Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- REALTEC Cart Mapper - description v1 (2005.03.08)
- by Tasco Deluxe [tascoDLX(AT)hotmail(DOT)com]
- * Thanks to Mask Of Destiny for info about the boot state (from "The Earth Defend")
- The REALTEC cart mapper is found in unlicensed Genesis/MegaDrive game carts produced by REALTEC.
- Game carts known to utilize the mapper include "The Earth Defend", "Whac-A-Critter", and
- "Funnyworld/Balloon Boy 2-in-1". They all contain common code used to display the REALTEC logo
- and map a portion of the main ROM.
- When the cart is powered on, 8KB of boot code is mapped by default into the cart's ROM area and
- is mirrored throughout. This boot code is likely the last 8KB of the main ROM (all known carts
- are 4 Mbit [512KB] w/ boot code at $07E000). The boot code, after displaying the REALTEC logo,
- has the option to display a menu for game selection. After a selection is made, any neccessary
- initializations are performed and a portion of the main ROM is mapped.
- The code used to access the mapping registers is common amongst all known carts. A portion
- of code is copied to RAM and executed. This code writes to the mapping registers based on a
- selection number. Afterwards, the code clears the first 16 bytes of the I/O area ($A10000
- thru $A1000F) and resets the M68000 manually (stack address is read from $000000, code address
- is read from $000004).
- The mapping is performed by writing to 3 mapped-in registers -- $400000, $402000, $404000.
- Only one value is written per register. However, the same value is written 256 times in a row.
- It is unknown whether this is because the registers explicitly require 256 writes, or because
- the hardware is so crappy as to need multiple writes.
- The register descriptions below are listed in the order they are commonly written.
- All registers are byte-sized and only known to have write access.
- * $402000 - Size of ROM range to map (in 1Mbit [128KB] blocks)
- [maximum (theoretical) value of 32]
- * $400000 - Bits of the ROM address (lower)
- The bits (as written) are: ? ? ? ? ? c c c
- * $404000 - Bits of the ROM address (upper)
- The bits (as written) are: ? ? ? ? ? m m !
- '?' is an unknown bit that is clear (in all known cases)
- '!' is an unknown bit that is set (in all known cases)
- From the above registers, the resulting ROM address (binary) is:
- 00mm ccc0 0000 0000 0000 0000
- The common code in all REALTEC mapper carts sets the mapper values based on a selection number
- (ROM address only -- the ROM size is fixed). The ROM addresses for these selections, numbered
- 1 thru 8, are:
- 1) $000000 [$00,$01]
- 2) $040000 [$02,$01]
- 3) $100000 [$00,$03]
- 4) $180000 [$04,$03]
- 5) $200000 [$00,$05]
- 6) $280000 [$04,$05]
- 7) $300000 [$00,$07]
- 8) $380000 [$04,$07]
- The only cart known to use a selection other than #1 is "Funnyworld/Balloon Boy 2-in-1"
- ("Balloon Boy" is #1, "Funnyworld" is #2). It is assumed that the included code is merely a
- suggestion and that any valid ROM address can be mapped.
- A ROM range that is mapped, in order to function properly, must include a M68000 vector table
- since the cart's entire ROM area is replaced by the mapped range. None of the known carts
- attempt to remap a different ROM range after the boot code has executed. It is unknown whether
- the mapper allows the boot code to be remapped, although it seems doubtful.
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement