INL-XO-ROM reverse engineering

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

INL-XO-ROM reverse engineering

Post by krzysiobal »

I got Gimmick 2 hack which was done using INL-XO-ROM PCB. My version does not have expansion sound, but the PCB at first glance looks like super-dooper:
* place for PRG1-ROM (up to 8MB), PRG2-ROM (up to 512 kB) - was PRG1 meant to be for storing games and PRG2 for firmware when using micro sd card?),
* place for CHR-ROM (up to 512 kB),
* place for PRG/CHR-RAM (even up to 128kB),
* place for battery,
* place for AY-3-8910,
* place for micro sd card,
* some other stuff (logic to support MMC2/MMC4) and a few unpopulated chips.
Probably one universal board for many applications.

Luckily I have a lot of AY-3-8910 chips so I reverse engineered the board mainly because I was curious which components need to be soldered to make audio expansion work.

* The board is build using LAMXO256 CPLD. Does not seem to be very popular, nor cheap (2$) but with similar capacity (256 LUT) and I/Os (78) versus Altera EPM240 (1$, 240 macrocells, 80 IO pins)
* 16 channel 74LVC16245 buffers used for 3V3-5V translation (4$) - I prefer 8 channel 74LVC245 (0.1$), smaller and easier to route signals. And they still ran out of the pins and needed to translate PPU-A13/PPU-A12 using resistor divider
* CON1: There is place for micro SD - loading games like in everdrive?
* IC10: There is place for SPI memory (probably for Dragon Ball and other games that require SPI flash for storing savestates)
* IC9 (STM32F0, unpopulated) / IC13 (STMSTM8S003F3P6) - seems to be responsible for CIC stun. It also has access to micro SD card pins and audio output - was this meant to be used to play back music from sd card and output it to NES?
* Programming CPLD done via EXP0 (TDO) / EXP1 (TDI) / EXP2 (TMS) / EXP3 (TCK) headers
* There is a jumper which selects if WRAM-A12 is tied to CPU-A12 or driven by CPLD (PRG-ROM-A12 is driven by the same pin) - 4kB banking support, woah, can be used to play NSF
* JP3 - unpopulated 5 pin small connector (was it for external audio hook-up?)

Flaws:
* The right terminal of battery (negative) is not routed to anything,
* One of the chasis pins of micro sd card is not routed to anything,
* One leg of R4 is not routed to anything,
* CPLD directly sees PPU A10-A13, but for MMC2/MMC4 it also needs to check if PPU A3-A9 are all ones (and so they used NAND - clever, I did similar trick but using diodes). Weird thing is that they do not care for PPU A0..A2 (according to wiki - MMC2 latch 0 responds only to one address)
* CPLD controls output enable of IC8 buffer and 1/2 of IC7 buffer using the same control line. For IC8 this is strange cause this buffer converts CPU address line which should be always enabled.

Image Image Image Image Image Image Image
Last edited by krzysiobal on Fri Sep 13, 2019 10:38 pm, edited 1 time in total.
User avatar
Memblers
Site Admin
Posts: 4044
Joined: Mon Sep 20, 2004 6:04 am
Location: Indianapolis
Contact:

Re: INL-XO-ROM reverse engineering

Post by Memblers »

That type of coin-cell holder is a clip that presses the battery directly against the gold on the board. So the solder terminals are both +.

That's a pretty cool write-up on that board.
lidnariq
Posts: 11432
Joined: Sun Apr 13, 2008 11:12 am

Re: INL-XO-ROM reverse engineering

Post by lidnariq »

krzysiobal wrote:* The board is build using LAMXO256 CPLD. Does not seem to be very popular, nor cheap (2$) but with similar capacity (256 LUT) and I/Os (78) versus Altera EPM240 (1$, 240 macrocells, 80 IO pins)
Right now, I cannot find the EPM240 for anything near that good of a price in the US.
krzysiobal wrote:* 16 channel 74LVC16245 buffers used for 3V3-5V translation (4$)
Prices in the US are much more favorable for the 74LVC16245; I'm seeing around ~0.3$ per for both the 16-signal and the 8-signal part.
* IC9 (STM32F0, unpopulated) / IC13 (STMSTM8S003F3P6) - seems to be responsible for CIC stun. It also has access to micro SD card pins and audio output - was this meant to be used to play back music from sd card and output it to NES?
Not a stunner! A full function CIC. INL's talked about it a bit.
(according to wiki - MMC2 latch 0 responds only to one address)
True, but irrelevant; Punch-out doesn't seem to use this behavior.
User avatar
aquasnake
Posts: 515
Joined: Fri Sep 13, 2019 11:22 pm

Re: INL-XO-ROM reverse engineering

Post by aquasnake »

Mapper
======

This project required the design and implementation of a new custom mapper by infiniteneslives and rainwarrior, intended to facilitate the inclusion of one of more NSFs into a single NES cartridge.

This mapper supports up to 1MB of PRG-ROM, in 4k banks located at $8000, $9000, $A000, $B000, $C000, $D000, $E000, and $F000. Each bank is selected by n 8-bit register at $5FF8, $5FF9, $5FFA, $5FFB, $5FFC, $5FFD, $5FFE, and $5FFF, respectively, just like NSF banking. These registers are mirrored across the entire $5000-$5FFF region (the register is selected by the low 3 bits), but it is recommended to use the original addresses. The mirroring is merely a convenience for the hardware implementation.

The 8kb CHR region may be RAM or ROM. This project uses CHR-RAM, and the board used by infiniteneslives for this project may only support CHR-RAM.

At power-on, the mapper automatically sets all bits in the $5FFF bank register, placing the highest bank in $F000. This occurs on power-on but not on reset, so any bank that is mapped to $F000 after power-on should contain a valid reset vector.

At present, the project uses iNES mapper 30 to designate this mapper, but this was merely chosen because it was unused by FCUEX at the time of development. No mapper number has been officially reserved yet.
The above is only the purpose of implementing an NSF cart
In addition, SD card function is used to serve for cooperative customers' mapper #413(super Russian roulette) or mappe #409 (music cassette of retroUSB), i guess
Post Reply