REALTEC Cart Mapper - description v1 (2005.03.08)

by Tasco Deluxe [tascoDLX(AT)hotmail(DOT)com]

* Thanks to Mask Of Destiny for info about the boot state (from "The Earth Defend")


The REALTEC cart mapper is found in unlicensed Genesis/MegaDrive game carts produced by REALTEC.
Game carts known to utilize the mapper include "The Earth Defend", "Whac-A-Critter", and
"Funnyworld/Balloon Boy 2-in-1".  They all contain common code used to display the REALTEC logo
and map a portion of the main ROM.

When the cart is powered on, 8KB of boot code is mapped by default into the cart's ROM area and
is mirrored throughout.  This boot code is likely the last 8KB of the main ROM (all known carts
are 4 Mbit [512KB] w/ boot code at $07E000).  The boot code, after displaying the REALTEC logo,
has the option to display a menu for game selection.  After a selection is made, any neccessary
initializations are performed and a portion of the main ROM is mapped.

The code used to access the mapping registers is common amongst all known carts.  A portion
of code is copied to RAM and executed.  This code writes to the mapping registers based on a
selection number.  Afterwards, the code clears the first 16 bytes of the I/O area ($A10000
thru $A1000F) and resets the M68000 manually (stack address is read from $000000, code address
is read from $000004).

The mapping is performed by writing to 3 mapped-in registers -- $400000, $402000, $404000.
Only one value is written per register.  However, the same value is written 256 times in a row.
It is unknown whether this is because the registers explicitly require 256 writes, or because
the hardware is so crappy as to need multiple writes.

The register descriptions below are listed in the order they are commonly written.
All registers are byte-sized and only known to have write access.

* $402000 - Size of ROM range to map (in 1Mbit [128KB] blocks)

[maximum (theoretical) value of 32]

* $400000 - Bits of the ROM address (lower)

The bits (as written) are:  ? ? ? ? ? c c c

* $404000 - Bits of the ROM address (upper)

The bits (as written) are:  ? ? ? ? ? m m !

'?' is an unknown bit that is clear (in all known cases)
'!' is an unknown bit that is set (in all known cases)

From the above registers, the resulting ROM address (binary) is:

00mm ccc0 0000 0000 0000 0000

The common code in all REALTEC mapper carts sets the mapper values based on a selection number
(ROM address only -- the ROM size is fixed).  The ROM addresses for these selections, numbered
1 thru 8, are:

1) $000000 [$00,$01]
2) $040000 [$02,$01]
3) $100000 [$00,$03]
4) $180000 [$04,$03]
5) $200000 [$00,$05]
6) $280000 [$04,$05]
7) $300000 [$00,$07]
8) $380000 [$04,$07]

The only cart known to use a selection other than #1 is "Funnyworld/Balloon Boy 2-in-1"
("Balloon Boy" is #1, "Funnyworld" is #2).  It is assumed that the included code is merely a
suggestion and that any valid ROM address can be mapped.

A ROM range that is mapped, in order to function properly, must include a M68000 vector table
since the cart's entire ROM area is replaced by the mapped range.  None of the known carts
attempt to remap a different ROM range after the boot code has executed.  It is unknown whether
the mapper allows the boot code to be remapped, although it seems doubtful.