irq6 (vbl) is triggered at e0
irq4 (?) is triggered at DA (drgw2)
in sprite drawing in mame
if (!sprite_source[4]) break; /* is this right? */
should be
if ((sprite_source[4] & 0x7fff) == 0) break; /* verified on real hardware */
watchdog isn't on motherboard, it is built into each cart. if it fails, it turns
the carts protection devices turn off! The encrypts the 68k rom for the asic27a
games!
Some carts don't have the watchdog (asic27a type 2 for sure, type 3?)
000000-7fffff - controllable by cart config
d00000-dfffff - ""
e00000-efffff is an open bus? returns junk!
f00000-ffffff - possibly?
palette ram is mirrored for entirety of a00000 & ~0x0fe000
palette ram is completely accessible > 1200! has 2000 of palette ram!
video controller is mirrored b00000 & ~0xe0000
bit & 0x2000 of the service input bank is tied to the service dip
the bits 0xc000 are active HIGH!! for the service input bank!
inputs are mirrored c08000 & ~e7ff8
sound latches are mirrored c00000 & ~e7ff8
bios is mirrored up to 1mb - & ~e0000
-- if the cart is not inserted, the bios is mirrored from 0-7fffff!!first 8mb!
drgw2 patches are not part of protection! not present on real hardware
-- rom is mirrored 2x 0-7ffff,8000-fffff
returns 0x1602 in most memory regions that aren't mapped - configurable by the
cart?
-end of cart rom - 7fffff
d00000-dfffff unless protection device mapped here...
f00000+
--------------------------------------------------------------------------------
z80 ram can be disconnected from 68k's bus!
write 45d3 to c0000a! connects (other values do not work!)
write 0a0a to c0000a! disconnects (other values do not work!)
disconnecting and reconnecting, sound resumes
sound chip keeps playing, does not update sounds (loops)
--------------------------------------------------------------------------------
cart ram / read / write
kov2's cart ram, is mirrored e0000, on address & 0x10000 returns 1617!
asic27a type 3's ram is 128k per bank, not 64! it is also mirrored! - verified
size w/data sheet & cart board scans
happy6's shared ram is mirrored 500000-51ffff & 520000-53ffff
olds's cart ram is mirrored ec000! is writeable by 68k!
olds's protection writes in da56xx range are mirrored:
da5400-da57ff (address & 3) == 3 - byte only! not word! unmapped sections are
$1602-filled!, high byte of word w/protection is 16xx
-68k latch read 5c0300, 5c0700, 5c0b00, 5c0f00 and mirrored in those by ~3ff and
mirrored by 30000! (5c0000-5fffff)
--------------------------------------------------------------------------------
68k ROM mirroring
dw2001's 68k program is mirrored from 100000-4fffff!
drgw2's 68k program is mirrored! twice (100000-17ffff & 180000-1fffff)
drgw3's 68kcart ram is mirrored! 300000-3fffff
happy6's 68k is mirrored 100000-17ffff through 4fffff
asic27a type 1 - the 68k rom is mapped to the address space while fully
encrypted and then hash checked
------------------------------------------------------------------------------
video controller notes
video_flag1 --
f000 - disable high prio sprites and bg layer
e000 - disable high priority sprites
d000 - disable bg layer
c000 - no effect
b000 - disable high prio sprites & bg layer
a000 - disable high priority sprites
9000 - disable bg layer
8000 - no effect
7000 - disable high prio sprite & bg layer
6000 - disable high priority sprites
5000 - disable bg layer
4000 - no effect
3000 - disable high prio sprites & bg layer
2000 - disable high prio sprites
1000 - disable bg layer
0000 - no effect
8000 - nothing?
4000 - nothing?
2000 - disable high priority sprites
1000 - disable background layer
0f00 - disable all but background layer
0e00 - disable all but background layer
0d00 - disable text layer
0c00 - disable text layer
0b00 - disable all but background layer + lines in remaing graphics?
0a00 - disable all but background layer
0900 - disable text layer
0800 - disable text layer
0700 - black screen
0600 - white screen
0500 - garbage?
0400 - nothing?
0300 - disable all but background layer
0200 - disable all but background layer
0100 - shows garbage for all but background?
0080 - changes frequency refresh rate?
0040 - nothing? - all games except cave single board sets this?
0020 - nothing? - all games except cave single board sets this?
0010 - nothing? - all games set this
0008 - nothing?
0004 - nothing?
0002 - nothing?
0001 - sprite dma enable!
Code: [Select]
// triggered once per frame if the sprite dma bit is enabled
static void sprite_buffer_dma()
{
UINT16 *ram = (UINT16*)PGM68KRAM;
for (INT32 i = 0; i < 0xa00/2; i += 5)
{
memcpy (sprite_buffer + (i / 5) * 8, ram + i, 0xA); // copies 10 bytes into a 16
byte entry, last 6 bytes empty, a full buffer is 0x1000 in size!, BUFFER IS NOT
CLEARED!
// absolutely stops copying when 0's reached! TO DO: test this!
if ((ram[i+4] & 0x7fff) == 0) // right?
break;
}
}
static void pgm_write_video_controller_word(UINT32 sekAddress, UINT16 wordValue)
{
switch (sekAddress & 0xf000)
{
case 0x0000: break; // not writeable ?
case 0x1000: ZoomRam[(sekAddress >> 1) & 0x1f] = wordValue; break;
case 0x2000: bg_scrolly = wordValue; break;
case 0x3000: bg_scrollx = wordValue; break;
case 0x4000: unk_video_flags0 = wordValue; break;
case 0x5000: fg_scrolly = wordValue; break;
case 0x6000: fg_scrollx = wordValue; break;
case 0x7000: break; // ?
case 0x8000: break; // ?
case 0x9000: break; // ?
case 0xa000: break; // ?
case 0xb000: break; // ?
case 0xc000: break; // ?
case 0xd000: break; // ?
case 0xe000: video_control_flags = wordValue; break;
case 0xf000: break;
}
}
static UINT16 pgm_read_video_controller_word(UINT32 sekAddress)
{
switch (sekAddress)
{
case 0x0000: return sprite_buffer[(sekAddress >> 1) & 0x7ff];
case 0x1000: return 0;
case 0x2000: return bg_scrolly;
case 0x3000: return bg_scrollx;
case 0x4000: return unk_video_flags0;
case 0x5000: return fg_scrolly;
case 0x6000: return fg_scrollx;
case 0x7000: return get_current_scanline(); // scanline counter? 0 - 107
case 0x8000: return 0; // ?
case 0x9000: return 0; // ?
case 0xa000: return 0; // ?
case 0xb000: return 0; // ?
case 0xc000: return 0; // accesses here cause video to refresh?
case 0xd000: return 0; // accesses here cause video to refresh?
case 0xe000: return video_control_flags;
case 0xf000: return 0;
}
}
interesting bits
--
a kovplus cart is backwards compatible with kov's 68k rom.
kovsh's cart hash is calculated like this:
Code: [Select]
struct define_hash
{
unsigned int start_address;
unsigned short add_or_xor;
unsigned short length;
};
static define_hash hash_regions[0x0c] = { // table in asic @ $2144
{ 0x00000, 0x0002, 0x1000 },
{ 0x48000, 0x0001, 0x8000 },
{ 0x58000, 0x0002, 0x8000 },
{ 0x68000, 0x0001, 0x8000 },
{ 0x78000, 0x0002, 0x8000 },
{ 0x88000, 0x0001, 0x8000 },
{ 0x98000, 0x0002, 0x8000 },
{ 0xa8000, 0x0001, 0x8000 },
{ 0xb8000, 0x0002, 0x8000 },
{ 0xc8000, 0x0001, 0x8000 },
{ 0xd8000, 0x0002, 0x4000 },
{ 0xe8000, 0x0001, 0x3000 }
};
// photoy2k
static define_hash hash_regions_photoy2k[0x11] = { // table in asic @ 17c0
{ 0x010000, 0x0001, 0x5000 },
{ 0x030000, 0x0002, 0x5000 },
{ 0x050000, 0x0001, 0x5000 },
{ 0x070000, 0x0002, 0x5000 },
{ 0x090000, 0x0001, 0x5000 },
{ 0x0b0000, 0x0002, 0x5000 },
{ 0x0d0000, 0x0001, 0x5000 },
{ 0x0f0000, 0x0002, 0x5000 },
{ 0x110000, 0x0001, 0x5000 },
{ 0x130000, 0x0002, 0x5000 },
{ 0x150000, 0x0001, 0x5000 },
{ 0x170000, 0x0002, 0x5000 },
{ 0x190000, 0x0001, 0x5000 },
{ 0x1b0000, 0x0002, 0x5000 },
{ 0x1d0000, 0x0001, 0x5000 },
{ 0x1e0000, 0x0002, 0x5000 },
{ 0x1f0000, 0, 0 } // address to find stored hash
};
{
int i, j;
unsigned short shash = 0, hash = 0, value, *rom = (unsigned short*)src;
for (i = 0; i < 0xc; i++, hash += shash)
{
define_hash *ptr = &hash_regions[i];
for (j = 0, shash = 0; j < ptr->length; j+=2)
{
value = rom[(ptr->start_address + j)/2];
shash = (i & 1) ? (shash + value) : (shash ^ value);
}
}
}
; z80 data in bios!
;33e6 in size
;ram - 00100 - 034e6
;rom - 0ed98 - 1217E
;f64 in size
;ram - 04000 - 04f64
;rom - 1217e - 130E2
;7b0 - in size -- this is re-used!!
;ram - 0500c -
;rom - 0e4f4 -
;
;3260 - in size
;ram - 08000
;rom - 1a4f4
;
;8ce in size
;ram - 0b260 - 0BB2E
;rom - 1d438 - 1DD06
;
;31A -
;ram - 0bb2e - 0BE48
;rom - 1DBE6 - 1D8CC
V1.05