Bio Hazard - color palette problems

This is an archive of a topic from NESdev BBS, taken in mid-October 2019 before a server upgrade.
View original topic
Bio Hazard - color palette problems
by on (#239383)
I got from a friend this Bio Hazard cartridge cartridge.
Image Image Image Image Image

However, it has two issues:
* vertical stripes
* weird colors causing it to be unplayable
Cleaning cartridge connector solved the first issue (probably one of the PPU-D pins was not having proper contact) but the second one still remained:


Here how it compares with working ROM:

Looks like some colors were missing, causing the game to be too dark and unplayable. I thought that either some bits of the PRG-ROM memory (which contained opcodes to set palette) were broken or either this was some pre-release - the version displayed at title screen (2003SR7416) is different to the known and working GoodNES one (200314121).
If you look carefully at the shell label, it says another one (20031463). And the label info at ... d_(Famicom) says yet another one (2003SR7416).

I started making schematic and noticed quite unique design - while there are PRG-RAM and CHR-RAM chips, PRG-ROM is integrated with mapper in blob, causing analysis of it to be hard. And dumping the game using mapper 15 or 227 (BioHazard fixed mapper) did not bring any result.

After a long examination I found that the mapper to be as below. After dumping, it worked in emu so the only thing that could potentialy cause harm was either PRG-RAM or CHR-RAM. The source of failure was the last one - writing some random data to it and then reading it back shows that there is some problems with A3 of this CHR-RAM.

Soldering new chip solved the issue. I attach IPS patch.

$4800 / $4801 / $4802: PRG bank registers (mask: $F803)
  $4800 [......xm]
               |+-- mirroring (0=V, 1=H)
               +--- PRG mode
  $4801 [.....ab.] 
              ++---- inner PRG bank
  $4802 [.....CDE]
              +++--- outer PRG bank
x | $8000  | $c000
0 | CDEab0 | CDEab1
1 | CDEab0 | CDE111

$6000-$7fff: WRAM (battery backed). Its /CE and /WE are generated by the mapper-blob, but it does not seem to be protected against writes (neither when M2 stops toggling, nor by any value of 480x registers
$8000-$bfff: 16kB PRG-ROM bank
$c000-$ffff: 16kB PRG-ROM bank

$0000-$1fff: 8kB unbanked CHR-RAM (no write protection)

* All bits are set to 0 on power-up & during reset (every time M2 stops toggling - around 5200us after that chip goes into reset)
* Order of bits was determined by comparing the dump with other version (200314121) of Bio Hazard
* On some consoles the game does not start from first power-up but it needs pressing reset button (probably the logic inside blob needs more time to go out from reset that console does after powering)
* When mirroring is set to V: blob outputs CIRAM_A10 <= not PPU_A10 (and then H: CIRAM_A10 <= not PPU_A11)
* The unknown purpuse test-pad, present in this PCB does not seem to be connected anywhere internally
Re: Bio Hazard - color palette problems
by on (#239386)
This is mapper 178, used by Waixing, Nanjing, and GameStar for many of their educational computer cartridges. There is also a multicart variant with two additional banking modes and $4801 bit 0 properly connected to form a proper UNROM mode with x=1. The wiki article only describes that multicart variant, which is good enough for every dumped ROM; no game seems to require the x=1 mode connected in the manner you describe, and I do not see it being useful for anything.

The 2003SR7416 serial indicates the later version. It is the final registration number at the Chinese copyright office, which one can enter at Chinese copyright lookup websites to learn things such as the game's release date. 200314121 is either an application number at the Chinese copyright office, or a Waixing-internal number; in any case, 200314121 is the earlier version.

The mapper 15 ROM is a buggy mapper hack that crashes a few seconds into the game on any emulator except Nesticle. The original 200314121 version uses the Waixing FW01 printed circuit board, which is currently assigned to mapper 227 along with a very similar multicart. The mapper 227 version is not fixed, but just the unmodified, non-mapper-hacked ROM image. The mapper 15 ROM should be erased from everywhere; no actual cartridge that is not a multicart has ever used mapper 15.