Jaleco SS 88006

[Ice Man]

Got a Jajamaru Gekimaden cart myself and found out that the WIki does not have any pinout for the SS 88006 at all.

So I made something:

Code: Select all

                  SS 88006
                 .---\/---.
       (f) M2 -> |01    42| -- VCC
(frw) PRG A12 -> |02    41| -> RAM CE2 (w)
  (f) CPU A13 -> |03    40| -> RAM /CE (w) (Also shorted to RAM /OE)
  (f) CPU A14 -> |04    39| -> RAM /WE (w)
  (r) PRG /CE <- |05    38| -> /RESET (µPD775x)
  (r) PRG A15 <- |06    37| -> /START (µPD775x)
  (r) PRG A14 <- |07    36| -> CIRAM A10 (f)
  (r) PRG A13 <- |08    35| <- PPU /OE (fr)
  (r) PRG A16 <- |09    34| -> CHR A17 (r)
  (r) PRG A17 <- |10    33| -> CHR A10 (r)
  (r) PRG A18 <- |11    32| -> CHR A16 (r)
 (frw) PRG A1 -> |12    31| -> CHR A11 (r)
 (frw) PRG A0 -> |13    30| -> CHR A13 (r)
 (frw) PRG D0 -> |14    29| -> CHR A12 (r)
 (frw) PRG D1 -> |15    28| -> CHR A14 (r)
 (frw) PRG D2 -> |16    27| -> CHR A15 (r)
 (frw) PRG D3 -> |17    26| -> CHR A18 (r)
  (f) CPU R/W -> |18    25| <- PPU A13 (fr)
  (f) /ROMSEL -> |19    24| <- PPU A12 (f)
     (f) /IRQ <- |20    23| <- PPU A11 (f)
          GND -- |21    22| <- PPU A10 (f)
                 `--------'

Pin 10 could be PRG A17.
Pin 11 could be PRG A18. Has a via on bottom side that leads to nowhere.
Pin 26, 37 and 38 don't know yet. Not connected anywhere though
Pin 34 could be CHR A17.

[lidnariq]

You helped me with a partial RE a couple years ago: viewtopic.php?t=16304

Of concern is the changes of pin 25 between now and then...

Last time you were helping with a copy of Terao no Dosukoi Oozumou.

Pin 26, 37 and 38 don't know yet. Not connected anywhere though

37 and 38 should be a pair of latches that hold values for a µPD775x playback IC.

Need to either disassemble a game that has sound to figure out which of pins 37 and 38 correspond to $F003q0 and $F003q1, or to sit down with something that'll try to write values to that address and see what causes the pins to drive high and low.

[Ice Man]

Oh. My memory isn't the best anymore.

But at least it's more complete to the previous.
Updated the schematic.

I assume Pin 25 was PPU A13 back then as well.

Also update on IC5 on the board, which could be the 74'32.

Code: Select all

                       IC5
                   .---\/---.
           PPU /OE |01    14| VCC
     J1 TO PPU A13 |02    13| /ROMSEL
J2 (NC) TO CHR /CE |03    12| J3 TO /ROMSEL
          J5 TO M2 |04    11| NC \
                M2 |05    10| NC | ALL BRIDGED
     J6 (NC) TO M2 |06    09| NC /
               GND |07    08| J4 (NC) TO /ROMSEL
                   `--------'

[Ice Man]

Updated schematic above to be fully complete.

Dumped the PRG and CHR using PRG/CHR A17 and A18 pin on 88006 and everything is equal meaning the 88006 supports 512KB PRG and 512KB CHR.

[lidnariq]

88006 supports 512KB PRG and 512KB CHR.

... wait, what? How can it support 512KB CHR? The interface to program CHR banks is only 2x4 bits wide and addresses 1KB banks - that's only enough control for 256KB CHR.

That said, the game Toukon Club already has 256KB CHR and visually tracing confirms pin 34.

[NewRisingSun]

The same way as the VRC4 does, I would assume; the high nibble having five bits.

[Ice Man]

Well, I put the English translation on Jajamaru Gekimaden and used 2x 27C040, expanded PRG and CHR for each to 512KB.
Dumped them both afterwards and all bytes were the same. So I assume that A18 is present.

Used sanni's Cartreader but modified the dumping size of mapper 18 since it initially only allowed 256KB for each, which worked fine as well though.

[lidnariq]

The same way as the VRC4 does, I would assume; the high nibble having five bits.

Can't. SS 88006 doesn't have a D4 pin - hence why the PRG banks are split across two registers, unlike in the VRC2/4.

[NewRisingSun]

Oh. Ice Man?

[Ice Man]

Well, if pin 26 is not CHR A18 then what is its purpose?
Because connecting CHR A18 to that pin works flawless.
Playing and dumping.

Same for pin 11 with PRG A18.

if that's not what they are, then why does it work without problems?

[NewRisingSun]

That is very nice that it "works without problems", but what register is connected to that pin? How are you setting the value of pin 26? That's what we're wondering about. It's obvious for PRG A18, but it's not obvious for CHR A18.

[Ice Man]

When dumping this is the script for CHR:

Code: Select all

          banks = int_pow(2, chrsize) * 4;
          for (int i = 0; i < banks; i++) {
            write_prg_byte(0xA000, i & 0xF); // CHR Bank Lower 4 bits
            write_prg_byte(0xA001, (i >> 4) & 0xF);  // CHR Bank Upper 4 bits
            for (word address = 0x0; address < 0x400; address += 512) {
              dumpCHR(address);
            }
          }
          break;

Other than that, I'm not doing anything special. Maybe it's a coincidence, though I wouldn't know what's causing it or what makes it work like that.

[lidnariq]

What's in the upper half of the CHR ROM you programmed? Is it the same as the lower half? (If so, how do you know which half you read back?)

My hunch is that pin 26 is OR(PPU A13,PPU /RD), since we've discovered a lot of other ASIC mappers integrated one OR gate for this purpose, and I can't figure out why else pins 35 (/RD) and 25 (A13) would be connected to the SS 88006.

[Ice Man]

Yea, it's the same as the lower half. I can try to get another SS 88006 cart, program an EPROM with 2 different mapper 18 games (256K lower bytes, 256K upper bytes) and then see how it reads back just to confirm about it. But that may take a while. If someone is faster with that or feels like testing, go for it.

[lidnariq]

Other things you could do if you're not tired of this yet and still have any cart with the SS 88006 in it:

1- Hook up a logic tester to pin 26 while you're dumping the ROM.

My favorite "cheapo" one looks like this:

Code: Select all

+5V --LED--+--LED-- Gnd
           |
          1k
           |
          test point

both "LED"s are either a blue/white LED with a forward voltage comfortably above 2.5V, or two red/orange/yellow LEDs such that neither LED lights when the test point is undriven (and one or the other lights when the test point is pulled to +5V or Gnd)

2- Instead of connected the CHR ROM /OE or /CE to the card edge, instead connect one or both to pin 26.