mirror of
https://github.com/ekeeke/Genesis-Plus-GX.git
synced 2024-11-12 22:05:06 +01:00
75 lines
3.3 KiB
Plaintext
75 lines
3.3 KiB
Plaintext
|
|
REALTEC Cart Mapper - description v1 (2005.03.08)
|
|
|
|
by Tasco Deluxe [tascoDLX(AT)hotmail(DOT)com]
|
|
|
|
* Thanks to Mask Of Destiny for info about the boot state (from "The Earth Defend")
|
|
|
|
|
|
The REALTEC cart mapper is found in unlicensed Genesis/MegaDrive game carts produced by REALTEC.
|
|
Game carts known to utilize the mapper include "The Earth Defend", "Whac-A-Critter", and
|
|
"Funnyworld/Balloon Boy 2-in-1". They all contain common code used to display the REALTEC logo
|
|
and map a portion of the main ROM.
|
|
|
|
When the cart is powered on, 8KB of boot code is mapped by default into the cart's ROM area and
|
|
is mirrored throughout. This boot code is likely the last 8KB of the main ROM (all known carts
|
|
are 4 Mbit [512KB] w/ boot code at $07E000). The boot code, after displaying the REALTEC logo,
|
|
has the option to display a menu for game selection. After a selection is made, any neccessary
|
|
initializations are performed and a portion of the main ROM is mapped.
|
|
|
|
The code used to access the mapping registers is common amongst all known carts. A portion
|
|
of code is copied to RAM and executed. This code writes to the mapping registers based on a
|
|
selection number. Afterwards, the code clears the first 16 bytes of the I/O area ($A10000
|
|
thru $A1000F) and resets the M68000 manually (stack address is read from $000000, code address
|
|
is read from $000004).
|
|
|
|
The mapping is performed by writing to 3 mapped-in registers -- $400000, $402000, $404000.
|
|
Only one value is written per register. However, the same value is written 256 times in a row.
|
|
It is unknown whether this is because the registers explicitly require 256 writes, or because
|
|
the hardware is so crappy as to need multiple writes.
|
|
|
|
The register descriptions below are listed in the order they are commonly written.
|
|
All registers are byte-sized and only known to have write access.
|
|
|
|
* $402000 - Size of ROM range to map (in 1Mbit [128KB] blocks)
|
|
|
|
[maximum (theoretical) value of 32]
|
|
|
|
* $400000 - Bits of the ROM address (lower)
|
|
|
|
The bits (as written) are: ? ? ? ? ? c c c
|
|
|
|
* $404000 - Bits of the ROM address (upper)
|
|
|
|
The bits (as written) are: ? ? ? ? ? m m !
|
|
|
|
'?' is an unknown bit that is clear (in all known cases)
|
|
'!' is an unknown bit that is set (in all known cases)
|
|
|
|
From the above registers, the resulting ROM address (binary) is:
|
|
|
|
00mm ccc0 0000 0000 0000 0000
|
|
|
|
The common code in all REALTEC mapper carts sets the mapper values based on a selection number
|
|
(ROM address only -- the ROM size is fixed). The ROM addresses for these selections, numbered
|
|
1 thru 8, are:
|
|
|
|
1) $000000 [$00,$01]
|
|
2) $040000 [$02,$01]
|
|
3) $100000 [$00,$03]
|
|
4) $180000 [$04,$03]
|
|
5) $200000 [$00,$05]
|
|
6) $280000 [$04,$05]
|
|
7) $300000 [$00,$07]
|
|
8) $380000 [$04,$07]
|
|
|
|
The only cart known to use a selection other than #1 is "Funnyworld/Balloon Boy 2-in-1"
|
|
("Balloon Boy" is #1, "Funnyworld" is #2). It is assumed that the included code is merely a
|
|
suggestion and that any valid ROM address can be mapped.
|
|
|
|
A ROM range that is mapped, in order to function properly, must include a M68000 vector table
|
|
since the cart's entire ROM area is replaced by the mapped range. None of the known carts
|
|
attempt to remap a different ROM range after the boot code has executed. It is unknown whether
|
|
the mapper allows the boot code to be remapped, although it seems doubtful.
|
|
|