Some light on mapper 3 vs mapper 185

BootGod · Post by **BootGod** » Fri Dec 15, 2006 10:07 pm

kyuusaku wrote: N/A? Pin 27 which is A14 on a 27256 is /PGM on a 27128 which should be held high...

That would make sense then for Bird Week, it is a 16K chip, the others are all 32K.

85cocoa wrote:I know that the issue of emulating mapper 185 was discussed a while back on the Nestopia part of R. Bannister's Emuversal Bulletin Board (and somebody came up with some logic that is cleaner than that table), but I'm too lazy to search for it since something screwed up with my account when they changed the forum software. Any ideas?

I believe I know what your refering to, but again it's tailored specifically for those few games. If there are others out there (who the hell knows), it could easily break it.

Bregalad · Post by **Bregalad** » Sat Dec 16, 2006 2:28 am

Here you are what I think the effect of those diodes would be.

1 - If the cathode is on the HC161 side (on the mapper side) :

The diode will prevent current to go from the mapper to the ROM.
Here you are the trurth table for one single bit :

Code: Select all

A B  OUT
0 0  0
0 1  ###
1 0  1
1 1  1

Legend :
A = NES connector CHR-Ax from the PPU
B = Output of the HC161 mapper
OUT = Voltage that will be applied to the ROM pin CHR-Ax
0 = Logic 0 (0 to 0.8 V)
1 = Logic 1 (2.4 to 5 V)
### = Bus conflicts will appear. Avoid this state at all costs.

2 - If the cathode is on the CHR-Ax side :

The diode will prevent current to go from the CHR-Ax signal to the HC161 mapper.
Trurth table :

Code: Select all

A B  OUT
0 0  0
0 1  1
1 0  ###
1 1  1

In other words, in the fist case, a '1' should always be written to the mapper, and the diode has no effect. If '0' is written, bus conflicts will alsmost certainly appear, unless only one pattern table is acedded or something.
In the second case, a '0' should always be written to the mapper, else bus conflicts will almost certainly appear. However, when zero logic is written, the mapper direcly controls the CHR adress lines, and the PPU has no effect. This allow for software pattern table swapping, and the PPU has no effect. This is interesting, however, I'm not sure of the accuracy of this since I've no board with slot for diodes. The only CNROM boad I have has it's mapper D4 and D5 tied to VCC and no slot for any diodes. I think it's a more recent board, because it's something like 'NES-CNROM-09' instead of 'NES-CNROM-256-01'.[/code]

BootGod · Post by **BootGod** » Sat Dec 16, 2006 11:30 am

Looks like NES-CN-ROM-256-05 was the last pcb revision to have spots for the diodes, -06 and onward do not.

85cocoa · Post by **85cocoa** » Sat Dec 16, 2006 12:22 pm

BootGod wrote:
85cocoa wrote:I know that the issue of emulating mapper 185 was discussed a while back on the Nestopia part of R. Bannister's Emuversal Bulletin Board (and somebody came up with some logic that is cleaner than that table), but I'm too lazy to search for it since something screwed up with my account when they changed the forum software. Any ideas?
I believe I know what your refering to, but again it's tailored specifically for those few games. If there are others out there (who the hell knows), it could easily break it.

In the FCEU-mm changelog (19 Mar 2006), CaH4e3 wrote:181 mapper - (...) defined for "Seicross (J)(Redump) [!].nes", this mapper have opposite protection bits values than normal 185.

The good dump of "Seicross (J)" was originally and is currently assigned to mapper 185, but CaH4e3 temporarily assigned it to mapper 181 when he couldn't get it to work properly under mapper 185. The logic I'm talking about allowed for the elimination of mapper 181.

hap · Post by **hap** » Sat Dec 16, 2006 12:34 pm

Oh, that was some guesswork, I doubt it's accurate:
http://www.bannister.org/forums/ubbthre ... mber=22723

Bregalad · Post by **Bregalad** » Sat Dec 16, 2006 1:08 pm

Err... I am the only one who undestand nothing about the utility of those diodes ? I really cannot understand anything from what people say. And why only FC games used this (while NES games had early boards with provisions for diodes) ?

kyuusaku · Post by **kyuusaku** » Sat Dec 16, 2006 1:48 pm

If someone could trace out a schematic, it could be made quite clear how the circuit works.

Most likely the reason that only FC carts used this mechanism was because in Japan around 1986 there was a primitive NROM/CNROM copying device; it consisted of a base unit which would simply copy the ROM from a source cart to an erasable (ultraviolet) EPROM cart. The rest of the world (even China) wasn't keen on NES piracy at the time.

Bregalad · Post by **Bregalad** » Sat Dec 16, 2006 2:26 pm

Well from what I can get, all CNROM games using those diodes actually are NROM games on a CNROM board. (I mean they could run on NROM without that protection stuff, the '161 is used ONLY for protection and not for bankswitching).
Now I really don't understand the effect of those diodes. To disable the CHR, the mapper would have to connect to CHR /OE on the CHROM, and it doesn't seem to do so. Also, since those games check one bank and make sure it doesn't work before selecting the bank wich is supposed to work, it sounds like the banking bits (D0-D1) are being used somewhere. But, if the CHRROM is always 8kb on those weird games, those latches are not used, and connects to nowhere.
A system to disable the CHROM would basically have a gate from the latched mapper value and leave the chip of its tristate mode only if the values matches. But those diodes seems to rather fool the PPU when attempting to communicate with it's CHROM chip. I think those games relies on bus conflicts to work, tough I really make no sense of this without shematics.

I think this method was so bad that Nintendo did give it up fastly, and developped the lockout chip for the NES instead. On a CNROM game one could just disolder the ROMs and dump them since they have standard pinout. With one of those tools that can grip ICs, it could be dumped without even being disoldered.

Quietust · Post by **Quietust** » Sat Dec 16, 2006 7:15 pm

Have you tried tracing D0 and D1 on those boards?

BootGod · Post by **BootGod** » Sat Dec 16, 2006 9:26 pm

I haven't been home in a couple days, won't be back until tommorow night. I will try to get you guys the info you want. Is a schematic of just the 161 connections sufficient?

As for reading the ROM directly, I actually have done this. I originally only bought Mighty Bomb Jack, when I saw those diodes on there, I suspected it had something to do with them. So I bought some more games that I thought would have different diode patterns according to that table, and they did. But I still was (am) unclear exactly what is going on. I desoldered the CHR ROM and first tried to read it as an 8K ROM (27C64) and got nothing but noise. Then I tried 16K, and the data showed up in the upper 8K. I also read it as a 32K to see if it would be in the uppermost 8K of that, but it wasn't, it was all noise except for the 2nd bank. What the hell does that mean? The pinout must not be standard? The ROMs (LH2367xx) are certainly 8K, so I do not understand why they would read like that.

BTW, if you try to read these ROMs thru CopyNES, without setting the proper "key", you get odd results too. For instance with MBJ, if you dump it as a 32K ROM, you get the same results as above. banks 1,3,4 are typical open-bus reads, and the 2nd bank is the real data, interleaved with a bunch of shit. The noise it's mixed with will always be different too. I'm guessing there is a full-blown conflict going on, probably not too good for the cart :/

Bregalad · Post by **Bregalad** » Sun Dec 17, 2006 2:25 am

Is a schematic of just the 161 connections sufficient?

Yeah, and where they lead if possible.

Maybe Nintendo did just replace the upper adress lines by additionnal output enable pins, and that all must be set correctly to be enabled. Then, in function of how the internal logic mixes output enable to actually enable the output, a certain configuration should be set to have the ouptut enabled.
Typically, on mighty bomb jack, A13 is instead OE and A14 is /OE. So if and only if A13 is high and A14 is low the output is enabled.

BootGod · Post by **BootGod** » Sun Dec 17, 2006 6:34 pm

OK here are the '161 connections:

Code: Select all

           ------ 
    +5V - |01  16| - +5V
PRG /CE - |02  15| - NC
 PRG D0 - |03  14| - CHR ROM pin 26
 PRG D1 - |04  13| - CHR ROM pin 27
 PRG D4 - |05  12| - Diode D2 - CHR A12
 PRG D5 - |06  11| - Diode D1 - CHR A10
    GND - |07  10| - GND
    GND - |08  09| - PRG R/W
           ------

I also found a doc for this particular CHR ROM, the LH2367. I am not sure wtf the meaning of pins 26 and 27 are though. S1//S1/N and S2//S2/N?

Code: Select all

    +--()--+
 NC | 1  28| VCC
A12 | 2  27| S2//S2/N
A07 | 3  26| S1//S1/N
A06 | 4  25| A08
A05 | 5  24| A09
A04 | 6  23| A11
A03 | 7  22| G//G/N
A02 | 8  21| A10
A01 | 9  20| E//E
A00 |10  19| D7
 D0 |11  18| D6
 D1 |12  17| D5
 D2 |13  16| D4
GND |14  15| D3
    +------+

kyuusaku · Post by **kyuusaku** » Sun Dec 17, 2006 10:05 pm

The diodes are just in series? There are no other components?

BootGod · Post by **BootGod** » Mon Dec 18, 2006 5:40 pm

That is correct, the diodes complete the connection between the 2 '161 pins and the 2 CHR ROM pins. Nothing else is between them.

Quietust · Post by **Quietust** » Mon Dec 18, 2006 6:06 pm

I think the only purpose of the diodes is to make it difficult to dump the cartridge without removing the ROMs - the real protection appears to be embedded within the CHR ROM itself, responding only to a single 8KB bank and disabling output for all other combinations, and that is what needs to be recorded.

nesdev.org

Some light on mapper 3 vs mapper 185

Probably isn't going to help at this point but...