|
vecna
|
SMS BIOS, port 3Eh -- anyone figure this out?
 Posted: Thu May 25, 2000 11:37 pm
|
Well, I finally decided I'm going to stick with the MAME Z80 engine for at least the next version of CHASMS, so I went ahead and brought the rest of the WIP 0.30 functionality into into the MAMEZ80 version, and have finally been able to start working on other things. One of my first orders of business was to try to decipher how to 'properly' emulate the BIOS / port $3E / $C000 thingymajig. I've been working on that the last 2 days, more or less. After painstaking debugging -- I conceed defeat. -_-
I've been working from the assumption that the BIOS writes things to port $3E and looks for a 'response' code of sorts at $C000. This follows the jist of what I'd heard from Charles Mac Donald and Zoop, and what I could understand of the BIOS diassemblies Zoop posted. My first task was to figure out what response codes did what, tho. and so, I literally tested all response values 0 through 255 to put into $c000 upon response of something written to $3E --- and absolutely nothing is responded to in either the Jap or USA bios. No matter WHAT I put in there, they both behave the same way as if I wasn't emulating port $3E at all.
To further complicate this, I figured, if I can't figure out the damn BIOS by the disassembly, maybe I can try to reverse-engineer MEKA. ^_^ (Of course, at this point, the idea of just ASKING had entered my mind, but it seemed much more manly to write a ROM and try to hack MEKA's behavior this way ^_~) So I pulled out TASM and created a ROM that would write an obscure value like 254 or 56 to $C000, write some different values to $3E, and then see if $C000 had been altered. No matter what I fed to port $3E, the value in $C000 was unchanged.
Of course, it is also entirely possible that MEKA simply doesnt respond to $3E unless it's emulating what it recognizes as the BIOS in MEKA.DAT, in which case I'd be just screwed, since I don't have a devcart to run the ROM on a Real SMS (tm).
So, at this point, if I hadn't seen the references to $c000 in the BIOS disassemblies myself, I'd swear all of you that said $c000 had anything to do with it all were smoking crack. Unfortunately, I figure it's got to have SOMETHING to do with, I just have no idea what.
The ONLY point of progress I've been able to make -- and even this is sort of questionable -- is how the thing maps in the ROM. I had sort of assumed that the BIOS was just loaded in the first page, but as soon as the BIOS wrote to $FFFD, it would map in the cartridge frame. Unfortunately, at no point does either BIOS write to values $FFFC - $FFFF, so that theory is gone. What I have figured out is that if I swap in the cartridge frame upon writing to $3E, the Japanese BIOS will jump to PC=0000 and the game will execute as normal. However, this didn't alter the execution of the USA BIOS at all, and I still don't know how to tell either BIOS that there is no cartridge present.
The Japanese BIOS will write $EB and $CB, alternating, to $3F -- seemingly infinitely.
Erm. I know I had gotten the a log of USA BIOS output once, but now it seems to not be writing to $3E at all. -_-
Sigh. Grr. Blah.
Anyone care to illuminate this subject any? Zoop? ^_~
- vecna
|
