INES Mapper 227

INES Mapper 227 denotes a PRG-ROM+CHR-RAM address-latch-based multicart that is also used for several 1 MiB single-game cartridges from Nanjing, Waixing, and Yancheng. The single-game cartridges lack the CHR-RAM protection facility, yet set the CHR-RAM protect bit, which therefore must be ignored. The variants with and without CHR-RAM protection can be unambiguously separated by the fact that all single-game cartridges using this mapper also mount a battery.

 Disch's notes, updated:
 Menu information added by Zepper, thanks to zxbdragon.  
 ========================
 =  Mapper 227          =
 ========================
 
 
 Example Game:
 --------------------------
 1200-in-1
 600-in-1
 
 
 Notes:
 ---------------------------
 This mapper has 8k CHR-RAM, and also has the ability to write protect its CHR-RAM!
 
 
 Registers:
 ---------------------------
 This mapper uses the address written for its setup. The value is irrelevant.
 
   $8000-FFFF:  A~[.... .mLP  OPPP PPMS]
     L = Last PRG Page Mode
     P = PRG Reg
     O = Mode
     M = Mirroring (0=Vert, 1=Horz)
     S = PRG Size
     m = Menu list (see below)
 
 Setup:
 ---------------------------
 
 When 'O' is set, CHR-RAM is write protected (writes have no effect).  'O' also changes the PRG mode.
 
 Note there is funky ANDs and ORs going on below depending on the modes:
 
 
                   $8000   $A000   $C000   $E000  
                 +---------------+---------------+
 O=1, S=0:       |       P       |       P       |
                 +-------------------------------+
 O=1, S=1:       |             < P >             |
                 +-------------------------------+
 O=0, S=0, L=0:  |       P       |   P AND $38   |
                 +---------------+---------------+
 O=0, S=1, L=0:  |   P AND $3E   |   P AND $38   |
                 +---------------+---------------+
 O=0, S=0, L=1:  |       P       |   P  OR $07   |
                 +---------------+---------------+
 O=0, S=1, L=1:  |   P AND $3E   |   P  OR $07   |
                 +---------------+---------------+

 Menu list:
 ---------------------------
 The following information does not work for the 1200in1 cartridge!
 Bit 10 of the address written activates the menu list selection. When activated, reading anywhere
 at $8000-$FFFF returns the menu list type (value x 8) described below; otherwise, returns PRG ROM
 data at $8000-$FFFF.
 +-------+----------------------------+
 | value | number of selectable games |
 +-------+----------------------------+
 |   0   | 860 in 1                   |
 |   1   | 460 in 1                   |
 |   2   | 500 in 1                   |
 |   3   | 560 in 1                   |
 |   4   | 600 in 1                   |
 |   5   | 660 in 1                   |
 |   6   | 700 in 1                   |
 |   7   | 860 in 1                   |
 |   8   | 900 in 1                   |
 |   9   | 920 in 1                   |
 |  10   | 940 in 1                   |
 |  11   | 960 in 1                   |
 |  12   | 980 in 1                   |
 |  13   | 400 in 1                   |
 |  14   | 380 in 1                   |
 |  15   | 360 in 1                   |
 +-------+----------------------------+
 | 16~19 | blue screen                |
 | 20    | up to 980, 981+ bugged     |
 | 21    | same of 21                 |
 | 22    | 40 in 1, clipped list      |
 | 23~31 | blue screen                |
 | 32    | 420 in 1                   |
 | 33    | 460 in 1 (same of 1) $21   |
 | 34    | 500 in 1 (same of 2) $22   |
 +-------+----------------------------+

The hardware on this board appears to be two 74157s, a 74153, two 74174s, a 7402, and a 7432. When the 'm' bit is set, one of the 74157s replaces the 4 LSbits of the CPU's address bus with a fixed constant. Evidently, this allowed the pirates to make multiple different seeming multicarts from the same physical ROMs, just by using different PCBs.

All bits of the banking register (meaning both 74174s) are most likely cleared on reset.

See also: dumping thread