PGM Tech Info

Pgm Game System


PGM System (c)1997 IGS


A flexible cartridge based platform some would say was designed to compete with
SNK’s NeoGeo and Capcom’s CPS Hardware systems, despite its age it only uses a
68000 for the main processor and a Z80 to drive the sound, just like the two
previously mentioned systems in that respect..

Motorola 68000 processor, clocked at 20.000MHz, for main code
Z80 processor, clocked at 8.468MHz, for sound code.

Resolution is 448×224, 15 bit color

Sound system is ICS WaveFront 2115 Wavetable midi synthesizer, used in some
actual sound cards (Turtle Beach)

Later games are encrypted. Latest games (kov2, ddp2) include an arm7
coprocessor with an internal rom and an encrypted external rom.

Roms Contain the Following Data

Pxxxx – 68000 program
Txxxx – Text and background graphics (2 formats within the same rom)
Mxxxx – Audio samples (8 bit mono signed PCM at 11025Hz)
Axxxx – Sprite graphics data
Bxxxx – A Offsets and Sprite masks

There is no rom for the Z80, the program is uploaded by the 68000

68000 Memory Map

0x000000 0x01FFFF BIOS ROM (Read-Only)
0x100000 0x5FFFFF Game ROM (Read-Only)
0x700006 0x700007 Watchdog?
0x800000 0x81FFFF Main Ram (Read/Write)
0x900000 0x903FFF Background layer (Read/Write)
0x904000 0x905FFF Text layer (Read/Write)
0x907000 0x9077FF Row scroll ram (Read/Write)
0xA00000 0xA011FF Palette ram (Read/Write)
0xB00000 0xB0FFFF Video Regs inc. Zoom Table (Read/Write)
0xC00002 0xC00003 Sound latch 1 (Read/Write)
0xC00004 0xC00005 Sound latch 2 (Read/Write)
0xC00006 0xC00007 Calander (Read/Write)
0xC00008 0xC00009 Z80 Reset (Write)
0xC0000A 0xC0000B Z80 Control (Write)
0xC0000C 0xC0000D Sound latch 3 (Read/Write)
0xC08000 0xC08001 Player 1 and 2 controls (Read)
0xC08002 0xC08003 Player 3 and 4 controls (Read)
0xC08004 0xC08005 Extra controls (Read)
0xC08006 0xC08007 Dip switches (Read)
0xC10000 0xC1FFFF Z80 program ram (Read/Write)

Z80 Memory Map

0x0000 0xFFFF Z80 program ram (Read/Write)

Z80 I/O Map

0x8000 0x8003 ICS 2115 Interface (Read/Write)
0x8100 0x81FF Sound latch 3 (Read/Write)
0x8200 0x82FF Sound latch 1 (Read/Write)
0x8400 0x84FF Sound latch 2 (Read/Write)

Graphics Data

Text format:
8×8 16 color tiles
Each nibble represents a pixel
The low nibble is left pixel of the two.
(eg. 1000 0001 0100 0010 would be 1824 on the screen.)

Background format:
32×32 32 color tiles
The data is arranged in 32 pixel rows.
Each row of pixels is packed into 20 bytes.

Sprite format:
32 color packed three 5 bit pixels to 2 bytes (x333332222211111)
Sprites also include a mask of 8 pixels per byte, A 1 bit indicates an omitted pixel.
Pixels that are marked as omitted in the mask are not included in the pixel data, and are
skipped over on the screen.
Sprites can be any size (multiple of 16(?) pixels wide, but also need to allow 3 pixels to be packed into 2 bytes, or have the non existent pixels marked as omitted in the mask).

Text/Background map format:
— — Ffpp ppp- nnnn nnnn nnnn nnnn

n = tile number
p = palette
F = Y flip
f = X flip

Rom text tiles start at $C000.
Rom background tiles. Tile $0A00 = offset 65536 in T rom. This is based on:
$1A00 (Real tile number) * $280 (Size of each tile) – $400000 (Offset of game tile rom).

Text tile transparent color is 15.
Background tile transparent color is 31.
Text tilemap is 64×32
Background tilemap is 64×64

Palette format:

0xA00800 0xA00FFF Background (32 * 2 bytes x 32 palettes)
0xA01000 0xA011FF Text (16 * 2 bytes x 32 palettes)

Scroll registers:
0xB02000 Background scroll Y register (WORD)
0xB03000 Background scroll X register (WORD)
0xB05000 Text scroll Y register (WORD)
0xB06000 Text scroll X register (WORD)


Sprite table is located at 0x800000 – 0x800A00

Sprite data format:
XXXX Xxxx xxxx xxxx
YYYY Y-yy yyyy yyyy
-Ffp pppp Pvvv vvvv
vvvv vvvv vvvv vvvv
wwww wwwh hhhh hhhh

X = X zoom ($8000 is default)
Y = Y zoom ($8000 is default)
x = X position
y = Y position
p = Palette
F = Y flip
f = X flip
P = Priority
v = Sprite data offset / 2 (in B rom)
w = Width / 16(?)
h = Height

Input Ports (Player 1 and 2 – 0xC08000, Player 3 and 4 0xC08002)

0x0001 Start (Player 1 and 3)
0x0002 Up (Player 1 and 3)
0x0004 Down (Player 1 and 3)
0x0008 Left (Player 1 and 3)
0x0010 Right (Player 1 and 3)
0x0020 Button 1 (Player 1 and 3)
0x0040 Button 2 (Player 1 and 3)
0x0080 Button 3 (Player 1 and 3)
0x0100 Start (Player 2 and 4)
0x0200 Up (Player 2 and 4)
0x0400 Down (Player 2 and 4w
0x0800 Left (Player 2 and 4)
0x1000 Right (Player 2 and 4)
0x2000 Button 1 (Player 2 and 4)
0x4000 Button 2 (Player 2 and 4)
0x8000 Button 3 (Player 2 and 4)

Extra Controls (0xC08004)

0x0001 Coin 1
0x0002 Coin 2
0x0004 Coin 3
0x0008 Coin 4
0x0010 Test Player 1 and 2
0x0020 Service Player 1 and 2
0x0040 Test Player 3 and 4
0x0080 Service Player 3 and 4
0x0100 Button 4 (Player 1)
0x0200 Button 4 (Player 3)
0x0400 Button 4 (Player 3)
0x0800 Button 4 (Player 4)
0x1000 Unused?
0x2000 Unused?
0x4000 Unused?
0x8000 Unused?


Huge update on “Hacked PGM Carts”

I have done alot of work today on hack carts….. I submitted dumps of the program roms to the Mame team.. as there not in mame at the moment….

I beleve the following is true….

ALL HACK carts run a PLD (seams to be a Lattice LC4128V On all of them).
PLUS a “ARM7” CPU. This is eigher in a a small QFP OR a PLCC 44pin chip.

“LPC2131FBD64” Is the QFP ARM7 Core.
I’m still ID’ing the PLCC part number (All chips are scratched off the top)

The PLD has JTAG.. i don’t know yet if the security bit is set…
The ARM7 seams to have jtag as well. (both have pin headers on the PCB for each chip).

SO it would seam they are emulating the IGS ASIC 27 chip…..

Another fact i know 100%. Some hack carts run un-encryted program rom code. While other use Encrypted Prog Roms.