Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Region changing in hardware

Reply to topic
Author Message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Region changing in hardware
Post Posted: Thu Jun 20, 2019 10:39 am
I was trying to replicate the region changing method that Tim's FM board uses. That works by looking for a IO write to port $3F and then pulling the JyDs pin high, which disables the IO chip and hopefully prevents it seeing the write, so the TH pin never changes state.

I didn't have much luck getting that to work well and apparently it doesn't work on around 20% of systems with the FM board as well. The timing of this seems to be very critical so i looked at other ways around it.

I thought about letting the CPU write to port $3F happen, then using the bus request pin to halt the CPU, which would free up the bus. Then i could externally write to port $3F with a micro and change TH back to 0 or 1 before freeing up the bus again and letting the CPU continue. That should work quite well but it got a little involved for my liking.

The other way i thought about doing this was to look at the OP code being read by the CPU during the M1 cycle. D3 is an OUT command and the next read after that is the port being written to. Using that i could then disable the IO chip (with the JyDs pin as above) before the CPU even starts the write process, avoiding all of the timing issues i faced earlier.

I had a crack at doing it the Op Code way with programmable logic and managed to get it going. It was a bit of trial and error and i had to get a new logic analyzer with more channels to be able to watch what was happening but it seems to work ok. I ended up making a small program that wrote to $3F in a loop and also made a little controller port breakout board with some LEDs on it for TH and TR so i could see if the pins were changing state. I also made a breakout board for the cart port to make hooking the logic analyzer up easy. The board directly under the cart is the bit doing the work.

Ive since tested this with a couple of games, both with and without FM sound and it seems fine.
Capture.PNG (134.92 KB)
Capture.PNG
20190620_223218.jpg (277.4 KB)
20190620_223218.jpg
20190620_223307.jpg (139.33 KB)
20190620_223307.jpg
20190620_223314.jpg (316.67 KB)
20190620_223314.jpg

  View user's profile Send private message
  • Joined: 05 Sep 2013
  • Posts: 3763
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Fri Jun 21, 2019 1:32 pm
Wow, so cool! :D
BTW you're using a very old Test Suite mate ;)
  View user's profile Send private message Visit poster's website
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Fri Jun 21, 2019 10:33 pm
sverx wrote
BTW you're using a very old Test Suite mate ;)


Yea.. itll be rather old, it just happened to be on my everdrive lol. The region checking bit was all i was really interested in.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Sun Sep 19, 2021 8:08 am
holy crap lol
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Mon Sep 20, 2021 4:48 am
Just looking at this

https://www.smspower.org/Development/RegionChanging

And thinking of a simpler method.

I wanted to run this by you:

Could you float pin 34 of the IO controller off the board, like lift it.

Tie that to an IO of a logic chip like an arduino digital pin.

Tie the trace of pin 34, or wherever the trace leads, to another IO pin

Then you could have jap mode = turn on master system with pause button pressed

So just have the arduino check for logic low on boot up across the pause circuit, and if it's low on boot up just tell the duino to pull IO pin 34 low for a certain amount of time to fail the check and after that just have it constantly loop and check the pins state and pass that state across back to the original trace ...like reconnecting it (pin34) to the board

Otherwise, if booted up without pause held, skip the pulling low and just pass the state through like the leg was never disconnected - I assume nano @ 8mhz would be fast enough in a simple loop like that?
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Mon Sep 20, 2021 6:56 am
The TH pins on the IO chip are bidirectional and only really go to the controller ports, so theres not really anything to "disconnect" as such.

You need to think of it like its an input thats also connected to a seperate output which is tri state. So you can set the output high, low or high z but regardless of the output state, the input can always be read. This is all internal to the IO chip.

Shorting the pin obviosly risks causing damage while its trying to pull that pin high/low but in turn that allows the input to read a fixed state and the software assumes its a JP system.

The best approach is to block the write happening in the first place.

Another solution is to have something sits between the IO chips IOReq pin and the rest of the console. Then you can prevent the IO chip seeing the write that changes the state of the TH pin happens. This was done on the smsfm board.
There is a little bit of info on it here...

https://etim.net.au/smsfm/smsfm.html
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Mon Sep 20, 2021 2:29 pm
Would pulling D5 on the IO chip low, which sets the output state of TH port A work? I guess this risks damaging the Z80?

Or lifting this pin out of circuit with my failed earlier idea then using something to pass the state from CPU back across after once it recognised as a Jap system ?
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Region changing in hardware
Post Posted: Tue Sep 21, 2021 3:26 am
Shorting an output pin or bi-directional pin directly to ground is quite brutal.

The SMS actually has 330-ohm series resistors on the TH and TR lines to the controller ports to protect these pins.

Has anyone out there tried the Region switch mod through a 330-ohm resistor to ground instead of directly to ground?
Capture.PNG (59.03 KB)
Capture.PNG

  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Tue Sep 21, 2021 5:40 am
What if you disconnected the IC completely, no +5v, kept the pin brutally grounded temporarily - which would cause no harm as the IC is dead in the water, then after the check, high-z the pin pulling it low and power it back up?

I was also wondering why they didn't use a pull down resistor, but surely it wouldn't be that simple of a fix to protect the IC from this brute region hack
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Tue Sep 21, 2021 8:33 am
L10N37 wrote
What if you disconnected the IC completely, no +5v, kept the pin brutally grounded temporarily - which would cause no harm as the IC is dead in the water, then after the check, high-z the pin pulling it low and power it back up?

I was also wondering why they didn't use a pull down resistor, but surely it wouldn't be that simple of a fix to protect the IC from this brute region hack


The IO chip also controls when the bios + ram are enabled and also which slot is active (card, cart or exp). If you disable the IO chip then the system wont boot. Likewise with disabling or altering the data pins to it.

I think the only options are to selectively alter the write or read to the IO chip so that the TH pin doesnt actually change state.. or always reads a particular state... or just patch the game itself.
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Tue Sep 21, 2021 8:36 am
asynchronous wrote
Shorting an output pin or bi-directional pin directly to ground is quite brutal.

The SMS actually has 330-ohm series resistors on the TH and TR lines to the controller ports to protect these pins.

Has anyone out there tried the Region switch mod through a 330-ohm resistor to ground instead of directly to ground?


I have a feeling that might not work as the voltage will drop across the resistor itself, so the IO chip side of the resistor will still be close to 5v.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Tue Sep 21, 2021 12:29 pm
one more idea,

D5 controls bit 5 of $3F on the IO chip? that should be 0 - TH low, 1- TH high

What if you lift D5 and force that low, then after a few seconds pass the true states being written to D5 back across to the IO IC?

Obviously we can patch games or just use an everdrive, just wondering
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Region changing in hardware
Post Posted: Tue Sep 21, 2021 1:54 pm
@Wasup that's true, but we can measure the voltage of the pin to determine if it has been pulled low or not, at least, externally.

I tried grounding one of the TH pins on my SMS tonight through various resistors using Power Strike as the test game.

The console is a PAL SMS with later chipset (315-5237 IC4).

I went as low as 56-ohm. With a 56-ohm resistor, the pin measures 0V, but it didn't fool the region test. Whereas a quick short to ground at the right time fooled the region check and made the game load the 'Aleste' title screen.

So the internal pin driver and pin protection circuit is playing a part.

@L10N37 no need to lift anything, the purpose of the KILLGA pin is to remove the chip from circuit and allow over devices like FM use the IO space. But if you're going to play with the data bus, better get those datasheets out and know them inside-out. :)
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Tue Sep 21, 2021 7:26 pm
L10N37 wrote
one more idea,

D5 controls bit 5 of $3F on the IO chip? that should be 0 - TH low, 1- TH high

What if you lift D5 and force that low, then after a few seconds pass the true states being written to D5 back across to the IO IC?


D5 on port $3E (which is also part of the IO chip) is for the card slot.. so that may work if you lift the pin and dont plan on using cards. Remember the data lines are bidirectional though so dont short them directly to ground or power. Im not sure what state the z80 is going to read with a floating data pin though.

https://www.smspower.org/Development/Port3E
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Wed Sep 22, 2021 12:31 am
@asynchronous
that's weird that it has to be directly to ground when with that resistor it measured 0v

And @wasup



SMS 2 has no card slot to affect so what about

bit 5: port A TH output level

bit 1: port A TH direction

When D1 is low IO chips sending DATA to Z80
When D1 is high IO chips getting written to from Z80

So let's say we jam some logic device between the bus on these lines to
monitor the state of D1 and set the logic devices equivalent pin

D1 high = equiv pin input
D1 low = equiv pin output


To begin with, in the first 'xx' seconds of boot up, we just wait for D1's high/ output pulse, then send the Z80 a low on D5.

after that, just some simple logic coding, which is all i can do at the moment (lol) to sit between the bus and pretend it's not there. This way, we aren't fighting the IO chip internally so we can't harm it.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Wed Sep 22, 2021 12:33 am
wasup wrote
L10N37 wrote
one more idea,

D5 controls bit 5 of $3F on the IO chip? that should be 0 - TH low, 1- TH high

What if you lift D5 and force that low, then after a few seconds pass the true states being written to D5 back across to the IO IC?


D5 on port $3E (which is also part of the IO chip) is for the card slot.. so that may work if you lift the pin and dont plan on using cards. Remember the data lines are bidirectional though so dont short them directly to ground or power. Im not sure what state the z80 is going to read with a floating data pin though.

https://www.smspower.org/Development/Port3E


my last comment was stupid so i deleted it
I was wondering if you knew how to tell which IO address is being written to on a hardware level by watching the 3 address pins?

i would assume there's 3 because of the 3 addresses for I/O

$3F
$DC
$DD
?
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Wed Sep 22, 2021 6:47 am
L10N37 wrote
my last comment was stupid so i deleted it
I was wondering if you knew how to tell which IO address is being written to on a hardware level by watching the 3 address pins?

i would assume there's 3 because of the 3 addresses for I/O

$3F
$DC
$DD
?


Have a read over the IO ports section of this.. its well written and should shed some light on this.

https://www.smspower.org/uploads/Development/smstech-20021112.txt
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Wed Sep 22, 2021 8:08 am
The whole thing has me baffled.
The Data lines should carry the reads and writes dependant on the direction pins state on whether it's a read or write. I've lifted corresponding pins out of circuit to test but I can still trigger Jap mode by just touching TH2 to ground for a second at the right time. How can that be read from that controller pin without the corresponding output line connected on the other side of the IC!?

**my bad, referenced the region hack page to the schematic and it's kill GA that is causing JP mode, but he says something about light gun detection pin
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Wed Sep 22, 2021 10:31 am
So looks like all you have to do is lift KILLGA out of circuit and you get JP mode, so why not just lift KILLGA out of circuit, then patch it back with a switch after?

Will this have adverse effects?
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Video :)
Post Posted: Wed Sep 22, 2021 10:40 am

I can't do further testing, i butchered my board so i have to replace the IO chip with a donor
  View user's profile Send private message
  • Joined: 05 Nov 2014
  • Posts: 435
  • Location: Auckland - NZ
Reply with quote
Post Posted: Fri Sep 24, 2021 5:40 am
L10N37 wrote
So looks like all you have to do is lift KILLGA out of circuit and you get JP mode, so why not just lift KILLGA out of circuit, then patch it back with a switch after?

Will this have adverse effects?


I suspect doing that will also stop the parts of the IO chip that control bios/ram/slot but i could be wrong there.

I guess if it doesnt break the system booting then you could use a timer on that pin. Worst case to that approach would be that games get random data back when trying to read the controller ports and might do something funky
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Region changing in hardware
Post Posted: Fri Sep 24, 2021 3:54 pm
KILLGA only affects the IO ports and not the CE lines that are generated by IC4 for the BIOS, RAM, etc.

If you pull KILLGA high from boot, the BIOS runs as normal, but the cartridge is never detected, because the write to Port $3E to map it in does not have an effect. I verified this the other evening.

I believe this is by design, because if KILLGA also inhibited the CE lines, you would have a software crash on the very next instruction fetch following the IO read/write if CE wasn't asserted due to any sort of latency of KILLGA.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Fri Sep 24, 2021 4:58 pm
I'll switch out the IO chip maybe tomorrow and do some further testing. As far as I can see the games are loading fine, I only tried Wonderboy 3 dragons trap and Wonderboy. I had a wire to ground and was basically tapping Killga and every now and then dragons trap would just restart with a solid Sega bumper logo, then show the Japanese name. For the most part it would just funk out the screen and crash.

I don't want to mess with any more master system 2's as I'm down to my last 8 or 9 ( haha) but there's boards there that sucked too much time diagnosing so they've become donors. As for the model 1's, I wanted one of every BIOS and ended up with a double up or 2 (other than super rare BIOS revisions) and they're precious to me. Won't touch them unless a mod is fully verified safe and working.

Hopeful that you can just float KillGA then reconnect it after, which would make for a safe hardware region switch. Can't really think of any fancy ways to do it other than SPDT.
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Region changing in hardware
Post Posted: Sun Sep 26, 2021 1:55 pm
I got nerd-swiped with this one, in particular by my own words "Shorting an output pin or bi-directional pin directly to ground is quite brutal" and seeing that only a dead short of one of the TH pins would fool the region detection code, which will slowly kill the TH pin of IC4.

I came up with a 1-chip mod that would safely fool the region detection code. It's essentially a lo-fi mod chip that anyone can buy for a buck and install easily into a master system: code-named Lionheart.

I tested it today on my PAL SMS with 315-5237 chipset and Power Strike and it works correctly and transparently with no observed issues.

This mod works by disabling IC4 for a Port $3F write using /KILLGA (the intended way to disable IC4) based on the Address lines. Because the Z80 CPU asserts the /IORQ and /WR lines at the same time for an IO write, and the write takes effect very quickly on IC4, there's not much time to act on the /IORQ signal. So we don't. The operation of /KILLGA also means /IORQ is not critical.

A good way of installing this mod chip may be to use a momentary push button switch between the mod chip (pin 8) and the KILLGA pin of IC4 which would be held down after power up at game boot to load the game into JAP mode and then released.

It's free for everyone to use and enjoy. :)

Post back here if you find any issues so we can know about them.
Project Lionheart Region Mod.png (34.57 KB)
Lionheart Region Mod Chip
Project Lionheart Region Mod.png

  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Mon Sep 27, 2021 2:27 am
Legendary, if only you were a day quicker - I Finnnnnalllyyy put an order through with Element 14 that i've been waiting to do for friggin ages as I didn't want to pay for shipping and the component i needed was literally like 20 cents for quantity of 150.

I wrote a new modchip for the PSone PAL version as 12C508's from China have being 80% faulty and Jaycar ran a special and they sold out in an instant. I actually just grabbed their last 45 12C509's the other day which are also compatible.

The idea was, write a new chip to a newer flash based microcontroller (the arduino ones in C++ were childs play, even for a total beginner) and then we have a modern PIC micro-controller to keep them alive.

I kid you not, literally a few days after (thinking) I'd finalized my code the guy @ Jaycar says "oh we don't sell them anymore, we won't be getting them back" and that's the end of the 12F675 from local brick and mortar stores haha.

I need to add a PWM frequency on a spare pin to chop the data line up as it won't load genuine imports, they HAVE to be burnt copies. As for genuine games of the correct region - I just did a lid check @ boot and if it was open the chip just 'disappears', then close the lid and we have boot. Anyway, a customer complained that she had lots of genuine Japanese games so I rewrote a V2.1 but it's not implemented on the PSone PIC version yet.

Anyway, back to the real topic ... A SAFE MASTER SYSTEM REGION HACK with an off the shelf IC. Would there be anyway to make this controllable by holding button 1, or button 2, or button 1 + button 2 on boot whilst powering on to set the JP mode? That would be much better!
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 740
  • Location: Adelaide, Australia
Reply with quote
Region changing in hardware
Post Posted: Mon Sep 27, 2021 11:34 am
Part end-of-life is a normal part of electronics design. There's even chance that 74 series logic becomes unavailable in the future. But for now, the 74HC27 is bountiful and $1.45 at Jaycar.

In terms of detecting a button press combo, the design would need to be totally reworked for that. It would probably need 2 chips like Charles' design in the link in the first post.

But food for thought: is it really easier to have to turn the console on and then reach and grab the controller and press the D-pad and both buttons simultaneously? :)
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 212
Reply with quote
Post Posted: Mon Sep 27, 2021 1:00 pm
I guess I could rewrite it for arduino where it you hold pause at power on for JP mode else normal.

Not that I haven't already drilled 500 holes into master systems for switches. Always good to have options. I'm worried I may infringe on your copyright though hehe
  View user's profile Send private message
Reply to topic



Back to the top of this page

Back to SMS Power!