG3 (used at $c000)                         [....PPPP]
$e000 (%111x00) : CHR1 (used at $0000 when latch0=FE) + MIRR   [Mm.CCCCC]
$e400 (%111x01) : CHR2 (used at $0000 when latch0=FD) + MIRR   [Mm.CCCCC]
$e800 (%111x10) : CHR3 (used at $1000 when latch1=FE)          [...CCCCC]
$ec00 (%111x11) : CHR4 (used at $1000 when latch1=FE)          [...CCCCC]

Memory map:
CPU:
  $8000 | $a000 | $c000 | $e000
  PRG1  | PRG2  | PRG3  | -1
  
PPU:
  $0000     |$1000
  CHR1/CHR2 | CHR3/CHR4

Mirroring:     | Mm=00  | Mm=01  | Mm=10  | Mm=11  
[$2000][$2400] | [0][0] | [0][0] | [0][1] | [1][1] 
[$2800][$2c00] | [0][1] | [1][1] | [0][1] | [1][1] 
                 (L-sh)     (H)      (V)    1scB

Differences:
* The previous PCB was 100% compatible with MMC2.

//mmc2_discrete1.jpg

* There is yet another discrete clone that I found photo of on russian website; I dont have photo of the bottom side but the same components suggest it is identical in function and connections to the previous one:

//mmc2_discrete2.jpg

Now about your one that I've just rev-ed:

//mmc2_discrete3.jpg, //mmc2_discrete3_sch.png

1. Different addresses for the registers when comparing to MMC2
2. Code must explicitly set PRG2 to -3 and PRG3 to -2
3. Mirroring reg was moved to CHR1.D76 and CHR2.D76 (both registers must contain the same values for .D7 and .D6, otherwise mirroring will depend on the currently latch value)
4. Mirroring can be also L-shaped and 1Sc (this is just a side effect of using 3xNAND as multiplexer for PPU-A10 and PPU-A11)
5. PPU-A13, A3, A2, A1, A0 are not taken into account for decoding clock signals to the latches. So latches will react not only to $0FDx,$0FEx,$1FDx,$1FEx but also $2FDx,$2FEx,$3FDx,$3FEx. But if the scroll is not set to the fourth nametable, I believe it does not matter. Worse is that A3 is ignored.
6. A1 and A3 are exchanged for both PRG and CHR chips
7. D lines for PRG chip are mixed

[TakuikaNinja]

Thanks for the amazing analysis. This is pretty different from a real MMC2 MTPO cart (or even the other discrete clones), then. I can probably adapt an existing mapper script to create a working dump once I get that dumper I've been eyeing on AliExpress.

Do we have a mapper number assigned for this particular board already, or is this the first time it's been documented?

[zombie343]

Thank you for your hard work!

[TakuikaNinja]

I've managed to dump the MTPO bootleg with my newly acquired kazzo. krzysiobal's analysis was spot on - I modified the MMC2 script based on that info and it worked on the first try!

Code: Select all

// MTPO bootleg with incompatible discrete MMC2 implementation
// https://forums.nesdev.org/viewtopic.php?p=301488#p301488
board <- {
	// now assigned to NES 2.0 Mapper 495
	mappernum = 9,
	cpu_romsize = 1 * mega, cpu_banksize = 0x2000,
	ppu_romsize = 1 * mega, ppu_banksize = 0x1000,
	ppu_ramfind = false, vram_mirrorfind = false
};

function cpu_dump(d, pagesize, banksize)
{
	for(local i = 0; i < pagesize - 1; i += 1){ // Read all but the last bank
		cpu_write(d, 0x8000, i); // 8KB bank @ $8000
		cpu_read(d, 0x8000, banksize * 1); // Read 8KB bank from $8000-9FFF
	}
	// These banks are fixed on a real MMC2 but are switchable on this bootleg
	// (Hacked code likely sets these to the expected "fixed" banks)
	// $A000 controls 8KB bank from $A000-BFFF
	// $C000 controls 8KB bank from $C000-DFFF
	
	// Read last 1x 8KB ($E000-FFFF fixed to last)
	cpu_read(d, 0xE000, banksize * 1);
}

function ppu_dump(d, pagesize, banksize)
{
	for(local i = 0; i < pagesize; i+=2){
		// Just set both banks so we don't have to worry about auto-switching
		cpu_write(d, 0xE000, i);	// 4KB bank @ $0000, high 2 bits set mirroring...
		cpu_write(d, 0xE400, i);	// 4KB bank @ $0000, high 2 bits set mirroring...
		cpu_write(d, 0xE800, i | 1);	// 4KB bank @ $1000
		cpu_write(d, 0xEC00, i | 1);	// 4KB bank @ $1000
		ppu_read(d, 0x0000, banksize * 2);	// Read 8KB (entire CHR space $0000-1FFF)
	}
}

To obtain the bootleg, apply the attached BPS patch to the rev 0 version of MTPO:

Code: Select all

Database match: Mike Tyson's Punch-Out!! (Japan, USA)
Database: No-Intro: Nintendo Entertainment System (v. 20210216-231042)
File SHA-1: AFE3A325657BD9A19612AC064847137D9258D2A4
File CRC32: 12F19390
ROM SHA-1: 339EB36ACBBBEC96C8D177F0265253A5764CC1FB
ROM CRC32: 92A2185C

Note: The patch does not alter the NES 2.0 header nor the mapper number. The correct mapper assignment is 495.

[TakuikaNinja]

As for the Exciting Basket cart, I've run into the following problems:

• NES 2.0 mappers aren't supported. The closest iNES mapper I could find was 108 (submapper 1, to be specific). No big deal, just fix the header afterwards.
• Reads below $8000 are not supported, which is bad when the mapper's switchable bank is at $6000. Even worse, I can't seem to compile the linux source ports on my machine due to outdated buildchains/dependencies.

I might try and work around this by dumping the fixed banks as NROM-256, then dumping the remaining banks as SRAM (setting the bank in the script's "initialisation" function).

[TakuikaNinja]

I might try and work around this by dumping the fixed banks as NROM-256, then dumping the remaining banks as SRAM (setting the bank in the script's "initialisation" function).

This was quite tedious but it worked! There are a few byte differences in bank 8 compared to the known dump, which likely correspond to the complete removal of the Konami logo from the title screen (as I initially observed). To get this bootleg, apply the attached BPS patch to the known dump:

Code: Select all

Exciting Basket (Asia) (En) (Kaiser) (KS-7016) (Pirate)
File SHA-1: 3AA76DC8EAB37F829CE5C2F9387C91217CCC117A
File CRC32: 1440FE32
ROM SHA-1: 3FB2EF872B2C18CE5B39C478D6BFD8084BB07F25
ROM CRC32: 6AA23323

[zombie343]

Very clever!

[TakuikaNinja]

The MTPO bootleg has now been assigned to NES 2.0 Mapper 495.

[krzysiobal]

I recently obtained bootleg carts for "Exciting Basket"

Could you please check with multimeter connections between other chips and KS-201, specifically its pins: 2,3,4,5,6,7,8,9,10,11,12,13,24,25,26
I tried to figure out what is going on in this cartridge but I gave up after many hours, mainly because we don't know how this chip works. It appears at least in four games (incuding yours), all of them are FDS ports. Each board wires its differently and I have suspicion that pin 18 is used to switch in into two distinct modes.

Castlevania 1 (KS-7010)
KS201 PIn18 = VCC
Mapper 554




Zanac (KS-7012)
KS201 PIn18 = GND
Mapper 346




Highway Star (KS-7013)
KS201 PIn18 = VCC
it is NOT Mapper 312. KS-7013 and KS-7013B are two different boards.




Exciting Basket (KS-7016)
KS201 PIn18 = GND
Mapper 306.
Schematic is not complete yet.

[TakuikaNinja]

The multimeter I have doesn't have a continuity mode...

[Joe]

Resistance mode is basically the same as continuity mode. Look for really low resistance, probably less than 1 ohm.

[TakuikaNinja]

Okay, here's what I was able to reliably detect for the KS201 pins in question:

Code: Select all

2 CPU A1
3 CPU A2
4 CPU A3
5 CPU A4
6 CPU A5
7 CPU A6
8 CPU A7
9 CPU A8
10 ?
11 CPU A10
12 CPU A11
13 CPU A12
24 ?
25 ?
26 ?

The ones with a ? mean that I couldn't find any connections with a smaller resistance than 1 Ohm, so I can't confidently say what those are connected to (if at all). Probably n/c?

[TakuikaNinja]

I just realised I never shared the dumper script for the Exciting Basket bootleg here. This needs to be used with anago_wx (or its mod) since I had to treat the PRG banks mapped to $6000-$7FFF as individual 8KiB SRAM dumps. Other requirements should be listed in the script comments.

Code: Select all

// Kaiser KS7016 bootleg port of Exciting Basket (FDS)
// https://forums.nesdev.org/viewtopic.php?p=301298

// IMPORTANT!!!
// Fix header to use NES 2.0 Mapper 306 w/ 8KB CHR-RAM after dumping:
// https://www.nesdev.org/wiki/NES_2.0_Mapper_306
board <- {
	// NES 2.0 headers & mappers are unsupported by kazzo/anago, 
	// so here's the most compatible iNES mapper I could find:
	// https://www.nesdev.org/wiki/INES_Mapper_108
	mappernum = 108, vram_mirrorfind = true, ppu_ramfind = true,
	cpu_rom = {
		banksize = 0x2000, 
		size_max = 0x20000, size_base = 1 * mega
	},
	cpu_ram = {
		banksize = 0x2000, 
		size_max = 0x2000, size_base = 0x2000
	},
	ppu_rom = {
		banksize = 0x2000, 
		size_max = 0, size_base = 0
	}
};

/** PRG-ROM bankswitching (from wiki)
	Mask: $D903 (according to FCEUX)

	A~FEDC BA98 7654 3210
	  -------------------
	  11.1 1..1 .Mpp PP11
			     ||| ++-- Bits 0-1 of 8 KiB PRG-ROM bank number at CPU $6000-$7FFF
			     |++----- Bits 2-3 of 8 KiB PRG-ROM bank number at CPU $6000-$7FFF if M=1
			     +------- 0=Ignore pp, switchable bank number is 10PP
			              1=Obey pp, switchable bank number is ppPP
**/
function set_prg_bank(d, bank)
{
	local val = 0x43 | (bank << 2); // Set M and low 2 bits to 1, then insert bank number
	cpu_write(d, 0xd900 | val, val); // Write to correct address (value is irrelevant)
}

function cpu_dump(d, pagesize, banksize)
{
	// 8000-FFFF: 32KB fixed bank (-4)
	cpu_read(d, 0x8000, banksize * 4);
}

// try dumping this cart as SRAM...
function program_initalize(d, cpu_banksize, ppu_banksize)
{
	set_prg_bank(d, 0) // just in case
}

function cpu_ram_access(d, pagesize, banksize)
{
	local bank = 0; // change this
	set_prg_bank(d, bank)
	cpu_ramrw(d, 0x6000, banksize * 1); // Read 8KB bank from $6000-7FFF
}

[kevtris]

I recently obtained bootleg carts for "Exciting Basket"

Could you please check with multimeter connections between other chips and KS-201, specifically its pins: 2,3,4,5,6,7,8,9,10,11,12,13,24,25,26
I tried to figure out what is going on in this cartridge but I gave up after many hours, mainly because we don't know how this chip works. It appears at least in four games (incuding yours), all of them are FDS ports. Each board wires its differently and I have suspicion that pin 18 is used to switch in into two distinct modes.

I have the Castlevania cartridge and dumped it a long time ago; the mapper is very strange is as far as I know, unique. It relies on READS to switch banks, and writes have no effect. I couldn't quite figure it out back in 2002 or so when I dumped it, but NRS helped and we finally got it doped out a few years ago. A mapper has been assigned for it:

https://www.nesdev.org/wiki/NES_2.0_Mapper_554

I figured at the time I dumped it there was a mode pin, and it seems that is indeed the case.