Mapper Decapping?

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

User avatar
tokumaru
Posts: 12106
Joined: Sat Feb 12, 2005 9:43 pm
Location: Rio de Janeiro - Brazil

Post by tokumaru »

I think you mean when the Master System came out in 1985.

I know, that may be a stretch... On the SMS, the tile map is as wide as the screen, but like on the NES you can mask the leftmost 8 pixel columns. On the NES that doesn't solve the problem because background attributes are applied to 16x16 pixel areas, but on the Master System backgound palettes are defined for individual tiles, so you can in fact perform artifactless scrolling by masking just that 8-pixel column.
User avatar
Memblers
Site Admin
Posts: 3901
Joined: Mon Sep 20, 2004 6:04 am
Location: Indianapolis
Contact:

Post by Memblers »

Dr. Floppy wrote:
Memblers wrote:Dr.Floppy, I made a cart a while back that does 4-screen nametables and has 4 channels of expansion sound (on NES, with no system mods needed). You interested? I have a bunch of the boards sitting around since I never built any to sell.
Very much so!!! :D

What do you want in exchange?
Since it would sorta be a DIY kit with rough software/firmware, not sure what I'd say about price. Including an RS232 adapter, I guess the cost of parts is under $20. If you have cash, post or PM me an offer (nothing is too low, since I've already had the parts sitting around forever :P), but more than anything I'd be really pleased to see it used for a game.

Here is what the board looks like: http://www.parodius.com/~memblers/nes/s ... s/rev1.jpg
It uses a PIC18F4525 (@ 40Mhz, it has 48kB program memory and ~4kB of RAM), so for full control of the hardware you would need to do a little PIC18 assembly. The code I wrote (for the sound synth, communications, banking, IRQs) worked last time I used it (maybe 5 years ago?) but definitely is in need of some optimization in a couple spots. I could help with that some, but I won't have time to offer a whole lot of support.

This is the doc I had written on the registers and memory map:
http://www.parodius.com/~memblers/nes/s ... mapper.txt

RS232 adapter is used to update the PIC firmware, also can be used for loading the NES program into FlashROM using XMODEM (though I can't remember if I ever wrote the code for it to load NES programs larger than 32kB). Alternatively you'd use a ROM programmer to use FlashROM up to 512kB or EPROM up to 1Mbyte. I did most testing using an EPROM emulator, because I had one and it was easy/fast.

There are some examples of the sound output (recorded through my TV at a really crappy samplerate though) here: http://www.parodius.com/~memblers/nes/squeedo/samps/. But the pitch is messed up on some of them, turns out it was because of the music driver I was using (some version of MCK I hacked to replace namco106). I wasted a bunch of time trying to find a non-existent bug in the PIC code. The NES has to spend some time handling the sound too, it gets an IRQ and then writes the sound to the DAC ($4011 register), which actually works pretty well.

Let me know if you're not scared off yet, I understand if so. It would have been easier to use if I had developed it fully.

I quit working on this version of the hardware a long time ago, but more recently started planning a redesign (with extremely better hardware, but more cost to go with it..). That redesign won't be ready for a long time though. What I've done so far on it is rewrite my sound synth in C, there are some examples here: http://membler-industries.com/squeedo/ (Castlevania, Lady Madonna, and TMNT4 all had an accidental distortion bug when I recorded them though)
Dr. Floppy
Posts: 47
Joined: Mon May 09, 2011 7:02 pm

Post by Dr. Floppy »

I contacted a representative of the aforementioned firm with regards to the possibility of decapping MMC5:

"What we're trying to do is trace out the transistors of the Nintendo MMC5 chip in order to gain a complete understanding of its internal functioning. Is this sort of imaging something your company does? (One of the forum members is under the impression that it merely checks for authenticity.)"

Today, I received this response:
Yes, you are correct regarding our specialty in determining a device’s authenticity. From my understanding, the first step you would require is to successfully expose the die, have some metallurgical images taken, and then trace out the number of transistors. Depending upon the size of the die after decapsulation, will inherently determine the type of objective magnification necessary during microscopic inspection. This may or may not be possible with the scope we have on hand, which is easily determined after decapsulation. A more detailed inspection might require use of an SEM, a capability not readily available at our facility.

The Decapsulation procedure itself, however, is something we are capable of performing. Depending upon the device, it is possible to maintain device functionality, to perform additional tests. A few questions I have are: Could you tell me the type of device requiring decapsulation? For example, is it a QFP, SOIC, BGA? Is the unit mounted on a circuit board? Is maintaining device functionality a priority as well?
I don't want to sound like a complete ingenue when I reply, so I figured I'd get some community input beforehand:

1) The device in question is an MMC5 ASIC, in a 100-pin rectangular PQFP package.

2) The unit is currently mounted on a circuit board... (but can be dismounted prior to submission?)

3) I've got several copies of Laser Invasion lying around, so maintaining device functionality is not necessarily a high priority. (Marginally speaking, the donor cart could be considered to be of higher value as a sacrificial lamb considering the information it may yield.)

Overall, the worst-case scenario is that this firm can decapsulate the MMC5 and take some prima facie images of its internal anatomy, but further detail might be required to fully trace out every transistor. And to get even this far will probably cost me a few hundred bucks (which isn't a problem) and the likely sacrifice of a Laser Invasion cart (also permissible).

If I've gotten anything wrong in the preceding paragraphs, would someone please correct me before I embarrass myself?
tepples
Posts: 22345
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

And don't forget to provide them with what we already know for certain about its pinout: which pins go to the CHR ROM, which to the PRG ROM, which to the CPU bus on the NES, and which to the PPU bus on the NES. This might help them know what they're looking for.
Post Reply