Tauwasser's Blog

Next week… Now you know how that worked out… Anyway, I was recently contacted on no-intro about an update on the Sachen dumps. And I thought why not share my current progress with the rest of the world 🙂

So, currently dumped physical media:

1B:
---

001  - Beast Fighter         // two different versions/revisions so far
002* - Jurassic Boy II
003* - Thunderblast Man (ROW)
003* - Rocman X         (TW)
004  - Street Hero
005  - 2002 Gedou Zhanlue    // WIP

* The numbers might have been switched between
  Taiwanese (TW) and Rest-of-World (ROW) releases.

4B: (Mono)                   6B:
----------                   ---
                             
001                          001
002                          
003*†
004
005
006
007
008
009

* 4B-003 was found inside Rocman X's ROM. It's assumed it is the
  Mono version as the CGB compatibility flag is reset at 0x0143.
† 4B-003 found inside Rocman X is the CGB version as can be seen by the header.
 Even though, it's just the same game as the mono version, which was dumped on 2017-05-27.

4B: (Color)     8B:    16B:        31B:
-----------     ---    ----        ----
                                   
001             001    002         001 - Mighty Mix (TW)
004             002    ???         001 - Mighty Mix (ROW)
005
006
007
008
009

Now is a good time to mention that I finally put the Sachen MMC2 information on the wiki page.

All 4B (mono) games I encountered so far were single ROMs with a single 4-in-1 collection on them (“standalone”). Some 1B games were distributed standalone as well. Now, all 4B (color) games I have encountered so far were not standalone 4-in-1 games! They were doubled up as two 4-in-1 games inside a single ROM — as a COB ROM/Mapper combo. Which game boots up is selected via two solderable/cuttable links on the cartridge PCB. SL1 connects to the OPT1 pin of the MMC2. SL2 (CL1) connects to OPT2 of the MMC2. (OPT1 and OPT2 are tentative names.)

RA18 is whatever ROM bank is selected or OPT1. This means, either RB 0x00 or 0x10 are the base ROM bank when loading up. As foresight would have it, RB 0x00 contains code for one 4-in-1 game, while RB 0x10 contains code for another, different 4-in-1 game.

For all cartridges I have inspected so far, the following was true: #ROM_CE := A15 or RA20 or OPT2. That means, the ROM is deselected for any bus address greater equal 0x8000, which is regular cartridge behavior. However, selecting RB 0x40 will also disable the ROM, as will selecting RB 0x20 when SL2 (CL1) is closed, because that feeds RA19 straight to OPT2.

Therefore, the following configurations can be achieved:

SL1 SL2 |
   (CL1)|
--------+-----
 0   0  | Base 0x00, #RB = 0x40
 0   1  | Base 0x00, #RB = 0x20
 1   0  | Base 0x10, #RB = 0x20 (0x10-0x1F, 0x30-0x3F)
 1   1  | Base 0x10, #RB = 0x10

0 open, 1 closed.

All 4-in-1 (color) games I have seen were 0x20 ROM banks, i.e. 4 Mbit/512kB. Now, menu for collection 4B#0 sits at RB 0x00, menu for collection 4B#1 sits at RB 0x10. However, there is more to this! As it turns out, menus are coded to test for the PCB settings by comparing what they read in RB 0x00 vs. RB 0x20 and RB 0x40 etc. If the whole 0x20/0x40 banks are accessible, but 0x20 aliases to 0x00, then an 8-in-1 menu will load! If 0x20 does not alias to 0x00 and has the right 4-in-1 Color collection ID in its header, then a 16-in-1 menu will load! That’s great news, because it means potentially collecting less games to preserve all content!

So my working hypothesis is as follows:

4B-001 \
       | ---- 8B-001 \
4B-009 /             |
                     | ---- 16B-001
4B-002 \             |
       | ---- 8B-002 /
4B-004 /

4B-005 \
       | ---- 8B-003 \
4B-006 /             |
                     | ---- 16B-002
4B-007 \             |
       | ---- 8B-004 /
4B-008 /

So two 4B games are one set, two sets make a 8B set and two 8B sets make a 16B set. I have to acknowledge two things:

• a) all games I currently checked out conformed to this hypothesis, but that does not mean that it holds for all games out there. There might be standalone 4B (color) games, as BigFred noted.
• b) It’s not entirely certain any 16B dies with an 8 Mbit ROM were actually produced.

As this fcgamer blog post mentions, 16B games come with a switch that enables either 8B collection inside the cartridge. So presumably, that means there are two 8B dies in the cartridge and the switch toggles between them. Presumably they don’t contain a single mapper/8Mbit ROM COB glob top.

As can be seen from the initial table of dumped media, we’re basically missing one whole 8B collection, because neither 4B-002, 4B-004, nor 8B-002 have been dumped. All the others should in theory be identical to what’s been dumped until now.

As I mentioned above, some — but not all — 1B games come as standalone as well. This includes Thunderblast Man as well as Beast Fighter and Street Hero. There is however a Thunderblast Man, Jurassic Boy II combo ROM. Selection works the same as 4B games, using the two solderable/cuttable links. Rocman X comes as a combo with 4B-003. It’s unknown if 4B-003 is the color version or the mono version¹⁾The game does not make use of the CGB features in any way, which is why BigFred classified it as “Game Boy” rather than “Game Boy Color” for now..

However, a YouTube video ²⁾Thanks to ssjbrollyus for making me aware of the video’s existence. purports to show the Color 4-in-1 version, yet, is mono all the way. Seeing as all 4B (mono) games came as standalone games, this might indicate that it’s actually the 4-in-1 Color version of the game and that Sachen just made 4B-003 (mono) compatible to CGB by using their Sachen MMC2 without adding colors.

This would also fit my established time-frame of all mono games being standalone and using SA-111 or TG-001/TG-002 PCBs. Notable exception: a Beast Fighter on SA8MBT6-2 was lent to me, which is a different version than the other two Beast Fighters I had dumped to far.

Worth mentioning: Rocman X and Thunderblast Man are the same ROM. They load different sprites by checking for RB aliasing at boot-up. The 31B-001 TW and ROW versions contain Rocman and TBM respectively and get around the RB aliasing code by simply writing the correct value into RAM and jumping to the actual init code³⁾31B-001 TW and ROW contain other changes as well..

Aaaaand…. That’s it :D! It takes a lot of nerve to keep all these factoids straight… There’s probably some more words needed for an outsider to understand all this, but I already feel like rambling at about 1000 words now, so I’ll just stop.

EDIT 1: Mighty Mix ROW dumped.
EDIT 2: 4B-005 Color dumped.
EDIT 3: 4B-008 Color dumped.
EDIT 4: Updated the list. 6B-001 does exist and is dumped, 16B-002 dumped, 31B-001 TW redumped, unknown 16B-??? dumped (features mahjong + other games).

This information is superseded, see Sachen Mappers.

I thought I might as well update that within hours of opening my 4B-007 cartridge I managed to dump it. Basically, the mapper has at least four registers.

• Lock register: Whether the mapper is unlocked or not, see below
• 0x0000-0x1FFF: base ROM bank register; select absolute base RB @ 0x0000-0x7FFF
• 0x2000-0x3FFF: ROM bank register; switch logical RB @ 0x4000-0x7FFF
• 0x4000-0x7FFF: ROM bank mask register; select mapping mask for absolute RBs

Basically, the mono variant of the Sachen 4B mapper has two modes of operation, which I call locked and unlocked. It defaults to locked after reset.
This is used to display the Sachen logo instead of the Nintendo logo for the DMG bootstrap ROM. While locked, the mapper will OR the actual ROM address with 0x0080 (i.e. A7 always set).
The unlock sequence is 0x31 writes to VRAM/WRAM/SRAM (A15 set) intermixed with 0x30 reads from ROM (A15 reset); #CS is don’t care. Write->read transitions as well as read->write transitions are counted and one needs 0x30 of each, 0x60 total.
As far as I could tell, all other functionality is unaffected by the lock register, i.e. switching banks, remapping etc. will all work while locked. The only way to lock the mapper after unlocking is to reset it.

The ROM bank register functionality should be obvious. Bank is zero-adjusted like e.g. MBC1. However, zero-adjustment is done on all 8 bits while writing to the register, which itself is only 6 bits wide (D5..D0)¹⁾I could not test if D5..D4 actually effect mapped bank, due to 4B-007 only containing 0x10 ROM banks.. So it is technically possible to map RB 0x00 to 0x4000-0x7FFF when abusing the overflow of this register or having a ROM smaller than 0x10 RBs²⁾Depending on D5..D4 of the ROM bank register affecting mapping, smaller than 0x40 resp. 0x20 ROM banks..

Base ROM bank and RB mask register are used for remapping 0x0000-0x7FFF to be based on a new base ROM bank³⁾It is reasonable to assume that both of these register are at least four bits and at most #active bits in ROM bank register wide.. Both are writable while the ROM bank register D5..D4 contains 0b11 without limitation.
The mapping function is: (rb & ~mask) | (mask & rb_base).

Too bad Sachen screwed up (on 4B-007 at least) and actually writes the base RB to the mask register and the mask to the base RB register, thus all games having broken masking. But due to power-of-2 sizes of RBs and masks, it turns out that only a few extra RBs are mappable which shouldn’t be instead of the games skipping ROM banks.

I noticed that the Sachen logo check was disabled in the mapped games⁴⁾VRAM comparison of logo area starting at 0x8010. I also noticed that games do write to 0x0000-0x1FFF while being mapped, so this may have some effect (possibly SRAM) either on the original Sachen 1B mapper or on both the 1B and 4B mono mappers.