After something like 6 years (it's scary how time flies) I found the MiWi 2 cartridges lying about and wanted to get on with what I planned all those years ago or something and dumping them.
I've built a somewhat crude setup to do so, and am at least obtaining consistent dumps but unfortunately they won't run in EmuVT. Looking at the dumps a bit closer, the reset and interrupt vectors
appear in the right place for a OneBus ROM (0x7fffc for reset), and at least in the sports cartridge points to what starts off looking like valid code but then starts to go wrong. Strangely in the games cartridge it appears off by one.
Interestingly the code before the code pointed to the reset vector matches exactly what I found in a VT168 demo ROM. The string "WISE@DJJUNGLE.COM V1.0" appears 8 times (7 times plus the menu likely) in the sports ROM and 9 times in the games ROM, which again also appears in the VT168 demo ROM so may be included automatically by one of the VRTech tools rather than a credit per se - Wise Wang of Djjungle is also credited in EmuVT.
Also the string "BY S.MATSUOKA & S.IWATA" appears in the games ROM which I believe will be from one of the original NES games they ripped.
I do want to build a better dumping setup which I will hopefully have done in a couple of weeks which should rule out any possibility of bad dumps once and for all; but the strings and consistent results mean I think
that is fairly unlikely. It does appear that the VT168 has a small built in boot ROM so maybe they're doing some trickery in that.
The ROMs at present are linked below if anyone with wants to have a look - I would be interest to hear from anyone with more Famicom or OneBus dumping experience.
Sports: http://davidstech.net/games/miwi2/MiWi%202%20Sports%207%20in%201%20(VT168).7z (http://davidstech.net/games/miwi2/MiWi%202%20Sports%207%20in%201%20(VT168).7z)
Games: http://davidstech.net/games/miwi2/MiWi%202%2016%20Arcade%20Games%20+%20Drum%20Master%20(VT168).7z (http://davidstech.net/games/miwi2/MiWi%202%2016%20Arcade%20Games%20+%20Drum%20Master%20(VT168).7z)
I've also ordered a few bits from Taobao as this has somewhat reminded me of my interest in pirate and obscure games...[/quote]WHAT? IT EXISTS? PLEASE PLEASE PLEASE MAKE IT PLAYABLE ON GAME BOY ADVANCE PLEASE, THIS WAS MY BIGGEST DREAM 8D
I've had a bit more of a look at this and I fear there is some weird "protection" scheme going on. When bits 7 and 2 are swapped in each byte, the assembly code at the reset vector location now looks much more like a normal NES reset vector on both games. However, it's not just a case of a pinout issue or something as other parts of the ROM don't have this transformation applied, e.g. the reset vector address itself, the credits, and seemingly some of the executable code jumped to by the reset code. So it remains a mystery, if anyone's seen anything like this before I would be curious to know.
I will have a new universal dumping setup built in the new year just to doubly rule out any equipment issues on my end.
The VT168 specification states that in addition to the external program ROM, there are also 4 KiB of embedded ROM which could be for "BIOS, security". It appears in CPU address space at $3000-$3FFF.
Either way, since the VT168 is not NES-compatible, I don't think I will be able to add VT168 support to Nintendulator without turning the entire main program upside down.
EmuVT (https://archive.org/details/EmuVTVersion1_36) seems to have some kind of VT168 support, you can select it from the drop-down Options menu. However, when I tried running the Arcade rom it just misinterpreted it as a VT03 rom and then crashed. Perhaps this'll be a bit of a help in getting those working though?
I've been playing about with EmuVT a bit, I think the VT03 at the bottom is a red herring is it also displays that for a correctly running VT168 ROM (one of their supplied demos).
I think there's some weird security going on that's not emulated in EmuVT TBH. Probably as NewRisingSun2 mentions using the internal program ROM. Given the transformation is nothing more than switching bits around as far as I can tell it should be possible to patch these ROMs and get them to work unless there's something else missing, the problem with patching is working out what to patch - definitely some parts of the ROM are correct code and data and shouldn't be patched.
I cannot even get the VT168 demo ROM to run in EmuVT --- I only get sound, no picture.
It took a bit of fiddling but I did get it to work, from memory I had to set it to VT168, close and reopen it.
Back to the MiWi2, staring at bytes for a bit I think I might know what's going on - bits 7 and 2 are swapped in the opcode but not the operands in the 6502 code. Maybe this is some VT1682 "security" feature, it's certainly weird and doesn't seem to be emulated by EmuVT. I'll investigate further but if EmuVT doesn't support it I'm not sure what can be done really, patching all the 6502 code would be virtually intractable as knowing what is instruction and what is data is nigh impossible.
It turns out that I only have two VT168 ROM images (http://symphoniae.com/nrs/pgc/VT168.7z) besides the VT168 demo ROM --- the ones included in MAME's ROM list ---, and they are for the worst console ever made (https://youtu.be/K0-NdIcjmCE). I thought I had more, but the dreamGEAR My Arcade Portable Gaming System (DGUN-2561) and Lexibook Compact Cyber Arcade, which I had previously thought to be for VT168, actually seem to run on a VT09-compatible platform and use features that Nintendulator does not emulate yet.
Thanks! Both of the InterAct ROMs load in my emulator (although I still haven't sorted out all of the PPU issues yet, the 32-in-1 gives a purple screen) and use the same opcode scrambling as the MiWi2.
At the moment as well as fixing the PPU issues I need to work out how input works on these consoles - both the MiWi 2 and the InterAct seem to use the same system based on their writes to the IO registers, before I can move past the title screen...
You would not have any datasheets of the NES-compatible chips beyond the VT18, which is the latest one available on V.R. Technology's website? Their "Latest News" page indicates that the NES-compatible series goes up to VT32, so I suspect that is what DGUN-2561 and the Lexibook Compact Cyber Arcade use, but I cannot find any description of their registers.
It's certainly annoying that VRT stopped releasing documentation after the VT18/VT32.
I'm focussing this emulator more on the non-NES compatible series at the moment, after the VT168 I'll probably try and start reverse engineering the VT368, which is also undocumented. The last non-NES compatible chip that is documented is the VT268 I think but not on VRT's website only on lcis.com.tw, although I'm not sure whether any known systems use it. Maybe that does mean there's hope other datasheets will leak at some point. I also wonder what would happen if you contacted VRT, ideally under the guise of a company.
There must be one VT168/VT268/VT368/similar system with 512x480 graphics. I have seen a YouTube video (that I cannot find anymore, unfortunately) of a console with such resolution running a high-resolution hack of Chip & Dale and several Sachen games.
As for my two NES-compatible games of unknown hardware, given that the ROM images are 64 MiB in size, and the VT18 only addresses 32 MiB, I guess my next step should be to look out for another banking register. These two games are the first ones that I have encountered that set the CPU5M flag in register $411C, which has existed in the VT18 already. Basically what it does is speed up the CPU from the normal 1.79 MHz to 5.37 MHz, in other words, making the CPU run as fast as the PPU.
- NewRisingSun2
- Dec 18 2017, 06:11:18 PM
There must be one VT168/VT268/VT368/similar system with 512x480 graphics. I have seen a YouTube video (that I cannot find anymore, unfortunately) of a console with such resolution running a high-resolution hack of
Chip & Dale and several Sachen games.[/quote]I think you're talking about these games (https://www.youtube.com/watch?v=wl-esKKJ73M). I have a console loaded with these (not the one shown in the video), but for some stupid reason it plays in black-and-white on the majority of TVs. As you can see there's WAY more than just Sachen stuff, with hacks of Mario games, Pac-Man games, etc.
The VT268 programming guide (mirrored here (https://ds0.me/ds/VT268PG_EN_v100.pdf)) does explain some of these mysteries. I'm not sure about the VT368, as it's not publicly documented, but it can probably be assumed to be an enhanced VT268.
The VT268 does have some high resolution output support, supporting a 512x240 sprite layer AFAICS. This is done with minimal hardware tweaks by having two render paths for each half of the screen. Maybe the VT368 has even more support for high resolution output. Even on the VT268 it might be possible to exploit interlacing to get up to 512x480, maybe that's done badly for some reason explaining the B&W output.
In theory the VT268 only supports 128MBit (16MB) of ROM. This may be higher again on the VT368, or larger ROMs could be connected to the VT368 using GPIO to bank switch the upper address bits. Alternatively some systems use the "fake cartridge" method to switch between ROM banks.
The addressing system of the VT268 is also interesting because instead of the complicated address translation in the VT168, the 6502 CPU has been modified to allow 24-bit addressing directly from the CPU. This unfortunately is documented in a separate document that is not available, however I think it can be reverse engineered easily enough as EmuVT will disassemble all of the new instructions - and I believe it may be similar, at least to some extent, to the 65C816. For use in multicarts and for backwards compatibility with older 6502 code, the VT268 does also support applying a fixed offset to the address.
There are definitely VT268 systems in circulation as Cube Technology claim to have developed games for it.
Hopefully I'll be able to add this to my emulator once the VT168 stuff is working well enough. Then maybe it will be possible to reverse engineer the changes in the VT368 assuming it's not too different from the VT268 (or VT168).
I'm not familiar with the technicals of this stuff, but by "fake cartridges" do you mean those GBA-shaped things that have no guts inside them, but trigger games for the system they came with?
Oh, and if you're investigating this stuff you might wanna look into this console called the Lexibook 300-in-1. There seems to be a hidden SD card in the system with VT368, VT09 and regular NES ROMs stored on it. I opened the system up but its pretty deep in there, behind literal layers of screws and I didn't wanna break the console just to get out potentially nothing.
Yes, that's what I mean by fake cart.
The Lexibook console with ROMs inside sounds awesome, any chance you could send me the suspected VT368 ones? If not don't worry as I'll probably get one myself out of curiosity in the inevitable post Christmas sale on those sorts of things.
I think i may have heard of it. Why would they load roms on a microSD though? Lazy shortcut? Additionally, which console is this? Is it this one: https://www.amazon.co.uk/Lexibook-JG7800-300-Retro-Console/dp/B072F6ZWJP (https://www.amazon.co.uk/Lexibook-JG7800-300-Retro-Console/dp/B072F6ZWJP) ?
- davidstech
- Dec 19 2017, 06:50:47 PM
Yes, that's what I mean by fake cart.
The Lexibook console with ROMs inside sounds awesome, any chance you could send me the suspected VT368 ones? If not don't worry as I'll probably get one myself out of curiosity in the inevitable post Christmas sale on those sorts of things. [/quote]What I'm trying to say is I can't get the SD card out without potentially breaking the system, which I don't want to do as its a really nice lineup of games. I should also add the circuit board had text printed on it, and in addition to saying the operating system is VT368, there's a SD card marking on the back. But that's as much info as I can give.
- Quote:
-
I think i may have heard of it. Why would they load roms on a microSD though? Lazy shortcut? Additionally, which console is this? Is it this one: https://www.amazon.co.uk/Lexibook-JG7800-300-Retro-Console/dp/B072F6ZWJP (https://www.amazon.co.uk/Lexibook-JG7800-300-Retro-Console/dp/B072F6ZWJP) ?[/quote]Yes that's the console, but...that listing says it has an SD card, even though its hidden in the plastic...I guess the European version has it accessible? Mine came from a Toys R Us in the US, so I guess the American version hid it since it would undoubtedly be used to load NES games. It also was WAY cheaper; the UK version is $25 more. Weird.
No worries, I'll probably get one myself as it will would be a useful development platform for testing code if there are ever ambiguities as to what the hardware should be doing.
Although the listing mentions an SD card the Q&A after it says it doesn't have one so I'm not sure what's going on. Perhaps it was removed at the last minute.
It's also interesting - and helpful - that they silkscreened the part number onto the board as none of the systems I have had have that.
Assuming it can run NES and VT03 ROMs that raises interesting thoughts about the architecture of the VT368, and confirms speculation that unlike the VT168 and VT268 it is also backwards compatible with the NES, and must have a mode where NES style sound and video hardware are accessible in the right place.
Thought I'd make an update that I finally digged into the 300-in-1 thing and it does NOT have an SD card slot, just a marking of where one presumably was in development. I also got the operating number wrong (don't blame me, the text is tiny) - its VT389, something I didn't know even existed.
If its useful to anyone the full operating thing on the back says:
GB-N013-Key-VT389-1
REV:A2 2Z
2017.03.24
Wonder if GB means Game Boy. It looks nothing like Game Boy/Advance hardware, but considering all the insane stuff derived from NES hardware who knows.
If it's still apart, would you be OK posting some photos of the inside and what chips you can see?
- davidstech
- Jan 15 2018, 07:27:54 PM
If it's still apart, would you be OK posting some photos of the inside and what chips you can see? [/quote]Sorry, I already put it back; but there was literally nothing in there besides a globtop chip. There were plenty of small boards connected to the main one by wires (all of which had the exact same model number on them), but they were all for buttons and connectors (power, reset, video cables, power cord). In addition there was the deceiving marking of where an SD card would go, but with no electronics even near it.
The only other technical thing I noticed was on the system, the game select menu is a larger resolution then the games (can't tell if that's the special 512x480 resolution or not). But that's all the info I can give.
On a whim, I tried importing the MiWi Arcade Games ROM into Audacity as unsigned 8-bit audio to see if I could find any recognizable tunes, since that's worked for other Famiclone consoles with sampled audio. It looks like the audio clips are encoded at ~4200 Hz, and I can clearly recognize one of the menu themes (the one from the 16-in-1 menu screen with the electric piano arpeggios) at 0x56000, but it's very fuzzy and garbled.
Is there some kind of bitwise manipulation going on with the music as well? Several of the audio clips are surrounded by long strings of 0xEA bytes, which seems suspicious in that respect, but if so, I'm not sure what the correct transformation is. (Or am I possibly using the wrong codec entirely, despite unsigned 8-bit PCM producing an identifiable melody?)
Edit: Probably some kind of DPCM codec, most likely. Interpreting the audio as a Famicom DMC sample at ~34KHz, the melody is at the right pitch and even more clearly identifiable, but it's still scratchy.