[Hardware] Magic Griffin

[MooZ]

The Magic Griffin is a game copier. From the menu and the case, it seems to have been made by a taiwanese company called Front Fareast and JSI.
I don't know if the Front Fareast listed on wikipedia is the same(link). And I've found nothing about JSI.
About the hardware. You plug it in the Hucard slot and the joypad port. Oh I forgot, you can only use it on a PC Engine/CoreGrafx. On the front you have a standard Hucard slot and 2 joypad ports. Only the right one is working. I don't know what's the left one is used for. There are 2 parallel ports on the right. One for an external floppy disk drive and another one labeled COM port. I only tested the floppy disk.



What's inside?

An Altera chip, a Motorola chip, some RAM, some TTL chips and a UV EEPROM (on the onther side). I haven't identified the chips yet.
So what happens when you power it on? Well you see this:

It may work like the other flash cards (TotoTek PCE Pro, Krizz Everdrive). This means that it acts like a standard Hucard. But some special addresses are used to communicate with the special hardware. For example the Everdrive can access the SD card via some addressess that are mapped to the SPI registers. I pretty sure the code is hosted on the UV EEPROM.
About the menu.

• RUN FILE
• RUN IC CARD
• SAVE IC CARD
• RENAME FILE
• DELETE FILE
• FORMAT DISK

RUN FILE: Run a file from the floppy disk.


RUN IC CARD: Run the Hucard.
Unfortunately I was unable to run any card. It either tells me that there's no Hucard or it will freeze. This surely comes from oxidized card connector.

SAVE IC CARD: Save Hucard to floppy disk.
It's the menu that would have sent you to jail in the 90's You name the file, press I and it will start dumping the Hucard on the floppy disk. Unfortunately the controls are awful. Pressing RUN will spit a whole lot of chars. Same for SEL, it's more likely that it'll delete the whole filename. You can't write a single char. So you'll end up with filenames like 'ssssooooolll' or 'bbbbooommbbb'
As I said before I was unable to run any Hucard. Despite the fact that it seems to have dump the game, I was unable to run any of the game I've dumped. I'll check the dumped files as soon as I get my hands on an USB Floppy drive. But I'm pretty sure I'll have a bunch of 0xff.


RENAME FILE: Rename one of the file on the floppy disk.

DELETE FILE: Delete a file from the floppy disk.


FORMAT DISK: Format floppy disk.
You can either format a HD (1.44M) or DD (720K) floppy drive. Be carefull, it'll start formatting the disk once you enter the menu.


That's all.
I'll try to clean/fix the connector. And once I receive the USB floppy drive I'll check the dumped files and verify which filesystem the disk was formatted.
The coolest stuff will be to dump the UV EEPROM. So if someone knows how to safely read it, I'll be more than pleased to hear it.

[MooZ]

I fixed the connector. It's now working like a charm. I managed to play games via RUN IC, save them to floppy and run the files.
More pictures:
The UV EPROM label. I think it's a Mitsubishi M5L2764K.

And the back

• 1 Motorola MCS3201FN / ZQHAF9102
• 2 Altera EP1810LC-45 / 4D19049
• 3 Motorola MCM514256AP80 (*8)
• 4 Motorola SN74LS245N
• 5 Motorola SN74LS174N
• 6 Toshiba 74HC08AP
• 7 ???? HD74LS74AP
• 8 Motorola SN74LS244N
• 9 ???? HD74LS04P
• 10 ???? LM340TS 7805

[MooZ]

Redfield from the necstasy forum dumped the eprom. I'll post it tomorrow with disassembled source code.


(edit) erm... let's say this week instead

[MooZ]

Here it's!
The Magic Griffin ROM

I started disassembling it. And there are some "funny" stuffs. There's only 1 IRQ defined (reset). And everything fits in 8K.
I'll post the asm files later.

[MooZ]

Let's start with the only defined IRQ, the RESET IRQ:

Code: Select all

    .code
    .bank 0
    .org $eb00
leb00:
       ; Disable hardware interrupts, clean decimal flag and
       ; switch HuC6280 to slow mode.
       SEI     
       CLD     
       CSL

       ; Initialize MPRs
       ; mpr 0 : f8
       ;       1 : f8
       ;       2 : ff
       ;       3 : 00
       ;       4 : 03
       ;       5 : 02
       ;       6 : 01
       ;       7 : 00
       LDA     #$f8
       TAM     #$00
       LDA     #$f8
       TAM     #$01
       LDA     #$ff
       TAM     #$02
       LDA     #$01
       TAM     #$06
       LDA     #$02
       TAM     #$05
       LDA     #$03
       TAM     #$04

       ; Setup stack pointer
       ; $2a seems to hold a copy.
       LDX     #$ff
       STX     $002a
       TXS

       ; No idea what it does.
       JSR     lf006
       
       ; It's copying up to 1280 bytes.
       ; I have no idea what it's used for.
       LDY     #$00
leb26: 
       LDA     $ecae, Y
       STA     $0800, Y
       LDA     $edae, Y
       STA     $0900, Y
       LDA     $eeae, Y
       STA     $0a00, Y
       LDA     $efae, Y
       STA     $0b00, Y
       LDA     $f0ae, Y
       STA     $0c00, Y
       INY     
       BNE     leb26

       ; To infinity and beyond!
       LDY     #$00
       JMP     leb96

Code: Select all

	.code
	.bank 0
	.org $f006
lf006: 
       LDA     #$04
       STA     $c002
       RTS

[MooZ]

Well disassembling the whole stuff is, to say the least, boring.
So let's use mednafen. It seems that the communication with the Motorola chip is done via $c000 to $c007.
For example, when you select a disk operation (let's say FORMAT DISK), you enter an infinite loop. And if you step into the debugger, you'll get:

Code: Select all

lf017:
    BIT    $c004
    BPL    lf017
    BVS    lf017
    STA    $c005
    RTS

Just before this code, you have:

Code: Select all

lf000:
    LDA    #$2D
    STA    $c002
    RTS
lf006:
    LDA    #$04
    STA    $c002
    RTS
lf00b:
    BIT    $c004
    BPL    $f00c
    BVC    $f00c
    LDA    $c005
    RTS

From the datasheet, we have:

• $3f0 - Input Register - 8bits - Read Only
• $3f2 - Digital Output Register - 8bits - Write Only
• $3f4 - Main Status Register - 8bits - Read Only
• $3f5 - Data Register - 4*8bits - Read Write
• $3f7 - Digital Input Register - 8bits - Read Only
• $3f7 - Diskette Control Register - 8bits - Write Only

At first sight, it seems that $c000, $c002, $c004, $c005, $c007 are directly mapped to those registers.
Here's the description for the Main Status Register.

• bit #0 - DRIVE 0 BUSY
  • 0 - After reading the first byte in the result phase of the sense interrupt command from this drive.
  • 1 - Diskette 0 is in seek mode, drive 0 busy. Set after the last byte of a seek or recalibrate commmand is written.
• bit #1 - DRIVE 1 BUSY
  • 0 - After reading the first byte in the result phase of the sense interrupt command from this drive.
  • 1 - Diskette 1 is in seek mode, drive 1 busy. Set after the last byte of a seek or recalibrate commmand is written.
• bit #2 - DRIVE 2 BUSY
  • 0 - After reading the first byte in the result phase of the sense interrupt command from this drive.
  • 1 - Diskette 2 is in seek mode, drive 2 busy. Set after the last byte of a seek or recalibrate commmand is written.
• bit #3 - DRIVE 3 BUSY
  • 0 - After reading the first byte in the result phase of the sense interrupt command from this drive.
  • 1 - Diskette 3 is in seek mode, drive 3 busy. Set after the last byte of a seek or recalibrate commmand is written.
• bit #4 - CONTROLLER BUSY
  • 0 - After the Last Byte of the Result Phase is Read.
  • 1 - After the First Byte of the Command Phase is Written.
• bit #5 - EXECUTION MODE (NON-DMA MODE)
  • 1 - Set during the execution phase of a command if it is in the non-DMA mode. If set, the multiple byte transfer must be monitored by the host either through interrupts or sofware polling.
• bit #6 - DATA INPUT/OUTPUT
  • 0 - Data Transfer from Host to Controller.
  • 1 - Data Transfer from Controller to Host.
• bit #7 - REQUEST FOR MASTER
  • 1 - The MCS3201 is ready for the host to send or receive data. This bit clears after the transfer is complete and is set again when ready for the next transfer.

So $f017 and $f00b wait for the device to be ready.

[MooZ]

I just noticed that ucon64 supports the Magic Griffin COM interface.
The source code for it can be found at:

• src/backup/ffe.c
• src/backup/ffe.h