I got Rinco famiclone (which looks just like Famicom) to fix it. It has one additional 60 pin cartridge socket underneath with multi-game cartridge inserted. I decided to reverse-engineer it because it looks funny (PAL, so many diodes and some mysterious pads with missing chips & resistors)
The cartridge was probably projectted to be put in two-slot consoles, because it is really narrow (nothing to lock against clips in cartridge shell) and was done on 1.5 mm laminate - requires so much force to put it inside.
I dumped the menu (CPU $8000-$FFFF + PPU $0000-$1FFF), which can be done with help of kazzo to almost any multicart cartridge without knowledge how it works - except those which start messing with banks at startup.
Cartridge contains 200 000 games, but in fact, only: Mario, Lunar ball, Duck Hunt, Wild gunman, Hogans Alley, Bomber man, Tank, Sky destroyer, Binary land, Ice climber. Programmers divided the menu into 1-5000, 5001-10000, etc for easier navigation.
First i desoldered chips and rev-ed all tracks
Those glob-tobs have pins in almost same order like ordinary ROMs:
PRG-ROM is 256k, CHR-ROM is 128 kB. CHR-ROM has only one chip enable line.
Then I rev-ed schematics:
Some notes:
* There is 74273 8 bit latch (adress bits A0-A7 are latched, but A4 & A5 are not used)
* ROM is not turned off during writes at $8000-$FFFF (bus conflicts),
* There is R-C-D reset circuitry which sets latch's bits to 0 on startup,
* Two diodes + resistors were used as poor man's OR gate (ORing PPU-A13 & PPU-!RD to feed the result into CHR-ROM's !CE),
* PAL16L8's is configured to serve as 12 input & 6 output combinational logic.
Then I dumped the PAL to binary using my home-made flash reader.
Then I wrote simple program to convert the binary file into espresso text description:
Then I ran espresso on this file to generate logic formulas for each output:
Data is latched on rising edge of REG.WR signal, which corresponds to writes at $5000-$5FFF (beginning of cycle) or $D000-$DFFF (end of cycle). In fact, first region is used because it does not produce bus conflicts with ROM.
Generally:
* PRG-A14 <- A0, PRG-A15 <- A1, PRG-A16 <- A2, PRG-A17 <= A3 (at $8000-$b000),
* A6 controls 16 KB / 32 KB banking mode,
* at $c000-$ffff there is some magic,
* A7 controls mirroring
Mysterious DIL14 chip, resistors and jumpers
In those mysterious 14 pads probably 74125 tri state buffer should be placed:
Its four inputs are combination of GND/VCC (according to jumpers), which are placed on D0-D3 bus when BUF_!OE goes low, which corresponds to reading from $5000-$5FFF. Probably that could be used for reading some magic value and displaying different game sets, based on that (manufacturer could produce just one type of PCB with same glop-tops and create pseudo-different cartridges according to jumpers)
Kazzo script for dumping whole set would be:
for (a = 0x5000; a < 0x5010; ++a) {
cpu_w(a, 0x00);
cpu_r(0x8000, 0xbfff);
ppu_r(0x0000, 0x1fff);
}
During whole operation, m2 must have 1.7 MHz clock, otherwise register will reset.
The cartridge was probably projectted to be put in two-slot consoles, because it is really narrow (nothing to lock against clips in cartridge shell) and was done on 1.5 mm laminate - requires so much force to put it inside.
I dumped the menu (CPU $8000-$FFFF + PPU $0000-$1FFF), which can be done with help of kazzo to almost any multicart cartridge without knowledge how it works - except those which start messing with banks at startup.
Cartridge contains 200 000 games, but in fact, only: Mario, Lunar ball, Duck Hunt, Wild gunman, Hogans Alley, Bomber man, Tank, Sky destroyer, Binary land, Ice climber. Programmers divided the menu into 1-5000, 5001-10000, etc for easier navigation.
First i desoldered chips and rev-ed all tracks
Those glob-tobs have pins in almost same order like ordinary ROMs:
PRG-ROM is 256k, CHR-ROM is 128 kB. CHR-ROM has only one chip enable line.
Then I rev-ed schematics:
Some notes:
* There is 74273 8 bit latch (adress bits A0-A7 are latched, but A4 & A5 are not used)
* ROM is not turned off during writes at $8000-$FFFF (bus conflicts),
* There is R-C-D reset circuitry which sets latch's bits to 0 on startup,
* Two diodes + resistors were used as poor man's OR gate (ORing PPU-A13 & PPU-!RD to feed the result into CHR-ROM's !CE),
* PAL16L8's is configured to serve as 12 input & 6 output combinational logic.
Then I dumped the PAL to binary using my home-made flash reader.
Then I wrote simple program to convert the binary file into espresso text description:
Code:
.i 12
.o 6
.ilb PPU-A11 PPU-A10 REG.A7 REG.A6 CPU-A14 CPU-A13 CPU-A12 REG.A2 REG.A1 REG.A0 CPU-!ROMSEL! CPU-R/!W!
.ob REG.WR PRG-A14 PRG-A15 PRG-A16 BUF-!OE! CIRAM-A10
000000000000 000010
000000000001 000010
000000000010 000010
000000000011 000010
000000000100 010010
000000000101 010010
000000000110 010010
000000000111 010010
...
.o 6
.ilb PPU-A11 PPU-A10 REG.A7 REG.A6 CPU-A14 CPU-A13 CPU-A12 REG.A2 REG.A1 REG.A0 CPU-!ROMSEL! CPU-R/!W!
.ob REG.WR PRG-A14 PRG-A15 PRG-A16 BUF-!OE! CIRAM-A10
000000000000 000010
000000000001 000010
000000000010 000010
000000000011 000010
000000000100 010010
000000000101 010010
000000000110 010010
000000000111 010010
...
Then I ran espresso on this file to generate logic formulas for each output:
Code:
REG.WR = (CPU-A14 & not CPU-A13 & CPU-A12 & CPU-!ROMSEL! & not CPU-R/!W!);
PRG-A14 = (not REG.A6 & CPU-A14 & not REG.A1) | (not REG.A6 & CPU-A14 & not REG.A2) | (REG.A0);
PRG-A15 = (not REG.A6 & REG.A2 & REG.A0) | (not REG.A6 & CPU-A14 & not REG.A2) | (REG.A1);
PRG-A16 = (not REG.A6 & CPU-A14 & notREG.A2) | (REG.A2);
BUF-!OE! = (CPU-A14 & not CPU-A13 & CPU-A12 & CPU-!ROMSEL! & not CPU-R/!W!) | (not CPU-!ROMSEL!) | (notCPU-A12) | (CPU-A13) | (not CPU-A14);
CIRAM-A10 = (PPU-A10 & not REG.A7) | (PPU-A11 & REG.A7);
PRG-A14 = (not REG.A6 & CPU-A14 & not REG.A1) | (not REG.A6 & CPU-A14 & not REG.A2) | (REG.A0);
PRG-A15 = (not REG.A6 & REG.A2 & REG.A0) | (not REG.A6 & CPU-A14 & not REG.A2) | (REG.A1);
PRG-A16 = (not REG.A6 & CPU-A14 & notREG.A2) | (REG.A2);
BUF-!OE! = (CPU-A14 & not CPU-A13 & CPU-A12 & CPU-!ROMSEL! & not CPU-R/!W!) | (not CPU-!ROMSEL!) | (notCPU-A12) | (CPU-A13) | (not CPU-A14);
CIRAM-A10 = (PPU-A10 & not REG.A7) | (PPU-A11 & REG.A7);
Data is latched on rising edge of REG.WR signal, which corresponds to writes at $5000-$5FFF (beginning of cycle) or $D000-$DFFF (end of cycle). In fact, first region is used because it does not produce bus conflicts with ROM.
Generally:
* PRG-A14 <- A0, PRG-A15 <- A1, PRG-A16 <- A2, PRG-A17 <= A3 (at $8000-$b000),
* A6 controls 16 KB / 32 KB banking mode,
* at $c000-$ffff there is some magic,
* A7 controls mirroring
Mysterious DIL14 chip, resistors and jumpers
In those mysterious 14 pads probably 74125 tri state buffer should be placed:
Its four inputs are combination of GND/VCC (according to jumpers), which are placed on D0-D3 bus when BUF_!OE goes low, which corresponds to reading from $5000-$5FFF. Probably that could be used for reading some magic value and displaying different game sets, based on that (manufacturer could produce just one type of PCB with same glop-tops and create pseudo-different cartridges according to jumpers)
Kazzo script for dumping whole set would be:
for (a = 0x5000; a < 0x5010; ++a) {
cpu_w(a, 0x00);
cpu_r(0x8000, 0xbfff);
ppu_r(0x0000, 0x1fff);
}
During whole operation, m2 must have 1.7 MHz clock, otherwise register will reset.