ok, I found the issue: I took VDP init register values from other program that I know works on real hardware and figured that you need to set register 23 to $80 (VRAM fill operation) before setting the first VRAM write in CTRL port. I guess that this has something to do with Memory to V-RAM DMA being started even if it shouldn't (probably because code register MSB are not cleared on startup and the first write to CTRL port which is set to program a VRAM write would trigger the DMA before the second write ???). Well, we know that DMA from ROM can lock the machine if not done properly so I think this is the issue.Eke wrote:Yes, this is indeed great, I don't think it has ever been done before so congrats for that !
I've hard time figuring why it does not work on real hardware though. So far, I found 2~3 odd things the program is doing:
(1) it sets the M3 latch bit (bit 1) in register 0 which apparently locks the HV counter (see thisthread). Since the program uses vertical counter to wait for VBLANK, it might be locked-out because of this.
(2) it sometime attempts to write at $00001F (cartridge ROM), seems like an address register is not being initialized properly.
(3) during initialization, it does a lot of VRAM reads followed by VRAM writes, while changing the VDP address manually (using CTRL port) between DATA port access. While it works on emulator, I'm not sure if real hardware can handle that and if it does not require some waits between setting a new VDP address and reading/writing the DATA port.
I've patched (1) and (2) in the ROM (requires patching the checksum routine also) but the game still refuses to boot on real hardware. It does starts and have the time to set some VDP registers though because I can see the BIOS licensing screen being distorded when it switches
into H32 mode.
I don't know, I also noticed that, contrary to most others, this program don't read the VDP status on startup. This might clear some internal settings as well and could do the trick also.
To resume, to get this ROM work on real hardware, the following patches are required:
$552: replace $06 by $04 (this clears the M3 latch bit)
$569: replace $00 by $80 (this prevents DMA from ROM to be accidentally triggered)
$2B2-$2B3: patch with $4E71
$2B4-$2B5: patch with $4E71
(this patches the checksum verification routine)
The problem now is that inputs seems not to be read properly: my controller does not respond and I can't leave the menu screen , it's probably something related to timings when programming the controller.