Author Topic: MiWi2 (VT168) Dumping Attempt  (Read 6218 times)

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« on: September 28, 2017, 07:00:37 AM »
After something like 6 years (it's scary how time flies) I found the MiWi 2 cartridges lying about and wanted to get on with what I planned all those years ago or something and dumping them.

I've built a somewhat crude setup to do so, and am at least obtaining consistent dumps but unfortunately they won't run in EmuVT. Looking at the dumps a bit closer, the reset and interrupt vectors
appear in the right place for a OneBus ROM (0x7fffc for reset), and at least in the sports cartridge points to what starts off looking like valid code but then starts to go wrong. Strangely in the games cartridge it appears off by one.

Interestingly the code before the code pointed to the reset vector matches exactly what I found in a VT168 demo ROM. The string "WISE@DJJUNGLE.COM V1.0" appears 8 times (7 times plus the menu likely) in the sports ROM and 9 times in the games ROM, which again also appears in the VT168 demo ROM so may be included automatically by one of the VRTech tools rather than a credit per se - Wise Wang of Djjungle is also credited in EmuVT.

Also the string "BY S.MATSUOKA & S.IWATA" appears in the games ROM which I believe will be from one of the original NES games they ripped.

I do want to build a better dumping setup which I will hopefully have done in a couple of weeks which should rule out any possibility of bad dumps once and for all; but the strings and consistent results mean I think
that is fairly unlikely. It does appear that the VT168 has a small built in boot ROM so maybe they're doing some trickery in that.

The ROMs at present are linked below if anyone with wants to have a look - I would be interest to hear from anyone with more Famicom or OneBus dumping experience.

Sports: http://davidstech.net/games/miwi2/MiWi%202%20Sports%207%20in%201%20(VT168).7z
Games: http://davidstech.net/games/miwi2/MiWi%202%2016%20Arcade%20Games%20+%20Drum%20Master%20(VT168).7z

I've also ordered a few bits from Taobao as this has somewhat reminded me of my interest in pirate and obscure games...

kelvin donna

  • Sr. Member
  • ****
  • Posts: 447
  • Company Name: Satervest
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #1 on: September 28, 2017, 09:35:18 AM »
davidstech
Sep 28 2017, 07:00:37 AM
After something like 6 years (it's scary how time flies) I found the MiWi 2 cartridges lying about and wanted to get on with what I planned all those years ago or something and dumping them.

I've built a somewhat crude setup to do so, and am at least obtaining consistent dumps but unfortunately they won't run in EmuVT. Looking at the dumps a bit closer, the reset and interrupt vectors
appear in the right place for a OneBus ROM (0x7fffc for reset), and at least in the sports cartridge points to what starts off looking like valid code but then starts to go wrong. Strangely in the games cartridge it appears off by one.

Interestingly the code before the code pointed to the reset vector matches exactly what I found in a VT168 demo ROM. The string "WISE@DJJUNGLE.COM V1.0" appears 8 times (7 times plus the menu likely) in the sports ROM and 9 times in the games ROM, which again also appears in the VT168 demo ROM so may be included automatically by one of the VRTech tools rather than a credit per se - Wise Wang of Djjungle is also credited in EmuVT.

Also the string "BY S.MATSUOKA & S.IWATA" appears in the games ROM which I believe will be from one of the original NES games they ripped.

I do want to build a better dumping setup which I will hopefully have done in a couple of weeks which should rule out any possibility of bad dumps once and for all; but the strings and consistent results mean I think
that is fairly unlikely. It does appear that the VT168 has a small built in boot ROM so maybe they're doing some trickery in that.

The ROMs at present are linked below if anyone with wants to have a look - I would be interest to hear from anyone with more Famicom or OneBus dumping experience.

Sports: http://davidstech.net/games/miwi2/MiWi%202%20Sports%207%20in%201%20(VT168).7z
Games: http://davidstech.net/games/miwi2/MiWi%202%2016%20Arcade%20Games%20+%20Drum%20Master%20(VT168).7z

I've also ordered a few bits from Taobao as this has somewhat reminded me of my interest in pirate and obscure games...[/quote]WHAT? IT EXISTS? PLEASE PLEASE PLEASE MAKE IT PLAYABLE ON GAME BOY ADVANCE PLEASE, THIS WAS MY BIGGEST DREAM  8D
« Last Edit: September 28, 2017, 12:05:22 PM by kelvin donna »
Profile Picture changed, due to severe trust issues.

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #2 on: December 09, 2017, 06:41:12 AM »
I've had a bit more of a look at this and I fear there is some weird "protection" scheme going on. When bits 7 and 2 are swapped in each byte, the assembly code at the reset vector location now looks much more like a normal NES reset vector on both games. However, it's not just a case of a pinout issue or something as other parts of the ROM don't have this transformation applied, e.g. the reset vector address itself, the credits, and seemingly some of the executable code jumped to by the reset code. So it remains a mystery, if anyone's seen anything like this before I would be curious to know.

 I will have a new universal dumping setup built in the new year just to doubly rule out any equipment issues on my end.
« Last Edit: December 09, 2017, 06:53:37 AM by davidstech »

NewRisingSun

  • Sr. Member
  • ****
  • Posts: 272
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #3 on: December 09, 2017, 10:30:30 AM »
The VT168 specification states that in addition to the external program ROM, there are also 4 KiB of embedded ROM which could be for "BIOS, security". It appears in CPU address space at $3000-$3FFF.

Either way, since the VT168 is not NES-compatible, I don't think I will be able to add VT168 support to Nintendulator without turning the entire main program upside down.

Linkrulezall

  • Sr. Member
  • ****
  • Posts: 302
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #4 on: December 09, 2017, 01:28:31 PM »
EmuVT seems to have some kind of VT168 support, you can select it from the drop-down Options menu. However, when I tried running the Arcade rom it just misinterpreted it as a VT03 rom and then crashed. Perhaps this'll be a bit of a help in getting those working though?

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #5 on: December 09, 2017, 02:46:59 PM »
I've been playing about with EmuVT a bit, I think the VT03 at the bottom is a red herring is it also displays that for a correctly running VT168 ROM (one of their supplied demos).

I think there's some weird security going on that's not emulated in EmuVT TBH. Probably as NewRisingSun2 mentions using the internal program ROM. Given the transformation is nothing more than switching bits around as far as I can tell it should be possible to patch these ROMs and get them to work unless there's something else missing, the problem with patching is working out what to patch - definitely some parts of the ROM are correct code and data and shouldn't be patched.

NewRisingSun

  • Sr. Member
  • ****
  • Posts: 272
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #6 on: December 09, 2017, 03:26:32 PM »
I cannot even get the VT168 demo ROM to run in EmuVT --- I only get sound, no picture.

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #7 on: December 14, 2017, 08:15:30 AM »
It took a bit of fiddling but I did get it to work, from memory I had to set it to VT168, close and reopen it.

Back to the MiWi2, staring at bytes for a bit I think I might know what's going on - bits 7 and 2 are swapped in the opcode but not the operands in the 6502 code. Maybe this is some VT1682 "security" feature, it's certainly weird and doesn't seem to be emulated by EmuVT. I'll investigate further but if EmuVT doesn't support it I'm not sure what can be done really, patching all the 6502 code would be virtually intractable as knowing what is instruction and what is data is nigh impossible.

NewRisingSun

  • Sr. Member
  • ****
  • Posts: 272
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #8 on: December 18, 2017, 12:59:30 PM »
It turns out that I only have two VT168 ROM images besides the VT168 demo ROM --- the ones included in MAME's ROM list ---, and they are for the worst console ever made. I thought I had more, but the dreamGEAR My Arcade Portable Gaming System (DGUN-2561) and Lexibook Compact Cyber Arcade, which I had previously thought to be for VT168, actually seem to run on a VT09-compatible platform and use features that Nintendulator does not emulate yet.

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #9 on: December 18, 2017, 01:11:02 PM »
Thanks! Both of the InterAct ROMs load in my emulator (although I still haven't sorted out all of the PPU issues yet, the 32-in-1 gives a purple screen) and use the same opcode scrambling as the MiWi2.

At the moment as well as fixing the PPU issues I need to work out how input works on these consoles - both the MiWi 2 and the InterAct seem to use the same system based on their writes to the IO registers, before I can move past the title screen...
« Last Edit: December 18, 2017, 01:11:20 PM by davidstech »

NewRisingSun

  • Sr. Member
  • ****
  • Posts: 272
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #10 on: December 18, 2017, 01:16:54 PM »
You would not have any datasheets of the NES-compatible chips beyond the VT18, which is the latest one available on V.R. Technology's website? Their "Latest News" page indicates that the NES-compatible series goes up to VT32, so I suspect that is what DGUN-2561 and the Lexibook Compact Cyber Arcade use, but I cannot find any description of their registers.

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #11 on: December 18, 2017, 01:37:37 PM »
It's certainly annoying that VRT stopped releasing documentation after the VT18/VT32.

I'm focussing this emulator more on the non-NES compatible series at the moment, after the VT168 I'll probably try and start reverse engineering the VT368, which is also undocumented. The last non-NES compatible chip that is documented is the VT268 I think but not on VRT's website only on lcis.com.tw, although I'm not sure whether any known systems use it. Maybe that does mean there's hope other datasheets will leak at some point. I also wonder what would happen if you contacted VRT, ideally under the guise of a company.

NewRisingSun

  • Sr. Member
  • ****
  • Posts: 272
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #12 on: December 18, 2017, 06:11:18 PM »
There must be one VT168/VT268/VT368/similar system with 512x480 graphics. I have seen a YouTube video (that I cannot find anymore, unfortunately) of a console with such resolution running a high-resolution hack of Chip & Dale and several Sachen games.

As for my two NES-compatible games of unknown hardware, given that the ROM images are 64 MiB in size, and the VT18 only addresses 32 MiB, I guess my next step should be to look out for another banking register. These two games are the first ones that I have encountered that set the CPU5M flag in register $411C, which has existed in the VT18 already. Basically what it does is speed up the CPU from the normal 1.79 MHz to 5.37 MHz, in other words, making the CPU run as fast as the PPU.

forgotusername

  • Full Member
  • ***
  • Posts: 108
    • View Profile
MiWi2 (VT168) Dumping Attempt
« Reply #13 on: December 18, 2017, 06:46:52 PM »
NewRisingSun2
Dec 18 2017, 06:11:18 PM
There must be one VT168/VT268/VT368/similar system with 512x480 graphics. I have seen a YouTube video (that I cannot find anymore, unfortunately) of a console with such resolution running a high-resolution hack of Chip & Dale and several Sachen games.[/quote]I think you're talking about these games. I have a console loaded with these (not the one shown in the video), but for some stupid reason it plays in black-and-white on the majority of TVs. As you can see there's WAY more than just Sachen stuff, with hacks of Mario games, Pac-Man games, etc.

davidstech

  • Full Member
  • ***
  • Posts: 140
    • View Profile
    • http://ds0.me
MiWi2 (VT168) Dumping Attempt
« Reply #14 on: December 19, 2017, 05:58:38 AM »
The VT268 programming guide (mirrored here) does explain some of these mysteries. I'm not sure about the VT368, as it's not publicly documented, but it can probably be assumed to be an enhanced VT268.

The VT268 does have some high resolution output support, supporting a 512x240 sprite layer AFAICS. This is done with minimal hardware tweaks by having two render paths for each half of the screen. Maybe the VT368 has even more support for high resolution output. Even on the VT268 it might be possible to exploit interlacing to get up to 512x480, maybe that's done badly for some reason explaining the B&W output.

In theory the VT268 only supports 128MBit (16MB) of ROM. This may be higher again on the VT368, or larger ROMs could be connected to the VT368 using GPIO to bank switch the upper address bits. Alternatively some systems use the "fake cartridge" method to switch between ROM banks.

The addressing system of the VT268 is also interesting because instead of the complicated address translation in the VT168, the 6502 CPU has been modified to allow 24-bit addressing directly from the CPU. This unfortunately is documented in a separate document that is not available, however I think it can be reverse engineered easily enough as EmuVT will disassemble all of the new instructions - and I believe it may be similar, at least to some extent, to the 65C816. For use in multicarts and for backwards compatibility with older 6502 code, the VT268 does also support applying a fixed offset to the address.

There are definitely VT268 systems in circulation as Cube Technology claim to have developed games for it.

Hopefully I'll be able to add this to my emulator once the VT168 stuff is working well enough. Then maybe it will be possible to reverse engineer the changes in the VT368 assuming it's not too different from the VT268 (or VT168).