One Week Later…?

      Comments Off on One Week Later…?

Next week… Now you know how that worked out… Anyway, I was recently contacted on no-intro about an update on the Sachen dumps. And I thought why not share my current progress with the rest of the world πŸ™‚

So, currently dumped physical media:


001  - Beast Fighter         // two different versions/revisions so far
002* - Jurassic Boy II
003* - Thunderblast Man (ROW)
003* - Rocman X         (TW)
004  - Street Hero
005  - 2002 Gedou Zhanlue    // WIP

* The numbers might have been switched between
  Taiwanese (TW) and Rest-of-World (ROW) releases.

4B: (Mono)                   6B:
----------                   ---
001                          001

* 4B-003 was found inside Rocman X's ROM. It's assumed it is the
  Mono version as the CGB compatibility flag is reset at 0x0143.
† 4B-003 found inside Rocman X is the CGB version as can be seen by the header.
 Even though, it's just the same game as the mono version, which was dumped on 2017-05-27.

4B: (Color)     8B:    16B:        31B:
-----------     ---    ----        ----
001             001    002         001 - Mighty Mix (TW)
004             002    ???         001 - Mighty Mix (ROW)

Now is a good time to mention that I finally put the Sachen MMC2 information on the wiki page.

All 4B (mono) games I encountered so far were single ROMs with a single 4-in-1 collection on them (“standalone”). Some 1B games were distributed standalone as well. Now, all 4B (color) games I have encountered so far were not standalone 4-in-1 games! They were doubled up as two 4-in-1 games inside a single ROM — as a COB ROM/Mapper combo. Which game boots up is selected via two solderable/cuttable links on the cartridge PCB. SL1 connects to the OPT1 pin of the MMC2. SL2 (CL1) connects to OPT2 of the MMC2. (OPT1 and OPT2 are tentative names.)

RA18 is whatever ROM bank is selected or OPT1. This means, either RB 0x00 or 0x10 are the base ROM bank when loading up. As foresight would have it, RB 0x00 contains code for one 4-in-1 game, while RB 0x10 contains code for another, different 4-in-1 game.

For all cartridges I have inspected so far, the following was true: #ROM_CE := A15 or RA20 or OPT2. That means, the ROM is deselected for any bus address greater equal 0x8000, which is regular cartridge behavior. However, selecting RB 0x40 will also disable the ROM, as will selecting RB 0x20 when SL2 (CL1) is closed, because that feeds RA19 straight to OPT2.

Therefore, the following configurations can be achieved:

SL1 SL2 |
 0   0  | Base 0x00, #RB = 0x40
 0   1  | Base 0x00, #RB = 0x20
 1   0  | Base 0x10, #RB = 0x20 (0x10-0x1F, 0x30-0x3F)
 1   1  | Base 0x10, #RB = 0x10

0 open, 1 closed.

All 4-in-1 (color) games I have seen were 0x20 ROM banks, i.e. 4 Mbit/512kB. Now, menu for collection 4B#0 sits at RB 0x00, menu for collection 4B#1 sits at RB 0x10. However, there is more to this! As it turns out, menus are coded to test for the PCB settings by comparing what they read in RB 0x00 vs. RB 0x20 and RB 0x40 etc. If the whole 0x20/0x40 banks are accessible, but 0x20 aliases to 0x00, then an 8-in-1 menu will load! If 0x20 does not alias to 0x00 and has the right 4-in-1 Color collection ID in its header, then a 16-in-1 menu will load! That’s great news, because it means potentially collecting less games to preserve all content!

So my working hypothesis is as follows:

4B-001 \
       | ---- 8B-001 \
4B-009 /             |
                     | ---- 16B-001
4B-002 \             |
       | ---- 8B-002 /
4B-004 /

4B-005 \
       | ---- 8B-003 \
4B-006 /             |
                     | ---- 16B-002
4B-007 \             |
       | ---- 8B-004 /
4B-008 /

So two 4B games are one set, two sets make a 8B set and two 8B sets make a 16B set. I have to acknowledge two things:

  • a) all games I currently checked out conformed to this hypothesis, but that does not mean that it holds for all games out there. There might be standalone 4B (color) games, as BigFred noted.
  • b) It’s not entirely certain any 16B dies with an 8 Mbit ROM were actually produced.

As this fcgamer blog post mentions, 16B games come with a switch that enables either 8B collection inside the cartridge. So presumably, that means there are two 8B dies in the cartridge and the switch toggles between them. Presumably they don’t contain a single mapper/8Mbit ROM COB glob top.

As can be seen from the initial table of dumped media, we’re basically missing one whole 8B collection, because neither 4B-002, 4B-004, nor 8B-002 have been dumped. All the others should in theory be identical to what’s been dumped until now.

As I mentioned above, some — but not all — 1B games come as standalone as well. This includes Thunderblast Man as well as Beast Fighter and Street Hero. There is however a Thunderblast Man, Jurassic Boy II combo ROM. Selection works the same as 4B games, using the two solderable/cuttable links. Rocman X comes as a combo with 4B-003. It’s unknown if 4B-003 is the color version or the mono version1)The game does not make use of the CGB features in any way, which is why BigFred classified it as “Game Boy” rather than “Game Boy Color” for now..

However, a YouTube video 2)Thanks to ssjbrollyus for making me aware of the video’s existence. purports to show the Color 4-in-1 version, yet, is mono all the way. Seeing as all 4B (mono) games came as standalone games, this might indicate that it’s actually the 4-in-1 Color version of the game and that Sachen just made 4B-003 (mono) compatible to CGB by using their Sachen MMC2 without adding colors.

This would also fit my established time-frame of all mono games being standalone and using SA-111 or TG-001/TG-002 PCBs. Notable exception: a Beast Fighter on SA8MBT6-2 was lent to me, which is a different version than the other two Beast Fighters I had dumped to far.

Worth mentioning: Rocman X and Thunderblast Man are the same ROM. They load different sprites by checking for RB aliasing at boot-up. The 31B-001 TW and ROW versions contain Rocman and TBM respectively and get around the RB aliasing code by simply writing the correct value into RAM and jumping to the actual init code3)31B-001 TW and ROW contain other changes as well..

Aaaaand…. That’s it :D! It takes a lot of nerve to keep all these factoids straight… There’s probably some more words needed for an outsider to understand all this, but I already feel like rambling at about 1000 words now, so I’ll just stop.

EDIT 1: Mighty Mix ROW dumped.
EDIT 2: 4B-005 Color dumped.
EDIT 3: 4B-008 Color dumped.
EDIT 4: Updated the list. 6B-001 does exist and is dumped, 16B-002 dumped, 31B-001 TW redumped, unknown 16B-??? dumped (features mahjong + other games).

1 The game does not make use of the CGB features in any way, which is why BigFred classified it as “Game Boy” rather than “Game Boy Color” for now.
2 Thanks to ssjbrollyus for making me aware of the video’s existence.
3 31B-001 TW and ROW contain other changes as well.

More Toys :)

      2 Comments on More Toys :)

So it’s been a while. akubi sent me some of her games that contain interesting PCBs — the most outstanding being DMG-Z01-01 followed by DMG-KECN-SP. Still no idea why they put an extra transistor on the latter tho… The former has some weird ROM where Sharp combined 2x 16Mbit in one package (LH5S5WTI).

Still working on figuring out the PALCE16V8 on SA8MBT6-2 used by Gedou Zhenlue 2002. I found the programming algorithm in some obscure Indonesian thesis. Now I need to build a cheep-ass programmer, then see if the security bits can be fooled by reversing the power sequencing for programming (some forum posts claim that’s how you do it).

Notwithstanding that I don’t have time for much of anything right now, I couldn’t refrain from spending some money on eBay. I’m now a proud owner of a DMG-QLA-01… err… a 4-Player adapter for the original DMG. I originally bought one in Japan, but it was literally in the only package that managed to get lost — with a copy of Rockman & Forte for WSC and some DMG games no less πŸ™ Of course, there’s a little Motorola MC68HC05P71)I shamelessly stole the CPU info from Jeff Frohwein; not sure how he determined it, but pinout matches. in there (actually, it’s quite a neat CPU) which is still undumped as far as I can tell. I always wanted to do some hobo decapping, just need the right tools and the right incentive. Still not sure if it’s such a great idea to use chemicals that can burn my lungs away, but… YOLO πŸ˜€

Anyway, shelled out some money for an official rumble dev cart, DMG-B03-11 (no pre-release game on it tho…). Operation isn’t as straightforward as one might have hoped, but I’m getting there. I already figured out how to access SRAM (yeah, it needed figuring out) and read the manufacturer information from the flash chip. Reading the actual game was no problem at all (kind of obvious, though). Made a schematic and marked down some preliminary findings about MBC5-D, the development version of the MBC5.

Then I got a Bung Exchanger and a 64M flash cart (actually, a “Mr. Flash” cartridge; the exchanger is unmarked, but has Bung chips on it) for cheap. Gathered some software from back in the day. Now I just need a printer port. Probably going to see if I can get one for dirt cheap that’s still reliable. Then I spent even more euros and acquired a GBDSO2)Game Boy Digital Sampling Oscilloscope and an ELV GBD 13)ELV Game Boy Datalogger 1 [German].

I managed to break the GBD 1 while undoing the casing — in case you need to open it, too: Don’t put a knife under either of the bottom sides of the case. You’ll catch on the inductances and break their legs off. It should be straightforward to fix though. It did work before my opening the case, so go figure πŸ˜›

Well, so much for now, I guess. I just barely managed to fix my GB dumper — yet again. Apparently, the FTDI chip’s clock input lead is having a hard time staying connected to its clock line, so the baud rates don’t match up anymore. Of course, I changed the original 187500 baud used by Kraku & Chroost to 750000 baud, because I hate waiting on my dumps. 32Mbit take long as is. Might look into a nicer solution as a redesign of my VUE Cart Reader design. Basically, pop in the other GEC, nix two DFF8s and it should work at breezing speeds. DFU over USB included. But I’m somewhat tight on time right now, so maybe I’ll think about it “next week”-ish.

1 I shamelessly stole the CPU info from Jeff Frohwein; not sure how he determined it, but pinout matches.
2 Game Boy Digital Sampling Oscilloscope
3 ELV Game Boy Datalogger 1 [German]

Sachen Update

      Comments Off on Sachen Update

So thanks to BigFred from no-intro, I got my hands on more Sachen cartridges.
A few were mono cartridges, which I managed to dump using my 4B-007 code.

Unlocking color cartridges, which are compatible with CGB as well as DMG works just fine in DMG mode. However, the internal mechanics work differently, so I’ll have to update the wiki shortly. Figuring out how to unlock them in CGB mode took quite some time, because I forgot to mark the #CS signal as being connected to the mapper πŸ˜‰ CGB and DMG mode do not refer to whether or not the game will run in color, they actually do make use of common Game Boy identification methods.

Well, anyway, I figured out how to unlock them in CGB mode as well and I believe I have a correct state machine figured out. I got to contribute some code to higan to properly emulate these mappers, but I digress.

So the actual pretty fucking huge deal is that many of the regular 4B color cartridges actually contain multiple ROMs in them and — depending on some solderable/cuttable links on the PCB — boot up in 8B-mode or 16-in-1 (16B anyone?) 16B-mode. Currently checking back with BigFred if he’s OK with me cutting some traces on his game PCBs though…

So yeah, exciting news. I also prepared schematics for most of them, though documenting chip-on-board is somewhat bothersome. I’m also convinced that they used 3D wire bonding technology and for some reason ROMs that are much bigger than their games — that must have been expensive… For instance, Thunderblast Man is 2 Mbit, yet its Chinese counterpart requires 4 Mbit to function correctly and has an 8 Mbit thus contains another 2 Mbit ROM πŸ™‚

So guessing some pinouts for them isn’t so straightforward 😐 But I’ll do my best guesstimate and that has to be enough, I guess.

Sachen 4B Mono Mapper

      Comments Off on Sachen 4B Mono Mapper

This information is superseded, see Sachen Mappers.

I thought I might as well update that within hours of opening my 4B-007 cartridge I managed to dump it. Basically, the mapper has at least four registers.

  • Lock register: Whether the mapper is unlocked or not, see below
  • 0x0000-0x1FFF: base ROM bank register; select absolute base RB @ 0x0000-0x7FFF
  • 0x2000-0x3FFF: ROM bank register; switch logical RB @ 0x4000-0x7FFF
  • 0x4000-0x7FFF: ROM bank mask register; select mapping mask for absolute RBs

Basically, the mono variant of the Sachen 4B mapper has two modes of operation, which I call locked and unlocked. It defaults to locked after reset.
This is used to display the Sachen logo instead of the Nintendo logo for the DMG bootstrap ROM. While locked, the mapper will OR the actual ROM address with 0x0080 (i.e. A7 always set).
The unlock sequence is 0x31 writes to VRAM/WRAM/SRAM (A15 set) intermixed with 0x30 reads from ROM (A15 reset); #CS is don’t care. Write->read transitions as well as read->write transitions are counted and one needs 0x30 of each, 0x60 total.
As far as I could tell, all other functionality is unaffected by the lock register, i.e. switching banks, remapping etc. will all work while locked. The only way to lock the mapper after unlocking is to reset it.

The ROM bank register functionality should be obvious. Bank is zero-adjusted like e.g. MBC1. However, zero-adjustment is done on all 8 bits while writing to the register, which itself is only 6 bits wide (D5..D0)1)I could not test if D5..D4 actually effect mapped bank, due to 4B-007 only containing 0x10 ROM banks.. So it is technically possible to map RB 0x00 to 0x4000-0x7FFF when abusing the overflow of this register or having a ROM smaller than 0x10 RBs2)Depending on D5..D4 of the ROM bank register affecting mapping, smaller than 0x40 resp. 0x20 ROM banks..

Base ROM bank and RB mask register are used for remapping 0x0000-0x7FFF to be based on a new base ROM bank3)It is reasonable to assume that both of these register are at least four bits and at most #active bits in ROM bank register wide.. Both are writable while the ROM bank register D5..D4 contains 0b11 without limitation.
The mapping function is: (rb & ~mask) | (mask & rb_base).

Too bad Sachen screwed up (on 4B-007 at least) and actually writes the base RB to the mask register and the mask to the base RB register, thus all games having broken masking. But due to power-of-2 sizes of RBs and masks, it turns out that only a few extra RBs are mappable which shouldn’t be instead of the games skipping ROM banks.

I noticed that the Sachen logo check was disabled in the mapped games4)VRAM comparison of logo area starting at 0x8010. I also noticed that games do write to 0x0000-0x1FFF while being mapped, so this may have some effect (possibly SRAM) either on the original Sachen 1B mapper or on both the 1B and 4B mono mappers.

1 I could not test if D5..D4 actually effect mapped bank, due to 4B-007 only containing 0x10 ROM banks.
2 Depending on D5..D4 of the ROM bank register affecting mapping, smaller than 0x40 resp. 0x20 ROM banks.
3 It is reasonable to assume that both of these register are at least four bits and at most #active bits in ROM bank register wide.
4 VRAM comparison of logo area starting at 0x8010

Opening Sachen “4 in 1” 4B-007

      Comments Off on Opening Sachen “4 in 1” 4B-007

So I recently acquired a Sachen game, 4B-007 “4 in 1”. Of course, I had to open it somehow to look inside… Cartridges are a bit smaller than regular Game Boy cartridges and they lack a screw at the back. So with no easy way to open it and prying and shoving on the edges not helping, I had to resort to a more forceful approach. So I used my trusty dremel to dremel the back off where the screw was supposed to be.

I pretty much dremeled away until I could make out what was holding the shells together. I hit part of the PCB — see that green smear :)? — but no worries there.

So after violently separating the shells, I now know how they were assembled. Turns out they used four snap-fit lugs on the sides — 1.0cm and 4.4cm down from the top edge on both sides, in case you were wondering — as well as a press-fit connection instead of a screw. Basically, what you can see in the shell images are the outer hub on the back shell with a hole in it where I dremeled the base of the shaft away. And yes, I just googled these terms.

Press-Fit JointPart of the shaft can be seen in the hub on the front shell. The hub on the front shell in turn is a shaft of its own for the hub on the back shell. No idea if there are barbs at the end of the inner shaft, I doubt it though.
The picture on the left shows what it would look like if I had not broken it. Blue hub and shaft on the back shell, red hub on the front shell; not to scale.

These cartridges were obviously never made with servicing or opening in mind. It should be possible to gently unhinge the lugs and then pull the press-fit joint apart, but it probably requires a really sensitive approach to work without telltale signs of the cartridge having been opened.

Well, the inside was kind of a let-down. I was kind of eager to find a full-size PCB with mapper plus ROM. What I found was a reduced-size PCB called SA-111 with a COB glob-top. This is actually mapper and ROM in one. I already found out how the Sachen mapper fools the DMG, but I need some time to merge the changes into a dumper firmware to dump the ROM. Also notice how the two holes on the left are actually pads for an electrolytic capacitor which was not fitted and not vias.

See also a related post here, which I only found after brutalizing my game.

TAMA5 update

      Comments Off on TAMA5 update

So I took the time to look at all my cartridges now. So far all have the same PCB serial, 020309E4-01-1. Other data in the following table.

ROM (TAMA7) MCU (TAMA6) Interface (TAMA5)
B9748 43903A 9752H 9749 EAH1
B9748 43906A 9730H 9726 EAA1
C9749 43896B 9731H 9725 EAD1
J9748 43860A 9728H 9726 EAB1
C9749 43908A 9727H 9725 EAI1
B9748 43906A 9730H 9726 EAA1

Somewhat disappointing: all contain the same ROM. I had hoped that some of the letters would indicate a ROM revision, but alas, seems to be a date code, or manufacturer code etc.

Game Boy Peripherals

      1 Comment on Game Boy Peripherals

So yeah, I took apart some Game Boy peripherals, namely the Zok Zok Heroes Full Changer, the GB Mobile Adapter (CGB-005PD/PDC version/blue) as well as the DOL-11 Game Cube to Game Boy Advance link cable. So yeah, expect some future updates on these πŸ™‚ I already drew schematics for the Full Changer as well as DOL-11. Didn’t find the muse to do CGB-005PD, yet.

I also finished the hardware for testing the MBCs, now I just need a decent software implementation for parsing some custom language to describe the data flow and I’m ready to test it. I plan to test MBC3 first to confirm pin-out/one missing pin I suspect is RAM_ENABLE, then move on to MBC30 to confirm its pin-out as well as several pins I’m not 100% sure of. The more exotic MBCs will have to be dealt with after that. I foresee some software changes along the way, so I do the easy ones first so software will hopefully be stabilized by the time I get to the more complex MBCs.

I also ordered a bunch of TAMA5 resp TAMA6. I’m somewhat hopeful though that the mask ROM can be read through the GEC, as the first RB of the game contains a bunch of calls to read and write some data. However, these could all be for the RTC :-/ Speaking of mask ROMs, the Full Changer has a MCU with custom mask ROM too, but I only have two of those and don’t feel like shelling out a lot of money to get more. Not sure how to extract the mask ROM anyway, as the only option open to me seems ghetto acid + USB cam style for now — or very expensive laboratory for which I’d have to ship the ICs halfway around the world.

Anyway, I guess this counts as an update πŸ™‚

GB Memory Cartridge

      1 Comment on GB Memory Cartridge

So I just finished reviewing the menu ROM of one of my carts (the other one is missing the G-MMC1 chip…) and as dreadfully expected, the stupid MX15002 (G-MMC1) is actually an SoC by Megachips (they call them LSI for I guess Large Scale Integration). So pretty much proprietary SoC/ASIP with proprietary software – great -_-”

GBMC Check Menu.

GBMC Check Menu.

So yeah, registers are mapped into ROM space. The menu cart has a little test program that can be activated by editing WRAM: set 0:C239 to 0xFF and 0:C000 to <>0x55. It will test the register map, start-up data (0xA8 0x00 0x00, which must somehow contain ROM bank/size, RAM bank/size, Mapper?), see if all mapped ROM banks can be accessed, see if single and double speed access are ok by checking the ROM check sum. If all checks are OK, it tries to boot the menu (which fails on emulators). I’ll cover the command sequences on the wiki when I find some free time to do so.

The menu comes in four different flavors: DMG, SGB, CGB, and an unused CGB + PocketPrinter flavor. SGB mode is DMG mode with better sound, CGB mode is colorful. Apparently, the menu would detect when the PocketPrinter was connected and show this background instead of the usual background. Code, graphics and tilemap are there, but it’s never used. Haven’t dug much into whether any PocketPrinter code is still present, but I looked at most of the code and nothing stood out too much…

So yeah, probably going to check next if the G-MMC1 will let me write to flash directly or if it will prevent that ;).

Small 2014 update

      Comments Off on Small 2014 update

So I’ve been somewhat busy tracking down some unconfirmed Gameboy cartridges from the no-intro set. Glad to say that right now only German PokΓ©mon Yellow is missing from German DMG games πŸ™‚ Have some other games in store I dumped and forgot about, but will commit them to DoM soon enough πŸ˜‰

Been somewhat busy today working on the VUE Cart Reader some more after I dumped my entire collection a few weeks ago. I just finished write support and the firmware is now complete — just missing some optimizations I’m not sure are worth it… The host app now has a Reader::bulk_read function instead of Reader::do_it3, too πŸ˜‰
That’s my first project using LUFA and libusb (blocking API, no firmware support for concurrent operations) and I have to say, it does take some time getting used to. libusb not so much as LUFA. I swear Dean Camera fucking loves his global variables -_-”
Well, just a little bit more polishing and I’m going to upload it here, schematics and all.

Speaking of schematics, I guess it’s time to upload those Game Boy and Virtual Boy cartridge schematics I had been talking about earlier. This will probably go into the wiki once I’m somewhat confident I triple-checked everything — already went over it twice and still found some signals that mysteriously vanished from revision to revision. Git sucks for binary files (which it detects Altium schematics to be…), so I’m kind of doing back to stone-age versioning of PDF files :-/

Well, I guess there hasn’t been going on much more, really.

Wonderswan Cartridges

      Comments Off on Wonderswan Cartridges


back from holidays. So I decided to finally open up my WonderSwan games (all nine of them) from back in the day in 2007. I used a Torx 6 (T6) screwdriver for the cartridges as well as the WonderSwan Crystal (which might actually be T7). The edge connector has 48 pins starting on the very left when the cartridge is upright, label facing out of the WonderSwan (the receptacle inside the SwanCrystal had numbers).

First thing I noticed was the complete lack of obvious ROM and cartridge codes. To my surprise, Bandai used OTP ROMs, which explains the lack of ROM version codes. No visible stamps (like for Nintendo revisions and presumably place of origin) on the cartridges either. There’s a sticker on the back of each PCB though, 8 arabic digits, no obvious pattern.

Codes seem to be SWJ-(developer)[C](game number; 2 or 3 digits)[game version].

I have developers BAN for BANDAI and SQR for SquareSoft. Optional C means Wonderstan Color. Arabic game number is somewhat self-explanatory. Optional alphanumeric game version, i.e. SWJ-BAN01C is Digimon Adventure Anode Tamer, SWJ-BAN01D is Digimon Adventure Cathode Tamer. Digimon Link System “Digital Partner” has two numbers, SWJ-BAN02C and SWJ-BAN02F. Some carts were apparently also numbered consecutively on their label, though only my Digimon carts feature this.

PCB codes aren’t much help either, as its seemingly only (PTE|PTS|WSS)-[0-9]{4}[A-Z]?. All my PTE carts have the Bandai 2001 controller, all my PTS carts have the Bandai 2003 controller. My single WSS cart has Bandai 2003, though it conspicuously lacks the “Bandai” text. Alphanumeric revisions, with no letter for initial and A (and presumably B, C, …) for following revisions.

Notably, Digimon Adventure 02 Tag Tamers is SWJ-BAN032 (my only 3-digit cart), does not have a WonderSwan Color/Crystal logo, yet features a PTS pcb.

I have the following PCBs

  • PTE-0016: beatmania for WonderSwan
  • PTE-0021C: WonderSwan Mainboard
  • PTE-0037
  • PTE-0037A
  • PTS-0108
  • PTS-0114: Digimon Link System Wireless Adapter PCB
  • PTS-0133
  • PTS-0133A
  • PTS-0148A: WonderSwan Crystal Mainboard
  • WSS-0003

So yeah, that’s it for now. Still working on the Virtual Boy dumper software tho πŸ˜‰ However, I already did order a “junk” WonderSwan Color from eBay for a spare edge connector receptacle, so I might build a dumper for this in the future. Kinda wish I had gone with a “universal” adapter style like the Retrode, so I could “just” transform my Virtual Boy dumper into a WonderSwan Dumper. Oh well…

EDIT: The junk WonderSwan arrived and I updated the PCB list above to include it. Also, luckily it was only considered junk because of appearance, not because it didn’t work πŸ™‚