Gameboy Camera Force Trippy H

Here is something I have been working on for a few days now and only got a little bit of progress. But progress is progress and this really helps me understand gameboy debugging.

Analyzed the WRAM addresses for any and all changes that occur when you press buttons, select particular cursor locations and of course: when you enter DJ mode (Trippy H).

After hours and hours, I found that WRAM $D5CE is the game mode byte, or at least that's what I call it. This byte is changed directly before switching between dancing mario, menu, view, shoot and trippy H (as well as the other menus and modes).
1:D5CE 00 w
The first instance was when you press a button while mario dances. I restarted the emu and pressed A. The code broke and stopped at $74AC where there was an "LD A, $00"
Has someone done this before?

Dance = 19, menu = 00, shoot = 01, DJ = 1F, view = 02, play - 07, etc.

After learning this, I set an access break when the byte 00 is written to $D5CE

I replaced this with "LD A, $1F" and restarted again.

This time when you press a button at dancing mario, Trippy H starts!

----------------------------------------------------------------------------------------------------------------

Next update I would like to stop the cart from checking if the camera is present. This will allow the ROM to be put onto a normal flash cart. 

2nd future update would be to remove unnecessary routines like "shoot  " and "view" hopefully the ROM itself can be reduced in size. Potentially an MBC1 + SRAM + BATTERY

3rd future update I would like to break the ROM even more and remove saving altogether so that it can be safely put on a 64M cart along with LSDJ or a dedicated ROM only cart.

Miracle Piano Final Thougts

I finally had time to probe a few pins inside the Miracle Piano.

AS0012 - Pin 21 (PWM)
It turns out this pin controls the master volume and NOT the envelope as I had originally assumed.
Turning on the keyboard, this pin defaults to about 50%, but as you can see, it is not exactly 50%. How odd.
When the volume is reduced, the pulse width is widened and when the volume is increased, the pulse width is reduced. That is because the integrator, U4A is inverting the output.

Each photo has the scope set to 10 microseconds per division:

Default Volume:



Highest Volume:



Lowest volume:



U4 - Pin 1
This pin goes to the LM13700 to control the master volume, or gain of the sound. It appears as a DC voltage and is remarkably solid. There is no visible ripple as would be expected from an integrator.
No photo is needed of this signal.

J004 - Pins 21-24 (OUT1-OUT4)
The signals from these pins are too small to view on my scope, so I chose the amplified versions from U10. Pins 1, 8, 7 and 14 respectively.

OUT1 is not active for all sound samples, apparently. When Harpsichord and Synthesizer are selected, nothing comes out at all.
When the other four sounds are selected however, the waveform is perfectly clear.

OUT2 is the opposite. Only when Harpsichord and Synth are selected, do we see any activity on this pin.

OUT3 mimics OUT1 exactly, or at least as far as I can tell.

OUT4 on the other hand does not seem to react to any button or key. It simply outputs a DC voltage which measures 5.03v at pin 14 of U10.

I can speculate as to why there are three OUT pins. While probing both Pins 8 and 14 of U4 which has the mixed and filtered outputs split to both left and right output terminals, the waveforms are identical for Harpsichord and Synthesizer but are not identical for the other four sounds. It would seem that Harpsichord and Synthesizer were recorded and digitized in mono while the other four sounds were recorded and digitized in stereo.

I am a little saddened that the envelope is not broken out to any specific pin or sub-circuit.

Some other Notes

J004 - Pin 40 (Bus Strobe)
This pin reacts differently for different sounds, however, when the key is pressed with a sound that has an attack and release; the pin will strobe for the full length of the sound and go to 0 when the note is finished.
For a sound that ends only when the key is released, the pin strobes at key press for a moment, then goes to 0 and strobes once again when the note is released.

I could use this pin for creating a gate and trigger, but it would require that I charge a capacitor then feed it through a comparator and set up some logic to keep the signal high when the key is pressed and low when the key is released. This wouldn't require too much effort, but the function would change from sample to sample since the envelopes are all different. I don't thin the modification is worth it in this case.

"Piano" sample is very hard to photograph since the amplitude changes so rapidly in software. It looks very similar to "Organ, but is more rounded whereas the Organ is more triangular.


"Organ:"



This photo shows a sample that is identical on both sound channels. Trust me, they are identical but the channels are not being displayed the same way.


These two photos show sounds that are not identical from OUT1 and OUT2.



PS: Yes, the reflection in my oscope is naked. Deal with it.

Fun with the Sega Genesis - Ultimate Portable Game player

Found a crazy deal on fleabay for one of these and had to have it. I had heard stories of how badly they are made, and how miserable the audio is.
All very true, but I think it can be improved a little.

The video is great, the size a too small, the sound from the speaker is crap but the sound from the headphone could be worse.
I immediately took it apart after opening the box. I was THRILLED to see only one epoxy-chip and several SOP's! :D

I want to believe that the audio issue is because of the amp/filter they have used. Through headphones, it sounds ok, but also a little clipped and shallow. This could also be because of the power supply, which is very weak. The battery is 3.7v and droops when the PSG is loud.




Its like a portable MP3 player considering all the titles that have sound tests. :p
You know, except horrible sounding.

Do not stay at the Guest Quarters Hotels - Dumping The Miracle Piano Teaching System

I had my Willem programmer pulled out for some Sega Genesis programming stuff and decided to finally dump the eprom inside of the Miracle Piano teaching System Keyboard. If you recall from a previous post of mine, it contained a 27c256 OTP eprom. It also contained many proprietary ICs of which I may never figure out. We may never know what microcontroller they used or what language the machine code is suppose to be written in. z80, 6502, etc.

In any case; with many vintage computers and other devices containing ROM, the authors always find the space to sign and date their work and in rare cases they may even decide to add a little easter egg. Although I cannot locate a date, here is some clear text I found in the ROM image:

"This Eprom contains code created by Mike Collins. Anne Graham and Ray Livingston. Do not stay at the Guest Quarters Hotels. Keep that Coke classic and that Piping hot coffee coming."



I got a real kick out of reading that. For anyone who knows what to do with it, here is the binary file:
http://www.mediafire.com/download/eo3zujca7jvw44f/MPTS_ROM.zip

Repairing an LCD Monitor

I am damn cheap, and this isn't the first time I have gotten a broken monitor to use as my own. By broken, I do not mean that the LCD is cracked, but that it comes on and goes off immediately. Some even went black and had a buzzing noise. More often than not, this means some capacitors on the power board are swollen or popped. This is just a detailing of one monitor in particular, but the method is nearly identical to other modern screens. The other problem that could occur seems less common, so I will not cover it here. The less common problem is the wires connecting to the CCLF tubes coming loose.

Step 1. Open the screen.
Unplug the monitor and press the power button a few times to (mostly) discharge any good capacitors.
Find all of the screws that are visible including VGA/DVI mounting screws and remove them, keeping a good idea of which holes they came from.

Now pry apart the plastic shell carefully. I use an expansion slot cover found on the back of a PC because they are wider than a screwdriver and leave less cosmetic damage (if any at all). Once you have the plastic bevel popped all around the edges, place the screen on your surface area, or lap, face down and lift the plastic off the back. This may not be the exact way for all monitors, but it has been for the last four I repaired.

Step 2. Take note of the orientation of the wires leading from the metal shielding. THese connecto to the high voltage CCFL tubes and may or may not be polarized. Don't screw this up! Take a photo if it helps.



Remove the metal shielding from the power and logic boards. Be very careful of any ribbon cables.
You should find the power board which is suspect.



Step 3. Inspect the power board. If you find swollen capacitors, you probably found the culprit. In our case, there are two swollen capacitors. From my experience, they normally go out in pairs, but I cannot prove that. Can you see the two fatties?




Step 4. Replace the capacitors with a "good" brand. Nichicon is my favorite. Make sure that the Farads are matched exactly and that the voltage is either the same or higher. Higher is better in this case, but normally the caps become larger with a higher voltage tolerance.



Step 5. Put it back together and power it up. ta-da! Although this is not 100% to work for you, it is a common problem and an easy fix. Good luck and good modding.

-Jordan

 ps. The monitor in this example was the Westinghouse L1975NW. I replaced two 220uF 25v capacitors with two 220uF 35v capacitors.
I also repaired an Acer x193w+ with new caps and some other Acer I no longer have.
One time I found that a Dell E2K-SE198WFPF(B) by reconnecting the CCFL tube with its wire which was difficult and apparently dangerous. To do so I had to disassemble the screen itself, LCD, polarizing film, and other layers just to get at the tubes...which were well encased in rubber. It was very difficult and I don't think that I would attempt it again.

Jazz Disassemblies Ep4: N64 Gameboy Adapter Teardown

Some time ago, I needed the shell and cartridge connector of the gameboy adapter for the Nintendo 64, but I never throw things away. In light of this, I decided to de solder all of the components and write up a pinout diagram of the internal CPU itself.

This CPU is an 80-pin SMT IC just like the Original Gameboy, gameboy pocket and super gameboy however I am sure that it is more similar to the gamboy Color's CPU because of the abilities.

During my time desoldering everything, I forgot to record what components were so I no longer have that information. I would not have known some of the tiny transistor-like components anyhow because they had no markings.

In any case, I just want to share some photos with close ups of the traces and also the pin diagram.
Check it out:









I feel like I cheated on this dissassembly, because I have so little information. Sorry about that, I will just have to make the next one twice as in depth.

Jazz Disassemblies Ep3: Sega Genesis Saving Teardown

I love the Sega Genesis, but rarely do anything with it. I have made a handful of reproduction carts in the past because there is nothing better than playing games on real hardware but I always have a regret after destroying a donor cartridge, whether it is sports or not. One of the goals I always set myself up with during a creating is to use 100% renewable components. By renewable, I mean of course modern and commercially produced components; nothing salvaged and nothing obsolete. Having nothing obsolete is very difficult in my circle of interests, but salvaging components is my greatest downfall.

During my journeys into the technologies that Sega and other companies used within the cartridges for the Sega Genesis/MegaDrive, I have found three official forms of saving data. Two forms use serial EEPROMs and the third uses the tried-and-true parallel SRAM with battery backup. My goal is to recreate these cartridges using new components and my stretch goal is to expand the addressable memory or just to improve them in some way while making the carts themselves renewable.

We already know that the plastic shells can be remade by the everyday hobbyist and their 3D printers and circuit boards can be fabricated by Chinese companies for pennies on the dollar. All that leave now is the components which are definitely on their way out of style. The components that we are looking for are 8- and 16-bit, parallel ROMs and RAMs. Referring to a statement above: by renewable I meant purchasable from Mouser or Digikey, etc in large quantities which will later be restored. Glancing at Mouser (My supplier of choice) I have already been able to locate a handful of ROMs and RAMs that come in both selectable 8- and 16-bit configurations!

The next goal I will have is to recreate the higher density logic with PLDs, but that is best left for another time.

1. KM62256 Parallel SRAM

These boards found in most of the miserable football and soccer games. Until I find another varient, I will cover one such board revision: "171-6279A"

The board seems to be made by Sega though I have long lost the ROM which was originally soldered in. It contains:

1x (CE) 47uF electrolytic capacitor
5x (C1-C5) .1uF ceramic capacitors
1x (BAT) CR2032 coin-cell battery
1x (IC1) 42-pin Mask ROM (27c160 equivalent) - 16Mbit
1x (IC2) KM62256BPL-7L, 32Kx8 bit (32Kbyte) Low Power CMOS Static RAM
1x (IC3) BA6162, Reset IC with battery backup function by Rohm
2x (IC4, IC5) 74HC00AP, Quad two-input NAND gate

I have already recreated everything on the board in Eagle PCB libraries including the board dimensions and general component layout. Tracing all of the connections is slower work and I will get to that eventually. In the meantime, my goal is to layout a functionally-identical board with 3v3 ROM/RAM, SMT caps and level shifters for proper data flow. THen we will have ourselves a flash cartridge!









Above you have seen the board itself with and without components. Ignore the text on the Mask ROM though since I just stuck a random IC in there to show it with one.

Looks pretty good if I do say so myself, though the traces are not as authentic as the layout. Sega never seemed to use top-side pads. They have vias which allow for double sided boards, but I have only seen EA cartridges that use top-side pads. These pads of course make for miserable desoldering since I need much more heat... and patience.

Some fun facts about this board is that the ROM is 16-bits but the SRAM is only 8-bit. Although I do not have the full details on how the software accesses these, the Gen/MD has two pins which are called !LDSW and !UDSW (Upper Data Set Write and Lower Data Set Write). When reading from RAM, the processor ignores the upper byte of data since there should be nothing there. While writing though, the !LDSW pin goes low which enables the !WE pin on our RAM. These two pins are for transferring 8-bits (one byte) at a time rather than 16 (two bytes).Not knowing how to activate either of these pins, it would seem that someone may add a second SRAM and use the currently unused !UDSW pin as the enable.




The above picture is how I found the glue logic for addressing our memories. Only 6 out of 8 gates are used which is a waste of space and battery power since the unused pins are connected to the Vout pin on our reset IC. If you think about it, the three NAND gates that have both inputs connected act as NOT gates which is something we would take into consideration if we were to redesign this with single-gate SMT ICs or on a PLD.

one problem I have with this board is that A21 and A22 are simply left hanging. Just a guess, but using A20 as a ROm address and A21 in the logic would expand the addressable memory, but Sega chose not to for some reason.

2. Acclaim Serial 24LC02B RAM

The next board I will cover is the P/N 670120 REV 2 by Acclaim. The contents of our board are as follow:

1x (C1) 47uF electrolytic capacitor
4x (C2-C5) 0.1uF ceramic capacitors
2x (R1, R2) 4.7K Ohm resistors
1x (U1) Mask ROM (capacity not yet known)
1x (U2) 74ALS138N, 1-of-8 decoder/demultiplexer
1x (U3) 74ALS74AN, Dual D-type flip-flop with set and reset
1x (U4) 74ALS125AN, Quad TRI-STATE Buffer
1x (U5) 24LC02B, I2C™ Serial EEPROM (2K capacity)

As you can see, the naming routines is different than that of Sega and yet again, we could reduce the chip count to much less with a PLD. U2-U4 could easily be designed in a PLD to reduce space and cost. For the time being, I assume the resistors are pull-ups or pull-downs.








3. Acclaim Serial 24LC04B RAM w/ LZ95A53

You're probably thinking that I recycled this board from a previous post and yes, yes I have. It does pertain to the topic though and I can probably shed a little more light on the special IC now that I know more about !LDSW and serial eeproms.

Anyhow, this board contains:

1x (C1) 47uF electrolytic capacitor
4x (C2-C5) 0.1uF ceramic capacitors
1x (R1) 10K Ohm resistor
2x (U1, U2) Mask ROMs (27c160 equivalents)
1x (U3) Acclaim LZ95A53 (memory mapper, glue logic, serial data interpreter, etc)
1x (U4) 24LC04B, I2C™ Serial EEPROM (4K capacity)

Above is the board that I created by probing all of the traces. Looks nice, but my next goal would be to reverse engineer the Acclaim's LZ95A53. Unfortunately, I have no scope to do so...



The above picture is my schematic which shows the connections on the LZ95A53. I had to make an addition to my cartridge connector since it uses several different pins that very few others use. I believe that the Acclaim's LZ95A53 IC contains the same logic as the board which used the 24lc02 serial RAM. Again, I cannot test this theory.




In hindsight, all of these boards used 27c160 equivalent Mask ROMs. The 27c160 can store a 2MB ROM which means the board with 2 Mask ROMs had a 4MB game. A piece of information for those making reproduction carts with the 27c400, 800, 160 and 322's, the first three mentioned all have a !BYTE pin. This pin allows for the EPROM to function as either an 8-bit or 16-bit ROM which means you may use it in many different systems.

Besides a little bit of work on the silkscreens, these boards are all ready to send to any fab house, granted they make 1.6mm thick boards. I will also be adding some more pictures of the other two boards shortly. Thanks for reading.

Jazz Disassemblies Ep1: Fun with Flippy Floppy Files

This week we have yet another yard sale treasure to gut and explore. Brought to you by Yamaha, I have found a short lived piece of equipment called the Midi data Filer 3, or MDF3. This particular handheld brick accepts live MIDI input and allows for the user to record it for later use on the new, innovative and wonderfully compact data storage called the 3.5" floppy diskette!

Yes folks, you and your friends will spend hours filing and sharing live sequences for years and years to come...The MDF3:



Just a few other facts before we tear it up: this device offers not only MIDI filing Utilities, but also a formatting, copying and back-up of floppies containing any sort of files. Unfortunately, it cannot be used as an external drive for a computer. (Or so says this ASM noob) As for the internals, it looks like we have an 8-bit z180 uProcessor, 128Kbits RAM, Floppy Drive Controller IC, 4Mbits ROM, graphic LCD module, keypad input and various other components.



According to the z180 datasheet, we can only support up to 1Mbit ROM. So...why would Yamaha choose to purchase an (IMO obscure) 4Mbit Mask ROM to store the ASM program? Are they using a highly complex bank mapping setup or are they simply costing the end user more money on a larger capacity chip? Lets have a look at the ROM's socket after desoldering it from the board:



lolwat!? "1M-EPROM"...I think not. The M534001E is definitely not 1M or an ordinary EPROM. Also, pin 1 is labeled as NC or Not connected in the datasheet but is obviously pulled high on the board. What on earth were they thinking? While probing a few other pins, A18 and A17 which are the high address bits seem to be pulled high as well! So to answer my previous question, yes, Yamaha seems to have wasted the extra space...a lot of extra space.

My biggest concern now is how to dump the data. I own a crappy Willem EPROM Programmer which cause everyone issues and I also only have Windows 7 64-bit which only supports high addressed LPT ports! That is another story for another time though; needless to say, I have it working. The Willem software does not have an M534-something-blah ROM option, so I will have to trick it into thinking it contains another chip. According to the datasheet, the pinout is rather common so I am able to tell my computer that I am dumping the 27C040 EPROM.

After attempting a few dumps and receiving verifying errors, I looked back at the datasheets and remembered a previously noted pin...pin 1. Pin 1 is not supposed to be connected with the Mask ROM, but happens to be the Vpp pin on a 27C040. This pin is going to be used on the 040 but is entirely static with the Mask ROM, so finally I figured out that I should simply bend pin 1 up... Dump and verify are a success (and a couple more times just to be sure) ;)

And Here she is: Yamaha MDF3

With Hex data, sometimes headers and other data being sent to an LCD module for example are clear text. It appears that "Copyright (C) 1997 by YAMAHA V1.20.MDF3" is clearly visible at the beginning of the program. Maybe there are other versions out there, or maybe they recycled the program from the MDF2 considering the fact that the Mask ROM says 1997 and 1998...hmmm...Another thing to notice is that I included two files. One is the full 512Kbyte ROM and the other is a cut down version because Yamaha repeated the same code four times, once in each of the 128Kbyte banks to fill it up.



There is more clear text such as the button names, but you can have a look yourself if you're interested. Lets move on to the other hardware inside. Again, there is an LCD and keypad as well as a floppy drive. Looking at the floppy drive, it clearly states 1999 so I assume the code was recycled yet another year! Did they simply improve the external look of the MDF1 and 2? Anyhow, I believe the keypad will be a wonderful example when I design my own 8 or 16 bit computer. As for the LCD, you can all expect to see an update with it backlit.



Now lets take a look at the whole board itself. What I love most about this computer is that it is mostly surface mounted components in SSOP packages and a few DIP's here and there. Many of these parts could have been much smaller, but that wouldn't have made for such an interesting write-up if none of them could be read! I also can share my appreciation for the board designer(s) because there are no components retro fit on the back of the board, such as filter capacitors as we have seen so often in other devices (like last week)...Also, who doesn't love a battery powered 8-bit computer? ;) So here it is, please click to enlarge and enjoy my side-notes:

Jazz Disassemblies Ep0: Me, Myself and the 8-bit Computer

Episode 0: Me, myself and the 8-bit computer

In both the video game and chiptune/modding scenes I am known me as Jazz or Jazzmarazz, but few know me by my real name; Jordan Appleton-Joslin. This past December, I finally graduated from Central Michigan University with a Bachelors of Science in Information Tech with a minor in Industrial Tech. Studying computer technology through the eyes of your everyday "end-user" simply didn't cut it. From very early on I was overly fascinated with electronics and what makes them work; while never being satisfied with just using them. I quickly finished Uni's requirements to graduate with IT and picked up a huge number of EE classes to fill in the rest of the gaps.

For as long as I remember the Nintendo and Atari took up the largest part of my childhood; playing games and pumping the audio through my father's stereo with unknowingly sketchy and possibly reckless hand-coiled wiring. While my brother tooled around with his walkman, I carried my gameboy listening to the sound files available through option menus. Naturally I found my way into the chip/mod crowd for future-learning-endeavors and old time's sake.

Each week following today will be accompanied by a dis-assembly of some sort. I plan to accept any and all gizmos and gadgets in the name of science! So please send your 70's, 80's and even early 90's crap so that I may break it down and tell you a little more about what makes it tick and or how it may be used for chip-relevant pursuits!

If you have something which piques your interest but cannot find a use, please contact me; broken or otherwise, so please hit up them yard sales and thrift stores!  :D

Now that you know all about me and myself, lets move on to the main attraction. As today's special guest, I have not chosen a gameboy, C64 or Sinclair something or other...but today you will all learn about the Compumate2 from Laser! Originally purchased at an estate sale after the death of the prior owner, this wonderful device was thought to be the one and only Compumate2 for the Atari 2600; however, it is not. I sat this aside for several years once I found out that it was nothing more than a miserable PDA from the 80's.



Full QWERTY keyboard and 7 functions and I was still rather peeved having just obtained an Atari after many long years. Recently though, I had become very interested in the Zilog z80 and Intel 8085. For several weeks, I worked on building my very own 8-bit computer based on the 8085 and even though it was much more powerful; I still wanted to work with the z80. The z80 as some of you may know is what powers each and everyone of your gameboys. Sure, it has many proprietary modifications to interface with the link port, LCD and button input; but it is still a z80 at heart.

So I tore into the PDA not looking for anything fun, but looking for components to scrap. To my surprise, I found not only a z80 micro Processor, but 256Kbit ROM, 64kbit RAM, 2 x 20 LCD and possibility for external programs to be written all running on 4xAA's! Not a whole lot has been shared about this device and even less is known about the external ROM slot, but know this: I will eventually find out how to run a custom program on it. See below that there is a 34 pin connection at one side of the board. Also note the RAM chip being socketed. Laser must have had plans to expand the RAM at one point, but up to what capacity?



Also notice that the sides have empty ports for expansion. The labels read: Line, Phone, Cassette and Expansion I/O. There seems to be limited room inside to fit many more components, but looking at pictures of the Compumate3 which itself is incredibly rare, I found that the I/O port at least was fitted with a midi/game type connection. Could there have been plans to release games for use with commercial PC controllers of that generation? There is no information on any carts being released to support a sure answer. In any case, the computer is equipped with a speaker for simple 1 bit beeps to signal an error or process completion, so why not write a simple 1-channel tracker once the code is analyzed?


If you looked closely at the external ROM connector, it is nothing more than a 2 x 17 DIP connection....exactly that of a floppy drive cable used in last year's PC! Following the pins back to their origins, I find that the ROM slot is directly interfaced with the Address and data buses, but what else...34 pins and only 24 D/A pins...I guess you'll have to wait for the second installment! xP

Thanks for tuning in!

Cheers,
Jazz

p.s. I am including the hex dump and (hopefully reliable) disassembly of the internal ROM as well as various pinouts that I traced with my multimeter:
Compumate2 ROM (BIN)
Various Pinouts (TXT) (Best to be viewed in word pad rather than your browser.)
Use these only for good! ;)