Sachen 4B Mono Mapper

This information is superseded, see Sachen Mappers.

I thought I might as well update that within hours of opening my 4B-007 cartridge I managed to dump it. Basically, the mapper has at least four registers.

• Lock register: Whether the mapper is unlocked or not, see below
• 0x0000-0x1FFF: base ROM bank register; select absolute base RB @ 0x0000-0x7FFF
• 0x2000-0x3FFF: ROM bank register; switch logical RB @ 0x4000-0x7FFF
• 0x4000-0x7FFF: ROM bank mask register; select mapping mask for absolute RBs

Basically, the mono variant of the Sachen 4B mapper has two modes of operation, which I call locked and unlocked. It defaults to locked after reset.
This is used to display the Sachen logo instead of the Nintendo logo for the DMG bootstrap ROM. While locked, the mapper will OR the actual ROM address with 0x0080 (i.e. A7 always set).
The unlock sequence is 0x31 writes to VRAM/WRAM/SRAM (A15 set) intermixed with 0x30 reads from ROM (A15 reset); #CS is don’t care. Write->read transitions as well as read->write transitions are counted and one needs 0x30 of each, 0x60 total.
As far as I could tell, all other functionality is unaffected by the lock register, i.e. switching banks, remapping etc. will all work while locked. The only way to lock the mapper after unlocking is to reset it.

The ROM bank register functionality should be obvious. Bank is zero-adjusted like e.g. MBC1. However, zero-adjustment is done on all 8 bits while writing to the register, which itself is only 6 bits wide (D5..D0)¹⁾I could not test if D5..D4 actually effect mapped bank, due to 4B-007 only containing 0x10 ROM banks.. So it is technically possible to map RB 0x00 to 0x4000-0x7FFF when abusing the overflow of this register or having a ROM smaller than 0x10 RBs²⁾Depending on D5..D4 of the ROM bank register affecting mapping, smaller than 0x40 resp. 0x20 ROM banks..

Base ROM bank and RB mask register are used for remapping 0x0000-0x7FFF to be based on a new base ROM bank³⁾It is reasonable to assume that both of these register are at least four bits and at most #active bits in ROM bank register wide.. Both are writable while the ROM bank register D5..D4 contains 0b11 without limitation.
The mapping function is: (rb & ~mask) | (mask & rb_base).

Too bad Sachen screwed up (on 4B-007 at least) and actually writes the base RB to the mask register and the mask to the base RB register, thus all games having broken masking. But due to power-of-2 sizes of RBs and masks, it turns out that only a few extra RBs are mappable which shouldn’t be instead of the games skipping ROM banks.

I noticed that the Sachen logo check was disabled in the mapped games⁴⁾VRAM comparison of logo area starting at 0x8010. I also noticed that games do write to 0x0000-0x1FFF while being mapped, so this may have some effect (possibly SRAM) either on the original Sachen 1B mapper or on both the 1B and 4B mono mappers.