6/22/2023 0 Comments Sms plus game genie![]() I suspect this is just left-over mess.This is an Sega Master System/Game Gear Emulator. There is a lot of left-over debugging code (and large chunks of the 1.3 BIOS) in the PAR ROM, including a function in the upper 16KB which seems like it cannot work. Why does the game write the value being "searched for" in training mode to address $0068? This is just after the reti (not retn.) it has in ROM, but it seems to serve no purpose? Maybe it's some left-over debugging code? It seems the low ROM interrupt handler may be involved.Ģ. Maybe the PAL injects the instruction onto the bus, but how can it know where it is aligned to? The upper 16KB is mostly filled with $31, which doesn't seem helpful (it'd decode as ld sp, $3131), and anyway the program counter might be at a higher address. How does the "return to PAR menu" pause button interception work? Presumably it enables the PAR ROM/RAM and then causes a jump to offset $0000, but I can't see how. There are only a few things left outstanding:ġ. Out Run road drawing) will apply the cheats many times per frame. ![]() This generated code is pretty efficient - it runs faster when fewer codes are entered, especially as games with many horizontal interrupts (e.g. The jump back to $0035 then swaps back the game ROM and execution continues at $0038 for the original game. This means interrupt handling is subverted by the code at $4038 in the PAR ROM, which jumps to this generated code. Presumably the PAL then switches from game to PAR memory mode (the same as a write to $6000) when execution reaches $0038. When loading the game, the PAR enables the upper 16KB ROM bank before booting the game. repeat these two lines for each code entered :D But I think its operation is fairly straightforward. Some day when we have enough SMS PARs that we don't know what to do with them, the PAL can be removed and dumped. There is probably some extra junk to handle not triggering a patch when the PAR ROM is enabled, etc. RAM locations are patched and control is returned to the game. The PAL detects an interrupt and enables the PAR ROM (much like a reset did) so that the code at $0038 is executed. The PAL enables the cartridge ROM and the PAR program, relocated to RAM, jumps to the cartridge ROM entry point. PAR program allows the user to enter codes which are stored in the 8K SRAM, then starts the game by setting flip-flop #1. This makes the PAL enable the on-board ROM instead of the cartridge ROM on the pass-through connector. Power-up, /reset asserted, flip flop #1 reset. I would bet it works something like this: The two chips on the bottom are a 74HC74 (can't quite read the logic family, maybe HCT) and a PALCE20V8H PAL which just implements user-programmed glue logic. All the other PARs (and GameGenies) use a ASIC to implement the patching functionality. I don't have a scanner unfortunately so you'll have to make do with my crappy pictures. I would really need to see a decent scan of the PAR PCB and/or look at a disassembly of the PAR ROM though. Depending on the modchip, they either overdrive the data lines(contending with the ROM chip) or pull !CE(or !OE) high(contending with the CPU) and put the patch value on the data lines. That's basically how many modern "modchips" work for consoles like PS2 when they need to "patch" the BIOS ROM. Or if the device's drivers are too strong, the PAR could simply drive !RD high to block the device from ever seeing the read and the PAR could output the patch value on the data lines without contention. As long as the PAR's output drivers are stronger than those of the addressed device(RAM chip) it would work just fine. Using ChaSMS's trainer, I can see that it's very fast, although there's plenty of room for improvement with it.ĭo you have any evidence that RAM patching is done by Z80 instructions? I'm wondering if the PAR simply "overdrives" the bus data lines with the patch value when it detects access to a matching address on the address lines. You can apparently concatenate the Mega Drive Sonic & Knuckles with a child cart and it works, but I doubt it'd work here. You'll need some method of loading the cheat cart and the rom. I don't know if the PAR allows you train without resetting every time. Shunting the training through the emulated Z80 would be slower - I think it takes a couple of seconds to scan all the memory locations.Ĥ. The actual devices only support 3 or 4 codes at once.ģ. There's three mean-looking chips in my (GB) PAR, probably only one of which is a rom.Ģ. They must have custom hardware in there, based on how I think they work. I can see a few problems with trying to fully emulate the cartridges.ġ. > I'd love to support the real thing, so games could be trained on an emulator.ĭ232BBBB54246DA1,Action Replay,VER=1.02,Mapper=6 > Does anyone know if the ROMs for either device have been dumped? Now I can add GG code handling to SMS Plus.
0 Comments
Leave a Reply. |