MyArcade Cabinet Customization

From revRE Wiki
Revision as of 09:36, 20 February 2023 by Lucienmp (talk | contribs) (First page edit)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


General introduction

The DreamGear, now rebranded MyArcade, micro-player/mini-arcade/etc cabinets are a collection of NES game emulator toys. See The MyArcade Gaming web site

There are a number of MyArcade cabinets, the micro player only play a single title and the mini player play multiple-titles. At time of writing there were 14 different micro player cabinets which all boot to one game only, and two mini player cabinets which boot many titles from namco, or data east.

In reality some contain only one game title whilst others contain many but the power-on game title is determined by make/break pads inside the cabinet PCB.

These units also have a interchangeable no-button, one-button, and two-button game pad tray. This tray can be popped out with a little pressure.

Opening the Cabinet

The cabinet has a sticker left and right of the back of the cabinet. This sticker is best removed with a heat gun, or exacto blade down the seam, or alternatively puncture the screw heads. See below

<<PICTURE OF REMOVAL>>

Removing the Joypad

<<PICTURE HERE>>

Main Circuit board

The main board consists of an emulator chip-on-board ( aka Chip-On-Board or Glob/Blob-top​ ) , SPI flash chip of 8Mbits (1Mbyte), a PWM speaker driver, and an unknown ASIC.

Main Board Components
Silk Screen ID Chip Designation Description
chip-on-bard ASIC NES Emulator Chip
U2 SC662K-3.3V 3.3V LDO
U3 GD25Q80C / XT25F08B 8Mbit SPI Flash
Q1 S8550 PNP (2TY)
U7 NO-MARKING PWM FB1/FB2 back buttons
U8 ST3157 PWM SOUND Switch


The chip-on-board ASIC, is something like the VT03, which is a complete NES emulator. It includes a 6502 CPU, PPU Graphic Unit with LCD output, SPU Sound Unit, two internal 2KBytes SRAMs, SPI, and some General Purpose I/O controller.  It also contains a unique mapper that allows for mapping upto 1MB, maybe more into the small 65KB memory space.

The GPIO comes out to the various joystick and game buttons.  Whilst the SPI is used to house various games that are mapped into the 6502 CPU's upper memory region $8000-$FFFF.  By selecting the mapping address its possible to load any number of games from the flash.

<mapping graphic>

Dumping the ROM

The SPI ROM cannot have a programmer attached, and the ROM must be disconnected from the +V rail in order to run or boot. Cutting the track and inserting a switch to toggle on the 5V rail works.

Model SPI ROM Part # ROM SHA256 Games Contained
Mappy XT25F08B d0a9ae89205fa078564a4fd6dc778cdcfc045386755e549f1110d7f5b5b4bf02 Mappy, Pacman, Rolling Thunder, Galaga, Galaxian
Bubble Bobble GD25Q08C-SIG (Datasheet) 0136a88ae8a7bee3a2cbcc196a33a4c284291be18050debb90fa73faef740f5a Bubble Bobble


Useful for checking NES images are the CHR rom editors such as NES Sprite Editor. The CHR ROM are hard to spot visually but do have a tendency to contain 00s and "3" characters because of the way the planar data is recorded

A deeper discussion for graphics can be seen at DustMop.io

The TILE and SQUARE mapping can be seen NES FAQ

IOB in Mappy Cabinet

<<PICTURE HERE>> 

MSB... LSB
   IOB2 -- furthest from chip
   IOB3
   IOB1 -- closest to chip (overlap to legs area)

    000 - Rolling Thunder
    001 - PacMan
    010 - Galaga
    011 - Galaxian
    100 - Mappy
    101 - DigDug
    110 - Mappy
    111 - Rolling Thunder

Monitoring SPI Bus

SPI protocol discussion;

- MOSI, multi-drop << WAVEFORM and wiring >>

- QUAD mode << WAVEFORM inc. E7h command >>

- Reason for decoder in python is size of data likely to be seen; not trying to make generic SPI but specific reader


<WAVEFORM PICTURE>

  - 100MHZ? FIXME

  - sample E7h command + continuous read mode


NOTES;

  • Multiple accesses to same memory location, appears to have zero caching
  • Other random low-memory accesses to 0x0000 - 0x1FFF
  • Accesses are WORD aligned so access to read 0x00F1 means 0x00F0 gets read, then 0x00F2

Decoding the SPI for a simple boot session can look like the following, part way through.

 line# 14110198 READ:* 0x7effe(mode=0xa5): 0xf120
 line# 14110212 READ:* 0x7effe(mode=0xa5): 0xf120
 line# 14110226 READ:* 0x7effe(mode=0xa5): 0xf120
 line# 14110240 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110254 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110268 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110282 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110296 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110310 READ:* 0x7f000(mode=0xa5): 0x0df1
 line# 14110408 READ:* 0x7f10c(mode=0xa5): 0x608a
 line# 14110422 READ:* 0x7f10c(mode=0xa5): 0x608a
 line# 14110436 READ:* 0x7f10c(mode=0xa5): 0x608a

This fits perfectly with the ROM disassembly for this memory location, assuming 0x7_E000 is mapped to m6502 CPU memory at 0xE000.

ROM:EFF4 09 04                                   ORA     #4
ROM:EFF6 8D 4B 41                                STA     byte_414B
ROM:EFF9 20 0D F1                                JSR     xsub_F10D_Delay
ROM:EFFC 20 0D F1                                JSR     xsub_F10D_Delay
ROM:EFFF 20 0D F1                                JSR     xsub_F10D_Delay <--- here
ROM:F002 20 0D F1                                JSR     xsub_F10D_Delay
ROM:F005 20 0D F1                                JSR     xsub_F10D_Delay
ROM:F008 60                                      RTS
ROM:F008                         ; End of function xsub_EF83_CART_DoSomething

ROM:F10C 60                                      RTS
ROM:F10D                         xsub_F10D_Delay:
ROM:F10D 8A                                      TXA


The above method was very useful in working out that the System-Test feature used 0x6_3000 for its CHR memory.

SPI 1MB Flash layout

The cabinet starts up with at first accesses to SPI at 0x1000, repeating until around XXXms. This then starts the MOS 6502 which defaults to SPI address 0x7_XXXX. The MOS 6502 RESET vector can be seen as the first read at SPI address 0x7_FFFC and then of course instruction reads happen from the address read from 0x7_FFFC.

The code at 0x7_XXXX ~ 0x7_FFFF is a custom NES Emulator ASIC initialization routine setting various custom values.

  • In the case of the bubble bobble cabinet, it copies code to low RAM and this remaps the SPI to 0x?_???? then jumps to that ROM reset vector starting Bubble Bobble
  • In the case of the Mappy/XX/YY/ZZ cabinet, it reads IOB pad values, copies code to low RAM which maps 1-of-6 titles, and this remaps the SPI to 0x?_???? then jumps to that ROM reset vector starting Bubble Bobble

Bubble Bobble Cabinet ROM

0_0000 PRG: Bubble Bobble Game

7_B000 Game Entry Table

7_C000 Initial Reset Handler Code

Mappy Cabinet ROM

0_0000 PRG: "BANK0" string, per Rolling Thunder	 	(ROLLING THUNDER : 8000-9FFF)
0_2000 PRG:                              		 	(ROLLING THUNDER : A000-BFFF)

0_4000 ???:                              			(ROLLING THUNDER : [ Title Screen texts here ] ) 
0_8000 ???: "BANK2" string, per Rolling Thunder		...
0_A000 ???: More data								...
0_C000 ???: "BANK3" string, per Rolling Thunder		...
0_E000 ???: More data
1_0000 ???: More data
1_2000 ???: More data
1_4000 ???: More data
1_6000 ???: More data
1_8000 ???: More data
1_A000 ???: More data								...
1_A000 ???: More data								(ROLLING THUNDER : Unknown data)

1_C000 PRG: ROLLING THUNDER (B000-DFFF)
1_E000 PRG: ROLLING THUNDER (E000-FFFF)

2_0000 CHR: Rolling Thunder
2_2000 CHR: Rolling Thunder
2_4000 CHR: Rolling Thunder
2_6000 CHR: Rolling Thunder
2_8000 CHR: Rolling Thunder
2_A000 CHR: Rolling Thunder
2_C000 CHR: Rolling Thunder
2_E000 CHR: Rolling Thunder
3_0000 CHR: Rolling Thunder
3_2000 CHR: Rolling Thunder
3_4000 CHR: Rolling Thunder
3_6000 CHR: Rolling Thunder
3_8000 CHR: Rolling Thunder
3_A000 CHR: Rolling Thunder
3_C000 CHR: Rolling Thunder
3_E000 CHR: Rolling Thunder

4_0000 PRG: PACMAN
4_2000 PRG: PACMAN
4_4000 CHR: PACMAN

4_6000 CHR: MAPPY
4_8000 PRG: MAPPY
4_A000 PRG: MAPPY

4_C000 PRG: DIGDUG
4_E000 PRG: DIGDUG
5_0000 CHR: DIGDUG

5_2000 CHR: GALAGA
5_4000 PRG: GALAGA?????
5_6000 PRG: GALAGA?????

5_8000 PRG: GALAXIAN
5_A000 PRG: GALAXIAN
5_C000 CHR: GALAXIAN  (Weird: Contains strings "MISSION" "DESTROY" "CONVOY" "CHARGER" "READY" "PAUSE" "START" "GALAXIA" )

5_E000 FF..FF..FF..
6_0000 CHR: "4in1" / "PAC-MAN" / "FROGGER" / ???? title names
6_2000 CHR: "4in1" and "380in1" / FONTS / ASTEROID / QBERT / PAC-MAN / ICONS for Qbert/PAC-MAN
6_4000 CHR: "GAMES LIST" / "ENGLiSH/JAPANESE"

7_0000 PRG:  Not sure what this applicaiton is, but its a program; mapped to 0x8000
7_2000 ???:	 Not sure (Up to 7_54D0)

7_5800 ???:  Some data

7_A000 ???:  Some table	
7_A400 ???:  Some other table


7_B000 Game Image Mapper Table (See below)

7_C000 Inital boot rom
			00: 06 <number of games in cabinet> ....
			10: ZERO terminated list of game names
		
7_F000 Initial boot rom (exec at 7_FFFC as reset vector)

8_0000 FF FF ...
F_FFFF FF FF

Mapping NES Cartridge to SPI Memory

If the ROM is 1 page then it maps to 0xF000, if its two then 0xE000, and so on until 0x8000.

After this the FIRST two pages map to 0x8000 and 0xA0000 respectfully, and the LAST two pages map to

0xC000, and 0xE000

<< Rollercoster thingy ROM example >>

<< PICTURE side by side .... >> 

 * NES expects
 *    0x8000 = PAGE0 : Your Code
 *    0xA000 = PAGE1 : Your Code
 *    0xC000 = PAGE2 : Your Code
 *    0xE000 = PAGE3 : Code + Reset Vectors
 *      0xFFF4 COP
 *      0xFFF6 N/A
 *      0xFFF8 ABORT
 *      0xFFFA NMI
 *      0xFFFC RESET
 *      0xFFFE IRQ/BRK

Controlling the Mapping

Discussion of the MMC, best left to the NESDEV wiki however the

and then discussion of the table at 7_B000.

At reset the ASIC mapps 0x8000-0xAFFF to RAM.

And 0xB000-0xFFFF to SPI Flash at 7_B000-7_FFFF.

In the Mappy/Pacman/Digdug/Galaga/Galaxian/Rolling Thunder cabinet

this section is a rom switcher.  It will setup the ASIC correctly,

then  will jump to the right game based on IOB shorting.

In BubbleBobble its just a system setup program, and will only jump to the game.

All cabinets also support UP-JOY + SELECT for a test mode.

<TEST MODE PICTURE>

https://cdn.discordapp.com/attachments/256806938774339584/634803550710661150/20191019_022217.jpg

IOB are read ($4147??) and this is used to select entry from table.

These are loaded into the MMC and the system is restarted.

Initial Reset Code, and Game Table Format

At reset the 0x7_B000 ~ 0x7_FFFF is mapped into the m6502 memory space and the RESET vector is taken. The Mappy and bubble bobble cabinet have similar reset handler code. It looks at the IOB values, uses this with a Game Table at 0x7_B000 to program the mapper and then boot that mapped game cartridge code.

The values from the Game Table are 9 bytes long and represent mapper registers that will be loaded for that game.

Example Table Entry
	ROM TABLE $B000
		ROM:B000 00       .BYTE   0               ; CHR Bank MSB; Always 0
		ROM:B001 00       .BYTE   0               ; CHR Bank Mid; 0 / $10 / $20
		ROM:B002 81       .BYTE $81               ; CHR Bank LSB; 
		ROM:B003 02       .BYTE   2               ; MMC mapper (2,4: Four ROM Banks or 5: Two Rom Banks )
		ROM:B004 00       .BYTE   0               ; PRG Bank0 x 2
		ROM:B005 01       .BYTE   1               ; PRG Bank1 x 2
		ROM:B006 0E       .BYTE  $E               ; PRG Bank2 x 2
		ROM:B007 0F       .BYTE  $F               ; PRG Bank3 x 2
		ROM:B008 00       .BYTE   0               ; Mirrored / Vertical - A000h


All Entries for Mappy Cabinet

	RT ROM:B000 00 00 81 02 00 01 0E 0F+                struc_RomTable <0, $00, $81 20 10, 2, $00, $01, $0E, $0F, 0>
	PM ROM:B009 00 00 10 16 05 20 21 20+                struc_RomTable <0, $10, $16  5  2, 5, $20, $21, $20, $21, 1>
	MA ROM:B012 21 01 00 10 1E 05 24 25+                struc_RomTable <0, $10, $1E  7  3, 5, $24, $25, $24, $25, 0>
	DD ROM:B01B 24 25 00 00 10 46 05 26+                struc_RomTable <0, $10, $46 11  8, 5, $26, $27, $26, $27, 1>
	GL ROM:B024 27 26 27 01 00 10 4E 05+                struc_RomTable <0, $10, $4E 13  9, 5, $2A, $2B, $2A, $2B, 1>
	GA ROM:B02D 2A 2B 2A 2B 01 00 10 76+                struc_RomTable <0, $10, $76 1D  E, 5, $2C, $2D, $2C, $2D, 1>

So calculating the CHR/PRG mapping for the Mappy cabinet looks something like the following

	Case ($201A & 0x07) => Video Mode and affects MASK value.
		 Normal Video Modes:   ($4100&0x0F)<<21+($2018&0x70)<<14+(($201A&0xF8)|(VBANK&0x07))<<10 
		 Enhanced Video Modes: ($4100&0x0F)<<21+(($201A&0xF8&MASK)|(VBANK&0x07))<<13+EVA<<10
									76543210
	ROLLING  CHR> 2_0000		81	10000001	10000 001	10	1	0x10 * 0x2000 -> 2_0000
	PACMAN   CHR> 4_4000		16	00010110	00010 110	 2	6	0x02 * 0x2000 -> 0_4000
	MAPPY    CHR> 4_6000		1E  00011110	00011 110	 3	6	0x03 * 0x2000 -> 0_6000
	DigDug   CHR> 5_0000		46  01000110	01000 110	 8	6	0x08 * 0x2000 -> 1_0000
	GALAGA   CHR> 5_2000		4E  01001110	01001 110	 9	6	0x09 * 0x2000 -> 1_2000
	GALAXIAN CHR> 5_C000 		76  01110110	01110 110	 E	6	0x0E * 0x2000 -> 1_C000

MyArcade Custom Mapper Registers

   $4100,  Program Bank1, Video Bank2                   PA[24:21]VA[24:21]
   $2018,  Video Bank1 register, BKPAGE, Video RW Bank  X|VA[20:18]|BKPAGE|VRWB[2:0]                   
			Write $00/10/20 ( Intermediate CHR Bank number; PPU $0000-$1FFF: Selected by register $2018 bits 4-6 (VA18-20). )
   $201A,  Video Bank0 register6, Video Bank0 selector  RV6[7:3]VB0S[2:0]
   $410B,  MMC mapper (2,4: Four ROM Banks or 5: Two Rom Banks )
   $4107,  PRG ROM Bank0: $8000 or $8000
   $4108,  PRG ROM Bank1: $A000 .. $C000
   $4109,  PRG ROM Bank2: $C000    $8000
   $410A,  PRG ROM Bank3: $E000    $C000
   $A000


MyArcade Custom Register Map

    $2010/2011  / 2018

    $4105    SEEN: Bubblebobble
    $410B    SEEN: Bubblebobble
    
    $4144    SEEN: Bubblebobble
    $4146    SEEN: Bubblebobble
    
    $4147,  IOB/GPIO
    
    $4148    SEEN: Bubblebobble
    $414A    SEEN: Bubblebobble
    $414C    SEEN: Bubblebobble
    $414E    SEEN: Bubblebobble
   
    $414F    SEEN: Bubblebobble
    
    $4155    SEEN: Bubblebobble
    $4157    SEEN: Bubblebobble
    $415A    SEEN: Bubblebobble
    $415B    SEEN: Bubblebobble
    
    $41E4    SEEN: Bubblebobble
    $41E6    SEEN: Bubblebobble
    $41E8    SEEN: Bubblebobble

https://problemkaputt.de/everynes.htm#mapper4mmc3prg8kvrom2k1kntsramirq
    $8000 / 8001 :

Applications and Tools

Hex Dump NES Application

  • https://github.com/lucienmp-nes/NesHexDumpTool


Other Cabinet stuff

* https://wrongbaud.github.io/MK-Teardown/

* https://boards.dingoonity.org/other-game-systems/identify-myarcade-pacman-pocket-player-hardware/

RANDOM LINKS

Very close to the "Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ" Or : Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ

http://wiki.nesdev.com/w/index.php/Programming_mappers http://wiki.nesdev.com/w/index.php/Mapper

Retrieved from "https://wiki.digitalartisans.org/index.php?title=MyArcade_Cabinet_Customization&oldid=6"