Rom Hunter mkII

Paragon (1563)

04-07-2019, 19:48

Btw: when was EPROM from this cartridge (or a same-type cartridge) first dumped? EPROMs tend to be 'leaky' once enough years have passed. So if dump was done just now, you may not be looking at -fully- original contents.

How the block-switching mechanism etc works, can of course be figured out @ any time by mapping out a circuit diagram. Even if EPROM forgot what it was supposed to do back in the day...

Van RetroTechie

Paragon (1563)

04-07-2019, 21:10

@Takamichi: looks like 256 bytes got snipped of that ROM dump. Better read its file name as "rom hunter 0100-BFFF dumped by SHEM".

Looking at contents: ROM data appears twice, just under 5KB 'payload'. First (16K - 256 bytes) = empty. And interestingly: a big block filled with zeroes. Those zeroes can't be coming from the EPROM. And there's no tri-state buffer/latch among the logic IC's on the pcb pix that could put "0" on the MSX's databus. So I'd guess that would be the RAM mapper, paged into 8000-BFFFh? Tip: whether that's indeed RAM can be tested with a BASIC program...

Mapper registers will be either 5, 6, 7 or 8 bits wide (that is: 32, 64, 128, or 256 choices for block #). Otherwise a 2nd '670 would not have been used. Makes sense with 8 KB block size.

Edit: /IORQ does not go into the cartridge! That means 100% sure no I/O port(s) implemented in it. Whatever is done, it's done using memory access only.

Van Manuel

Ascended (19676)

04-07-2019, 22:19

As I wrote before, the 8000-C000 area is indeed RAM. When the ROM is loading a cartridge from the tape, it is loading it into this area, 16kB at a time using the tape BIOS routines.
As I also said, there is a write to address 0x7000 to switch 16kB blocks (it writes 1, 2, 3, etc. after each 16kB block loaded from tape).

The I/O port thing is good to know. I traced all memory writes but I couldn't really figure out what it is doing. See few pages back for the details. I would expect a write to set the RAM to read-only and enable the ASCII8 mapper. I didn't see it, but perhaps someone else can.

As your remark on a routine above C000 that does stuff: indeed, it seems to be there:

F380  out    (#a8),a      D3 A8
F382  ld     e,(hl)       5E
F383  jr     #f388        18 03
F385  out    (#a8),a      D3 A8
F387  ld     (hl),e       73
F388  ld     a,d          7A
F389  out    (#a8),a      D3 A8
F38B  ret                 C9
F38C  out    (#a8),a      D3 A8
F38E  ex     af,af'       08
F38F  call   #f398        CD 98 F3
F392  ex     af,af'       08
F393  pop    af           F1
F394  out    (#a8),a      D3 A8
F396  ex     af,af'       08
F397  ret                 C9

Or is this some standard thing?
Before it resets in openMSX it is executing at F38B, but with 0 on the stack.
The jump came from 0232 (so BIOS). Which eventually got there from 40E1 (jp #0014).

Van Manuel

Ascended (19676)

04-07-2019, 23:00

Gdx, why do you think it has an ASCII 8kB mapper?

Van RetroTechie

Paragon (1563)

04-07-2019, 23:24

Quote:

Or is this some standard thing?

Yep. Part of the MSX slotswitching routines I believe. Doesn't mean this couldn't be used as a route for the ROM software to achieve its goal...

Personally I hate guessing this kind of stuff by debugging code. Circuit schematics are crystal clear in that respect.

Van Manuel

Ascended (19676)

05-07-2019, 00:12

Well, you can trace the lines on the PCB right? They're mostly quite clear.

Van Manuel

Ascended (19676)

05-07-2019, 00:29

Manuel wrote:

Gdx, why do you think it has an ASCII 8kB mapper?

As you already said, the Konami ROM Goemon was't patched. Or do you think it's patched after loading?

Van Manuel

Ascended (19676)

05-07-2019, 00:36

Takamichi: can you try to dump ROMs with different mappers with the tool? You already tried a Konami mapper. What about a game with ASCII8 mapper and a game with ASCII16 mapper?

Van RetroTechie

Paragon (1563)

05-07-2019, 00:51

You can't see how traces run under IC's on component side of the board. So you need either:

Good photos of an empty board (+ info on what components go where, like photo from populated board).
Or the board in hand. So you can measure connections using ohmmeter, shine light through from underside & angle board just right to see how a trace runs, plug into MSX & try things in debugger, etc.

Since I don't own such a cartridge (and practical use of emulator support would be doubtful imho), I wouldn't want to invest the time to trace all connections without something in exchange. But hey, if someone is willing to exchange [Rom Hunter (mkII ?) cartridge + shipping to NL] for [full schematic + description of how it works], then I'm your man!

Van gdx

Enlighted (6421)

05-07-2019, 02:19

Manuel][quote=Manuel wrote:

Gdx, why do you think it has an ASCII 8kB mapper?

Dump of ROMs with RHx extention (SCC megaroms) work on emulator by selecting the ASCII8 mapper. It does not make sense to choose the ASCII8 mapper, It's more easy to patch them for Konami4 mapper if ROM Hunter support it.

Manuel wrote:

As you already said, the Konami ROM Goemon was't patched. Or do you think it's patched after loading?

Dump of ROMs without RHx extention (ASCII16 amd Konami4 megaroms) are not patched but seen the remark above, maybe there are several ways to make dumps. For the moment, nothing works if I understood correctly. So it is difficult to determine now what this cartridge can exactly do. But my first impression may be the right one. ROM hunter mkII probably supports two or three mappers.