mirror of
https://github.com/problemkaputt/problemkaputt.github.io.git
synced 2024-05-12 09:44:52 -04:00
13981 lines
656 KiB
Plaintext
13981 lines
656 KiB
Plaintext
Everynes - Nocash NES Specs
|
||
---------------------------
|
||
|
||
Contents
|
||
--------
|
||
|
||
No$nes Emulator / Debugger
|
||
--> No$nes Controls
|
||
--> No$nes Emulation Files
|
||
|
||
Everynes NES Hardware Specifications
|
||
--> Tech Data
|
||
--> Memory Maps
|
||
--> I/O Map
|
||
--> Picture Processing Unit (PPU)
|
||
--> Audio Processing Unit (APU)
|
||
--> Controllers
|
||
--> Cartridges and Mappers
|
||
--> Famicom Disk System (FDS)
|
||
--> VS System
|
||
--> Nintendo Playchoice 10
|
||
--> FamicomBox
|
||
--> Modems
|
||
--> Hardware Pin-Outs
|
||
--> CPU 65XX Microprocessor
|
||
--> About Everynes
|
||
|
||
No$nes Controls
|
||
---------------
|
||
|
||
General Joypad Controls
|
||
Keyboard controls for up to four players can be defined in setup. Buttons of
|
||
USB Gamepads & Joysticks & the like can be also changed per player.
|
||
|
||
Special Controls
|
||
F1..F5 Enable/Disable Sound Channel 1-5
|
||
F9 Enable/Disable Showing Screen Splits as dotted line
|
||
NUM * Hard Reset
|
||
NUM / Soft Reset
|
||
NUM - Switch to Debug Mode
|
||
NUM + Disable Realtime Delays and use 10% frameskip (while held down)
|
||
BS Disable Realtime Delays (same as above, for notebook keyboards)
|
||
|
||
Famicom Disk System (FDS)
|
||
INS Flip Disk (some games ignore fast flips; hold down for some seconds)
|
||
|
||
VS Unisystem (Arcade Cabinet)
|
||
INS Credit Left Coin Slot
|
||
HOME Credit Right Coin Slot
|
||
PGUP Credit Service Button
|
||
1..4 Button 1..4 (aliases for NES Start/Select buttons)
|
||
0 DIP-Switch Window
|
||
|
||
Playchoice 10 (Arcade Cabinet)
|
||
INS Credit Coin Slot 1
|
||
HOME Credit Coin Slot 2 (works only if enabled via DIP switches)
|
||
PGUP Service Button (add credit) (during reset: bookkeeping)
|
||
DEL Reset Button (if any)
|
||
END Enter Button (also works via Num-Enter)
|
||
PGDN Channel Select Button
|
||
0 DIP-Switch Window
|
||
Mouse Zapper (Lightgun Move/Trigger)
|
||
|
||
FamicomBox
|
||
INS XXX Insert Coin
|
||
HOME RESET Button
|
||
PGUP XXX GAME/TV Button
|
||
123456 1st..6th Keyswitch Position (from left) [=INTENDED, see Note]
|
||
0 DIP-Switch Window
|
||
Mouse Zapper (Lightgun Move/Trigger)
|
||
Note: The ordering of the keyswitch positions from left-to-right is still
|
||
unknown; currently keys 1..6 are simply mapped to keyswitch bit0..5.
|
||
Multi-cart loading isn't emulated yet, so you'll only see the menu & self-test
|
||
feature, without any games.
|
||
|
||
Famicom Keyboard
|
||
BS/DEL DEL
|
||
HOME CLR
|
||
TAB ESC
|
||
END STOP
|
||
L-ALT GRPH
|
||
R-ALT KANA
|
||
|
||
Party Tap Push Buttons
|
||
123456 Buttons for Player 1-6
|
||
|
||
Konami Hyper Shot Push Buttons
|
||
Joypad Button A --> "RUN"-Button (or, used as "Shoot-Right" in Hyper Sports)
|
||
Joypad Button B --> "JUMP"-Button (or, used as "Shoot-Left" in Hyper Sports)
|
||
The games do replace joypad data by button data; no$nes somewhat undoes that
|
||
replacement.
|
||
|
||
Lightguns (NES Zapper, Famicom Beam Gun, VS Zapper, Bandai Hyper Shot Gun)
|
||
Mouse Move
|
||
Left Mouse Button Trigger
|
||
|
||
Paddle (NES and both Famicom versions)
|
||
Mouse (left/right) Move
|
||
Left Mouse Button Button
|
||
|
||
Oeka Kids Tablet
|
||
Mouse Move & Touch
|
||
Left Mouse Button Click
|
||
|
||
Mouse / Trackball
|
||
Mouse (move) Move
|
||
Left/Right Button Left/Right Button (A/B Button on Trackball)
|
||
Middle Button or ESC Return mouse to operating system
|
||
|
||
Power Glove
|
||
Gamepad Analog X/Y/Z/R Position X/Y/Z and Wrist Rotation
|
||
Gamepad Button 1..4 Thumb/Index/Middle/Ring Finger Flex
|
||
Gamepad Digital POV Keypad DPAD
|
||
Keyboard 0..9 Keypad 0..9
|
||
Keyboard Buttons/DPAD Keypad A,B,Start,Select,DPAD
|
||
XXX Keypad Prog,Center,Enter
|
||
|
||
UForce
|
||
Page Down Top-most sensor ;\for push-button
|
||
NUM-/ NUM-* Upper Left/Right sensors in upper field ; style usage (with
|
||
NUM-8 NUM-9 Lower Left/Right sensors in upper field ; sensor=min/max)
|
||
NUM-5 Upper Left sensor in lower field ; (eg. Nuclear Rat,
|
||
NUM-2 NUM-3 Lower Left/Right sensors in lower field ; and Rock on Air)
|
||
Page Up Bottom-most sensor ;/
|
||
Gamepad Analog X Top-most sensor ;\for analog usage
|
||
Gamepad Analog Y Bottom-most sensor, or, ; (eg. Hose'em Down
|
||
Gamepad Analog Y Lower-Left sensor in lower field ;/and Rock on Air)
|
||
Plus Start/Select as configured in joypad setup. Analog mode is activate when
|
||
moving the analog gamepad (and will then override the corresponding keyboard
|
||
keys). Analog input emulation is matched to the existing "UForce Power Games"
|
||
cartridge (and may mismatch with other/homebrew UForce games).
|
||
|
||
Top-Rider Bike
|
||
Gamepad Analog X Steering Handles Left/Right
|
||
Gamepad Analog Y Forward=GearLo, Back=GearHi
|
||
Gamepad Analog Z Forward=Accelerate Slow/Fast, Back=Accelerate Turbo
|
||
Gamepad Button 1,2,3,4 Brake,Wheelie,Start,Select
|
||
|
||
Pachinko
|
||
Digital Joypad/Keyboard Pachinko Joypad Buttons
|
||
Analog Joypad Forward Pachinko Analog Dial
|
||
|
||
Barcode Reader (Barcode Batter and Datach)
|
||
INS-Key Paste numeric ASCII string from clipboard and Send barcode
|
||
DEL-Key Manually Clear input buffer (without sending)
|
||
Keypad 0..9 Manually Key-in Barcode digits
|
||
Keypad Dot Manually Confirm input and Send (or re-send) barcode
|
||
Note: For the Barcode Battler, only EAN-13 is implemented (since it's unknown
|
||
how/if it supports shorter UPC-A, UPC-E, or EAN-8 barcodes). For Datach,
|
||
EAN-13, UPC-A, EAN-8 are supported (however, the Datach software seems to
|
||
support a further non-standard unknown barcode format, which isn't emulated).
|
||
|
||
Capcom Mahjong Controller
|
||
A..N Drop Card A..N (or N=Draw new card)
|
||
Space Same as N
|
||
F1..F7 Function Keys (Select, Start, and five "japanese" keys)
|
||
Tab/LeftCtrl Same as F1 (Select)
|
||
Enter Same as F2 (Enter)
|
||
|
||
Piano Keyboard
|
||
12345... 1st Octave (12 keys) (only last 7 keys used on Doremikko)
|
||
QWERT... 2nd Octave (12 keys) (all keys used)
|
||
ASDFG... 3rd Octave (12 keys) (all keys used)
|
||
ZXCVB... 4th Octave (10 keys) (only first 5 keys used on Doremikko)
|
||
Rshift/Ctrl 4th Octave (last 2) (Miracle only)
|
||
NUM-Dot 5th Octave (1 key) (Miracle only)
|
||
NUM-0..7 Control Buttons 0..7 (Miracle only)
|
||
Left Shift Sustain Foot Pedal (Miracle only)
|
||
Note: The miracle sound isn't emulated (as far as known there aren't any dumps
|
||
of it's BIOS and SOUND-ROM existing yet). The FDS sound for Doremikko isn't
|
||
emulated yet (when I last checked, there seems to have been little known about
|
||
FDS sound hardware).
|
||
|
||
Mats (Power Pad/Family Trainer/Tap-tap Mat)
|
||
QWER --> Upper row (Side B) RTYU --> Upper Row (Side A, or Tap-tap Mat)
|
||
ASDF --> Middle row (Side B) FGHJ --> Middle Row (Side A, or Tap-tap Mat)
|
||
ZXCV --> Lower row (Side B) VBNM --> Lower Row (Side A, or Tap-tap Mat)
|
||
Safety Note: Put the keyboard on the floor if you are using feet or hammer.
|
||
|
||
Exciting Boxing Bag
|
||
Num-7,8,9 Left Hook, N/A ,Right Hook
|
||
Num-4,5,6 Left Jabb, Straight ,Right Jabb
|
||
Num-1,2,3 Left Push, Body ,Right Push
|
||
|
||
RacerMate Bicycle Trainer
|
||
Gamepad Analog X Pulse
|
||
Gamepad Analog Y Speed
|
||
Gamepad Analog Z Watts
|
||
F1 or Enter Button F1 (START)
|
||
F2 Button F2 (DISPLAY)
|
||
F3 Button F3 (SET)
|
||
F4 or End Button RESET
|
||
PGUP or Up Button Plus (UP)
|
||
PGDN or Down Button Minus (DOWN)
|
||
|
||
XED Editor
|
||
----------
|
||
|
||
--> XED About
|
||
--> XED Hotkeys
|
||
--> XED Assembler/Debugger Interface
|
||
--> XED Commandline based standalone version
|
||
|
||
XED About
|
||
---------
|
||
|
||
About XED
|
||
XED is a text editor, the executable is fast and small, and it includes
|
||
comfortable editing functions. It is both intended for standard .TXT files (or
|
||
any other ASCII files, such like .ASM for assembler source code). Also, the
|
||
line-wrapping support (.XED files) can be used for authoring stories,
|
||
specifications, etc. Most of the features are much the same as for other text
|
||
editors, some special functions are pointed out below:
|
||
|
||
Block Selection
|
||
XED supports good old quality block mechanisms, allowing to copy/move the
|
||
selection directly to cursor position by Ctrl+K,C/V hotkeys (without needing to
|
||
use paste). For data exchange with other programs or text files, the block can
|
||
be directly written to (or loaded from) file by Ctrl+K,R/W. And, mainstream
|
||
copy/cut/paste functions are supported as well, by Ctrl+Ins, Shift+Del,
|
||
Shift+Ins.
|
||
Note: The block remains selected even when typing text, and it won't get
|
||
deleted when touching Del-key.
|
||
|
||
Condensed Display Mode
|
||
Condensed mode is activated by "F6,C" key combination. In this mode, only lines
|
||
beginning with colon ":", or (for assembler source code files) with
|
||
semicolon-colon ";:", for example:
|
||
:Chapter IV
|
||
;:---Sound Engine---
|
||
Normal block functions can be used in this mode to Move, Copy, or Delete whole
|
||
'chapter(s)'. Cursor keys can be used to move the cursor to a specific chapter.
|
||
Pushing Enter or Escape terminates condensed mode.
|
||
|
||
Column Block Mode
|
||
Column mode is activated by "Ctrl+K,N" key combination. In this mode, the block
|
||
selection appears as a rectangular area, allowing to deal with tables & columns
|
||
in text files by using copy/delete, indent/unindent block functions.
|
||
Typing "Ctrl+K,N" again will return to normal block mode (in which any lines
|
||
between begin/end of the block will be selected at full length).
|
||
|
||
Blank Space
|
||
Unlike most other editors, XED allows to move the cursor to any screen
|
||
location, including at horizontal positions after the end of the current line.
|
||
Entering space characters at such locations advances the cursor position, but
|
||
does not actually store space characters in the file.
|
||
When typing text, spaces are automatically inserted between line-end and cursor
|
||
position. Respectively, ending spaces are automatically deleted (eg. assume
|
||
that the line contains "Hello !", deleting "!" will also remove the space
|
||
character, internally).
|
||
That is of course all happening behind your back, you won't have to care about
|
||
it - but you can be sure that there'll be no hidden spaces filling up disk
|
||
space.
|
||
|
||
Tabulation Marks / TAB-Key
|
||
The TAB Key advances the cursor to the next higher tabulation location (usually
|
||
in steps of eight columns, counted from leftmost screen border), and the
|
||
appropriate number of spaces is inserted into the file if necessary.
|
||
In overwrite mode (de-/activated by INS Key), the TAB Key simply advances the
|
||
cursor without actually inserting spaces (and without overwriting existing text
|
||
by spaces).
|
||
|
||
Tabulation Marks / CHR(9)
|
||
When enabled in setup (default), TAB marks are automatically expanded into
|
||
appropriate number of spaces (ie. towards next "8-column" position) when
|
||
loading a file.
|
||
The file is normally saved by using raw SPC characters, without any TABs.
|
||
Optionally, it can be saved by using "best-fill" SPCs and TABs (disabled by
|
||
default), that feature may conflict with third party tools (assemblers,
|
||
compilers, etc). In order to reduce the risk of such problems, best-fill is
|
||
suppressed in quoted lines (by using ' or " or <> quotation marks, eg. db
|
||
'Hello !').
|
||
|
||
Line Wrapping
|
||
Line wrapping is enabled/disabled by "F5+W" key combination. Wrapping is
|
||
automatically enabled when loading a file with extension ".XED".
|
||
In the file, wrapped lines are using CR characters as soft linebreaks,
|
||
paragraphs are terminated by normal CR,LF characters.
|
||
Note: It'd be recommended to convert .XED files into 'standard' formats such
|
||
like .TXT or .HTM before releasing them, but preferably NOT into disliked
|
||
bloated file formats such like .PDF or .DOC.
|
||
|
||
Word Processing
|
||
Aside from the above line-wrapping support, no other 'word processing' features
|
||
are included, the program provides normal 'type writer' functions, not more,
|
||
not less. In particular, any overload such like bold or colored text, big and
|
||
small fonts, bitmaps and different fonts are disliked.
|
||
|
||
XED Hotkeys
|
||
-----------
|
||
|
||
XED recognizes both CP/M Wordstar hotkeys (also used by Borland PC compilers),
|
||
and Norton editor hotkeys (NU.EXE). The "Ctrl+X,Y" style hotkeys are wordstar
|
||
based, particulary including good block functions. The F4,X and Alt/Ctrl+X type
|
||
hotkeys are norton based, particulary very useful for forwards/backwards
|
||
searching.
|
||
|
||
Standard Cursor Keys
|
||
Up Move line up
|
||
Down Move line down
|
||
Left Move character left
|
||
Right Move character right
|
||
Pgup Scroll page up / to top of screen
|
||
Pgdn Scroll page down / to bottom of screen
|
||
Ctrl+Pgup Go to start of file (or Ctrl+Home)
|
||
Ctrl+Pgdn Go to end of file (or Ctrl+End)
|
||
Home Go to start of line
|
||
End Go to end of line
|
||
Ctrl+Left Move word left
|
||
Ctrl+Right Move word right
|
||
Ins Toggle Insert/Overwrite mode
|
||
Del Delete char below cursor
|
||
Backspace Delete char left of cursor
|
||
Tab Move to next tabulation mark
|
||
Enter New line/paragraph end
|
||
Esc Quit (or Alt+X, F3+Q, Ctrl+K+D, Ctrl+K+Q, Ctrl+K+X)
|
||
Note: Pgup/Pgdn are moving the cursor to top/bottom of screen, page scrolling
|
||
takes place only if the cursor was already at that location.
|
||
|
||
Editor Keys
|
||
Ctrl+Y Delete line (or Alt+K)
|
||
Alt+L Delete to line end (or Ctrl+Q,Y)
|
||
Alt+V Caseflip to line end
|
||
Ctrl+V Caseflip from line beginning
|
||
|
||
Norton Search/Replace Functions
|
||
Alt+F Norton - search/replace, forwards
|
||
Ctrl+F Norton - search/replace, backwards
|
||
Alt+C Norton - continue search/replace, forwards
|
||
Ctrl+C Norton - continue search/replace, backwards
|
||
Search: Type "Alt/Ctrl+F, String, Enter".
|
||
Search+replace: "Type Alt/Ctrl+F, String1, Alt+F, String2, Enter".
|
||
Non-case sensitive: Terminate by Escape instead of Enter.
|
||
|
||
Wordstar Search/Replace Functions
|
||
Ctrl+Q,F Wordstar - search
|
||
Ctrl+Q,A Wordstar - replace
|
||
Ctrl+L Wordstar - continue search/replace
|
||
Search options: B=Backwards, G=Global, N=No query,
|
||
U=non-casesensitive, W=whole words only, n=n times.
|
||
|
||
Disk Commands
|
||
F3,E Save+exit
|
||
F3,S Save (or Ctrl+K,S)
|
||
F3,N Edit new file
|
||
F3,A Append a file
|
||
See also: Block commands (read/write block).
|
||
|
||
Block Selection
|
||
Shift+Cursor Select block begin..end
|
||
Ctrl+K,B Set block begin (or F4,S)
|
||
Ctrl+K,K Set block end (or F4,S)
|
||
Ctrl+K,H Remove/hide block markers (or F4,R)
|
||
F4,L Mark line including ending CRLF (or Ctrl+K,L)
|
||
F4,E Mark line excluding ending CRLF
|
||
Ctrl+K,T Mark word
|
||
Ctrl+K,N Toggle normal/column blocktype
|
||
|
||
Clipboard Commands
|
||
Shift+Ins Paste from Clipboard
|
||
Shift+Del Cut to Clipboard
|
||
Ctrl+Ins Copy to Clipboard
|
||
Ctrl+Del Delete Block
|
||
|
||
Block Commands
|
||
Ctrl+K,C Copy block (or F4,C)
|
||
Ctrl+K,V Move block (or F4,M)
|
||
Ctrl+K,Y Delete block (or F4,D)
|
||
Ctrl+K,P Print block (or F7,B)
|
||
Ctrl+Q,B Find block begin (or F4,F)
|
||
Ctrl+Q,K Find block end (or F4,F)
|
||
Ctrl+K,R Read block from disk towards cursor location
|
||
Ctrl+K,W Write block to disk
|
||
Ctrl+K,U Unindent block (delete one space at begin of each line)
|
||
Ctrl+K,I Indent block (insert one space at begin of each line)
|
||
F5,F Format block (with actual x-wrap size) (or ;Ctrl+B)
|
||
F8,A Add values within column-block
|
||
|
||
Setup Commands
|
||
F11 Setup menu (or F8,S)
|
||
F5,S Save editor configuration
|
||
F5,L Set line len for word wrap (or Ctrl+O,R)
|
||
F5,W Wordwrap on/off (or Ctrl+O,W) (*)
|
||
F5,I Auto indent on/off (or Ctrl+O,I)
|
||
F5,T Set tab display spacing
|
||
(*) Wrapped lines will be terminated by CR, paragraphs by CRLF.
|
||
|
||
Other
|
||
F1 Help
|
||
F2 Status (displays info about file & currently selected block)
|
||
F8,M Make best fill tabs
|
||
F8,T Translate all tabs to spaces
|
||
SrcLock Freeze cursor when typing text ("useful" for backwards writing)
|
||
Ctrl+O,C Center current line
|
||
Ctrl+K,# Set marker (#=0..9)
|
||
Ctrl+Q,# Move to marker (#=0..9)
|
||
Ctrl+Q,P Move to previous pos
|
||
F6,C Condensed display mode on/off (*)
|
||
Ctrl+G Go to line nnnn (or F6,G) (or commandline switch /l:nnnn)
|
||
(*) only lines starting with ':' or ';:' will be displayed. cursor and block
|
||
commands can be used (e.g. to copy a text-sequence by just marking it's
|
||
headline)
|
||
|
||
Hex-Edit Keys (Binary Files)
|
||
This mode is activated by /b commandline switch, allowing to view and modify
|
||
binary files. Aside from normal cursor keys, the following hotkeys are used:
|
||
Tab Toggle between HEX and ASC mode (or Shift+Left/Right)
|
||
Ctrl+Arrow Step left/right one full byte (instead one single HEX digit)
|
||
Ctrl+G Goto hex-address
|
||
Ctrl+K,S Save file (as usually)
|
||
|
||
Printer Commands
|
||
F7,P Print file
|
||
F7,B Print block (or Ctrl+K,P)
|
||
F7,E Eject page
|
||
F7,S Set page size
|
||
More printer options can be found in setup. Printing was working well (at least
|
||
with my own printer) in older XED versions, but it is probably badly bugged (at
|
||
least untested) for years now.
|
||
|
||
XED Assembler/Debugger Interface
|
||
--------------------------------
|
||
|
||
Nocash Debuggers
|
||
The XED editor provides simple but very useful interaction with the various
|
||
nocash debuggers/emulators (no$gba, no$gmb, no$cpc, no$msx, no$c64, no$2k6,
|
||
no$zx, no$nes, no$sns, no$x51).
|
||
The editor can be launched from inside of the debugger (by Alt+E hotkey, by
|
||
retaining the recently edited line number when re-launching the editor).
|
||
And, when editing assembler source code files, F9-key can used to launch the
|
||
assembler from inside of XED. That is, the file is saved to disk, the A22i
|
||
assembler is started (built-in in all debuggers), and, in case of successful
|
||
assembly, the program is loaded & started in the emulator. Otherwise, the
|
||
assembler displays a list of errors, and the editor is moved directly to the
|
||
source code line number in which the first error has occured.
|
||
|
||
16bit DOS debuggers
|
||
The XED editor is included built-in in all nocash windows debuggers, and in the
|
||
no$gba 32bit DOS version only.
|
||
For use with other nocash 16bit DOS debuggers the XED editor must be downloaded
|
||
separately at http://problemkaputt.de/xed.htm, and must be installed in a
|
||
directory which is included in your PATH statement.
|
||
|
||
XED Commandline based standalone version
|
||
----------------------------------------
|
||
|
||
Standalone 16bit DOS version
|
||
This version is written in turbo pascal, nevertheless fast enough to work on
|
||
computer with less than 10MHz. It uses 16bit 8086 code, and works with all
|
||
80x86 compatible CPUs, including very old XTs.
|
||
The downside is that it is restricted to Conventional DOS Memory, so that the
|
||
maximum filesize is 640K (actually less, because the program and operating
|
||
system need to use some of that memory).
|
||
|
||
Using the 32bit debugger-built-in version as 32bit standalone editor
|
||
I haven't yet compiled a 32bit standalone version, however, any of the no$xxx
|
||
32bit debuggers can be used for that purpose. By commandline input:
|
||
no$xxx /x <filename> Edit text file in standalone mode
|
||
no$xxx /b <filename> Edit binary file in standalone hexedit mode
|
||
|
||
Standalone Commandline Syntax
|
||
Syntax: XED <filename> [/l:<line number>] | /?
|
||
<name> Filename, optionally d:\path\name.ext
|
||
/? Displays commandline help
|
||
/l:<nnn> Moves to line number nnn after loading
|
||
The filename does not require to include an extension, the program
|
||
automatically loads the first existing file with any of following extensions
|
||
appended: XED, ASM, ASC, INC, BAT, TXT, HTM, DOC, A22, PAS.
|
||
|
||
Standalone DOS Return Value
|
||
XED returns a three-byte return value after closing the program. This data is
|
||
used when calling XED as external editor from inside of nocash DOS debuggers,
|
||
but it might be also useful for other purposes.
|
||
Because normal DOS return values are limited to 8bits only, the three bytes are
|
||
written into video RAM at rightmost three character locations in first line:
|
||
VSEG:77*2 Exit code (00h=Exit normal, F9h=Exit by F9-key)
|
||
VSEG:78*2 Line number (Lower 8bits, 1..65536 in total)
|
||
VSEG:79*2 Line number (Upper 8bits)
|
||
The color attribute for these characters is set to zero (invisible, black on
|
||
black). Use INT 10h/AH=0Fh to determine the current video mode (AL AND 7Fh), if
|
||
it is monochrome (07h) then use VSEG=B000h, otherwise VSEG=B800h.
|
||
|
||
|
||
No$nes Emulation Files
|
||
----------------------
|
||
|
||
SLOT Folder
|
||
Default location for Game ROM-Images is "SLOT" folder (in same directory as
|
||
"no$nes.exe").
|
||
ZIPped ROM-Images can be loaded if PKUNZIP.EXE is installed (ie. it must be
|
||
somewhere in your "PATH") (if you don't know what that means, put it into a
|
||
folder like C:\WINDOWS\COMMAND or so).
|
||
|
||
BIOS Folder
|
||
The "BIOS" folder (in same directory as "no$nes.exe") should contain following
|
||
files:
|
||
DISKSYS.ROM 8Kbytes Famicom Disk System (FDS) BIOS
|
||
PC10BIOS.ROM 16Kbytes Playchoice 10 (PC10) BIOS (IC "8T")
|
||
PC10CHAR.ROM 24Kbytes Playchoice 10 (PC10) Charset (ICs "8P+8M+8K")
|
||
|
||
Playchoice 10 Games
|
||
PC10 games require the BIOS files (see above), and completely dumped ROMs. As
|
||
of 2012, most or all existing PC10 dumps are incomplete: They contain only the
|
||
NES PRG/CHR-ROMs, and the Z80 INST-ROM, but do miss the Z80 PROM (which is
|
||
absolutely required to use/decrypt the INST-ROMs). A tool for adding the
|
||
missing PROM data to existing ROM-images can be found here:
|
||
http://problemkaputt.de/pc10make.zip
|
||
|
||
Tech Data
|
||
---------
|
||
|
||
Overall Specs
|
||
CPU 2A03 - customized 6502 CPU - audio - does not contain support for decimal
|
||
The NTSC NES runs at 1.7897725MHz, and 1.662607MHz for PAL.
|
||
|
||
NMIs may be generated by PPU each VBlank.
|
||
IRQs may be generated by APU and by external hardware.
|
||
Internal Memory: 2K WRAM, 2K VRAM, 256 Bytes SPR-RAM, and Palette/Registers
|
||
|
||
The cartridge connector also passes audio in and out of the cartridge, to allow
|
||
for external sound chips to be mixed in with the Famicom audio.
|
||
|
||
Original Famicom (Family Computer) (1983) (Japan)
|
||
60-pin cartridge slot, with external sound-input, without lockout chip.
|
||
Two joypads directly attached to console, Joypad 1 with Start/Select buttons,
|
||
Joypad 2 with microphone, but without Start/Select. 15pin Expansion port for
|
||
further controllers. Video RF-Output only.
|
||
"During its first year, people found the Famicom to be unreliable, with
|
||
programming errors and freezing rampant. Yamauchi recalled all sold Famicom
|
||
systems, and put the Famicom out of production until the errors were fixed. The
|
||
Famicom was re-released with a new motherboard."
|
||
|
||
Original NES (Nintendo Entertainment System) (1985) (US, Europe, Australia)
|
||
Same as Famicom, but with slightly different pin-outs on cartridge slot, and
|
||
controllers/expansion ports: Front-loading 72-pin cartridge slot, without
|
||
external sound-input on cartridge slot, without microphone on joypads, with
|
||
lockout chip.
|
||
|
||
Newer Famicom, AV Famicom (1993-1995)
|
||
60-pin cartridge slot, with external sound-input, without lockout chip.
|
||
Includes NES-style joystick connectors, plus the original 15pin Famicom
|
||
Expansion port. Doesn't have microphone. Video AV-Output only.
|
||
|
||
Newer NES (1993-1995)
|
||
Top-loading 72-pin cartridge slot, without external sound-input, without
|
||
lockout chip. Poorer video signal than old NES. Video WHAT?-output only.
|
||
|
||
VS Unisystem
|
||
Arcade Machine. Coin-detect inputs, eight Dip-switches, different palette.
|
||
|
||
Play Choice 10
|
||
Arcade Machine with 10 cartridge slots. Uses Z80 as second CPU.
|
||
|
||
Memory Maps
|
||
-----------
|
||
|
||
Internal Memory: 2K WRAM, 2K VRAM, 256 Bytes SPR-RAM, and Palette/Registers
|
||
|
||
CPU Memory Map (16bit buswidth, 0-FFFFh)
|
||
0000h-07FFh Internal 2K Work RAM (mirrored to 800h-1FFFh)
|
||
2000h-2007h Internal PPU Registers (mirrored to 2008h-3FFFh)
|
||
4000h-4017h Internal APU Registers
|
||
4018h-5FFFh Cartridge Expansion Area almost 8K
|
||
6000h-7FFFh Cartridge SRAM Area 8K
|
||
8000h-FFFFh Cartridge PRG-ROM Area 32K
|
||
CPU Reset vector located at [FFFC], even smaller carts must have memory at that
|
||
location. Larger carts may use whatever external mappers to access more than
|
||
the usual 32K.
|
||
|
||
PPU Memory Map (14bit buswidth, 0-3FFFh)
|
||
0000h-0FFFh Pattern Table 0 (4K) (256 Tiles)
|
||
1000h-1FFFh Pattern Table 1 (4K) (256 Tiles)
|
||
2000h-23FFh Name Table 0 and Attribute Table 0 (1K) (32x30 BG Map)
|
||
2400h-27FFh Name Table 1 and Attribute Table 1 (1K) (32x30 BG Map)
|
||
2800h-2BFFh Name Table 2 and Attribute Table 2 (1K) (32x30 BG Map)
|
||
2C00h-2FFFh Name Table 3 and Attribute Table 3 (1K) (32x30 BG Map)
|
||
3000h-3EFFh Mirror of 2000h-2EFFh
|
||
3F00h-3F1Fh Background and Sprite Palettes (25 entries used)
|
||
3F20h-3FFFh Mirrors of 3F00h-3F1Fh
|
||
Note: The NES contains only 2K built-in VRAM, which can be used for whatever
|
||
purpose (for example, as two Name Tables, or as one Name Table plus 64 Tiles).
|
||
Palette Memory is built-in as well. Any additional VRAM (or, more regulary,
|
||
VROM) is located in the cartridge, which may also contain mapping hardware to
|
||
access more than 12K of video memory.
|
||
|
||
SPR-RAM Memory Map (8bit buswidth, 0-FFh)
|
||
00-FF Sprite Attributes (256 bytes, for 64 sprites / 4 bytes each)
|
||
Sprite RAM is directly built-in in the PPU chip. SPR-RAM is not connected to
|
||
CPU or PPU bus, and can be accessed via I/O Ports only.
|
||
|
||
I/O Map
|
||
-------
|
||
|
||
I/O Map
|
||
2000h - PPU Control Register 1 (W)
|
||
2001h - PPU Control Register 2 (W)
|
||
2002h - PPU Status Register (R)
|
||
2003h - SPR-RAM Address Register (W)
|
||
2004h - SPR-RAM Data Register (RW)
|
||
2005h - PPU Background Scrolling Offset (W2)
|
||
2006h - VRAM Address Register (W2)
|
||
2007h - VRAM Read/Write Data Register (RW)
|
||
4000h - APU Channel 1 (Rectangle) Volume/Decay (W)
|
||
4001h - APU Channel 1 (Rectangle) Sweep (W)
|
||
4002h - APU Channel 1 (Rectangle) Frequency (W)
|
||
4003h - APU Channel 1 (Rectangle) Length (W)
|
||
4004h - APU Channel 2 (Rectangle) Volume/Decay (W)
|
||
4005h - APU Channel 2 (Rectangle) Sweep (W)
|
||
4006h - APU Channel 2 (Rectangle) Frequency (W)
|
||
4007h - APU Channel 2 (Rectangle) Length (W)
|
||
4008h - APU Channel 3 (Triangle) Linear Counter (W)
|
||
4009h - APU Channel 3 (Triangle) N/A (-)
|
||
400Ah - APU Channel 3 (Triangle) Frequency (W)
|
||
400Bh - APU Channel 3 (Triangle) Length (W)
|
||
400Ch - APU Channel 4 (Noise) Volume/Decay (W)
|
||
400Dh - APU Channel 4 (Noise) N/A (-)
|
||
400Eh - APU Channel 4 (Noise) Frequency (W)
|
||
400Fh - APU Channel 4 (Noise) Length (W)
|
||
4010h - APU Channel 5 (DMC) Play mode and DMA frequency (W)
|
||
4011h - APU Channel 5 (DMC) Delta counter load register (W)
|
||
4012h - APU Channel 5 (DMC) Address load register (W)
|
||
4013h - APU Channel 5 (DMC) Length register (W)
|
||
4014h - SPR-RAM DMA Register (W)
|
||
4015h - DMC/IRQ/length counter status/channel enable register (RW)
|
||
4016h - Joypad #1 (RW)
|
||
4017h - Joypad #2/APU SOFTCLK (RW)
|
||
Additionally, external hardware may contain further ports:
|
||
4020h - VS Unisystem Coin Acknowledge
|
||
4020h-40FFh - Famicom Disk System (FDS)
|
||
4100h-FFFFh - Various addresses used by various cartridge mappers
|
||
|
||
Picture Processing Unit (PPU)
|
||
-----------------------------
|
||
|
||
--> PPU Reset
|
||
--> PPU Control and Status Registers
|
||
--> PPU SPR-RAM Access Registers
|
||
--> PPU VRAM Access Registers
|
||
--> PPU Scrolling
|
||
--> PPU Tile Memory
|
||
--> PPU Background
|
||
--> PPU Sprites
|
||
--> PPU Palettes
|
||
--> PPU Dimensions & Timings
|
||
|
||
Based on "Nintendo Entertainment System Documentation" Version 2.00 by Jeremy
|
||
Chadwick aka Y0SHi aka JDC. Which was itself based on "Nintendo Entertainment
|
||
System Architecture" by Marat Fayzullin.
|
||
|
||
--> 3D Glasses
|
||
|
||
PPU Reset
|
||
---------
|
||
|
||
Registers
|
||
Some registers are reset to zero upon reset; namely NMIs are disabled. Other
|
||
registers are kept unchanged (or contain semi-stable initial values on
|
||
Power-Up).
|
||
|
||
Locked Registers
|
||
During first frame after Reset, Ports 2000h, 2001h, 2005h, and 2006h are
|
||
reportedly write-protected. And, Port 2007h is read-protected (always returns
|
||
00h, even if all VRAM at 0000h..3FFFh is FFh-filled, and even if the 2007h
|
||
prefetch latch was pre-loaded with a nonzero value before reset; the origin of
|
||
the 00h is unknown, it might be an open-bus value).
|
||
The read/write protection is released when:
|
||
NTSC: At END of First Vblank (261 scanlines after reset)
|
||
PAL: At END of First Vblank (311 scanlines after reset)
|
||
|
||
PPU Control and Status Registers
|
||
--------------------------------
|
||
|
||
2000h - PPU Control Register 1 (W)
|
||
Bit7 Execute NMI on VBlank (0=Disabled, 1=Enabled)
|
||
Bit6 PPU Master/Slave Selection (0=Master, 1=Slave) (Not used in NES)
|
||
Bit5 Sprite Size (0=8x8, 1=8x16)
|
||
Bit4 Pattern Table Address Background (0=VRAM 0000h, 1=VRAM 1000h)
|
||
Bit3 Pattern Table Address 8x8 Sprites (0=VRAM 0000h, 1=VRAM 1000h)
|
||
Bit2 Port 2007h VRAM Address Increment (0=Increment by 1, 1=Increment by 32)
|
||
Bit1-0 Name Table Scroll Address (0-3=VRAM 2000h,2400h,2800h,2C00h)
|
||
(That is, Bit0=Horizontal Scroll by 256, Bit1=Vertical Scroll by 240)
|
||
|
||
2001h - PPU Control Register 2 (W)
|
||
Bit7-5 Color Emphasis (0=Normal, 1-7=Emphasis) (see Palettes chapter)
|
||
Bit4 Sprite Visibility (0=Not displayed, 1=Displayed)
|
||
Bit3 Background Visibility (0=Not displayed, 1=Displayed)
|
||
Bit2 Sprite Clipping (0=Hide in left 8-pixel column, 1=No clipping)
|
||
Bit1 Background Clipping (0=Hide in left 8-pixel column, 1=No clipping)
|
||
Bit0 Monochrome Mode (0=Color, 1=Monochrome) (see Palettes chapter)
|
||
If both sprites and BG are disabled (Bit 3,4=0) then video output is disabled,
|
||
and VRAM can be accessed at any time (instead of during VBlank only). However,
|
||
SPR-RAM does no longer receive refresh cycles, and its content will gradually
|
||
degrade when the display is disabled.
|
||
|
||
2002h - PPU Status Register (R)
|
||
Bit7 VBlank Flag (1=VBlank)
|
||
Bit6 Sprite 0 Hit (1=Background-to-Sprite0 collision)
|
||
Bit5 Lost Sprites (1=More than 8 sprites in 1 scanline)
|
||
Bit4-0 Not used (Undefined garbage)
|
||
Reading resets the 1st/2nd-write flipflop (used by Port 2005h and 2006h).
|
||
Reading resets Bit7, can be used to acknowledge NMIs, Bit7 is also
|
||
automatically reset at the end of VBlank, so manual acknowledge is normally not
|
||
required (unless one wants to free the NMI signal for external NMI inputs) (and
|
||
unless one wants to disable/reenable NMIs during NMI handling, in that case
|
||
Bit7 MUST be acknowledge before reenabling NMIs, else NMI would be executed
|
||
another time).
|
||
|
||
Status Notes
|
||
VBlank flag is set in each frame, even if the display is fully disabled, and
|
||
even if NMIs are disabled. Hit flag may become set only if both BG and OBJ are
|
||
enabled. Lost Sprites flag may become set only if video is enabled (ie. BG or
|
||
OBJ must be on). For info about the "Not used" status bits, and some other PPU
|
||
bits see:
|
||
--> Unpredictable Things
|
||
|
||
VS System
|
||
Some VS System PPUs have Port 2000h/2001h swapped, and do have a Chip ID in
|
||
LSBs of 2002h. For details, see
|
||
--> VS System
|
||
|
||
PPU SPR-RAM Access Registers
|
||
----------------------------
|
||
|
||
2003h - SPR-RAM Address Register (W)
|
||
D7-D0: 8bit address in SPR-RAM (00h-FFh)
|
||
Specifies the destination address in Sprite RAM for use with Port 2004h (Single
|
||
byte write), and Port 4014h (256 bytes DMA transfer).
|
||
This register is internally used during rendering (and typically contains 00h
|
||
at the begin of the VBlank period).
|
||
|
||
2004h - SPR-RAM Data Register (Read/Write)
|
||
D7-D0: 8bit data written to SPR-RAM.
|
||
Read/write data to/from selected address in Sprite RAM.
|
||
The Port 2003h address is auto-incremented by 1 after each <write> to 2004h.
|
||
The address is NOT auto-incremented after <reading> from 2004h.
|
||
Caution: Single byte access via 2004h is somewhat working, but DMA via 4014h is
|
||
more robust.
|
||
|
||
4014h - Sprite DMA Register (W)
|
||
Transfers 256 bytes from CPU Memory area into SPR-RAM. The transfer takes 512
|
||
CPU clock cycles, two cycles per byte, the transfer starts about immediately
|
||
after writing to 4014h: The CPU either fetches the first byte of the next
|
||
instruction, and then begins DMA, or fetches and executes the next instruction,
|
||
and then begins DMA. The CPU is halted during transfer.
|
||
Bit7-0 Upper 8bit of source address (Source=N*100h) (Lower bits are zero)
|
||
Data is written to Port 2004h. The destination address in SPR-RAM is thus
|
||
[2003h], which should be normally initialized to zero - unless one wants to
|
||
"rotate" the target area, which may be useful when implementing more than eight
|
||
(flickering) sprites per scanline.
|
||
|
||
Notes
|
||
SPR-RAM should be accessed during VBlank only, preferably by issuing Sprite DMA
|
||
at begin of Vblank.
|
||
SPR-RAM is dynamic memory, refreshed during rendering, it does no longer
|
||
receive refresh cycles (and will lose its content quickly within about a frame)
|
||
when the display is disabled (by clearing both Bit3+Bit4 in Port 2001h).
|
||
PAL issues another refresh somewhere mid-vblank even when display disabled?
|
||
NTSC doesn't do so and tends to forget data more easily - using DMA to rewrite
|
||
sprite memory on vblank is somewhat forcefully fixing that issue.
|
||
|
||
Port 2003h/2004h are internally used during rendering. The unlicensed game
|
||
Micro Machines is reading 2004h to determine the currently rendered line,
|
||
however, that doesn't work with all PPU revisions and PPU clones.
|
||
|
||
PPU VRAM Access Registers
|
||
-------------------------
|
||
|
||
Registers used to Read and Write VRAM data, and for Background Scrolling.
|
||
The CPU can Read/Write VRAM during VBlank only - because the PPU permanently
|
||
accesses VRAM during rendering (even in HBlank phases), and because the PPU
|
||
uses the VRAM Address register as scratch pointer. Respectively, the address in
|
||
Port 2006h is destroyed after rendering, and must be re-initialized before
|
||
using Port 2007h.
|
||
|
||
1st/2nd Write
|
||
Below Port 2005h and 2006h require two 8bit writes to receive a 16bit
|
||
parameter, the current state (1st or 2nd write) is memorized in a single
|
||
flipflop, which is shared for BOTH Port 2005h and 2006h. The flipflop is reset
|
||
when reading from PPU Status Register Port 2002h (the next write will be then
|
||
treated as 1st write) (and of course it is also reset after any 2nd write).
|
||
|
||
2005h - PPU Background Scrolling Offset (W2)
|
||
Defines the coordinates of the upper-left background pixel, together with PPU
|
||
Control Register 1, Port 2000h, Bits 0-1).
|
||
Port 2005h-1st write: Horizontal Scroll Origin (X*1) (0-255)
|
||
Port 2005h-2nd write: Vertical Scroll Origin (Y*1) (0-239)
|
||
Port 2000h-Bit0: Horizontal Name Table Origin (X*256)
|
||
Port 2000h-Bit1: Vertical Name Table Origin (Y*240)
|
||
Caution: The above scroll reload settings are overwritten by writes to Port
|
||
2006h. See PPU Scrolling chapter for more info.
|
||
|
||
2006h - VRAM Address Register (W2)
|
||
Used to specify the 14bit VRAM Address for use with Port 2007h.
|
||
Port 2006h-1st write: VRAM Address Pointer MSB (6bit)
|
||
Port 2006h-2nd write: VRAM Address Pointer LSB (8bit)
|
||
Caution: Writes to Port 2006h are overwriting scroll reload bits (in Port 2005h
|
||
and Bit0-1 of Port 2000h). And, the PPU uses the Port 2006h register internally
|
||
during rendering, when the display is enabled one should thus reinitialize Port
|
||
2006h at begin of VBlank before accessing VRAM via Port 2007h.
|
||
|
||
2007h - VRAM Read/Write Data Register (RW)
|
||
The PPU will auto-increment the VRAM address (selected via Port 2006h) after
|
||
each read/write from/to Port 2007h by 1 or 32 (depending on Bit2 of $2000).
|
||
Bit7-0 8bit data read/written from/to VRAM
|
||
Caution: Reading from VRAM 0000h-3EFFh loads the desired value into a latch,
|
||
and returns the OLD content of the latch to the CPU. After changing the address
|
||
one should thus always issue a dummy read to flush the old content. However,
|
||
reading from Palette memory VRAM 3F00h-3FFFh, or writing to VRAM 0000-3FFFh
|
||
does directly access the desired address.
|
||
Note: Some (maybe all) RGB PPUs (as used in Famicom Titler) do not allow to
|
||
read palette memory (instead, they appear to mirror 3Fxxh to 2Fxxh).
|
||
|
||
Caution
|
||
The APU (if DMC sound is used) can conflict with joypad reads! For details,
|
||
see:
|
||
--> APU DMC-DMA Glitch
|
||
|
||
PPU Scrolling
|
||
-------------
|
||
|
||
The PPU allows to scroll the background pixelwise horizontally and vertically.
|
||
The total scroll-able area is 512x480 pixels (though the full size can be
|
||
usedwith external memory only, see Name Tables chapter), of which circa 256x240
|
||
pixels are displayed (see visible screen resolution).
|
||
|
||
Vertical offsets 240-255 (aka Tile Rows 30-31) will cause garbage Tile numbers
|
||
to be fetched from the Attribute Table (instead of from Name Table), after line
|
||
255 it will wrap to line 0, but without producing a carry-out to the Name Table
|
||
Address.
|
||
|
||
Scroll Pointer and Reload Registers
|
||
Scrolling relies on a Pointer register (Port 2006h), and on a Reload register
|
||
(Port 2005h, and Bit0-1 of Port 2000h). The Pointer is automatically
|
||
incremented by the hardware during rendering, and points to the currently drawn
|
||
tile row, the same pointer register is also used by software to access VRAM
|
||
during VBlank or when the display is disabled. The Reload value defines the
|
||
horizontal and vertical origin of upper-left pixel, the reload value is
|
||
automatically loaded into the Pointer at the end of the vblank period (vertical
|
||
reload bits), and at the begin of each scanline (horizontal reload bits). The
|
||
relation between Pointer and Reload bits is:
|
||
VRAM-Pointer Scroll-Reload
|
||
A8 2006h/1st-Bit0 <--> Y*64 2005h/2nd-Bit6
|
||
A9 2006h/1st-Bit1 <--> Y*128 2005h/2nd-Bit7
|
||
A10 2006h/1st-Bit2 <--> X*256 2000h-Bit0
|
||
A11 2006h/1st-Bit3 <--> Y*240 2000h-Bit1
|
||
A12 2006h/1st-Bit4 <--> Y*1 2005h/2nd-Bit0
|
||
A13 2006h/1st-Bit5 <--> Y*2 2005h/2nd-Bit1
|
||
- 2006h/1st-Bit6 <--> Y*4 2005h/2nd-Bit2
|
||
- 2006h/1st-Bit7 <--> - -
|
||
A0 2006h/2nd-Bit0 <--> X*8 2005h/1st-Bit3
|
||
A1 2006h/2nd-Bit1 <--> X*16 2005h/1st-Bit4
|
||
A2 2006h/2nd-Bit2 <--> X*32 2005h/1st-Bit5
|
||
A3 2006h/2nd-Bit3 <--> X*64 2005h/1st-Bit6
|
||
A4 2006h/2nd-Bit4 <--> X*128 2005h/1st-Bit7
|
||
A5 2006h/2nd-Bit5 <--> Y*8 2005h/2nd-Bit3
|
||
A6 2006h/2nd-Bit6 <--> Y*16 2005h/2nd-Bit4
|
||
A7 2006h/2nd-Bit7 <--> Y*32 2005h/2nd-Bit5
|
||
- - <--> X*1 2005h/1st-Bit0
|
||
- - <--> X*2 2005h/1st-Bit1
|
||
- - <--> X*4 2005h/1st-Bit2
|
||
|
||
Port 2006h-1st Write (VRAM Pointer MSB)
|
||
As one might (not) have expected, this does NOT change the VRAM Pointer,
|
||
instead, the written value is stored in the corresponding Reload bits (Port
|
||
2005h/2000h settings), the VRAM pointer is left unchanged for now.
|
||
|
||
Port 2006h-2nd Write (VRAM Pointer LSB)
|
||
The written value is stored in the VRAM Pointer LSB Bits (and maybe also in the
|
||
corresponding Reload bits ?). And, the VRAM Pointer MSB is now loaded from the
|
||
corresponding Reload bits (ie. the value from the previous Port 2006h-1st Write
|
||
is applied now).
|
||
|
||
Port 2005h-1st Write (Horizontal Scroll Origin, X*1, 0-255)
|
||
Port 2005h-2nd Write (Vertical Scroll Origin, Y*1, 0-239)
|
||
Port 2000h-Bit0 (Horizontal Name Table Origin, X*256)
|
||
Port 2000h-Bit1 (Vertical Name Table Origin, Y*240)
|
||
Writing to these registers changes the Reload value bits only, the VRAM Pointer
|
||
is left unchanged (except for indirect changes at times when the Reload value
|
||
is loaded into the Pointer during rendering).
|
||
|
||
Full-screen and Mid-frame Scrolling
|
||
Simple full-screen scrolling can be implemented by initializing the Reload
|
||
value via Ports 2005h and 2000h. Many games change the scroll settings
|
||
mid-frame to split the screen into a scrolled and non-scrolled area: The
|
||
Horizontal bits can be changed by re-writing the Reload value via Ports 2005h
|
||
and 2000h, the vertical bits by re-writing the Pointer value via Port 2006h.
|
||
Changing both horizontal and vertical bits is possible by mixed writes to Port
|
||
2005h and 2006h, for example:
|
||
[2006h.1st]=(X/256)*4 + (Y/240)*8
|
||
[2005h.2nd]=((Y MOD 240) AND C7h)
|
||
[2005h.1st]=(X AND 07h)
|
||
[2006h.2nd]=(X AND F8h)/8 + ((Y MOD 240) AND 38h)*4
|
||
Notes: In that example, most bits are updated twice, once via 2006h and once
|
||
via 2005h, above shows only the relevant bits, the other bits would be don't
|
||
care (eg. writing unmasked values to 2005h would be faster, and wouldn't change
|
||
the functionality). The 1st/2nd-write-flipflop is toggled on each of the four
|
||
writes, so that above does <first> change 2005h-2nd-write, and <then>
|
||
2005h-1st-write.
|
||
|
||
Pointer Increment/Reload during Rendering
|
||
During rendering, A4-A0 is incremented per tile, with carry-out to A10, at end
|
||
of HBlank A4-A0 and A10 are reset to the Reload value. "A14-A12" are used as
|
||
LSBs of Tile Data address, these bits are incremented per scanline, with
|
||
carry-out to tile row A9-A5, the tile row wraps from 29 to 0 with carry-out to
|
||
A11.
|
||
Note: Initializing the tile row to 30 or 31 will display garbage tiles (fetched
|
||
from Attribute table area), in that case the row wraps from 31 to 0, but
|
||
without carry-out to A11.
|
||
|
||
PPU Tile Memory
|
||
---------------
|
||
|
||
PPU 0000h-0FFFh - Pattern Table 0 (4K) (256 Tiles)
|
||
PPU 1000h-1FFFh - Pattern Table 1 (4K) (256 Tiles)
|
||
|
||
Pattern Table Format
|
||
Each pattern table contains 256 tiles. When using both pattern table 0 and 1,
|
||
up to 512 tiles can be used for Background and Sprites.
|
||
Each tile consists of a 8x8 pixel bitmap with 2bit depth (4 colors). Each tile
|
||
occopies 16 bytes, the first 8 bytes contain color bit 0 for each pixel, the
|
||
next 8 bytes color bit 1. Each byte defines a row of 8 pixels (MSB left).
|
||
|
||
Pattern Table Memory
|
||
The console does NOT include built-in Pattern Table Memory. Instead, Pattern
|
||
tables are located in the cartridge, usually in a separate ROM chip, or (less
|
||
often) in a SRAM chip. Cartridges with more than 8K Pattern memory may contain
|
||
whatever mapping mechanisms to map the memory into the PPU 8K Pattern Memory
|
||
area.
|
||
There are some special mappers that do automatically change the CHR banks
|
||
during rendering (allowing to access more than 8K in one frame):
|
||
--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc.
|
||
--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH
|
||
--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH
|
||
--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH
|
||
Cartridges with CHR-RAM (instead CHR-ROM) usually have 8K RAM, but there also a
|
||
few with 16K, 32K or 64K RAM:
|
||
--> Mapper 13: CPROM - 16K VRAM
|
||
--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH
|
||
--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ
|
||
|
||
PPU Background
|
||
--------------
|
||
|
||
PPU 2000h-23FFh - Name Table 0 and Attribute Table 0 (1K)
|
||
PPU 2400h-27FFh - Name Table 1 and Attribute Table 1 (1K)
|
||
PPU 2800h-2BFFh - Name Table 2 and Attribute Table 2 (1K)
|
||
PPU 2C00h-2FFFh - Name Table 3 and Attribute Table 3 (1K)
|
||
PPU 3000h-3EFFh - Mirror of 2000h-2EFFh
|
||
|
||
Name Table Format
|
||
Each Name Table occupies 3C0h bytes, containing 8bit tile numbers for 32x30
|
||
tiles (256x240 pixels). The tiles are fetched from Pattern Table 0 or 1
|
||
(depending on Bit 4 in PPU Control Register 1). Note that NTSC displays may be
|
||
unable to display the whole 256x240 pixels, basically the relevant portion of
|
||
screen output should be in the <middle> 32x28 tiles (256x224 pixels) see PPU
|
||
Dimensions and Timings chapter for more info.
|
||
|
||
Attribute Table Format
|
||
Each Name Table is directly followed by an Attribute Table of 40h bytes,
|
||
containing 2bit background palette numbers for each 16x16 pixel field. Each
|
||
byte in the Attribute table defines palette numbers for a 32x32 pixel area:
|
||
Bit0-1 Palette Number for upperleft 16x16 pixels of the 32x32 area
|
||
Bit2-3 Palette Number for upperright 16x16 pixels of the 32x32 area
|
||
Bit4-5 Palette Number for lowerleft 16x16 pixels of the 32x32 area
|
||
Bit6-7 Palette Number for lowerright 16x16 pixels of the 32x32 area
|
||
Note: Attributes for each 8x1 pixel row are fetched from cartridge bus. The
|
||
MMC5 Mapper with EXRAM allows to use different palettes for each 8x8 pixel
|
||
tile, instead of sharing one palette for above 16x16 areas.
|
||
|
||
Background Scrolling
|
||
Scrolling origin is defined by the Name Table selection in Bit0-1 of $2000, and
|
||
by offsets in $2005, of which Horizontal offsets may range in 0-255, vertical
|
||
offsets in 0-239; values above 239 are considered negative (eg. 248 is -8). The
|
||
picture wraps to the next Name Table when drawing exceeds the boundaries of the
|
||
current Name Table...
|
||
|
||
Multiple Name Tables
|
||
The NES has the capability of addressing up to four Name Tables (NT0-3),
|
||
allowing to define backgrounds of up to 512x480 pixels, arranged as such:
|
||
Square Horizontal Scroll Vertical Scroll
|
||
NT0 NT1 NT0 left/right NT1 NT0 above/below NT2
|
||
NT2 NT3 NT2 left/right NT3 NT1 above/below NT3
|
||
However, the NES includes only 2K VRAM, so that not more than two Name Tables
|
||
can be used (unless the cartridge includes external Name Table memory).
|
||
|
||
Name Table Mapping/Mirroring
|
||
The NES outputs the desired Name Table number (NT0-3) to the cartridge, which
|
||
may then respond by selecting one of the two internal 1K RAM blocks (BLK0-1),
|
||
or by presenting an external RAM/ROM block (eg. BLK2-3). Examples:
|
||
_Name Table____________NT0___NT1___NT2___NT3___Purpose______________
|
||
Horizontal Mirroring BLK0 BLK0 BLK1 BLK1 Vertical Scrolling
|
||
Vertical Mirroring BLK0 BLK1 BLK0 BLK1 Horizontal Scrolling
|
||
Four-screen BLK0 BLK1 BLK2 BLK3 Four-Way Scrolling
|
||
When using only the internal blocks, the cartridge may use a simple hardwired
|
||
connection between two pins to select horizontal or vertical mirroring. Also,
|
||
the cartridge may contain whatever circuits to map Single-Screen or CHR-ROM to
|
||
whatever addresses dependently or independently of the selected NT number.
|
||
|
||
Background Clipping
|
||
The PPU allows to mask the left 8 pixels of BG, allowing to use horizontal
|
||
scrolling with only one Name Table, the 16pix-width palette attribute isn't
|
||
fully clipped though. Also, BG could be vertically clipped by software, which
|
||
would require accurate timing though. Aside from that, it'd be no problem to
|
||
implement four-way scrolling by using only one name table.
|
||
|
||
PPU Sprites
|
||
-----------
|
||
|
||
SPR-RAM 00-FF - Sprite Attributes (256 bytes, for 64 sprites / 4 bytes each)
|
||
|
||
The PPU supports 64 sprites, which can be either 8x8 or 8x16 pixels in size,
|
||
only 8 sprites can be displayed per scanline. The sprite Tile bitmaps are kept
|
||
within the Pattern Table region of VRAM (which is also used for BG Tiles).
|
||
|
||
Sprite-RAM is built-in in the PPU-chip, and can be accessed via I/O ports only
|
||
(it is not part of the PPU or CPU memory area). Each four bytes in SPR-RAM
|
||
define attributes for one sprite, bytes 0-3 for sprite 0, up to bytes FCh-FFh
|
||
for sprite 63.
|
||
|
||
SPR-RAM Byte 0 - Y Coordinate Minus 1
|
||
Vertical Position-1 (FFh,00h..EEh=Scanline 0..239, EFh..FEh=Not displayed)
|
||
The sprites can be moved bottom-offscreen, but cannot be moved top-offscreen.
|
||
|
||
SPR-RAM Byte 1 - Tile Number
|
||
In 8x8 pixel mode (PPU Control Register 1, Bit5=0):
|
||
Bit7-0 Specifies 8bit tile number
|
||
And, Pattern Table selected by Bit 3 in PPU Control Register 1
|
||
In 8x16 pixel mode (PPU Control Register 1, Bit5=1):
|
||
Bit7-1 Upper 7bit of tile number (N=0-127 uses Tiles N*2 and N*2+1)
|
||
Bit0 Pattern Table Address (0=VRAM 0000h, 1=VRAM 1000h)
|
||
|
||
SPR-RAM Byte 2 - Attributes
|
||
7 Vertical Flip (0=Normal, 1=Mirror)
|
||
6 Horizontal Flip (0=Normal, 1=Mirror)
|
||
5 Background Priority (0=Sprite in front of BG, 1=Sprite Behind BG)
|
||
4-2 Not used (Always zero when reading from SPR-RAM)
|
||
1-0 Sprite Palette (0-3=Sprite Palette 0-3)
|
||
|
||
SPR-RAM Byte 3 - X Coordinate
|
||
Horizontal Position (00h..FFh)
|
||
Sprites can be moved right-offscreen, and clipping via Port 2001h also allows
|
||
to move sprites somewhat left-offscreen.
|
||
|
||
Sprite Priorites
|
||
If two or more non-transparent sprite-pixels overlap, then only the sprite with
|
||
highest priority is processed. If the sprites background priority bit is set to
|
||
"Behind BG", then it will be hidden behind any non-transparent background
|
||
pixels.
|
||
Sprite 0 = highest priority
|
||
Sprite 63 = lowest priority
|
||
Mind that the PPU processes ONLY the sprite with highest priority, eg. if a
|
||
non-transparent pixel of sprite 5 hides "Behind BG", then sprite 6-63 won't be
|
||
displayed (even if they are "In Front of BG").
|
||
|
||
Sprite 0 Hit Flag (Collision Check between BG and Sprite 0)
|
||
The Hit Flag, Bit 6 of register 2002h, gets set when the cathode ray beam
|
||
passes a non-transparent Sprite 0 pixel which is overlapping a non-transparent
|
||
BG pixel (regardless the sprites BG priority).
|
||
The Hit Flag is automatically reset at the end of the VBlank period, it cannot
|
||
be set or reset by software, that means one can detect only one Hit per frame.
|
||
Aside from a normal collision detection, the Hit Flag is also useful to detect
|
||
when the cathode ray beam has reached a specific screen location, eg. to split
|
||
the picture into a scrolled and non-scrolled section.
|
||
|
||
Color 1 or color 2 are (NOT) non-nontransparent (?)
|
||
|
||
PPU Palettes
|
||
------------
|
||
|
||
PPU 3F00h-3F1Fh - Background and Sprite Palettes
|
||
|
||
Palette Memory (25 entries used)
|
||
3F00h Background Color (Color 0)
|
||
3F01h-3F03h Background Palette 0 (Color 1-3)
|
||
3F05h-3F07h Background Palette 1 (Color 1-3)
|
||
3F09h-3F0Bh Background Palette 2 (Color 1-3)
|
||
3F0Dh-3F0Fh Background Palette 3 (Color 1-3)
|
||
3F11h-3F13h Sprite Palette 0 (Color 1-3)
|
||
3F15h-3F17h Sprite Palette 1 (Color 1-3)
|
||
3F19h-3F1Bh Sprite Palette 2 (Color 1-3)
|
||
3F1Dh-3F1Fh Sprite Palette 3 (Color 1-3)
|
||
|
||
Palette Gaps, Mirrors, and Unused Entries
|
||
3F04h,3F08h,3F0Ch - Three general purpose 6bit data registers.
|
||
3F10h,3F14h,3F18h,3F1Ch - Mirrors of 3F00h,3F04h,3F08h,3F0Ch.
|
||
3F20h-3FFFh - Mirrors of 3F00h-3F1Fh.
|
||
|
||
Palette Entries
|
||
Bit7-6 Not used (contains garbage when reading palette memory)
|
||
Bit5-4 Luminance (Grayscale) (0-3)
|
||
Bit3-0 Chrominance (Color) (0-F)
|
||
|
||
The Color values are based on the NTSC color-wheel (even on PAL consoles):
|
||
|__0__|__1___2___3___4___5___6___7___8___9___A___B___C_|_D__|__E___F__|
|
||
|White|..Blue..Magenta..Red......Yellow...Green....Blue|Gray| Black |
|
||
Color and Grayscale (0-3) can be combined as such:
|
||
Luminance__0Xh_______1Xh__________2Xh_________3Xh___________________
|
||
Color 0: Med Gray, Light Gray, White, White
|
||
Color 1-C: (Dark), (Normal), (Brighter), (Brightest/Pastelized)
|
||
Color D: Reserved, Black, Dark Gray, Lighter Gray
|
||
Color E-F: Black, Black, Black, Black
|
||
Some black/white colors are duplictated, one should normally use 0Eh or 0Fh as
|
||
black. Of the two Light Grays, 3Dh is slightly brighter than 10h. The Reserved
|
||
color is Blacker-than-black, producing a very low voltage, which some monitors
|
||
may or may not treat to be a sync signal rather than a color.
|
||
|
||
Monochrome Television Set (nine different grayshades)
|
||
On mono TV sets, Colors 0 and D-F can be used for Black/Gray/White colors as
|
||
usually, and Colors 1-C are all displayed as grayshades: 01h-0Ch=Black,
|
||
11h-1Ch=Med/Dark Gray, 21h-2Ch=Med/Light Gray, 31h-3Ch=Bright Gray. Intensity
|
||
ramp example: 0Eh, 2Dh, 11h, 00h, 21h, 01h, 3Dh, 31h, 30h. Also, the Color
|
||
Emphasis bits are somewhat affecting the luminance output, even on mono
|
||
television sets.
|
||
|
||
Monochrome Bit (three different grayshades)
|
||
When Port 2001h/Bit0 is set: The lower 4bits of all palette entries are treated
|
||
to be zero; this affects both memory reads and video output.
|
||
For memory reads, the 6bit values are ANDed with 30h when trying to read
|
||
palette data via Port 2007h.
|
||
For video output, only 3 colors can be displayed: Gray, Light Gray, and White.
|
||
All other colors cannot be used (even Black and Dark Gray are disabled). The
|
||
Color Emphasis bits can be still used (eg. to change above 3 gray-shades into 3
|
||
pastelized green-shades).
|
||
|
||
Color Emphasis Bits
|
||
Port 2001h/Bit7-5 allow to adjust the palette, eg. with setting 001b the whole
|
||
picture becomes more green.
|
||
000b Normal
|
||
001b Green
|
||
010b Brown
|
||
100b Blue
|
||
To play by the rules, one should reportedly not set more than one of the
|
||
emphasis bits at once, setting two or more bits may shortcut something inside
|
||
the PPU, though it doesn't seem to damage the chip.
|
||
|
||
Border Color and Clipping Colors
|
||
The screen border is black, regardless of any palette settings.
|
||
The Color 0 setting is displayed when the BG is disabled, when the whole
|
||
display is disabled, and when the left BG row is clipped.
|
||
|
||
RGB-Palettes (VS System, Play Choice 10, Famicom Titler)
|
||
These systems are using PPUs with RGB output. The PPUs are having a MUCH more
|
||
colorful palette than the pastelized NES palette; this "feature" may be seen as
|
||
a hardware glitch, or as an improvement.
|
||
Some of the VS System's PPUs are additionally having "scrambled" colors
|
||
(rearranged color numbers, so games will have wrong colors when not buying the
|
||
correct PPU; intended to prevent piracy and unlicensed games). For details, see
|
||
--> VS System
|
||
|
||
PPU Cartridge Bus Note
|
||
When software accesses palette RAM via Port 2006h/2007h, the palette address
|
||
(PPU 3Fxxh) is output to the PPU address bus (usually a mirror of PPU 2Fxxh),
|
||
but the /WR signal isn't activated on palette writes (so VRAM remains
|
||
unchanged), however, the /RD signal is activated on palette reads, and the
|
||
addressed VRAM data is latched (ie. if the [2006h] gets changed to a
|
||
non-palette address, then the latched value will be returned on the next read
|
||
from 2007h).
|
||
|
||
PPU Dimensions & Timings
|
||
------------------------
|
||
|
||
Below are timings for Nintendo's NTSC and PAL consoles, and for the Dendy (a
|
||
russian Famicom clone with PAL output and Famicom-like NTSC-style timings).
|
||
|
||
Clock Speeds
|
||
Type NTSC PAL Dendy
|
||
Master Clock (X1) 21.47727MHz 26.6017125MHz Like PAL
|
||
Color Clock 3.579545MHz=X1/6 4.43361875MHz=X1/6 Like PAL
|
||
Dot Clock 5.3693175MHz=X1/4 5.3203425MHz=X1/5 Like PAL
|
||
CPU Clock 1.7897725MHz=X1/12 1.66260703MHz=X1/16 1.773448MHz=X1/15
|
||
Frame Rate 60.09914261Hz 50.00697891Hz Like PAL
|
||
Note: Above NTSC values are rounded. The exact NTSC Color Clock should be
|
||
315/88MHz.
|
||
|
||
Vertical Timings (in scanlines)
|
||
NTSC PAL Dendy
|
||
? 1 ? Pre-Render Time
|
||
240? 239 240? Rendering Time
|
||
1 1 51? Post-Render Time
|
||
20 70 20? Vblank
|
||
1 1 1? Post-Blank Time
|
||
---- ---- ---- -------
|
||
262 312 312? Total number of Scanlines
|
||
|
||
Horizontal Timings (in dots)
|
||
NTSC PAL Dendy
|
||
25x 252 25x Rendering Time
|
||
xx 89 xx Hblank
|
||
---- ---- ---- -------
|
||
341 341 341? Total number of dots per scanline
|
||
In each second frame, NTSC does output a short scanline with only 340 dots,
|
||
this happens only if BG and/or OBJ are enabled.
|
||
|
||
CPU vs PPU Timings
|
||
Type NTSC PAL Dendy
|
||
Dots per CPU Clk 3.0 (12/4) 3.2 (16/5) 3.0 (15/5)
|
||
CPU Clks per Scanline 113.6666 106.5625
|
||
CPU Clks per One Frame 29780.66 33247.5
|
||
CPU Clks per Other Frame 29780.33 33247.5
|
||
CPU Clks per Two Frames 59561.0 66495.0
|
||
|
||
Modulator vs PPU Timings
|
||
Type NTSC PAL Dendy
|
||
Dots per Color Clk 1.5 (6/4) 1.2 (6/5) 1.2 (6/5)
|
||
Color Clks per Scanline 227.3333 284.1666
|
||
Color Clks per One Frame 59561.33 88660.0
|
||
Color Clks per Other Frame 59560.66 88660.0
|
||
Color Clks per Two Frames 119122.0 177320.0
|
||
|
||
Visible Screen Resolution
|
||
The logical screen resolution processed by the PPU is 256x240 pixels. However
|
||
the visible screen resolution is somewhat smaller, due to improper blanking
|
||
periods, and eventually due to exceeding the physical dimensions of (NTSC)
|
||
displays.
|
||
On PAL hardware, the upper 1 scanline, the left 2 pixels, and the right 2
|
||
pixels are invisible (displayed as black border). On NTSC hardware, the upper 8
|
||
scanlines, and the lower 8 scanlines are reportedly often invisible (224 lines
|
||
visible), eventually some NTSC screens are hiding only the upper 3 scanlines
|
||
(237 lines visible).
|
||
To be compatible with all types of displays, output valid 256x240 pixels, but
|
||
have the relevant information in the <middle> 240x224 pixels (30x28 tiles)
|
||
only.
|
||
|
||
Synchronizing Software with the Cathode Ray Beam
|
||
The PPU sets the VBlank flag in PPU Status Register (and optionally produces an
|
||
NMI) once per frame. It doesn't support scanline interrupts, or a current
|
||
scanline number register, which is making it a bit difficult to access PPU
|
||
registers at specific Cathode Ray Beam locations (for example, to split the the
|
||
screen into two sections with different colors or scroll offsets). However, a
|
||
couple of methods could be used for that purpose:
|
||
1) Delay Loops synchronized with NMI (badly wasting CPU time) or using
|
||
meaningful code with fixed non-conditional execution time instead delays.
|
||
2) Producing a "Sprite 0 Hit", or a "More Than 8 Sprites Per Scanline"
|
||
situation at specific screen location (which sets corresponding flag in
|
||
PPU Status Register, one cannot reset the flag manually, so either works
|
||
only once per frame)
|
||
3) Using PCM Sound IRQs as Timer (synchronized with NMI)
|
||
4) Using external Timers (contained in some Cartridge Mappers)
|
||
The APU also contains a so-called "Frame" counter - that counter is NOT
|
||
physically synchronized with the PPU, and it doesn't even match the exact
|
||
number of clock cycles per frame. There's a limited chance that one could
|
||
program it to produce an IRQ at a specific screen location (and to
|
||
resynchronize it for the next frame).
|
||
|
||
More detailed Timing Info
|
||
--> PPU 2C02 Timings
|
||
|
||
PAL Vblank Start Timing
|
||
Line <--Line238--><--Line239--><--Line240--><--Line241--><--Line242-->
|
||
/NMI ---------------------------------------__________________________
|
||
Video: PPPPPPPPP-_C-PPPPPPPPP-_C-----------_C-----------_C-----------_C-
|
||
|
||
PAL Vblank Middle Timing
|
||
Line <--Line268--><--Line269--><--Line270--><--Line271--><--Line272-->
|
||
/NMI _________________________________________________________________
|
||
Video: ----------_C-----------____________-____________-____________-_C-
|
||
|
||
PAL Vblank End Timing
|
||
Line <--Line310--><--Line311--><--Line000--><--Line001--><--Line002-->
|
||
/NMI _____________----------------------------------------------------
|
||
Video: ----------_C-----------_C-----------_C-PPPPPPPPP-_C-PPPPPPPPP-_C-
|
||
|
||
Whereas
|
||
For Video: P=Picture, -=Blank, _=Sync, C=ColorBurst
|
||
/NMI is toggled on & off at the begin of the line (after the ending "-_C-"
|
||
blanking part of the previous line).
|
||
VSYNC is toggled at HSYNC, while active, it changes the "-_C-" part to "-___",
|
||
and also changes the next lines "picture" part from "---" to "___".
|
||
|
||
PPU 2C02 Timings
|
||
----------------
|
||
|
||
PPU base timing - NTSC
|
||
the 21.48 MHz signal is divided by 4 to get 5.37 MHz, and is used as the
|
||
smallest unit of timing in the PPU. All following references to PPU clock cycle
|
||
(abbr. "cc") timing in this document will be in respect to this timing base,
|
||
unless otherwise indicated.
|
||
- Pixels are rendered at the same rate as the base PPU clock.
|
||
In other words, 1 clock cycle= 1 pixel.
|
||
- One frame consists of 262 scanlines.
|
||
This equals 341*262 PPU cc's per frame (divide by 3 for # of CPU cc's).
|
||
- 341 PPU cc's make up the time of a typical scanline (or 341/3 CPU cc's).
|
||
All PPU memory access cycles are 2 clocks long, and can be made back-to-back
|
||
(typically done during rendering). Here's how the access breaks down:
|
||
|
||
At the beginning of the access cycle, PPU address lines 8..13 are updated with
|
||
the target address. This data remains here until the next time an access cycle
|
||
occurs.
|
||
|
||
Miscellanious PPU info
|
||
- Reading from $2002 clears the vblank flag (bit 7), and resets the
|
||
internal $2005/6 flip-flop. Writes here have no effect.
|
||
- $2002.5 and $2002.6 after being set, stay that way for the first 20
|
||
scanlines of the new frame, relative to the VINT.
|
||
- Pin /VBL on the 2C02 is the logical NAND between 2002.7 and 2000.7.
|
||
|
||
Frame rendering details
|
||
The following describes the PPU's status during all 262 scanlines of a frame.
|
||
Any scanlines where work is done (like image rendering), consists of the steps
|
||
which will be described in the next section.
|
||
|
||
0..19: Starting at the instant the VINT flag is pulled down (when a NMI is
|
||
generated), 20 scanlines make up the period of time on the PPU which I like to
|
||
call the VINT period. During this time, the PPU makes no access to it's
|
||
external memory (i.e. name / pattern tables, etc.).
|
||
|
||
20: After 20 scanlines worth of time go by (since the VINT flag was set), the
|
||
PPU starts to render scanlines. This first scanline is a dummy one; although it
|
||
will access it's external memory in the same sequence it would for drawing a
|
||
valid scanline, no on-screen pixels are rendered during this time, making the
|
||
fetched background data immaterial. Both horizontal *and* vertical scroll
|
||
counters are updated (presumably) at cc offset 256 in this scanline. Other than
|
||
that, the operation of this scanline is identical to any other. The primary
|
||
reason this scanline exists is to start the object render pipeline, since it
|
||
takes 256 cc's worth of time to determine which objects are in range or not for
|
||
any particular scanline.
|
||
|
||
21..260: after rendering 1 dummy scanline, the PPU starts to render the actual
|
||
data to be displayed on the screen. This is done for 240 scanlines, of course.
|
||
|
||
261: after the very last rendered scanline finishes, the PPU does nothing for 1
|
||
scanline (i.e. the programmer gets screwed out of perfectly good VINT time).
|
||
When this scanline finishes, the VINT flag is set, and the process of drawing
|
||
lines starts all over again.
|
||
|
||
Scanline rendering details
|
||
As explained before, external PPU memory can be accessed every 2 cc's. With 341
|
||
cc's per scanline, this gives the PPU enough time to make 170 memory accesses
|
||
per scanline (and it uses all of them!). After the 170th fetch, the PPU does
|
||
nothing for 1 clock cycle. Remember that a single pixel is rendered every clock
|
||
cycle.
|
||
|
||
Note that the PPU fetches an attribute table byte for every 8 sequential
|
||
horizontal pixels it draws. This essentially limits the PPU's color area (the
|
||
area of pixels which are forced to use the same 3-color palette) to only 8
|
||
horizontally sequential pixels.
|
||
|
||
Memory fetch phase 1 thru 128 - BG Fetch
|
||
Fetches 4x32 bytes; one Name Table entry, one Attribute Table entry, and two
|
||
Pattern Table bytes; for 3rd..34th tile in scanline (33th tile may be parts
|
||
visible if BG scrolled, 34th is never visible). From the time of the Name Table
|
||
fetch, it takes (16-n) clock cycles until the first pixel of the fetched tile
|
||
is processed (drawn on screen, unless being covered by a Sprite-pixel, and
|
||
eventually setting the Hit Flag) (n=0..7, horizontal scroll offset).
|
||
Simultaneously with above BG fetch, the PPU pre-processes SPR-RAM for the NEXT
|
||
scanline by searching for Sprite Y-cooridnates that are visible in that
|
||
scanline, only the first eight matches will be recursed, if the search finds
|
||
additional matching entries then bit5 of $2002 will get set to indicate that
|
||
one or more entries have been ignored.
|
||
|
||
Memory fetch phase 129 thru 160 - Sprite Fetch
|
||
Fetches 4x8 bytes; two dummy Name Table entris, and two Pattern Table bytes;
|
||
for 1st..8th sprite in NEXT scanline (fetches dummy patterns if the scanline
|
||
contains less than 8 sprites).
|
||
|
||
Memory fetch phase 161 thru 168 - BG Fetch
|
||
Fetches 4x2 bytes; one Name Table entry, one Attribute Table entry, and two
|
||
Pattern Table bytes; for 1st..2nd tile in NEXT scanline.
|
||
|
||
Memory fetch phase 169 thru 170 (and a half) - Padding
|
||
Fetches 2 bytes; two dummy reads from the Name Table address of the 3rd tile in
|
||
next scanline. After that fetches, the PPU rests for one "dead" cycle here (or
|
||
the equivelant of 1/2 memory access cycle) before repeating the whole
|
||
pixel/scanline rendering process. Scanline 20 is the only scanline that has
|
||
variable length, on every odd frame, this scanline is only 340 cycles (the dead
|
||
cycle at the end is removed). This is done to cause a shift in the NTSC
|
||
colorburst phase.
|
||
|
||
3D Glasses
|
||
----------
|
||
|
||
Famicom 3D System (Japan) (LCD shutter glasses)
|
||
Japanese Famicom games are using fairly expensive LCD shutter glasses,
|
||
controlled via the 15pin Controller Expansion Port. Left & Right images are
|
||
transferred in separate frames (and the left/right shutters are opened/closed
|
||
accordingly).
|
||
Write to [4016h].Bit1 (0=Shut Which? Eye, 1=Shut WhichOther? Eye)
|
||
The advantage is that the 3D picture is fully colored. The downside is that the
|
||
hardware is expensive, and must be purchased separately. Another restriction is
|
||
that it requires the old 15pin Famicom connector (or an adapter for newer
|
||
Famicom and NES 7pin controller ports).
|
||
|
||
Simple 3D Glasses (US and Europe) (red/cyan glasses)
|
||
US and European NES games are using much cheaper "passive" 3D glasses with
|
||
colored "lens" instead of LCD shutters. Theoretically, this would allow to
|
||
transfer the left & right picture in one frame, but that'd require more CPU
|
||
load and color depth, so, in practice the games are drawing the left/right
|
||
frames separately (similar as in the LCD shutter method).
|
||
Right Eye -- Red
|
||
Left Eye -- Blue/cyan or so
|
||
The advantage is that the hardware is so cheap that it can have been included
|
||
with the game for free. Cheapest variant would be "cardboard" glasses, though
|
||
there seems to have been also a yellow stylish plastic variant.
|
||
The downside of mis-using colors for 3D effects is that the picture will appear
|
||
more or less monochrome.
|
||
|
||
Pulfrich Effect 3D Glasses (US) (dark/clear glasses)
|
||
Another approach is using the Pulfrich effect with dark/clear glasses, this is
|
||
some sort psychophysical stuff, related to different signal timings for
|
||
bright/dark colors.
|
||
Right Eye -- Dark ;\as so for NES Orb-3D
|
||
Left Eye -- Clear ;/(that is, opposite as for SNES Jim Power)
|
||
The advantage is that it's cheap, and that it can be even used for colored
|
||
images (unlike the red/cyan glasses method). The disadvantage is that it does
|
||
work only with permanently moving objects.
|
||
|
||
Games with support for 3D Glasses
|
||
Attack Animal Gakuen (J) (Pony Canyon)
|
||
Cosmic Epsilon (J) (Asmik)
|
||
Falsion (Konami)
|
||
Famicom Grand Prix: 3D Hot Rally (Nintendo)
|
||
Highway Star (J) aka Rad Racer (U) (E) (Square)
|
||
Tobidase Daisakusen (J) aka 3-D World Runner (U) (Square)
|
||
JJ Tobidase Daisakusen Part II (J) (Square)
|
||
Orb-3D (U) (Pulfrich Effect)
|
||
In most of that games, 3D mode is activated by pressing SELECT button. Game
|
||
versions that were released outside of Japan are customized to work with the
|
||
red/cyan glasses (or dark/clear glasses for Orb-3D).
|
||
|
||
Audio Processing Unit (APU)
|
||
---------------------------
|
||
|
||
--> APU Channel 1-4 Register 0 (Volume/Decay)
|
||
--> APU Channel 1-4 Register 1 (Sweep)
|
||
--> APU Channel 1-4 Register 2 (Frequency)
|
||
--> APU Channel 1-4 Register 3 (Length)
|
||
--> APU Channel 5 - DMC Sound
|
||
--> APU Control and Status Registers
|
||
--> APU 4-bit DAC
|
||
--> APU Various
|
||
--> APU DMC-DMA Glitch
|
||
--> APU External Sound Channels
|
||
--> Controllers - Microphones
|
||
|
||
Based on "2A03 technical reference by Brad Taylor" (1st release, April 2004).
|
||
|
||
APU Channel 1-4 Register 0 (Volume/Decay)
|
||
-----------------------------------------
|
||
|
||
4000h - APU Volume/Decay Channel 1 (Rectangle)
|
||
4004h - APU Volume/Decay Channel 2 (Rectangle)
|
||
400Ch - APU Volume/Decay Channel 4 (Noise)
|
||
0-3 Volume / Envelope decay rate
|
||
When Bit4=1: Volume (0=Silent/None..F=Loud/Max)
|
||
When Bit4=0: Envelope decay rate, NTSC=240Hz/(N+1), PAL=192Hz/(N+1)
|
||
4 Envelope decay disable (0=Envelope/Decay, 1=Fixed Volume)
|
||
5 Length counter clock disable / Envelope decay looping enable
|
||
When Bit4=1: length counter clock disable
|
||
When Bit4=0: envelope decay looping enable
|
||
0: Disable Looping, stay at 0 on end of decay [ \_____ ]
|
||
1: Enable Looping, restart decay at F [ \\\\\\ ]
|
||
(Does this still affect Length counter clock disable ?)
|
||
6-7 Duty cycle type (unused on noise channel)
|
||
0 [--______________] 12.5% Whereas,
|
||
1 [----____________] 25.0% [_] = LOW (zero) (0)
|
||
2 [--------________] 50.0% [-] = HIGH (volume/decay) (0..F)
|
||
3 [------------____] 75.0% Noise randomly outputs LOW or HIGH
|
||
The Duty Cycle counter is reset when the length counter of the same channel is
|
||
written to (via 4003h/4007h).
|
||
|
||
Initial Decay Volume:
|
||
Only a write out to 4003h/4007h/400Fh will reset the current envelope decay
|
||
counter to a known state (to 0Fh=max) for the appropriate channel's envelope
|
||
decay hardware. Otherwise, the envelope decay counter is always counting down
|
||
(by 1) at the frequency currently contained in the volume / envelope decay rate
|
||
bits (even when envelope decays are disabled by setting bit 4), except when the
|
||
envelope decay counter contains a value of 0, and envelope decay looping (bit
|
||
5) is disabled (0).
|
||
|
||
4008h - APU Linear Counter Channel 3 (Triangle)
|
||
0-6 linear counter load register
|
||
7 length counter clock disable / linear counter start
|
||
Linear counter incremented-or-decremented? at NTSC=240Hz, PAL=192Hz, same
|
||
purpose, but higher resolution than length counter, so Triangle channel is
|
||
ALWAYS using either linear-counter or length-counter, and cannot be used with
|
||
both counters disabled?
|
||
|
||
The Triangle channel does not have a variable volume, nor variable duty cycle.
|
||
Instead, it produces the following fixed 32-step output level stream:
|
||
0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F,F,E,D,C,B,A,9,8,7,6,5,4,3,2,1,0
|
||
On 2A03 reset, the stream starts at 0. The stream will be halted (at the
|
||
current position) whenever the Triangle channel's length or linear counter
|
||
contains a count of 0, and will continue at whatever old position when it is
|
||
restarted.
|
||
|
||
APU Channel 1-4 Register 1 (Sweep)
|
||
----------------------------------
|
||
|
||
4001h - APU Sweep Channel 1 (Rectangle)
|
||
4005h - APU Sweep Channel 2 (Rectangle)
|
||
0-2 Sweep right shift amount (S=0..7)
|
||
3 Sweep Direction (0=[+]Increase, 1=[-]Decrease)
|
||
4-6 Sweep update rate (N=0..7), NTSC=120Hz/(N+1), PAL=96Hz/(N+1)
|
||
7 Sweep enable (0=Disable, 1=Enable)
|
||
At specified Update Rate, the 11bit Wavelength will be modified as such:
|
||
Wavelength = Wavelength +/- (Wavelength SHR S)
|
||
(For Channel 1 Decrease only: minus an additional 1)
|
||
(Ie. in Decrease mode: Channel 1 uses NOT, Channel 2 uses NEG)
|
||
Wavelength register will be updated only if all 3 of these conditions are met:
|
||
Bit 7 is set (sweeping enabled)
|
||
The shift value (which is S in the formula) does not equal to 0
|
||
The channel's length counter contains a non-zero value
|
||
Sweep end: The channel gets silenced, and sweep clock is halted, when:
|
||
1) current 11bit wavelength value is less than 008h
|
||
2) new 11bit wavelength would become greater than 7FFh
|
||
Note that these conditions pertain regardless of any sweep refresh rate values,
|
||
or if sweeping is enabled/disabled (via Bit7).
|
||
|
||
4009h - APU N/A Channel 3 (Triangle)
|
||
400Dh - APU N/A Channel 4 (Noise)
|
||
0-7 Unused (No Sweep support for these channels)
|
||
|
||
APU Channel 1-4 Register 2 (Frequency)
|
||
--------------------------------------
|
||
|
||
4002h - APU Frequency Channel 1 (Rectangle)
|
||
4006h - APU Frequency Channel 2 (Rectangle)
|
||
400Ah - APU Frequency Channel 3 (Triangle)
|
||
0-7 Lower 8 bits of wavelength (upper 3 bits in Register 3)
|
||
F = CPUCLK/(N+1)/16 for Rectangle channels
|
||
F = CPUCLK/(N+1)/32 for Triangle channel
|
||
CPUCLK is 1.789773MHz (NTSC), or 1.662607MHz (PAL).
|
||
|
||
400Eh - APU Frequency Channel 4 (Noise)
|
||
0-3 Noise frequency, F=1.79MHz/2/(N+1)
|
||
Value 0..F corresponds to following 11bit clock cycle value:
|
||
N=002,004,008,010,020,030,040,050,065,07F,0BE,0FE,17D,1FC,3F9,7F2
|
||
4-6 Unused
|
||
7 Random number type generation (0=32767 bits, 1=93 bits)
|
||
XXX conflicting info suggests these frequency values:
|
||
NTSC: 004,008,010,020,040,060,080,0A0,0CA,0FE,17C,1FC,2FA,3F8,7F2,FE4
|
||
PAL: 004,008,00E,01E,03C,058,076,094,0BC,0EC,162,1D8,2C4,3B0,762,EC2
|
||
(XXX but, this won't match the "/2/(N+1)" part of the above formula)
|
||
The random number generator consists of a 15bit shift register. The MSB (Bit14)
|
||
is output/inverted (1=Low/Zero, 0=High/Decay/Volume). At the specified
|
||
frequency, Bit14 is XORed with Bit13 (32767-bit mode) or with Bit8 (93-bit
|
||
mode), the register is then shifted to the left, with the result of the XOR
|
||
operation shifted-in to Bit0.
|
||
|
||
On 2A03 reset, this shift register is loaded with a value of 1.
|
||
Not sure if it is reset when switching from 32767-bit mode to 93-bit mode? If
|
||
it isn't reset then 93-bit mode will act unstable: produce different 93-bit
|
||
patterns, or even a 31-bit pattern, depending on old shift register content.
|
||
|
||
APU Channel 1-4 Register 3 (Length)
|
||
-----------------------------------
|
||
|
||
4003h - APU Length Channel 1 (Rectangle)
|
||
4007h - APU Length Channel 2 (Rectangle)
|
||
400Bh - APU Length Channel 3 (Triangle)
|
||
400Fh - APU Length Channel 4 (Noise)
|
||
Writing to the length registers restarts the length (obviously), and also
|
||
restarts the duty cycle (channel 1,2 only), and restarts the decay volume
|
||
(channel 1,2,4 only).
|
||
0-2 Upper 3 bits of wavelength (unused on noise channel)
|
||
3-7 Length counter load register (5bit value, see below)
|
||
The above 5bit value is translated to the actual 7bit counter value as such:
|
||
Bit3=0 and Bit7=0 (Dividers matched for use with PAL/50Hz)
|
||
Bit6-4 (0..7 = 05h,0Ah,14h,28h,50h,1Eh,07h,0Dh)
|
||
Bit3=0 and Bit7=1 (Dividers matched for use with NTSC/60Hz)
|
||
Bit6-4 (0..7 = 06h,0Ch,18h,30h,60h,24h,08h,10h)
|
||
Bit3=1 (General Fixed Dividers)
|
||
Bit7-4 (0..F = 7Fh,01h..0Fh)
|
||
The 7bit counter value is decremented once per frame (PAL=48Hz, or NTSC=60Hz)
|
||
the counter and sound output are stopped when reaching a value of zero. The
|
||
counter can be paused (and restarted at current location) by Length Counter
|
||
Clock Disabled bit in Register 0.
|
||
|
||
APU Channel 5 - DMC Sound
|
||
-------------------------
|
||
|
||
4010h - DMC Play mode and DMA frequency
|
||
7 IRQ Enable, when Length=0 AND Loop=Disabled (0=Disable, 1=Enable)
|
||
DMC IRQs can be acknowledged by writing 0 to Bit7 of 4010h, or
|
||
by writing any value to 4015h
|
||
6 Loop when reaching Length=0 (0=Stop, 1=Loop)
|
||
In looped mode, the sample block is restarted by reloading the
|
||
DMA Start Address and Length values, IRQs are not generated.
|
||
5-4 Appear to be unused
|
||
3-0 DMC frequency (00h..0Fh, see below)
|
||
For frequency 00h..0Fh, the number of cycles/samplebyte are:
|
||
NTSC: D60,BE0,AA0,A00,8F0,7F0,710,6B0,5F0,500,470,400,350,2A8,240,1B0
|
||
PAL: XXX
|
||
For frequency 00h..0Fh, the number of cycles/samplebit are:
|
||
NTSC: 1AC,17C,154,140,11E,0FE,0E2,0D6,0BE,0A0,08E,080,06A,054,048,036
|
||
PAL: 18E,162,13C,12A,114,0EC,0D2,0C6,0B0,094,084,076,062,04E,042,032
|
||
|
||
4011h - DMC Delta counter load register
|
||
7 Appears to be unused
|
||
6-1 MSBs of 7bit DAC (6bit "Delta Counter")
|
||
0 LSB of 7bit DAC
|
||
Used to initialize the Delta Counter (for DMC usage), or to output 7bit data
|
||
directly (for PCM usage). Another use of this register has been to somewhat
|
||
control the volume of the Triangle & Noise sound channel outputs. Please see
|
||
NESSOUND.TXT for more information.
|
||
|
||
4012h - DMC address load register
|
||
Specifies the DMA Start Address. The Start Address is loaded to the actual DMA
|
||
pointer, when the DMC is activated from an inactive state, or when restarting
|
||
looped playback.
|
||
7-0 DMA Start Address for DMC (Address = C000h+N*40h)
|
||
The DMA pointer is 15 bits in size, and wraps from FFFFh to 8000h (not C000h).
|
||
|
||
4013h - DMC length register
|
||
7-0 DMA Length DMC (Length = N*10h+1 Bytes = N*80h+8 Bits)
|
||
When it arrives at 0, the DMC will take action(s) based on the 2 MSB of $4010.
|
||
This counter will be loaded with the current calculated address value of $4013
|
||
when the DMC is activated from an inactive state.
|
||
|
||
Usage as Delta Modulation Channel (DMC) with Direct Memory Access (DMA)
|
||
This method uses 1-bit samples, processed at the specified sample-bit-rate,
|
||
1 = Increment Delta counter by 1 (unless result would be greater than 3Fh)
|
||
0 = Decrement Delta counter by 1 (unless result would be less than 0)
|
||
Every eight sample-bits, the DMC will halt the CPU for 2 clock cycles to
|
||
retrieve the next sample-byte per DMA, each sample byte is processed bit-by-bit
|
||
(LSB first).
|
||
|
||
Usage as Pulse Code Modulation (PCM) Channel
|
||
Alternately, 7bit samples can be written directly to the DAC.
|
||
Advantages are that all 7bit can be used (instead only the upper six Delta
|
||
bits), and that the DAC can be directly changed from one value to any other
|
||
value (which would take up to 64 increment/decrement steps in DMC mode).
|
||
Disadvantages are that it requires exact software timings and more CPU load
|
||
than the DMA method.
|
||
No idea if it is required to "enable" the DMC channel (eg. by outputting a
|
||
looped dummy 55h sample byte) in order to use PCM ?
|
||
|
||
On 2A03 reset, the DMC's IRQ flag is cleared (disabled), and the [DMC] channel
|
||
is disabled. On 2A03 reset, all 7 used bits of $4011 are reset to 0.
|
||
|
||
Caution
|
||
Using DMC-DMA can conflict with other I/O ports (such like VRAM or joypad
|
||
reads)! For details, see:
|
||
--> APU DMC-DMA Glitch
|
||
|
||
APU Control and Status Registers
|
||
--------------------------------
|
||
|
||
4015h - DMC/IRQ/length counter status/channel enable register
|
||
0 Status/Enable rectangle wave channel 1
|
||
1 Status/Enable rectangle wave channel 2
|
||
2 Status/Enable triangle wave channel 3
|
||
3 Status/Enable noise channel 4
|
||
4 Status/Enable DMC channel 5
|
||
5 Not used (returns garbage on reading)
|
||
6 Frame IRQ status (active when set)
|
||
7 DMC's IRQ status (active when set)
|
||
Reading Bit4-0 returns 0 for a zero count status in the length counter
|
||
(channel's sound is disabled), and 1 for a non-zero status. Reading Bit7-6
|
||
returns IRQ status flags.
|
||
Writing to Bit4-0: Writing 0 forces to disable the channel, it will get stopped
|
||
and become silent (as if its length counter has reached 0), writing 1
|
||
de-activates the forced-stop (without changing the length counter, playback
|
||
continues at whatever value have been in the length counter).
|
||
Writing to Bit7-5: Unknown.
|
||
DMC IRQs are acknowledged by WRITING any value to 4015h.
|
||
Frame IRQs are acknowledged by READING from 4015h.
|
||
|
||
Note that all 5 writable bits in 4015h will be set to 0 upon 2A03 reset.
|
||
|
||
4017h - APU Low frequency timer control (W)
|
||
Any write to 4017h resets both the frame counter, and the clock divider.
|
||
Sometimes, games will write to this register in order to synchronize the sound
|
||
hardware's internal timing, to the sound routine's timing (usually tied into
|
||
the NMI code). The frame IRQ frequency is slightly smaller than the PPU's
|
||
vertical retrace frequency, so you can see why games would desire this
|
||
synchronization.
|
||
bit6: Frame IRQ Disable (0=Enable Frame IRQ, 1=Disable Frame IRQ)
|
||
bit7: Frame Rate Select (0=NTSC=60Hz=240Hz/4, 1=PAL=48Hz=240Hz/5)
|
||
...XXX... Frame IRQ works ONLY if bit6 and bit7 are BOTH zero!
|
||
On 2A03 reset, Bit6-7 will be cleared. That means that Frame IRQs are enabled
|
||
by default (though usually not executed since the CPUs IRQ-Disable-Flag is set
|
||
on reset).
|
||
Frame IRQs are acknowledged by reading from 4015h.
|
||
|
||
Frame Counter
|
||
Several audio timings are referred to as "Frames" and "PAL" and "NTSC",
|
||
! These timings are NOT physically related to actual PPU VBlank/NMI timings !
|
||
The Audio "Frame" counter can be switched into "PAL" or "NTSC" mode by software
|
||
- regardless of whether the game does run on a PAL/NTSC console. Audio-frames
|
||
may be (more or less) synchronized with video-frames by chosing PAL/NTSC
|
||
audio-mode matching to PAL/NTSC console type respectively.
|
||
The frame counter is based on a 240Hz signal which is gained from dividing the
|
||
1.78Mhz PHI2 clock edges (2*1.78M edges/second) by 14915. In PAL Mode (4017h
|
||
Bit7=1), the 240Hz signal is divided by 1.25 (by simply leaving out each fifth
|
||
clock pulse), resulting in a somewhat dirty 192Hz signal. This PAL/NTSC
|
||
adjustment mechanism counts through 4 or 5 steps, producing output as such:
|
||
0/NTSC: 4,0,1,2,3,0,1,2,3,0,1,2,3 | 1/PAL: 0,1,2,3,4,0,1,2,3,4,0,1,2,3,4
|
||
240Hz: __-_-_-_-_-_-_-_-_-_-_-_- | 192Hz: -_-_-_-___-_-_-_-___-_-_-_-__
|
||
120Hz: ____-___-___-___-___-___- | 96Hz: __-___-_____-___-_____-___-__
|
||
60Hz: (above somehow div by 2) | 48Hz: (above somehow divided by 2)
|
||
Frame Counter is reset on writing to 4017h, and does then restart sequences as
|
||
shown above (in NTSC mode starting with a skipped step, whilst directly
|
||
starting with a non-skipped step in PAL mode).
|
||
Linear counter (triangle) and envelope decay counters (rectangle/noise) are
|
||
clocked by 240Hz/192Hz. Frequency sweep (rectangle) clocked by 120Hz/96Hz.
|
||
Length counters (all channels) and Frame IRQ clocked by 60Hz/48Hz.
|
||
|
||
4014h - SPR-RAM DMA
|
||
Sprite RAM DMA Function contained in 2A03 chip. See PPU description.
|
||
|
||
4016h - Write
|
||
Three bit general purpose output latch contained in 2A03 chip.
|
||
Used to strobe joysticks. See Controllers chapter for more info.
|
||
|
||
4016h/4017h - Read
|
||
The 2A03 chip does not actually contain read-able registers at these addresses,
|
||
however, it does output read-request signals for these addresses, which are
|
||
used to activate on-board joystick inputs.
|
||
See Controllers chapter for more info.
|
||
|
||
Note: 4015h is the only R/W register in the 4000h-4017h area, all other
|
||
registers in this area are write-only, and do not respond to read cycles
|
||
(except for the external read-able 4016h/4017h registers).
|
||
|
||
APU 4-bit DAC
|
||
-------------
|
||
|
||
Channel 1-4 are (each) using a standard 4-bit DAC with 16 steps of output
|
||
voltage resolution. On the 2A03, rectangle wave 1 & 2 are mixed together, and
|
||
are available via pin 1. Triangle, noise, and DMC are available on pin 2.
|
||
Signals are then merged via 20KOhm (pin 1) and 12KOhm (pin2), respectively,
|
||
rectangle channels have different output levels than equivalent volume settings
|
||
on triangle/noise channels?
|
||
|
||
The output waveforms have some linear asymmetry (the desired output voltage
|
||
would increase on a linear scale, the actual outputted voltage increases less
|
||
and less each step).
|
||
|
||
The side effect of this is that the DMC's 7-bit DAC port ($4011) is able to
|
||
indirectly control the volume (somewhat) of both triangle & noise channels.
|
||
When $4011=0, triangle & noise volume outputs are at maximum. When $4011=7F,
|
||
triangle & noise channel outputs operate at only 57% total volume. A few games
|
||
actually take advantage of this "volume" feature, and write values to $4011 in
|
||
order to regulate the amplitude of the triangle wave channel's output.
|
||
|
||
Forced Zero Volume:
|
||
When hardware in the channel wants to disable it's sound output (like the
|
||
length counter, or sweep unit).
|
||
|
||
APU Various
|
||
-----------
|
||
|
||
After 2A03 reset, the sound channels are unavailable for playback during the
|
||
first 2048 CPU clocks.
|
||
|
||
The rectangle channel(s) frequency in the range of 54.6 Hz to 12.4 KHz.
|
||
The triangle wave channel range of 27.3 Hz to 55.9 KHz.
|
||
The random wavelength channel range anywhere from 29.3 Hz to 447 KHz.
|
||
|
||
RP2A03E quirk
|
||
I have been informed that revisions of the 2A03 before "F" actually lacked
|
||
support for the 93-bit looped noise playback mode. While the Famicom's 2A03
|
||
went through 4 revisions (E..H), I think that only one was ever used for the
|
||
front loading NES: "G". Other differences between 2A03 revisions are
|
||
unknown. Is that Quirk True and Confirmed ?
|
||
|
||
APU DMC-DMA Glitch
|
||
------------------
|
||
|
||
DMC-DMA can conflict with other I/O ports. If the DMA read occurs at the same
|
||
time as a CPU read, then the CPU read is executed TWICE. In case of CPU reads
|
||
from read-sensitve I/O ports this can result in "lost" bits and bytes.
|
||
2002h ppu status ;-vblank flag acknowledged (lost flag)
|
||
2007h vram data read ;-vram address incremented twice (one byte skipped)
|
||
4016h joypad1 read ;\two CLKs sent to joypad, causing one shift-register
|
||
4017h joypad2 read ;/step to be skipped
|
||
xxxxh other external read-sensitive mapper registers
|
||
The bug occurs only on CPU reads (not on CPU writes). And, it occurs only on
|
||
NTSC consoles (with RP2A03xx APU/CPU), not on PAL consoles (with RP2A07xx
|
||
APU/CPU).
|
||
|
||
Workarounds
|
||
In case of joypad & vram reads, the workaround would be to read the data
|
||
repeatedly, until receiving twice the same values. This should also work for
|
||
most other controllers - unless the controller transfers the data only ONCE, or
|
||
unless it does internally reset the data after reading.
|
||
For ppu status read, it is generally better to set a nmi_flag in the NMI
|
||
handler, and to poll that flag in the main program (rather than polling 2002h
|
||
directly, which is unstable, even without the DMC glitch).
|
||
And, of course, one could disable DMC. Or, sense the collision time (eg. by
|
||
examining VRAM reads), and then place critical reads into gaps where DMC isn't
|
||
occuring).
|
||
|
||
APU External Sound Channels
|
||
---------------------------
|
||
|
||
The Famicom 60-pin cartridge slot includes a SND_IN pin, allowing external
|
||
sound controllers (as included in some Cartridge Mappers, and in Famicom Disk
|
||
System) to produce additional sound channels which are merged with the normal
|
||
APU channels:
|
||
|
||
--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc.
|
||
--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND
|
||
--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND
|
||
--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 188: UNROM-reversed
|
||
|
||
However, the NES 72-pin cartridge slot DOES NOT include a SND_IN pin, even
|
||
though it does have more (more or less unused) pins than Famicom.
|
||
|
||
And, there are a few devices with external speakers (not routed through NES
|
||
SND_IN) - a "beep" function Power Glove, and fully featured synthesizer in the
|
||
Miracle:
|
||
--> Controllers - Piano Keyboards
|
||
--> Controllers - Power Glove
|
||
|
||
And, the FamicomBox contains a beep function (when money is inserted); the beep
|
||
sound is merged with the APU sound, and then passed to TV-Set.
|
||
--> FamicomBox
|
||
|
||
Controllers
|
||
-----------
|
||
|
||
Controller Interface
|
||
--> Controllers - I/O Ports
|
||
--> Controllers - Pin-Outs
|
||
--> Controllers - Summary of Controller Types
|
||
--> Controllers - Summary of Controller Signals
|
||
--> Controllers - Detection
|
||
|
||
Controllers
|
||
--> Controllers - Joypads
|
||
--> Controllers - Four-Player Adaptors
|
||
--> Controllers - Lightguns (Zapper)
|
||
--> Controllers - Paddles
|
||
--> Controllers - Push Buttons
|
||
--> Controllers - Typewriter Keyboards
|
||
--> Controllers - Piano Keyboards
|
||
--> Controllers - Keypads
|
||
--> Controllers - Mats
|
||
--> Controllers - Inflatable Controllers
|
||
--> Controllers - RacerMate Bicycle Training System
|
||
--> Controllers - Tablets
|
||
--> Controllers - Trackball and Mouse
|
||
--> Controllers - Power Glove
|
||
--> Controllers - UForce
|
||
--> Controllers - Barcode Readers
|
||
--> Controllers - Pachinko
|
||
--> Controllers - Microphones
|
||
--> Controllers - Reset Button
|
||
--> Controllers - Arcade Machines
|
||
|
||
Other Devices that connect to Controller I/O Ports
|
||
--> 3D Glasses
|
||
--> Storage Data Recorder
|
||
--> Storage Turbo File
|
||
--> Storage Battle Box
|
||
--> Hori Game Repeater
|
||
--> Headphones
|
||
|
||
Another special device (not directly connected to Controller Ports)
|
||
--> R.O.B. (Robotic Operating Buddy)
|
||
|
||
Controllers - I/O Ports
|
||
-----------------------
|
||
|
||
Port 4016h-4017h control 3 general purpose outputs (OUT0/1/2), plus 2 clock
|
||
outputs (PORT0/1-CLK), and several inputs (number of inputs varies depending on
|
||
the console type), all inputs are inverted inside of the console, ie. LOW
|
||
arrives as "1" at the CPU.
|
||
|
||
4016h - Joypad Output Register (W)
|
||
2-0 OUT2-0 Expansion Port Outputs
|
||
0 OUT0 NES/Famicom: Joypad 1+2 Strobe (for BOTH joypads)
|
||
|
||
4016h - Joypad Input Register 0 (R)
|
||
Bit Name NES Famicom Purpose
|
||
7-5 N/A Not used (undefined) Not used (undefined) -
|
||
4 PORT0-4 Expansion/Gameport Not used (undefined) Zapper 1 Button
|
||
3 PORT0-3 Expansion/Gameport Not used (undefined) Zapper 1 Light
|
||
2 PORT0-2 Expansion Microphone Input Microphone
|
||
1 PORT0-1 Expansion Expansion Exp.
|
||
0 PORT0-0 Expansion/Gameport Joypad Joypad 1
|
||
Reading from 4016h generates a PORT0-CLK signal (used to clock joypads).
|
||
|
||
4017h - Joypad Input Register 1 (R)
|
||
Bit Name NES Famicom Purpose
|
||
7-5 N/A Not used (undefined) Not used (undefined) -
|
||
4 PORT1-4 Expansion/Gameport Expansion Zapper 2 Button
|
||
3 PORT1-3 Expansion/Gameport Expansion Zapper 2 Light
|
||
2 PORT1-2 Expansion Expansion Exp.
|
||
1 PORT1-1 Expansion Expansion Exp.
|
||
0 PORT1-0 Expansion/Gameport Expansion/Joypad Joypad 2
|
||
Reading from 4017h generates a PORT1-CLK signal (used to clock joypads).
|
||
|
||
4017h - APU Low frequency timer control (W)
|
||
Not joypad/expansion related. See APU chapter for more info.
|
||
|
||
For info about the "Not used (undefined)" bits, see:
|
||
--> Unpredictable Things
|
||
|
||
Caution
|
||
The APU (if DMC sound is used) can conflict with joypad reads! For details,
|
||
see:
|
||
--> APU DMC-DMA Glitch
|
||
|
||
Controllers - Pin-Outs
|
||
----------------------
|
||
|
||
Controller ports - NES (and newer Famicom models) - male, front side
|
||
Pin Dir Player 1 Player 2 Expl./Usage .---------.
|
||
1 Out GND GND Ground | 4 3 2 1 |
|
||
2 Out PORT0-CLK PORT1-CLK Joystick Clock (CPU Port Read) | 7 6 5 /
|
||
3 Out OUT0 OUT0 Joystick Serial-Start (Strobe) '-------'
|
||
4 In PORT0-0 PORT1-0 Joystick Serial-Data .---------.
|
||
5 Out +5VDC +5VDC Supply | 4 3 2 1 |
|
||
6 In PORT0-3 PORT1-3 Zapper Light, Paddle Button | 7 6 5 /
|
||
7 In PORT0-4 PORT1-4 Zapper Button, Paddle Position '-------'
|
||
All controller inputs are inverted inside of the console, LOW arrives as "1".
|
||
Note: Older Famicom consoles do not include controller ports, instead the
|
||
joypad cables are directly attached to the console (without plugs/sockets).
|
||
|
||
Famicom Expansion Port (standard db15, female, front side)
|
||
Included in both older and newer Famicom consoles, not in NES consoles.
|
||
1 Out GND .------------------------.
|
||
2 Out SOUND OUT (headphone adaptors) | 8 7 6 5 4 3 2 1 |
|
||
3 I/O /IRQ \ 15 14 13 12 11 10 9 /
|
||
4 In port1-D4 (zapper button) '--------------------'
|
||
5 In port1-D3 (zapper light)
|
||
6 In port1-D2 (barcode battler) (turbo file data.in)
|
||
7 In port1-D1 (joystick 4 serial input) (paddle ADC serial input)
|
||
8 In port1-D0 (joystick 2 serial input)
|
||
9 Out port1-CLK (joystick 2+4 clock read)
|
||
10 Out OUT2 (turbo file data.clock) (tape output)
|
||
11 Out OUT1 (turbo file reset address)
|
||
12 Out OUT0 (joystick 1+2+3+4 start) (turbo file data.out)
|
||
13 In port0-D1 (joystick 3 serial input) (paddle button) (tape input)
|
||
14 Out port0-CLK (joystick 1+3 clock read)
|
||
15 Out +5V
|
||
Used to connect a 3rd and 4th joystick, and various other expansion hardware.
|
||
Keep in mind that older Famicom Joypads cannot be disconnected, so the input at
|
||
Pin 8 may be disturbed by joypad 2 signals.
|
||
|
||
Note: Joypads/PowerPads/etc are normally using standard 4021 parallel-in
|
||
serial-out shift registers.
|
||
|
||
Controllers - Summary of Controller Types
|
||
-----------------------------------------
|
||
|
||
NES Controllers
|
||
NES Joypad 1/2
|
||
NES Joypad 3/4
|
||
NES Joypad 4-player adaptor Satellite (for joypad 3-4) (wireless)
|
||
NES Joypad 4-player adaptor Four-Score (for joypad 3-4) (wired)
|
||
NES Lightgun Zapper
|
||
NES Arkanoid I Paddle
|
||
NES Miracle Piano Keyboard (49 keys)
|
||
NES Mat - Power Pad (dance mat)
|
||
NES RacerMate Bicycle Training System
|
||
NES Power Glove
|
||
NES UForce
|
||
NES Add-on 3D-Glasses (colored lens, without any electronics)
|
||
NES Add-on Robot
|
||
Note: Most of the NES controllers do also exist for the Famicom. However,
|
||
observe that they are connected differently, and thus need to be accessed
|
||
differently at software side.
|
||
|
||
Famicom Controllers
|
||
Famicom Joypad 1/2 (hardwired to console, pad2 with mic instead start/select)
|
||
Famicom Joypad 3/4 (player 3/4, or alternate joypads for player 1/2)
|
||
Famicom Joypad 4-player adaptor (for joypad 4, not needed for joypad 3)
|
||
Famicom Joypad Add-ons (gimmicks mounted on top of standard joypads)
|
||
Famicom Lightgun Beam-Gun
|
||
Famicom Lightgun Hyper Shot (extra buttons, not fully compatible trigger)
|
||
Famicom Arkanoid I Paddle (with 9bit overflow)
|
||
Famicom Arkanoid II Paddle (raw 8bit without overflow)
|
||
Famicom Arkanoid II Secondary Paddle (add-on for second player)
|
||
Famicom Push Buttons Party Tap (6 players, 1 button/player)
|
||
Famicom Push Buttons Hyper Shot (2 players, 2 buttons/player)
|
||
Famicom Keyboard (72 keys type-writer keyboard)
|
||
Famicom Doremikko Piano Keyboard (36 keys)
|
||
Famicom Keypad TV-Net ("remote control" style) (different versions exist)
|
||
Famicom Keypad Famicom Network (joypad with numeric keypad)
|
||
Famicom Keypad Mahjong Controller (keys "A..M", plus 7 functions keys)
|
||
Famicom Mat - Family Trainer (dance mat)
|
||
Famicom Mat - Tap-tap Mat (mat with hammer)
|
||
Famicom Inflatable Exciting Boxing Bop Bag
|
||
Famicom Inflatable Top-Rider Bike
|
||
Famicom Tablet Oeka Kids (touchpad)
|
||
Famicom Trackball Hori Track (joypad with trackball)
|
||
Famicom Power Glove
|
||
Famicom Barcode Reader - Barcode Battler (controller port)
|
||
Famicom Barcode Reader - Datach (cartridge slot)
|
||
Famicom Pachinko - Joypad with pachinko dial
|
||
Famicom Microphone - Standard Microphone in japanese Joypad 2
|
||
Famicom Microphone - Bandai Cartridge with "Stage" Microphone & buttons
|
||
Famicom Disk System (with Eject Button; aka no-disk sensor)
|
||
Famicom Add-on 3D-Glasses (with LCD shutters, connected to controller port)
|
||
Famicom Add-on Storage Turbo File
|
||
Famicom Add-on Storage Battle Box
|
||
Famicom Add-on Storage Data Recorder
|
||
Famicom Add-on Robot
|
||
|
||
Console Variants with special Controllers
|
||
Subor Keyboard (NES-clones with built-in keyboard)
|
||
Subor Mouse (NES-clone bundled with mouse)
|
||
Sharp Famicom Titler (console with built-in tablet and keypad)
|
||
VS System Joysticks (swapped signals; other than normal joypads)
|
||
VS System Dip-Switches / Coin-Inputs / Service Button
|
||
VS System Lightgun (with serially injected data)
|
||
Play Choice 10
|
||
FamicomBox: Dip Switches, Keyswitch, Coin Input, Joypad/Zapper Control
|
||
Nintendo M82 - Shop Demo Unit for 12 games (similar to FamicomBox)
|
||
|
||
Controllers - Summary of Controller Signals
|
||
-------------------------------------------
|
||
|
||
==================== Port 4016h.Write ====================
|
||
|
||
OUT-0 (4016h.W.Bit0)
|
||
NES/Famicom Strobe Joypads, Paddle, Keyboard, etc. (load Shift-Registers)
|
||
NES Miracle Piano Data Out (and Long/Short Strobe)
|
||
NES RacerMate Bicycle Trainer - Forwarded to TX1/TX2 on 4016h/4017h.reads
|
||
Famicom Battle Box: CLK to EEPROM, and, when set, enable chipselect toggle
|
||
Famicom Doremikko Piano: Clock for next row
|
||
Famicom Turbo File Data Out
|
||
Famicom Oeka Kids Tablet Strobe (inverse of normal joypad strobe)
|
||
|
||
OUT-1 (4016h.W.Bit1)
|
||
Famicom 3D System (select left/right shutter for 3D Glasses)
|
||
Famicom Bandai Hyper Shot Gun: Vibration Feature Enable
|
||
Famicom Doremikko Piano: Start transfer (select 1st row)
|
||
Famicom Exciting Boxing (row select)
|
||
Famicom Keyboard Clock for Nibbles
|
||
Famicom Konami Hyper Shot Must be LOW for Player 2 "JUMP"/"RUN" Buttons
|
||
Famicom Newer-Paddle-Versions: Manually start next A/D-Conversion?
|
||
Famicom Oeka Kids Tablet Clock (manually clocked, unlike joypads)
|
||
Famicom Top-Rider Bike - Start some conversion or so?
|
||
Famicom Turbo File Reset Address to 0000h
|
||
NES Unused (not connected to Controller Port)
|
||
VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ) (and map Shared-RAM)
|
||
|
||
OUT-2 (4016h.W.Bit2)
|
||
Famicom Bandai Hyper Shot Gun: Sound Feature Enable
|
||
Famicom Keyboard Tape Data Out
|
||
Famicom Konami Hyper Shot Must be LOW for Player 1 "JUMP"/"RUN" Buttons
|
||
Famicom Turbo File Data Clock
|
||
NES Unused (not connected to Controller Port)
|
||
VS Unisystem Mapper 99, Select 8K VROM Bank
|
||
|
||
==================== Port 4016h.Read ====================
|
||
|
||
PORT0-0 (4016h.R.Bit0)
|
||
Famicom Joypad 1 (always connected)
|
||
NES/Famicom Power Glove (per-byte strobe, and data-out after LONG strobe)
|
||
NES Hori Track (8bit joypad, 2x4bit trackball, 4bit switches/ID) (unreleased)
|
||
NES Joypad 1 (if connected)
|
||
NES Miracle Piano Data In
|
||
NES Power Glove (data-in) (Mattel)
|
||
NES RacerMate Bicycle Trainer - Get RX1 (and forward OUT0 to TX1) (Player 1)
|
||
NES Satellite & Four-Score (Joypad 1, Joypad 3, ID_A)
|
||
VS Unisystem Joypad 2 (not Joypad 1)
|
||
VS Unisystem Lightgun (5th Bit=ID=1, 7th Bit=Light, 8th Bit=Trigger)
|
||
|
||
PORT0-1 (4016h.R.Bit1)
|
||
Famicom Hori Track (8bit joypad, 2x4bit trackball, 4bit switches/ID)
|
||
Famicom Joypad 3 (when 4-player adaptor used)
|
||
Famicom Pachinko Controller (8bit Joypad 3 data, followed by 8bit ADC data)
|
||
Famicom Paddle 1 Button (1bit)
|
||
Famicom Keyboard Tape Data In
|
||
NES Unused (not connected to Controller Port)
|
||
And, probably: Famicom Power Glove (data-in) (PAX)
|
||
|
||
PORT0-2 (4016h.R.Bit2)
|
||
Famicom Microphone (built-in in Joypad 2)
|
||
NES Unused (not connected to Controller Port)
|
||
VS Unisystem Credit Service Button
|
||
|
||
PORT0-3 (4016h.R.Bit3)
|
||
Famicom Unused (not connected to Controller nor Expansion Port)
|
||
NES Second-Zapper Light Sensor
|
||
NES Power Pad Bits 2,1,5,9,6,10,11,7
|
||
VS Unisystem Dip Switch 1
|
||
|
||
PORT0-4 (4016h.R.Bit4)
|
||
Famicom Unused (not connected to Controller nor Expansion Port)
|
||
NES Second-Zapper Trigger Button
|
||
NES Power Pad Bits 4,3,12,8, and four "1"-bits
|
||
VS Unisystem Dip Switch 2
|
||
|
||
PORT0-5/6 (4016h.R.Bit5/6)
|
||
NES/Famicom Unused (not connected to Controller nor Expansion Port)
|
||
VS Unisystem Credit Left/Right Coin Slot
|
||
|
||
PORT0-7 (4016h.R.Bit7)
|
||
NES/Famicom Unused
|
||
VS Dualsystem: Master/Slave ID (0=Slave CPU, 1=Master CPU)
|
||
|
||
==================== Port 4017h.Read ====================
|
||
|
||
PORT1-0 (4017h.R.Bit0)
|
||
Famicom Joypad 2 (always connected) (without Start/Select)
|
||
NES Joypad 2 (if connected)
|
||
NES Satellite & Four-Score (Joypad 2, Joypad 4, ID_B)
|
||
NES RacerMate Bicycle Trainer - Get RX2 (and forward OUT0 to TX2) (Player 2)
|
||
Subor Clone: Subor Mouse Data (in conjunction with OUT-0,OUT-1,OUT-2 ?)
|
||
VS Unisystem Joypad 1 (not Joypad 2)
|
||
|
||
PORT1-1 (4017h.R.Bit1)
|
||
Famicom Doremikko Piano: Data fragment for current half-row
|
||
Famicom Joypad 4 (when 4-player adaptor used)
|
||
Famicom Exciting Boxing (column 1)
|
||
Famicom Keyboard Bit0 of 4-bit Nibble
|
||
Famicom Konami Hyper Shot Player 1 "RUN" Button
|
||
Famicom Mahjong Controller: Data (in conjunction with OUT-0,OUT-1,OUT-2 ?)
|
||
Famicom Paddle 1 Position (8bits)
|
||
NES Unused (not connected to Controller Port)
|
||
|
||
PORT1-2 (4017h.R.Bit2)
|
||
Famicom Barcode Battler (20-byte ASCII String at 1200 Baud, 8N1)
|
||
Famicom Doremikko Piano: Data fragment for current half-row
|
||
Famicom Exciting Boxing (column 2)
|
||
Famicom Keyboard Bit1 of 4-bit Nibble
|
||
Famicom Konami Hyper Shot Player 1 "JUMP" Button
|
||
Famicom Oeka Kids Tablet Ack (confirm Strobe/Clock signals)
|
||
Famicom Party Tap (Button 1, Button 4, ID "1"-Bit)
|
||
Famicom Turbo File Data In
|
||
NES Unused (not connected to Controller Port)
|
||
VS Unisystem Dip Switch 3
|
||
|
||
PORT1-3 (4017h.R.Bit3)
|
||
Famicom Battle Box: Dta.In (data from EEPROM)
|
||
Famicom Doremikko Piano: Data fragment for current half-row
|
||
Famicom Exciting Boxing (column 3)
|
||
Famicom Keyboard Bit2 of 4-bit Nibble
|
||
Famicom Konami Hyper Shot Player 2 "RUN" Button
|
||
Famicom Oeka Kids Tablet Data (18bits)
|
||
Famicom Paddle 2 Button (1bit)
|
||
Famicom Party Tap (Button 2, Button 5, ID "0"-Bit)
|
||
Famicom Top-Rider Bike - First 8bit shift-register
|
||
NES/Famicom Zapper Light Sensor
|
||
NES/Famicom Power Pad Bits 2,1,5,9,6,10,11,7
|
||
NES Paddle Button (1bit)
|
||
NES Power Pad Bits 2,1,5,9,6,10,11,7
|
||
VS Unisystem Dip Switch 4
|
||
|
||
PORT1-4 (4017h.R.Bit4)
|
||
Famicom Battle Box: Status of Dta.out (can be toggled by [4016h].reads)
|
||
Famicom Doremikko Piano: Data fragment for current half-row
|
||
Famicom Exciting Boxing (column 4)
|
||
Famicom Keyboard Bit3 of 4-bit Nibble
|
||
Famicom Konami Hyper Shot Player 2 "JUMP" Button
|
||
Famicom Paddle 2 Position (8bits)
|
||
Famicom Party Tap (Button 3, Button 6, ID "1"-Bit)
|
||
Famicom Top-Rider Bike - Second 8bit shift-register
|
||
NES/Famicom Zapper Trigger Button
|
||
NES/Famicom Power Pad Bits 4,3,12,8, and four "1"-bits
|
||
NES Power Pad Bits 4,3,12,8, and four "1"-bits
|
||
NES Paddle Position (8bits)
|
||
VS Unisystem Dip Switch 5
|
||
|
||
PORT1-5/6/7 (4017h.R.Bit5/6/7)
|
||
NES/Famicom Unused (not connected to Controller nor Expansion Port)
|
||
VS Unisystem Dip Switch 6/7/8
|
||
|
||
==================== Other Controller Port Signals ====================
|
||
|
||
PORT0-CLK (4016h.R) and PORT1-CLK (4017h.R)
|
||
Automatically clocked when reading 4016h and 4017h accordingly, usually
|
||
clocking serial shift registers (joypad, paddle). Other uses are:
|
||
Famicom Battle Box: Toggle Dta.out (always), Toggle /CS (when [4016h].W.0=1)
|
||
Famicom Doremikko Piano: Clock for 1st/2nd half of current row
|
||
FamicomBox: Watchdog Reload
|
||
NES RacerMate Bicycle Trainer - Forward OUT0 to TX0/TX1 (by 4016h/4017h.Read)
|
||
|
||
/IRQ
|
||
Famicom Unused (expansion port /IRQ-pin not used by any known controllers)
|
||
NES Unused (not connected to Controller Port)
|
||
|
||
SOUND OUT
|
||
Famicom Headphones (used by some headphone adaptors)
|
||
NES Unused (not connected to Controller Port)
|
||
|
||
==================== Controller Signals on Cartridge Slot ====================
|
||
|
||
Controller I/O Ports
|
||
4032h FDS Disk Status Register 1 (Disk Insert/Eject Sensor)
|
||
6000h Bandai Microphone and Buttons ?
|
||
6000h.Bit3 - Bandai Datach - Joint ROM System (Barcode Sensor)
|
||
500xh FamicomBox: Dip Switches, Keyswitch, Coin Input, Joypad/Zapper Control
|
||
And, video out: Used by Lightguns and R.O.B. Robot.
|
||
|
||
Controllers - Detection
|
||
-----------------------
|
||
|
||
Opcodes
|
||
88 8C 16 40 A9 08 2D 17 40 C9 08 C8 8C 16 40 ;Battle Box
|
||
AD 17 40 4A 4A 29 01 09 06 8D 16 40 ;Turbo File (older games)
|
||
AD 17 40 29 04 4A 4A 09 06 8D 16 40 ;Turbo File (newer games)
|
||
|
||
Controllers - Joypads
|
||
---------------------
|
||
|
||
Joypads (or Joysticks)
|
||
Each joypad includes an 8bit shift register, set Port 4016h/Bit0=1 to reload
|
||
the button states into the shift registers of both joypads, then reset Port
|
||
4016h/Bit0=0 to disable the shift reload (otherwise all further reads would be
|
||
stuck to the 1st bit, ie. Button A). Joypad data can be then read from bit 0 of
|
||
4016h (joypad 1) and/or bit 0 of 4017h (joypad 2) as serial bitstream of 8bit
|
||
length, ordered as follows:
|
||
1st Button A (0=High=Released, 1=Low=Pressed)
|
||
2nd Button B (0=High=Released, 1=Low=Pressed)
|
||
3rd Select (0=High=Released, 1=Low=Pressed)
|
||
4th Start (0=High=Released, 1=Low=Pressed)
|
||
5th Direction Up (0=High=Released, 1=Low=Moved)
|
||
6th Direction Down (0=High=Released, 1=Low=Moved)
|
||
7th Direction Left (0=High=Released, 1=Low=Moved)
|
||
8th Direction Right (0=High=Released, 1=Low=Moved)
|
||
9th and up Unused (all 1=Low) ;(or all 0=High when no joypad connected)
|
||
The console automatically sends a clock pulse to the Joypad 1 shift register
|
||
after each read from 4016h (and to joypad 2 after read from 4017h). There are
|
||
no timing restrictions, joypads can be handled as fast, or as slow, as desired.
|
||
Note that older Famicom controllers include Select & Start buttons only on
|
||
joypad 1, whilst joypad 2 probably returns unused dummy bits instead (the
|
||
values of that dummy bits are unknown, probably 0=High=Released?).
|
||
|
||
Joypad Layout
|
||
___________________________________
|
||
| _ |
|
||
| _| |_ Nintendo |
|
||
| |_ _| SELECT START |
|
||
| |_| (==) (==) ( B ) ( A ) |
|
||
|___________________________________|
|
||
|
||
Jump and Run Games conventionally use A=Jump, B=Fire.
|
||
|
||
Third-Party Joypads/Joysticks (NES)
|
||
Third-Party NES Joypads/Joysticks can be simply plugged into normal controller
|
||
ports.
|
||
|
||
Third-Party Joypads/Joysticks (Famicom)
|
||
The Famicom comes with two hardwired joypads, making it difficult to use
|
||
third-party joypads or joysticks. One simple solution is to mount add-on
|
||
hardware (mechanically) on the standard joypads:
|
||
Climber Stick NBF-CY (Nichibutsu) (mini-dildo/nipple to be mounted on DPAD)
|
||
FamiCoin (colored "coins" to be mounted on DPAD; for better grip or so)
|
||
Super Controller (Bandai?)(joystick to be mounted on DPAD of standard joypad)
|
||
Ultech 3 Meijin-kun (joystick to be mounted on DPAD+A+B of standard joypad)
|
||
Another solution is to connect the devices to the 15pin expansion port (the
|
||
15pin connector lacks the joypad 1 signal, so at best, they could be shortcut
|
||
with the joypad 2 signal, or wired as joypad 3/4; aside from 3/4-player games,
|
||
many 1/2-player games also support that kind of input). Known devices are:
|
||
ASCII Stick L5 - one-handed joypad (not joystick) (ASCII)
|
||
Joypad with numeric keypad for Famicom Modem (connects to the 15pin port)
|
||
Reportedly, following further devices exist (unknown if they are mechanically
|
||
attached, or electronically connected to 15pin port, or to 7pin ports of late
|
||
Famicoms):
|
||
Joystick-7 and Joystick-7 Mk II
|
||
Joycard Sanusui SSS (Hudson) (with adapter for headphones)
|
||
Reggies's Joystick (with turbofire)
|
||
Super Controller II (Bandai) (with LCD screen)
|
||
Toyo Stick (Toyo)
|
||
Attention:
|
||
To support external joypads, single-player games should read joypad 3, and
|
||
treat it is alternate input for player 1. Two-player games should also support
|
||
joypad 4 (via 4-player adaptor) as alternate input for player 2.
|
||
|
||
Crazy Climber Stick
|
||
Crazy Climber is played with two regular joypads, but both turned by 90
|
||
degrees. Optionally, "Climber Sticks" can be mounted on the joypads, turning
|
||
the thumb-controlled DPADs into thumb-controlled joysticks.
|
||
_________ _________
|
||
| _ | Joypad 1 | _ | Joypad 2
|
||
| _| |_ | (Left Hand) | _| |_ | (Right Hand)
|
||
| |_ _| | | |_ _| |
|
||
| |_| | | |_| |
|
||
| | | |
|
||
| | SEL | | |
|
||
| | | :: MIC |
|
||
| | STA | | |
|
||
| | | |
|
||
| (B) | | (B) |
|
||
| (A) | | (A) |
|
||
|_________| |_________|
|
||
|
||
Controllers - Four-Player Adaptors
|
||
----------------------------------
|
||
|
||
NES Four-player devices (Satellite and Four Score)
|
||
NES Satellite (wireless) (Nintendo) (1989)
|
||
Four-Score (wired) (Nintendo) (1990)
|
||
The device is connected to both of the consoles two controller ports, and up to
|
||
four controllers can be connected to the device.
|
||
The device is accessed much like normal joypads, except that the returned
|
||
bitstream consist of 24 bits instead of normal 8 bits:
|
||
write "1-then-0" to (4016h) (that only once, for all 24 bits)
|
||
read 1st 8 bits: controller 1 (4016h) / controller 2 (4017h) (as normal)
|
||
read 2nd 8 bits: controller 3 (4016h) / controller 4 (4017h) (new ports)
|
||
read 3rd 8 bits: 0,0,0,1,0,0,0,0 (4016h) / 0,0,1,0,0,0,0,0 (4017h) (ID codes)
|
||
further bits: unknown (probably all 0, or all 1)
|
||
The ID codes can be used to detect if the 4-player adapter is connected (used
|
||
by RC Pro Am 2, not used by Gauntlet II). Otherwise the ID field typically
|
||
contains all ones (normal/single controller), or all zeros (no controller
|
||
connected at all).
|
||
Satellite & Four Score Games
|
||
Bomberman II
|
||
Danny Sullivan's Indy Heat
|
||
Gauntlet II
|
||
Greg Norman's Golf Power
|
||
Harlem Globetrotters
|
||
Kings of the Beach
|
||
Magic Johnson's Fast Break
|
||
Monster Truck Rally
|
||
M.U.L.E.
|
||
NES Play Action Football
|
||
Nightmare on Elm Street
|
||
Nintendo World Cup
|
||
Rackets & Rivals
|
||
R.C. Pro-Am II
|
||
Rock 'n' Ball (?)
|
||
Roundball: 2 on 2 Challenge
|
||
Smash TV
|
||
Spot
|
||
Super Jeopardy!
|
||
Super Off Road
|
||
Super Spike V'Ball
|
||
Swords and Serpents
|
||
Top Players' Tennis
|
||
|
||
Famicom Four-player device (Two extra joypads at Expansion Port)
|
||
Older Famicom consoles have 2 "built-in" joypads, additional 2 joypads can be
|
||
connected to the expansion port. The procedure for reading Famicom 4-player
|
||
data is similar as for 2-player data: As normal, write "1-then-0" to 4016h,
|
||
then read 8 times from 4016h, that simultaneously receives data for two pads,
|
||
Bit 0 for joypad 1, and additionally Bit 1 for joypad 3. Respectively, Bit 0
|
||
and 1 of 4017h are for pad 2 and 4.
|
||
Japanese 3-4 player games:
|
||
Downtown Nekketsu Koshinkyoku: Soreyuke Daiundokai
|
||
Ike Ike! Nekketsu Hockey Bu: Subette Koronde Dai Ranto
|
||
Nekketsu Kakutou Densetsu
|
||
Nekketsu Koukou Dodge Ball Bu (in Bean Ball mode of japanese version only)
|
||
Nekketsu Street Basket: Ganbare Dunk Heroes
|
||
Kunio-kun no Nekketsu Soccer League
|
||
U.S. Championship V'Ball
|
||
Wit's
|
||
Note: For 3-players, joypad 3 can be plugged directly to the Expansion Port
|
||
(without needing a 4-player adaptor).
|
||
Moreover, many normal 1-2 player games do support joypad 3-4 as alternate
|
||
player 1-2 inputs (allowing to use external joysticks/joypads, including such
|
||
with autofire functions, instead of the standard famicom joypads).
|
||
|
||
Controllers - Lightguns (Zapper)
|
||
--------------------------------
|
||
|
||
Zapper (Light Gun) Ports / Connection
|
||
Zapper state can be obtained by reading Bit3-4 of Port 4017h and/or 4016h.
|
||
Famicom Zapper connected to Famicom Expansion Port (Inputs at 4017h).
|
||
NES Zappers connected to 1st and/or 2nd Joypad Port (Inputs at 4016h, 4017h).
|
||
Most or all NES games are using 2nd Joypad Port because Famicom uses 4017h.
|
||
Bit3 State of the gun sight (0=High=Light detected, 1=Low=None)
|
||
Bit4 Trigger (0=High=Released, 1=Low=Pulse) (shoot on 1-to-0 transition)
|
||
The trigger mechanics are working as so:
|
||
pulled part way: soft "click" sound: 0-to-1 transition (ignored by games)
|
||
pulled full way: loud "CLANG" sound: 1-to-0 transition (games do fire)
|
||
One exception are Bandai games, which do accidently shoot at 0-to-1 (either
|
||
because of misunderstanding the zapper hardware, and/or for compatibility with
|
||
Bandai's own Hyper Shot gun).
|
||
The light detection flag gets set when sensing light emission from the display,
|
||
ie. when the cathode ray beam outputs a bright color (preferably white) at the
|
||
location where the gun is pointed to.
|
||
Handling the light sensor is usually done as so:
|
||
Output a black picture with a white-rectangle at target location
|
||
If the gun senses light, then it's a "hit".
|
||
(to reduce unnecessary flickering, do that only when trigger is pulled)
|
||
To avoid "hits" on other light sources, verify that there is NO light at times
|
||
when the screen should be dark (eg. shortly before end of vblank).
|
||
When sensing light, the sensor bit does reportedly stay set for 10-25 scanlines
|
||
(during hit-checks, one should check the bit around every 5 scanlines).
|
||
Note: The NES PPU doesn't have any H/V-latches for lightpen/lightgun
|
||
coordinates, so there's little chance to measure the H-position by software.
|
||
However, one may measure the vertical position by counting the time between
|
||
light and vblank (this would allow handling multiple targets at different
|
||
vertical positions within a single frame).
|
||
Note: Shooting at offscreen locations is advancing menu cursors in some games
|
||
(the games are typically also allowing to do this via joypad-select, so it
|
||
isn't stritcly necessary to support offscreen positions in emulators).
|
||
|
||
Games compatible with the NES Zapper:
|
||
Adventures of Bayou Billy (gun optional) (U) 1989 (E) 1990 Konami
|
||
Baby Boomer (unlicensed) (gun optional) (U) 1989 Jim Meuer/Color Dreams
|
||
Barker Bill's Trick Shooting (U) 1989 Nintendo
|
||
Chiller (unlicensed) (gun optional) (U) (HES) 1986 Exidy
|
||
Day Dreamin' Davey (gun optional) (U) 1990 HAL
|
||
Duck Hunt (JUE) (PC10) (VS) 1984 Nintendo
|
||
Freedom Force (U) (VS) 1988 Sunsoft
|
||
Gotcha! The Sport! (U) 1987 LJN
|
||
Gumshoe (UE) (VS) 1986 Nintendo
|
||
Gun-Nac (U) (J) 1990 Tonkin House/Tokyo Shoseki/Nexoft
|
||
Hogan's Alley (JU) (PC10) (VS) 1984 Nintendo
|
||
Laser Invasion (U) aka Gun Sight (for LaserScope or Zapper) (J) 1991 Konami
|
||
The Lone Ranger (gun optional) 1991 Konami
|
||
Mechanized Attack (gun optional) (U) 1991 SNK
|
||
Operation Wolf (gun optional) (J) (U) 1989 Taito
|
||
Shooting Range (for Hyper Shot or Zapper+Joypad) (U) 1989 Bandai
|
||
Space Shadow (for Hyper Shot or Zapper+Joypad) (J) 1989 Bandai
|
||
To The Earth (U) 1989 Nintendo
|
||
Track & Field II (in one section of the game) (U)(E) 1988/89 Konami
|
||
Wild Gunman (U) (PC10) Wairudo Ganman (J) 1984 Nintendo
|
||
|
||
NES/Famicom Lightguns
|
||
Nintendo Zapper (US) (old gray/dark gray version) (1985)
|
||
Nintendo Zapper (US) (new gray/orange version)
|
||
Nintendo Beam Gun (Japan) (black/brown revolver) (1985)
|
||
Nintendo VS Unisystem Lightgun (orange revolver) (2bit serial transmit)
|
||
Bandai Hyper Shot (black machine gun: zapper + joypad-like buttons) (1989)
|
||
Hyperkin FC Super Loader Gun (made by Hyperkin, NES/Zapper compatible?)
|
||
Konami LaserScope/Gun Sight (headset: headphones + voice-activated zapper)
|
||
Nexoft The Dominator: Pro Beam Light Gun (wireless lightgun)
|
||
As additional add-on gimmicks, Quickshot has made Sighting Scopes and Deluxe
|
||
Sighting Scopes that can be mounted on the Nintendo Zapper.
|
||
|
||
Bandai Hyper Shot Gun (for Space Shadow) (1989)
|
||
A black machine pistol, working (more or less) like a normal zapper combined
|
||
with an additional joypad.
|
||
4016h.R.Bit1 Serial 8bit joypad3-style button data
|
||
4017h.R.Bit3 Light (0=High=Yes, 1=Low=No)
|
||
4017h.R.Bit4 Trigger (0=High=Released, 1=Low=Pressed/Held) (shoot while 1)
|
||
4016h.W.Bit1 Gun Move aka Body Vibration System (0=Off, 1=On)
|
||
4016h.W.Bit2 Sound (0=Off, 1=On)
|
||
The serial "joypad3" data is used as so (by Space Shadow):
|
||
joypad3 button B --> throw grenade
|
||
joypad3 up --> move forward (after defeating enemy)
|
||
joypad3 select --> toggle sound/gun-move (in title screen)
|
||
joypad3 start --> start/pause
|
||
The trigger is a simple push-button without the normal zapper-mechanics, this
|
||
allows Space Shadow to support continous fire when the button is held down, but
|
||
isn't fully compatible with normal zapper games (which will fire on 1-to-0
|
||
transitions, ie. when <releasing> the Hyper Shot trigger, rather than pressing
|
||
it).
|
||
The light sensor may have different sensitivity as normal zappers (Space Shadow
|
||
does use white-rectangles, but doesn't output black-background; the
|
||
tunnel-backgrounds are fairly dark, but the backgrounds at tunnel-end are very
|
||
bright, even including some white pixels; so apparently, the hypershot gun
|
||
senses light only when aimed at all-white-pixels areas).
|
||
There seems to be some sort of rumble/vibration feature (called "Body Vibration
|
||
System" on the gun, and "Gun Move" in Space Shadow).
|
||
And, some "Sound" feature (can be enabled/disabled in Space Shadow title
|
||
screen), details are unknown; maybe causing the gun to produce sounds when
|
||
pulling the trigger, or maybe simply outputting the APU sound/music to a
|
||
speaker in the gun?
|
||
Note: Bandai's "Hyper Shot" Lightgun is not to be confused with Konami's "Hyper
|
||
Shot" Push Buttons.
|
||
|
||
VS System Lightguns (for VS Unisystem/Dualsystem arcade machines)
|
||
These are resembling the japanese revolver-shaped Beam Guns. The VS Unisystem
|
||
can't use the "normal" Zapper I/O lines (because it has DIP-Switches connected
|
||
to that ports), and, instead, it's injecting Lightgun data to the 8bit "Joypad"
|
||
shift-register:
|
||
Port.Bit (VS-Joypad) VS-Zapper
|
||
4016h.5th.Bit (Joy2 Up) Connect OK (0=Alert sound, 1=Connected)
|
||
4016h.7th.Bit (Joy2 Left) Light Sensor (0=No,1=Light ;INVERSE of NES Zapper)
|
||
4016h.8th.Bit (Joy2 Right) Trigger (0-to-1=Fire ;INVERSE of NES Zapper)
|
||
The Connect bit is used to generate an Alert sound if people are trying to
|
||
steal the gun by cutting the cable.
|
||
The gun lacks a transistor that is found in normal Zappers (so the Light sensor
|
||
will output opposite voltage).
|
||
Also mind that the VS Unisystem uses different palette(s) than NES consoles, so
|
||
the PPU color number for White (20h or 30h on NES) may differ from game to
|
||
game.
|
||
|
||
FamicomBox Zapper
|
||
The FamicomBox is using a standard NES-Zapper, but with some extras on the
|
||
mainboard: A somewhat bidirectional Supply GND pin on the Zapper connector
|
||
(allows to do a zapper connect check), an Disconnect-Alert signal (on a special
|
||
"CATV" connector), and a DIP-switch for disabling the Zapper. For details, see:
|
||
--> FamicomBox
|
||
|
||
Zapper Schematic / Handheld Pistol NES004
|
||
.----------.
|
||
| 1|--------------GND VCC -----NES.Pin5
|
||
| Sharp 2|---|<|--------GND (light sensor "43 Pi") GND -----NES.Pin1
|
||
| IR3T07A 3|---[22]--||---GND (cap: 1/50) ___
|
||
| 4|---------||---GND (cap: 3.3/50) VCC GND -o o-NES.Pin7
|
||
| 5|--------------GND | 2SC459 Trigger
|
||
| 6|--[390K]------VCC [10K] .------.
|
||
| 7|---------||---GND (cap: .001) | | C|------ NES.Pin6
|
||
| 8|----------------------------------+---|B |
|
||
| 9|--------------VCC | E|---GND
|
||
'----------' VCC--||---GND (cap: 10/16) '------'
|
||
|
||
Arcade Gun "062G2 GUN" (for VS and/or PC10 or so)
|
||
.----------.
|
||
| 1|--------------GND GND ----------- GND, RedPlug.pin1
|
||
| 2|---|<|--------GND (light sensor "43PI") .-- GND, RedPlug.pin2
|
||
| IR3T07 3|--[6R8]--||---GND (C1: 105) '-- ALM, RedPlug.pin3
|
||
| 4|---------||---GND (C2: 335)
|
||
| 5|--------------GND
|
||
| 6|--[394]-------VCC ___
|
||
| 7|---------||---GND (C3: 102) GND ---o o--- TRG, WhitePlug.pin1
|
||
| 8|------------------------------------------ HIT, WhitePlug.pin2
|
||
| 9|--------------VCC VCC --[101]-- +5V, WhitePlug.pin3
|
||
'----------' GND--||--VCC (C4: 476) GND--||--+5V (C5: 476)
|
||
|
||
Note: Aside from the electronics, there's also a lens the gun barrel (not shown
|
||
in the schematics).
|
||
|
||
Controllers - Paddles
|
||
---------------------
|
||
|
||
The Paddle (aka Arkanoid Controller or Vaus Controller) consists of a Push
|
||
Button, and a Dial (a potentiometer, which can be turned left/right by about
|
||
270 degrees, connected to an A/D-converter and 8bit shift-register), some (or
|
||
maybe all) paddles also have a second potentiometer (for calibrating the
|
||
dial-range).
|
||
|
||
Paddle Games
|
||
Arkanoid (J) 1986 (Taito) (bundled with OLD paddle for 15pin Famicom)
|
||
Arkanoid (U) 1987 (Taito) (bundled with OLD paddle for 7pin NES)
|
||
Arkanoid 2 (J) 1988 (Taito) (with NEW paddle; with connector for 2nd paddle)
|
||
Chase H.Q. (J) 1989 (Taito) (compatible with NEW paddle)
|
||
|
||
Old Paddles (automatic ADC-start, max 1 paddle)
|
||
For Famicom-version (Japan):
|
||
4016h.W.Bit0 Load shift-register (strobe 1-then-0)
|
||
4016h.R.Bit1 Paddle Button (1bit) (0=High=Released, 1=Low=Pressed)
|
||
4017h.R.Bit1 Paddle Position (8bits) (0=High=One, 1=Low=Zero) (MSB first)
|
||
For NES-version (US/Europe):
|
||
4016h.W.Bit0 Load shift-register (strobe 1-then-0)
|
||
4017h.R.Bit3 Paddle Button (1bit) (0=High=Released, 1=Low=Pressed)
|
||
4017h.R.Bit4 Paddle Position (8bits) (0=High=One, 1=Low=Zero) (MSB first)
|
||
For the Position Values, first of, undo inversion of the ADC value (XOR by
|
||
FFh), then handle the result as so:
|
||
treat 00h..1Fh as position 100h..11Fh ;\repair 8bit/9bit "overflows"
|
||
treat 20h..FEh as position 020h..0FEh ;/
|
||
treat FFh as NOT CONNECTED (although FFh may ALSO occur at position 0FFh)
|
||
clip position 020h..11Fh to min/max range 062h..102h ;<-- Arkanoid
|
||
Values are small=left, large=right. With old paddles, A/D-conversion seems to
|
||
start automatically (unlike as new paddles); unknown how that works (if it's
|
||
poorly implemented, read-errors might occur if the ADC value is updated during
|
||
shift-register loading).
|
||
|
||
New Paddles (different ADC-range, manual ADC-start, max 2 paddles)
|
||
For Famicom-version (new paddles were released ONLY in Japan):
|
||
4016h.W.Bit0 Load shift-register (strobe 1-then-0)
|
||
4016h.R.Bit1 Paddle 1 Button (1bit) (0=High=Released, 1=Low=Pressed)
|
||
4017h.R.Bit1 Paddle 1 Position (8bits) (0=High=One, 1=Low=Zero) (MSB first)
|
||
4017h.R.Bit3 Paddle 2 Button (1bit) (0=High=Released, 1=Low=Pressed)
|
||
4017h.R.Bit4 Paddle 2 Position (8bits) (0=High=One, 1=Low=Zero) (MSB first)
|
||
4016h.W.Bit1 Start next A/D-conversion (strobe 1-then-0)
|
||
For the Position Values, first of, undo inversion of the ADC value (XOR by
|
||
FFh), then handle the result as so:
|
||
treat 00h..FFh as position 00h..FFh (no 9bit "overflows" in new paddles)
|
||
optionally treat as FFh as NOT CONNECTED (Arkanoid 2/Chase H.Q. don't so)
|
||
clip position 00h..FFh to min/max range 4Eh..BAh ;<--Arkanoid 2, TINY-screen
|
||
clip position 00h..FFh to min/max range 4Eh..F2h ;<--Arkanoid 2, WIDE-screen
|
||
clip position 00h..FFh to min/max range 54h..DBh ;<--Arkanoid 2, PONG-view
|
||
clip position 00h..FFh to min/max range 38h..E7h ;<--Chase H.Q.
|
||
Note: For reaching the Arkanoid 2 doors at left/right screen sides, the values
|
||
received from paddle must EXCEED the 4Eh..F2h min/max range.
|
||
Values are small=left, large=right (or, in Arkanoid 2's PONG-view, small=up for
|
||
player 1, and small=down for player 2).
|
||
|
||
Note
|
||
Emulators (or hardware) can auto-detect the Paddle version by sensing OUT1=1.
|
||
|
||
Component List (Old Paddle)
|
||
IC1 14pin NE556 (dual 555 universal timers)
|
||
IC2 16pin NEC D4040BC (12-bit asynchronous binary counter with reset)
|
||
IC3 16pin NEC D74HC00C (quad NAND gates)
|
||
IC4 14pin NEC D74HC165C (8-bit parallel-in serial-out shift register)
|
||
CN 6pin connector (VCC,GND,STB,DTA,CLK,BUTTON)
|
||
VR1 paddle-dial potentiometer
|
||
VR2 calibration potentiometer
|
||
SW1 push-button
|
||
plus, 11 capacitors, and 6 resistors
|
||
|
||
Controllers - Push Buttons
|
||
--------------------------
|
||
|
||
Party Tap (Six Players, one Button per player) (Yonezawa/Partyroom 21)
|
||
Set of six controllers, each with one push button. Used by following games:
|
||
Casino Derby (J) (19xx)
|
||
Gimmi a Break - Shijou Saikyou no Quiz OuKetteisen (J) (TBS/S'PAL) (1991)
|
||
Gimmi a Break - Shijou Saikyou no Quiz OuKetteisen 2 (J) (TBS/S'PAL) (1992)
|
||
Project Q (J) (Hect/Hector) (1992)
|
||
.-----.
|
||
.----------------------------------------|1 \
|
||
| .---------------------------------|2 | _
|
||
| | .--------------------------|3 |_________| | 15pin
|
||
| | | .-------------------|4 | |_| plug
|
||
| | | | .------------|5 |
|
||
| | | | | .-----|6 /
|
||
.-'-. .-'-. .-'-. .-'-. .-'-. .-'-. '-----'
|
||
|(1)| |(2)| |(3)| |(4)| |(5)| |(6)|
|
||
'---' '---' '---' '---' '---' '---'
|
||
The thing has somehow fragile timings; the different games all have different
|
||
delays before/after strobing and between reads. With max delays, it's accessed
|
||
somewhat like so:
|
||
wait 500 clks ;-lead delay (with strobe=0)
|
||
[4016h]=01h, [4016h]=00h, wait 160 clks ;-strobe 1-then-0 with delay
|
||
a=[4017h], wait 80 clks, b=[4017h] ;-read 2x3bit with delay
|
||
data = (a AND 1Ch)/4 + (b AND 1Ch)*2 ;-merge (Bit0-5 = Button 1-6)
|
||
Moreover, at whatever time (apparently somewhere after above 1st/2nd reads), a
|
||
detection value can be read: "([4017h.R] AND 1Ch)=14h"
|
||
|
||
Konami Hyper Shot (Two Players, two Buttons per player) (Konami)
|
||
Set of two controllers, each with two push buttons. Used by following games:
|
||
Hyper Olympic (J) Konami (1985)
|
||
Hyper Sports (J) Konami (1985)
|
||
Accessed as shown below.
|
||
4016h.W.Bit1 Select Player 2 "JUMP"/"RUN" Buttons (0=Low=Yes) ;\usually, set
|
||
4016h.W.Bit2 Select Player 1 "JUMP"/"RUN" Buttons (0=Low=Yes) ;/both to 0
|
||
4017h.R.Bit1 Player 1 "RUN" Button (0=High=No, 1=Low=Pressed and OUT-2=LOW)
|
||
4017h.R.Bit2 Player 1 "JUMP" Button (0=High=No, 1=Low=Pressed and OUT-2=LOW)
|
||
4017h.R.Bit3 Player 2 "RUN" Button (0=High=No, 1=Low=Pressed and OUT-1=LOW)
|
||
4017h.R.Bit4 Player 2 "JUMP" Button (0=High=No, 1=Low=Pressed and OUT-1=LOW)
|
||
Note: For whatever reason, the buttons are wired to OUT-2/OUT-1 (rather than
|
||
being wired to GND), this would allow to select/deselect the buttons; in the
|
||
existing software both OUT-2 and OUT-1 are always set to LOW.
|
||
.--------------------------. .--------------------------.
|
||
| imanoK | | imanoK |
|
||
| tohSrepyH | | tohSrepyH |
|
||
| PMUJ NUR | | PMUJ NUR |
|
||
_| ( ) I ( ) | _| ( ) II ( ) |
|
||
/ | JUMP RUN | / | JUMP RUN |
|
||
| | HyperShot | | | HyperShot |
|
||
| | Konami | | | Konami |
|
||
| '--------------------------' \ '--------------------------' _
|
||
\ '--------------------------------| | 15pin
|
||
'-----------------------------------------------------------------|_| plug
|
||
The pads don't explicitly have "front/back" sides (and can be turned either way
|
||
around); however, for shooting left/right in Hyper Sports they should be turned
|
||
this way: JUMP=Left, RUN=Right.
|
||
Theoretically, one could as well use normal joypad buttons, however, Konami has
|
||
intentionally crippled them to be working ONLY with their Hyper Shot: The games
|
||
are actually reading normal joypad data, but are then erasing all joypad bits
|
||
(except start/select), and are then replacing them by the Hyper Shot Button
|
||
bits.
|
||
Note: Konami's "Hyper Shot" Buttons are not to be confused with Bandai's "Hyper
|
||
Shot" Lightgun.
|
||
|
||
Controllers - Typewriter Keyboards
|
||
----------------------------------
|
||
|
||
Keyboard with 72 Keys, and tape read/write port, connected to 15-pin Famicom
|
||
Expansion port. Used by Famicom BASIC and Playbox BASIC. Also, the Study and
|
||
Game 32-in-1 and Education 18-in-1 cartridges use an identical protocol, but
|
||
with different keyboard matrix.
|
||
|
||
Keyboard Access Pseudo Code
|
||
[4016h]=05h:WAIT(16clks) ;reset (force row 0)
|
||
FOR i=0 TO 8 ;loop 9 rows
|
||
[4016h]=04h:WAIT(56clks) ;request LSB of NEXT row
|
||
Row[i]=(([4017h] SHR 1) AND 0Fh) ;read LSB
|
||
[4016h]=06h:WAIT(56clks) ;request MSB of SAME row
|
||
Row[i]=(([4017h] SHL 3) AND F0h)+Row[i] ;read MSB
|
||
NEXT ;loop next
|
||
Column 0-7 are then in Bit0-7 of each row. Bits are 0=Pressed, 1=Released
|
||
(unlike for most other NES/Famicom controllers, which are 1=Pressed).
|
||
When reading more than 9 rows, the 10th read (row 9) returns garbage data, and
|
||
then starts over at row 0.
|
||
|
||
Famicom Keyboard Matrix
|
||
Row Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7
|
||
0 F8 RETURN [ ] KANA R-SHFT \(Yen) STOP
|
||
1 F7 @ : ; _ / - ^
|
||
2 F6 O L K . , P 0
|
||
3 F5 I U J M N 9 8
|
||
4 F4 Y G H B V 7 6
|
||
5 F3 T R D F C 5 4
|
||
6 F2 W S A X Z E 3
|
||
7 F1 ESC Q CTRL L-SHFT GRPH 1 2
|
||
8 CLR UP RIGHT LEFT DOWN SPACE DEL INS
|
||
|
||
Famicom Keyboard Layout (HVC-007)
|
||
.------------------------------------------------.
|
||
| F1 F2 F3 F4 F5 F6 F7 F8 |
|
||
| 1 2 3 4 5 6 7 8 9 0 - ^ \ STOP |
|
||
| ESC Q W E R T Y U I O P @ [ ENTER CLR INS DEL |
|
||
| CTRL A S D F G H J K L ; : ] KANA UP |
|
||
| SHIFT Z X C V B N M , . / _ SHIFT LEFT RIGHT |
|
||
| GRPH SPACE DOWN |
|
||
'------------------------------------------------'
|
||
|
||
32-in-1 Study and Game / Education Keyboard Matrix
|
||
Row Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7
|
||
0 4 G F C F2 E 5 V
|
||
1 2 D S END F1 W 3 X
|
||
2 INS BS PGDN RIGHT F8 PGUP ESC HOME
|
||
3 9 I L , F5 O 0 .
|
||
4 ] ENTER UP LEFT F7 [ \ DOWN
|
||
5 Q CAPS Z Pa ESC A 1 CTRL
|
||
6 7 Y K M F4 U 8 J
|
||
7 - ; ' / F6 P = SHIFT
|
||
8 T H N SPACE F3 R 6 B
|
||
The 32-in-1 menu also checks Bit4 in Row 9, if that bit is zero then it does
|
||
additionally read row 0Ah..0Ch. Aside from the menu, most or all games in the
|
||
32-in-1 cartridge don't seem to use that extra rows though.
|
||
|
||
32-in-1 Study and Game Keyboard Layout (as shown in Typing School I)
|
||
.------------------------------------------------------------.
|
||
| ESC F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 Pa. Br Nu Re. |
|
||
| ~ 1 2 3 4 5 6 7 8 9 0 - + BS HOME |
|
||
| TAB Q W E R T Y U I O P [ ] \ END |
|
||
| CAPS A S D F G H J K L ; ' ENTER PGUP |
|
||
| SHIFT Z X C V B N M , . / SHIFT UP PGDN |
|
||
| ### CTRL ALT ## [ SPACE ] ALT INS DEL LT DN RIGH |
|
||
'------------------------------------------------------------'
|
||
Above does only show how software in "Typing School I" depicts the keyboard,
|
||
unknown how the real hardware looks like... there are some NES-console clones
|
||
named GA-M16 and GLK-2016 with built-in keyboard... maybe these clone(s) are
|
||
compatible with the 32-in-1 cartridge?
|
||
|
||
Keyboard I/O Signals
|
||
OUT.0 Keyboard Strobe/Reset (0=Normal, 1=Initialize)
|
||
OUT.1 Keyboard Clock (0=LSB, 1=MSB) (1-to-0=Next Row)
|
||
OUT.2 Tape Output (Should be 1 when accessing Keyboard)
|
||
PORT0-1 Tape Input
|
||
PORT1-4..1 Keyboard Input Bit3..0 (either MSB or LSB of current row)
|
||
Tape In/Out allow to connect an external tape recorder.
|
||
--> Storage Data Recorder
|
||
|
||
Subor Keyboard
|
||
Details are unknown, maybe same as the Study and Game thing.
|
||
|
||
Controllers - Piano Keyboards
|
||
-----------------------------
|
||
|
||
Doremikko (Three octaves; aka two & two-half octaves) (Konami)
|
||
Piano keyboard for the "Doremikko" FDS (Famicom Disk System) game.
|
||
_____________________________________________
|
||
| _________________________________________ |
|
||
| | U U U | U U | U U U | U U | U U U | U U | |
|
||
| | U U U | U U | U U U | U U | U U U | U U | | Keys
|
||
| | | | | | | | | | | | | | | | | | | | | | | |
|
||
|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
|
||
F G A H C D E F G A H C D E F G A H C D E Notes
|
||
|-------><------------><------------><----| Octaves
|
||
1..7 8..19 | 20..31 32..36 Key Numbers
|
||
|
|
||
Middle C
|
||
36 Piano Keys (21 White Keys, 15 Black Keys) (two & two-half octaves)
|
||
The 36 keys are read like so:
|
||
[4016h]=02h, [4016h]=01h ;-write 2-then-1
|
||
dummy=[4017h], Key1,2=[4017h].Bit1,2 ;-read 0+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key3,4,5,6=[4017h].Bit1,2,3,4, Key7,8=[4017h].Bit1,2 ;-read 4+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key9,10,11,12=[4017h].Bit1,2,3,4, Key13,14=[4017h].Bit1,2 ;-read 4+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key15,16,17,18=[4017h].Bit1,2,3,4, Key19,20=[4017h].Bit1,2 ;-read 4+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key21,22,23,24=[4017h].Bit1,2,3,4, Key25,26=[4017h].Bit1,2 ;-read 4+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key27,28,29,30=[4017h].Bit1,2,3,4, Key31,32=[4017h].Bit1,2 ;-read 4+2 bits
|
||
[4016h]=00h, [4016h]=01h ;-write 0-then-1
|
||
Key33,34,35,36=[4017h].Bit1,2,3,4 ;-read 4+0 bits
|
||
The used controller signals are working somewhat like so:
|
||
OUT-1 start transfer (select 1st row)
|
||
OUT-0 clock for next row
|
||
CLK clock for 1st/2nd half of current row
|
||
PORT1.1-4 data for current row (4bit in 1st half, 2bit in 2nd half)
|
||
Unlike the Miracle, the Doremikko Keyboard doesn't contain its own sound
|
||
generator. However, since the software was shipped on disk, it may use the FDS
|
||
sound hardware:
|
||
--> Famicom Disk System (FDS)
|
||
The Piano mode (right-most option in main menu) uses normal APU sound as second
|
||
voice (when pressing two keys).
|
||
|
||
Miracle (Four Octaves, plus next higher C) (The Software Toolworks)
|
||
MIDI Synthesizer connected to NES controller Port. Used by only one NES
|
||
cartridge: The Miracle Piano Teaching System (1990). Aside from the keyboard,
|
||
the Miracle contains its own sound generators and speakers.
|
||
.--._________________________________________________________.--.
|
||
| |:::::::::::: MIRACLE .. .. .. .. .. ::::::::::::| |
|
||
| |:::::::::::: .. .. .. .. .. ::::::::::::| |
|
||
| |:::::::::::: # # # # : .. .. .. .. ::::::::::::| |
|
||
| |:::::::::::: # # # # : .. .. .. ::::::::::::| |
|
||
| |_________________________________________________________| |
|
||
| | U U | U U U | U U | U U U | U U | U U U | U U | U U U | | |
|
||
| | U U | U U U | U U | U U U | U U | U U U | U U | U U U | | |Keys
|
||
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
|
||
|__|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|__|
|
||
C D E F G A H C D E F G A H C D E F G A H C D E F G A H C Notes
|
||
<-------------><------------><------------><------------>X Octaves
|
||
36..47 48..59 | 60..71 72..83 84 Key Numbers
|
||
|
|
||
Middle C
|
||
49 Piano Keys (29 White Keys, 20 Black Keys) (4 octaves, plus next higher C)
|
||
1 Foot Pedal (Sustain)
|
||
8 Push Buttons (Mode/Volume Selection)
|
||
The thing can be connected to NES, SNES, and other consoles/computers.
|
||
--> Controllers - Piano - Miracle Piano Controller Port
|
||
--> Controllers - Piano - Miracle Piano MIDI Commands
|
||
--> Controllers - Piano - Miracle Piano Instruments
|
||
--> Controllers - Piano - Miracle Pinouts and Component List
|
||
|
||
Controllers - Piano - Miracle Piano Controller Port
|
||
---------------------------------------------------
|
||
|
||
Miracle Controller Port Transfer
|
||
Read Direction (invoked by SHORT Strobe signal)
|
||
1st Data Present Flag (0=High=None, 1=Low=Yes)
|
||
2nd..9th Data Bit7..0 (MSB First, inverted 1=LOW=Zero)
|
||
10th..12th Unknown
|
||
13th..16th Unknown (would be ID Bit3..0 on other SNES controllers)
|
||
17th and up Unknown
|
||
Write Direction (invoked by LONG Strobe signal, data output on STROBE line)
|
||
1st..8th Data Bit7..0 (MSB First, 0=LOW=Zero)
|
||
Observe that read/write direction depends on length of initial Strobe signal
|
||
(so games that are reading joypad with other strobe-lengths might mess up
|
||
things).
|
||
10th bit and up (including the 4bit Controller ID) might be garbage (depending
|
||
on how the 8051 CPU in the keyboard handles the data transfer). However, with
|
||
appropriate timings, detecting a Miracle could be done via the "Firmware
|
||
version request" MIDI command.
|
||
Note: The NES and SNES Miracle software expects the piano keyboard connected to
|
||
Port 1, and a normal joypad connected to Port 2.
|
||
|
||
miracle_recv_byte
|
||
[4016h]=01h ;strobe on
|
||
delay (need strobe on for 12 NES clks) ;short delay = READ mode
|
||
[4016h]=00h ;strobe off
|
||
data_present_flag = [4016h].bit0 ;data present flag (1=LOW=Yes)
|
||
for i=7 to 0
|
||
data.bit(i)=NOT [4016h].bit0 ;data bits (MSB first, 1=LOW=Zero)
|
||
next i
|
||
|
||
miracle_send_byte
|
||
[4016h]=01h ;strobe on (start bit)
|
||
delay (need strobe on for 66 NES clks) ;long delay = WRITE mode
|
||
for i=7 to 0
|
||
[4016h].bit0=data.bit(i) ;data bits (MSB first, 1=HIGH=One)
|
||
dummy=[4016h] ;issue short CLK pulse
|
||
next i
|
||
[4016h]=00h ;strobe off (stop/idle)
|
||
delay (21 NES clks... plus overload) ;wait before next byte transfer
|
||
|
||
Controllers - Piano - Miracle Piano MIDI Commands
|
||
-------------------------------------------------
|
||
|
||
The Miracle is always using MIDI messages (no matter if the messages are
|
||
transferred through MIDI or RS232 or NES/SNES/Genesis controller cables). Below
|
||
lists the supported MIDI messages (including "Undocumented" messages, which are
|
||
used by the Miracle's SNES software, although they aren't mentioned in the
|
||
Miracle's Owner's Manual).
|
||
|
||
MIDI Information Sent FROM/TO The Miracle keyboard
|
||
Expl. Dir Hex
|
||
Note off (Undocumented) W 8#h,<key>,00h ;same as Note ON with velo=00h
|
||
Note on/off command R/W 9#h,<key>,<velo>
|
||
Main volume level W B0h,07h,<vol>
|
||
Sustain on/off command R/W B#h,40h,<flag>
|
||
Local control on/off W B0h,7Ah,<flag>
|
||
All notes off W B#h,7Bh,00h
|
||
Patch change command (*) R ?? C#h,<instr> ;TO keyboard = Undocumented
|
||
Miracle button action R F0h,00h,00h,42h,01h,01h,<bb>,F7h
|
||
Unknown (Undocumented) W F0h,00h,00h,42h,01h,02h,<??>,F7h ;???
|
||
Keyboard buffer overflow R F0h,00h,00h,42h,01h,03h,01h,F7h
|
||
Midi buffer overflow R F0h,00h,00h,42h,01h,03h,02h,F7h
|
||
Firmware version request W F0h,00h,00h,42h,01h,04h,F7h
|
||
Miracle firmware version R F0h,00h,00h,42h,01h,05h,<maj>,<min>,F7h
|
||
Patch split command W F0h,00h,00h,42h,01h,06h,0#h,<lp>,<up>,F7h
|
||
Unknown (Undocumented) W F0h,00h,00h,42h,01h,07h,F7h ;???
|
||
All LEDs on command W F0h,00h,00h,42h,01h,08h,F7h
|
||
LEDs to normal command W F0h,00h,00h,42h,01h,09h,F7h
|
||
Reset (Undocumented) W FFh
|
||
Direction: R=From keyboard, W=To keyboard
|
||
Notes: (*) Patch change FROM Keyboard is sent only in Library mode.
|
||
N#h Hex-code with #=channel (#=0 from keyb, #=0..7 to keyb)
|
||
<key> Key (FROM Miracle: 24h..54h) (TO Miracle: 18h..54h/55h?)
|
||
<velo> Velocity (01h..7Fh, or 00h=Off)
|
||
<vol> Volume (00h=Lowest, 7Fh=Full)
|
||
<flag> Flag (00h=Off, 7Fh=On)
|
||
<instr> Instrument (00h..7Fh) for all notes
|
||
<lp> Instrument (00h..7Fh) for notes 24?/36-59, lower patch number
|
||
<up> Instrument (00h..7Fh) for notes 60-83/84?, upper patch number
|
||
<maj>.<min> Version (from version 1.0 to 99.99)
|
||
<bb> button on/off (bit0-2:button number, bit3:1=on, bit4-7:zero)
|
||
Data from piano is always sent on first channel (#=0). Sending data to piano
|
||
can be done on first 8 channels (#=0..7), different instruments can be assigned
|
||
to each channel. Although undocumented, the SNES software does initialize 16
|
||
channels (#=0..0Fh), unknown if the hardware does support/ignore those extra
|
||
channels (from the instrument table: it sounds as if one could use 16
|
||
single-voice channels or 8 dual-voice channels).
|
||
|
||
Controllers - Piano - Miracle Piano Instruments
|
||
-----------------------------------------------
|
||
|
||
Available Patches (aka Instruments)
|
||
The following patches are available through both Library Select Mode and MIDI
|
||
control:
|
||
000 Grand Piano 032 Marimba 064 Synth Bells 096 Tube Bells'
|
||
001 Detuned Piano 033 Glockenspiel' 065 Vox 1 097 Frogs/Ducks
|
||
002 FM Piano 034 Kalimba' 066 Vox 2 098 Banjo'
|
||
003 Dyno 035 Tube Bells 067 Vox 3 099 Shakuhachi'
|
||
004 Harpsichord 036 Steel Drums 068 Mod Synth 100 Piano'
|
||
005 Clavinet 037 Log Drums' 069 Pluck Synth 101 Vibraphone'
|
||
006 Organ 038 Strings 1 070 Hard Synth 102 FM Piano'
|
||
007 Pipe Organ 039 Pizzicato 071 Syntar 103 Clock Belis'
|
||
008 Steel Guitar 040 Strings 2 072 Effects 1 * 104 Harpsichord'
|
||
009 12-StringGuitar 041 Violin 1' 073 Effects 2 * 105 Clavinet'
|
||
010 Guitar 042 Trumpet' 074 Percussion 1 * 106 Organ'
|
||
011 Banjo 043 Trumpets 075 Percussion 2 * 107 Pipe Organ'
|
||
012 Mandolin 044 Horn' 076 Percussion 3 * 108 Metal Guitar'
|
||
013 Koto' 045 Horns 077 Sine Organ' 109 Stick'
|
||
014 Jazz Guitar' 046 Trombone' 078 Organ # 110 Guitar'
|
||
015 Clean Guitar' 047 Trombones 079 Pipe Organ # 111 Xylophone'
|
||
016 Chorus Guitar 048 CupMuteTrumpet' 080 Harpsichord # 112 Marimba'
|
||
017 Fuzz Guitar 049 Sfz Brass 1 081 Synth Pad 1 113 Syn Trombone'
|
||
018 Stop Guitar 050 Sfz Brass 2 082 Synth Pad 2 114 Syn Trumpet'
|
||
019 Harp' 051 Saw Synth 083 Synth Pad 3 115 Sfz Brass 1'
|
||
020 Detuned Harp 052 Tuba' 084 Synth Pad 4 116 Sfz Brass 2'
|
||
021 Upright Bass' 053 Harmonica 085 Synth Pad 5 117 Saw Synth'
|
||
022 Slap Bass' 054 Flute' 086 Synth Pad 6 118 Church Bells'
|
||
023 Electric Bass' 055 Pan Flute' 087 Synth Pad 7 119 Marcato'
|
||
024 Moog 056 Calliope 088 Synth Pad 8 120 Marcato
|
||
025 Techno Bass 057 Shakuhachi 089 Synth Pad 9 121 Violin 2'
|
||
026 Digital Waves 058 Clarinet' 090 Synth Pad 10 122 Strings 3
|
||
027 Fretless Bass' 059 Oboe' 091 Synth Pad 11 123 Synth Bells'
|
||
028 Stick Bass 060 Bassoon' 092 Synth Pad 12 124 Techno Bass'
|
||
029 Vibraphone 061 Sax' 093 Synth Pad 13 125 Mod Synth'
|
||
030 MotorVibraphone 062 Church Bells 094 Synth Pad 14 126 Pluck Synth'
|
||
031 Xylophone 063 Big Bells 095 Synth Pad 15 127 Hard Synth'
|
||
Notes:
|
||
' These programs are single voice, which lets The Miracle play up to 16
|
||
notes simultaneously. All other programs are dual voice, which lets it
|
||
play up to 8 notes simultaneously.
|
||
* 072..076 See below for a list of Effects/Percussion sounds.
|
||
# 078..080 To be true to the nature of the sampled instrument, these patches
|
||
do not respond to velocity.
|
||
|
||
Effects and Percussion Patches
|
||
When selecting instruments 072..076 (Effects 1-2 and Percussion 1-3), a number
|
||
of different sounds are mapped to each six keyboard keys/notes:
|
||
Note Effects 1 Effects 2 Percussion 1 Percussion 2 Percussion 3
|
||
30-35 Jet Yes (ding) - - Ratchet
|
||
36-4l Gunshot No (buzz) Kick Drum Rim Shot Snap 1
|
||
42-47 RoboDeath Applause Snare Exotic Snap 2
|
||
48-53 Whoosh Dogbark Toms Congas Dripdrum 1
|
||
54-59 Punch Door creak Cymbal Timbale Dripdrum 2
|
||
60-65 Slap Door slam Closed Hat Cowbell Wet clink
|
||
66-71 Duck Boom Open Hat Bongos Talk Drum
|
||
72-77 Ow! 1 Car skid Ride Whistle Agogo
|
||
78-83 Ow! 2 Goose Shaker Clave Explosion
|
||
Note: The piano keys are numbered 36..84 (so notes 30..35 can be used only
|
||
through MIDI messages, not via keyboard).
|
||
|
||
Controllers - Piano - Miracle Pinouts and Component List
|
||
--------------------------------------------------------
|
||
|
||
25pin SUBD connector (J6)
|
||
1 PC/Amiga/Mac RS232 GND (also wired to RTS)
|
||
2 PC/Amiga/Mac RS232 RxD
|
||
3 PC/Amiga/Mac RS232 TxD
|
||
7 NES/SNES/Genesis GND
|
||
10 NES/SNES/Genesis Data
|
||
13 NES/SNES/Genesis Strobe
|
||
14 Sense SENSE0 (0=MIDI Output off, 1=MIDI Output on)
|
||
15 Sense SENSE1 (0=9600 Baud; for RS232, 1=31250 Baud; for MIDI)
|
||
19 NES/SNES/Genesis Clock
|
||
all other pins = not connected
|
||
For PC/Mac RS232 wire SENSE0=GND, SENSE1=GND
|
||
|
||
Miracle NES and SNES Cartridges
|
||
According to the ROM Headers: The SNES cartridge contains 512Kbyte Slow/LoROM,
|
||
and no SRAM (nor other storage memory). The NES cartridge contains MMC1 mapper,
|
||
256Kbyte PRG-ROM, 64Kbyte CHR-ROM, and no SRAM (nor other storage memory).
|
||
|
||
Miracle Piano Component List (Main=Mainboard Section, Snd=Sound Engine)
|
||
U1 Snd 16pin TDA7053 (stereo amplifier for internal speakers)
|
||
U2 Snd 8pin NE5532 (dual operational amplifier)
|
||
U3 Snd 16pin LM13700 or LM13600 (unclear in schematic) (dual amplifier)
|
||
U4 Snd 14pin LM324 (quad audio amplifier)
|
||
U5 Main 3pin LM78L05 (converts +10V to VLED, supply for 16 LEDs)
|
||
U6 Main 14pin 74LS164 serial-in, parallel-out (to 8 LEDs)
|
||
U7 Main 14pin 74LS164 serial-in, parallel-out (to another 8 LEDs)
|
||
U8 Main 5pin LM2931CT (converts +12V to +10V, and supply for Power LED)
|
||
U9 Main 3pin LM78L05 (converts +10V to +5REF)
|
||
U10 Snd 14pin TL084 (JFET quad operational amplifier)
|
||
U11 Snd 40pin J004 (sound chip, D/A converter with ROM address generator)
|
||
U12 Snd 32pin S631001-200 (128Kx8, Sound ROM for D/A conversion)
|
||
U13 Main 3pin LM78L05 (converts +10V to VCC, supply for CPU and logic)
|
||
U14 Main 40pin AS0012 (ASIC) Keyboard Interface Chip (with A/D for velocity)
|
||
U15 Main 40pin 8032 (8051-compatible CPU) (with Y1=12MHz)
|
||
U16 Snd 40pin AS0013 (ASIC)
|
||
U17 Main 28pin 27C256 EPROM 32Kx8 (Firmware for CPU)
|
||
U18 Main 28pin 6264 SRAM 8Kx8 (Work RAM for CPU)
|
||
U19 Main 16pin LT1081 Driver for RS232 voltages
|
||
U20 Main 8pin 6N138 opto-coupler for MIDI IN signal
|
||
S1-8 Main 2pin Push Buttons
|
||
S9 Main 3pin Power Switch (12V/AC)
|
||
J1 Main 3pin 12V AC Input (1 Ampere)
|
||
J2 Main 2pin Sustain Pedal Connector (polarity is don't care)
|
||
J3 Snd 2pin RCA Jack Right
|
||
J4 Snd 2pin RCA Jack Left
|
||
J5 Snd 5pin Headphone jack with stereo switch (mutes internal speakers)
|
||
J6 Main 25pin DB25 connector (RS232 and SNES/NES/Genesis controller port)
|
||
J7 Main 5pin MIDI Out (DIN)
|
||
J8 Main 5pin MIDI In (DIN)
|
||
JP1 Main 16pin Keyboard socket right connector
|
||
JP2 Main 16pin Keyboard socket left connector
|
||
JP3 Snd 4pin Internal stereo speakers connector
|
||
Note: The official original schematics are released & can be found in internet.
|
||
|
||
Controllers - Keypads
|
||
---------------------
|
||
|
||
TV-NET (21 Buttons)
|
||
The TV-NET controllers are roughly resembling TV remote controls (though using
|
||
a cable connection, no wireless IR-transmission). There are several revisions
|
||
(with differently labeled buttons):
|
||
Television Network Whatever Daiwa no My Trade
|
||
.----------------. .----------------. .----------------.
|
||
| TV-NET | | JAP | | JAP |
|
||
| [JP] [F1] [F2] | | [JP] [JP] [JP] | | [JP] [JP] [JP] |
|
||
| [F3] [F4] [F5] | | [JP] [JP] [JP] | | [<|] [|>] [C ] |
|
||
| (1) (2) (3) | | (1) (2) (3) | | (1) (2) (3) |
|
||
| (4) (5) (6) | | (4) (5) (6) | | (4) (5) (6) |
|
||
| (7) (8) (9) | | (7) (8) (9) | | (7) (8) (9) |
|
||
| (*) (0) (.) | | (^) (0) (v) | | (*) (0) (.) |
|
||
| (<-) (->) | | (<|) (|>) | | (# ) (->) |
|
||
| (JAP) | | (JAP) | | ((o)) |
|
||
'----------------' '----------------' '----------------'
|
||
Numeric keypads for use with TV-NET modems:
|
||
--> Modems
|
||
|
||
Famicom Network Controller (HVC-051) (23 Buttons)
|
||
.------------------------------------------.
|
||
| (<) (>) (1) (2) (3) (*) (C) |
|
||
| SEL _ STA (JAP) |
|
||
| _| |_ (4) (5) (6) (#) (.) |
|
||
| |_ _| |
|
||
| |_| (7) (8) (9) ( 0 ) (B) (A) |
|
||
'------------------------------------------'
|
||
Joypad with numeric keypad for use with Famicom Network modems:
|
||
--> Modems
|
||
|
||
Power Glove Numeric Keypad
|
||
The Power Glove does also have some sort of numeric keypad. In normal mode, the
|
||
keypad is used to configure the glove (for using it with games without built-in
|
||
glove-support). When entering a special glove mode, it's also possible to read
|
||
the keypad buttons by software.
|
||
--> Controllers - Power Glove
|
||
|
||
Jissen Mahjong Controller (Capcom) (21 Buttons)
|
||
The top row has 14 buttons (square "A-M" keys, and a round "N" key), these keys
|
||
are used to drop one of the 14 cards (or if one has less than 14 cards, then
|
||
"N" draws a new card).
|
||
The bottom row has 7 buttons (SEL, ST, and some japanese symbols), these are
|
||
function keys (Select and Start, and whatever special "japanese" functions).
|
||
...--------...
|
||
.-------------------'' CAPCOM ''------------------.
|
||
/ lt up rt \
|
||
| [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] (N) |
|
||
| |
|
||
| [F1][F2][F3][F4][F5][F6][F7] |
|
||
| lt dn rt |
|
||
\ /
|
||
'-------------------------------------------------------'
|
||
Reading is done as:
|
||
[4016h]=5, [4016h]=4, read 8bits from [4017h].Bit1 ;row 0
|
||
[4016h]=3, [4016h]=2, read 8bits from [4017h].Bit1 ;row 1
|
||
[4016h]=7, [4016h]=6, read 8bits from [4017h].Bit1 ;row 2
|
||
The bits returned are:
|
||
Read Row 0 Row 1 Row 2
|
||
1st H (Right) None? None? (Change/Cheat?) ;\
|
||
2nd G (Up) None? Fn Unknown(EndGame?) ; All buttons:
|
||
3rd F (Left) N (New/Okay) Fn Unknown(Tingeling?) ; 1=Low=Pressed
|
||
4th E M Fn Unknown(Jp?) ; 0=High=Released
|
||
5th D L Fn Unknown(Jp?) ; Unused bits:
|
||
6th C K Fn Unknown(Right/Toggle); ?=What=Unknown
|
||
7th B J F2 Start (Down) ;
|
||
8th A I F1 Select (Left) ;/
|
||
9th.. Unknown(N/A?) Unknown(N/A?) Unknown(N/A?) ;-Probably padding
|
||
Translation for the text on the 5 japanese functions keys is unknown (the
|
||
left-most one apparently toggles setup options); Location of the japanese
|
||
function keys in the return data is unknown (probably in Row 2, 2nd..6th,
|
||
probably ordered as 6th read left-most, through 2nd read right-most).
|
||
There are only two known supported games:
|
||
Ide Yousuke Meijin no Jissen Mahjong (J) Capcom (1987)
|
||
Ide Yousuke Meijin no Jissen Mahjong 2 (J) Capcom (1991)
|
||
There are at least three (cosmetic) revisions of the Mahjong controller; mostly
|
||
different text/logos in lower-left section. The "II" version has a black case,
|
||
additional arrow symbols (LT-UP-RT above F-G-H keys, and LT-DN-RT below
|
||
SEL-STA-JP keys) and a blue rectangle around M-key.
|
||
|
||
Famicom Titler
|
||
A special NES console from Sharp. The thing has built-in Tablet and Keypad.
|
||
|
||
Controllers - Mats
|
||
------------------
|
||
|
||
Power Pad (Dance Mat) (Bandai/Nintendo)
|
||
The Power Pad aka Family Trainer aka Family Fun Fitness is a device made by
|
||
Bandai/Nintendo (1987/1988) which serves as an "exercising fun center" for the
|
||
whole family. That is, a large (1x1 meters) vinyl mat with 12 touch-sensitive
|
||
areas, or actually step-sensitive areas, since it's intended to be put on the
|
||
floor. The mat has two sides, with different patterns drawn on each side.
|
||
Supported games are:
|
||
Athletic World (J) (U) (E) 1986-1988
|
||
Class Track Meet/Running Stadium/Stadium Events (J) (U) (E) 1986-1988
|
||
Aerobics Studio/Dance Aerobics (J) (U) 1987/1989
|
||
Fuuun! Takeshi Shiro 2 (J) 1988
|
||
Jogging Race (J) 1987
|
||
Meiro Daisakusen (J) 1987
|
||
Power Pad Test Program by Tennessee Carmel-Veilleux (PD) (UE)
|
||
Rai Rai! Kyonshiizu: Baby Kyonshi no Amida Daiboken (J) 1989
|
||
Short Order / Eggsplode! (U) 1989
|
||
Street Cop/Manhattan Police (J) (U) 1987/1989
|
||
Super Team Games/Daiundoukai (J) (U) 1987/1988
|
||
Totsugeki! Fuuun Takeshi Shiro (J) 1987
|
||
|
||
Tap-tap Mat (igs) (Japan only)
|
||
Another mat, this one is smaller than the Power Pad mat, and one is supposed to
|
||
hit the fields with a plastic hammer. Used by only one known game:
|
||
Super Mogura Tataki!! - Pokkun Moguraa (J) (bundled with mat & hammer)
|
||
|
||
NES Version I/O Access (outside Japan) (Bandai/Nintendo Mats)
|
||
Connects to 7pin controller port (typically the mat connects to port 2, and a
|
||
normal joypad for menu selections to port 1). To read the button states:
|
||
Output 1-then-0 to Bit0 of Port 4016h
|
||
Read eight times from Port 4017h (or 4016h, when plugged into port 1)
|
||
Each read receives two button states in Bit 3 and 4, in following order:
|
||
Bit4 4,3,12,8,u,u ,u ,u (0=High=Released, 1=Low=Pressed) (u=Unused always 1)
|
||
Bit3 2,1,5 ,9,6,10,11,7 (0=High=Released, 1=Low=Pressed)
|
||
Whereas, "1-12" are button numbers as drawn on Side B, or equivalent buttons on
|
||
Side A (horizontally mirrored, of course).
|
||
|
||
FAMICOM Version I/O Access (Japan) (Bandai/Nintendo Mats and igs Mats)
|
||
Connects to 15pin expansion port. Unlike in NES version, the buttons are read
|
||
via a simple row/column matrix (without shift-register). The overall I/O access
|
||
is same for Nintendo/Bandai-mats and igs-mats:
|
||
4016h.W.Bit0 Select Lower row (9..12) (0=Low=Select, 1=High=No)
|
||
4016h.W.Bit1 Select Middle row (5..8) (0=Low=Select, 1=High=No)
|
||
4016h.W.Bit2 Select Upper row (1..4) (0=Low=Select, 1=High=No)
|
||
4017h.R.Bit1 Read Right-most column (4,8,12) (0=High, 1=Low=Pressed)
|
||
4017h.R.Bit2 Read Right-middle column (3,7,11) (0=High, 1=Low=Pressed)
|
||
4017h.R.Bit3 Read Left-middle column (2,6,10) (0=High, 1=Low=Pressed)
|
||
4017h.R.Bit4 Read Left-most column (1,5,9) (0=High, 1=Low=Pressed)
|
||
After selecting a Row one should execute some delay before reading Column data:
|
||
For the Nintendo/Bandai-mats this should be a huge 1800 cycle delay. The
|
||
igs-mat can be used with shorter 138 cycle delays, but results might be
|
||
unstable (the tap-tap game reads all data twice, and retries reading until both
|
||
results are same).
|
||
|
||
Power Pad Layout (Side A and Side B)
|
||
Side A has 2 red fields, 6 blue fields, and 4 hidden fields.
|
||
Side B has 12 fields, numbered 1..12, the left fields (1,2,5,6,9,10) are blue,
|
||
the other are red.
|
||
____________.-------.____________ ____________.-------.____________
|
||
|POWER PAD '=======' SIDE B| |POWER PAD '=======' SIDE A|
|
||
| | | |
|
||
| .---. .---. .---. .---. | | .---. .---. |
|
||
|-( 1 )-( 2 )-( 3 )-( 4 )-| | ( ) ( ) |
|
||
| '---' '---' '---' '---' | | '---' '---' |
|
||
|---------------------------------| | |
|
||
| .---. .---. .---. .---. | | .---. .---. .---. .---. |
|
||
|-( 5 )-( 6 )-( 7 )-( 8 )-| | ( ) ( ) ( ) ( ) |
|
||
| '---' '---' '---' '---' | | '---' '---' '---' '---' |
|
||
|---------------------------------| | |
|
||
| .---. .---. .---. .---. | | .---. .---. |
|
||
|-( 9 )-( 10 )-( 11 )-( 12 )-| | ( ) ( ) |
|
||
| '---' '---' '---' '---' | | '---' '---' |
|
||
|_________________________________| |_________________________________|
|
||
_________.-------------._________
|
||
| |// Tap-tap | igs |
|
||
| |/ Mat | |
|
||
|---------'============='---------|
|
||
| .---. .---. .---. .---. | <--- Tap-tap numbering is same as
|
||
| (dragn) (BANG!) (croco) (BANG!) | on SIDE A of Power Pad, ie.
|
||
| '---' '---' '---' '---' | 4 3 2 1
|
||
| .---. .---. .---. .---. | 8 7 6 5
|
||
| (BANG!) (monky) (BANG!) (chick) | 12 11 10 9
|
||
| '---' '---' '---' '---' |
|
||
| .---. .---. .---. .---. |
|
||
| (frank) (BANG!) (shark) (BANG!) |
|
||
| '---' '---' '---' '---' |
|
||
|_________________________________|
|
||
|
||
Controllers - Inflatable Controllers
|
||
------------------------------------
|
||
|
||
Exciting Boxing Bop Bag (Konami) 1987
|
||
Inflatable boxing bag with 8 sensors, used only by one game (Exciting Boxing).
|
||
4016h.W.Bit1 Row Select (0=Hook/Move or 1=Jabb/Straight/Body)
|
||
4017h.R.Bit1-4 Column Inputs (0=High=Punch, 1=Low=None)
|
||
There seems to be a delay required after changing the Row Select bit: The game
|
||
seems to read one 4bit column per frame, then toggle the row select bit, and
|
||
then read the other 4bit in next frame.
|
||
4017h.R Row0 (OUT1=0) Row1 (OUT1=1)
|
||
Bit4 Right Hook (left ear) Straight (breast/chin)
|
||
Bit3 Move? (to left screen-edge) Right Jabb (left shoulder)
|
||
Bit2 Move? (to right screen-edge) Body (belly)
|
||
Bit1 Left Hook Left Jabb (right shoulder)
|
||
The location of the 2 move sensors is unknown (not used in Training mode; used
|
||
only in VS mode). The average location of the 6 punch-sensors can be seen in
|
||
Training mode, as so:
|
||
_###_
|
||
/"#####"\
|
||
(ear) Row0.Bit1 --> (| o\ /o |) <-- Row0.Bit4 (ear) (hook)
|
||
\ _ /
|
||
/ \_o_/ \ <---- Row1.Bit4 (breast) (straight)
|
||
(shoulder) Row1.Bit1 --> | " | <-- Row1.Bit3 (shoulder) (jabb)
|
||
| () () | <---- Row1.Bit4 (belly) (body)
|
||
|_/ \_|
|
||
|=======|
|
||
| /-\ |
|
||
|==| |==| <-- inflatable boxer
|
||
| | | |
|
||
_|__|#|__|_ <-- control box
|
||
(___________) <-- inflatable ring
|
||
\ \
|
||
\___________\ <-- floor mat
|
||
The type of all 8 sensors is unknown, presumably some kind of pressure or shock
|
||
sensors. The size of the bag is unknown (looks like around 100..150cm in height
|
||
on photos). Unknown how the thing is stabilized; maybe one is intended to sit
|
||
on the floor mat... or the ring or mat are meant to be filled with water... or
|
||
so?
|
||
|
||
Top-Rider Bike (Varie) 1988
|
||
Inflatable motor-bike with handle-bars mounted on the front end.
|
||
4016h.W.Bit1 Start some conversion or so?
|
||
4016h.W.Bit0 Reload shift-registers
|
||
4017h.R.Bit3 8bit shift-register
|
||
4017h.R.Bit4 8bit shift-register
|
||
Accessing the bike seems to require special start-bit and some delays:
|
||
[4016h]=03h ;start some conversion or so?
|
||
wait 60 clks (game tries so, but bugged code waits only 10 clks)
|
||
wait some more (whatever overload, additionally to above delay)
|
||
[4016h]=01h ;strobe on
|
||
wait some clks (strobe on should last for 12 clks)
|
||
[4016h]=00h ;strobe off
|
||
read 8 times from [4017h].Bit3-4
|
||
The separate bits are:
|
||
Read 4017h.R.Bit3 4017h.R.Bit4
|
||
1st Accel, Bit5 (0=VCC=Zero) Turbo Unknown/unused? (?)
|
||
2nd Accel, Bit4 (0=VCC=Zero) Steer Right, Bit1 (0=VCC=Zero, 1=One)
|
||
3rd Accel, Bit3 (0=VCC=Zero) Steer Left, Bit1 (0=VCC=Zero, 1=One)
|
||
4th Accel, Bit2 (0=VCC=Zero) Steer Right, Bit0 (0=VCC=Zero, 1=One)
|
||
5th Accel, Bit1 (0=VCC=Zero) Fast Steer Left, Bit0 (0=VCC=Zero, 1=One)
|
||
6th Accel, Bit0 (0=VCC=Zero) Slow Hand Brake (0=VCC=No, 1=GND=Pulled)
|
||
7th Start Button (0=VCC=Released) Gear Switch (0=VCC=Lo, 1=GND=Hi)
|
||
8th Select Button (0=VCC=Released) Wheelie (0=VCC=No, 1=GND=What?)
|
||
Of the 6bit accelerate value, only a few values are actually used: 01h=Slow,
|
||
02h=Fast, 20h=Turbo, and 00h/03h..1Fh/21h..3Fh=Stop; details are unknown, it's
|
||
probably not a 6bit analog values, maybe a 7-position switch with 1bit per
|
||
position; and no bit for the stop-position)?
|
||
The 4bit steering value allows 7 directions (forward, and 3 levels of
|
||
left/right each) (settings with both left and right bits nonzero are invalid);
|
||
details are unknown, maybe analog input, or a 7-position switch.
|
||
The gear switch is a switch (not a push button), and so, remains in the most
|
||
recently selected position.
|
||
Pulling the Hand Brake obviously pushes a button. Start/Select are on the bases
|
||
front panel, but unknown is Start is on left or right side.
|
||
Unknown how to trigger the Wheelie function; the picture on the box depicts a
|
||
function near ring finger of left hand, maybe there's a button underneath of
|
||
the left handle, or maybe it's possible to lift/pull the handles?
|
||
The length/height/width of the bike is unknown (judging from the photo on the
|
||
box, it seems to be made for small children). There's reportedly some risk to
|
||
pop the bike when used by heavy adults, unknown if that's just panic or an
|
||
actual problem.
|
||
______ something near ring finger? maybe wheelie-button or so?
|
||
| ___ gear switch
|
||
| | _________ mimmicked km/h and rpm display
|
||
| | | | ____ handbrake
|
||
| | v v |
|
||
| | .---------------. __ v turn handle-bar
|
||
v v | .--. .--. | | |=====O to steer left/right?
|
||
._______ _____| | | | | |__| |/______.
|
||
|_______| |__| '--' o '--' o|__|__|.______| <--- turn right handle
|
||
' '|__| :'---------------': ' to accelerate?
|
||
# : (S??) (S??) :
|
||
: '._____________.' : <------ base with start/select
|
||
: :
|
||
: : <------ inflatable pillow to sit on
|
||
: :
|
||
|
||
Controllers - RacerMate Bicycle Training System
|
||
-----------------------------------------------
|
||
|
||
CompuTrainer by RacerMate. Used only by RacerMate Challenge II.
|
||
4016h.W.Bit0 OUT0 (to be forwarded to TX1/TX2 on 4016h/4017h.reads)
|
||
4016h.R.Bit0 Get RX1 (and forward OUT0 to TX1) (Player 1)
|
||
4017h.R.Bit0 Get RX2 (and forward OUT0 to TX2) (Player 2) (if any)
|
||
The transfer rate is generated by an IRQ timer in the cartridge (the timer's
|
||
baudrate is unknown; the transfers do require at least 27 IRQs per 60Hz frame,
|
||
so the IRQ rate must be at least 1620 Hz or higher). In practice, 1024 clks per
|
||
IRQ seems to be too slow (video glitches), 512 clks too fast (1/10 second
|
||
counter increases non-linear), so, the IRQ rate is probably something around
|
||
768 clks.
|
||
|
||
Transfer Packets (per player) (48 TX Bits & 48 RX Bits)
|
||
First Frame:
|
||
2 IRQs Leading Pause (TX levels left unchanged)
|
||
1 IRQ Output 1st TX Bit (Start Bit "0") Input nothing
|
||
23 IRQs Output 2nd..24th TX Bit Input 1st..23rd RX Bit
|
||
1 IRQ Output nothing (keep 24th TX bit) Input 24th RX Bit
|
||
0 IRQs Ending pause (IRQs should be disabled until next Vblank NMI)
|
||
Second Frame:
|
||
2 IRQs Leading Pause (TX levels left unchanged)
|
||
1 IRQ Output 25th TX Bit (Start Bit "1") Input nothing
|
||
23 IRQs Output 26nd..48th TX Bit Input 25th..47rd RX Bit
|
||
1 IRQ Output nothing (keep 48th TX bit) Input 48th RX Bit
|
||
0 IRQs Ending pause (IRQs should be disabled until next Vblank NMI)
|
||
Both the 48bit-RX and 48bit-TX streams are interleaved:
|
||
24 "odd" bits (1st, 3rd, 5th, 7th, ... 47th bits)
|
||
24 "even" bits (2nd, 4th, 6th, 8th, ... 48th bits)
|
||
|
||
Odd TX Bits (1st, 3rd, 5th, 7th, ... 47th TX bits) (24bit from NES to Bike)
|
||
1bit Must be "0" (start bit of packet-half transferred in First Frame)
|
||
6bit Unknown (seems to be fixed: 1,1,0,1,0,0) ;(aka 2Ch/4, LSB first)
|
||
5bit Data, Bit0..4 (LSB first)
|
||
1bit Must be "1" (start bit of packet-half transferred in Second Frame)
|
||
7bit Data, Bit5..11 (LSB first)
|
||
4bit Index, Bit0..3 (LSB first)
|
||
The Index/Data Pairs are:
|
||
Index=1, Grade (signed)
|
||
Index=2, Wind (signed)
|
||
Index=3, Weight (LBS)
|
||
Index=4, Pulse Target Min (BPM+800h) ;\player 1 only
|
||
Index=5, Pulse Target Max (BPM+800h) ;/
|
||
Index=5, Zero ;-player 2 only
|
||
Index=F, Start Race (Data=001h)
|
||
Unknown if there are further ones... eg. to stop/pause/resume race?
|
||
|
||
Even RX Bits (2nd, 4th, 6th, 8th, ... 48th RX bits) (24bit from Bike to NES)
|
||
1st EvenRxByte --> Button flags (bit0-5) SpecialStart (bit6)
|
||
2nd EvenRxByte --> 8bit Data Fragment
|
||
3rd EvenRxByte --> 4bit Data Fragment (LSBs), 4bit Index (01h..0Eh) (MSBs)
|
||
The 12bit data fragments are stored in an array (with index 01h..0Eh), there
|
||
are thus 14x12bit = 168 bits in that array. There are two separate arrays (one
|
||
per bike).
|
||
XXX content of the array is unknown (presumably speed and such things?)
|
||
The Button bits are:
|
||
0 Button RESET (0=High=Released, 1=Low=Pressed)
|
||
1 Button F1 (START/PAUSE/LEAVE) (0=High=Released, 1=Low=Pressed)
|
||
2 Button F3 (SET/SELECT) (0=High=Released, 1=Low=Pressed)
|
||
3 Button + (PLUS/UP) (0=High=Released, 1=Low=Pressed)
|
||
4 Button F2 (DISPLAY) (0=High=Released, 1=Low=Pressed)
|
||
5 Button - (MINUS/DOWN) (0=High=Released, 1=Low=Pressed)
|
||
6 Start of Special Odd RX Bits (?)
|
||
7 Unknown/unused? (?)
|
||
The Index/Data Pairs are:
|
||
Index=0 Unknown/Ignored
|
||
Index=1 Speed 12bit (0..FFFh = 0..81.9 MPH) (ie. 1/50 MPH units)
|
||
Index=2 Watts 12bit (0..FFFh = 0..3054 Watts) (roughly 3/4 Watt units)
|
||
Index=3 Pulse 8bit (0..FFh = 0..255 BPM) (and MSBs = 4bit Flags)
|
||
Index=4..E Unknown/Stored in memory (but seems to have no effect)
|
||
Index=F Unknown/Ignored
|
||
Unknown if/how/where RPM is transferred.
|
||
Speed (MPH) also affects distance (DST).
|
||
The 4bit flag-field for the Pulse data is:
|
||
Bit8 Blink Heart-Symbol
|
||
Bit9 Show "E"
|
||
Bit10 Show "LO" ;\when both set: treated as "sensor not connected"
|
||
Bit11 Show "HI" ;/(ie. showing "--" instead of the pulse value)
|
||
|
||
Even TX Bits (2nd, 4th, 6th, 8th, ... 48th TX bits) (24bit from NES to Bike)
|
||
These bits are simply inverse bits that are preceeding the following Odd TX
|
||
Bits. Ie. a "0" bit will be transferred as "1-then-0" bit-pair, and "1" bit as
|
||
"0-then-1". The receiver (control panel) may use that transitions for
|
||
synchronization (eg. in case of baudrate inaccuracies).
|
||
In case of the 24th/48th TX bits, this "wraps" to next frame, ie. they are
|
||
inverse of the of the start-bit of the next frame.
|
||
|
||
Odd RX Bits (1st, 3rd, 5th, 7th, ... 47th RX bits) (24bit from Bike to NES)
|
||
These bits can be inverse data bits that are preceeding the normal Even RX Bits
|
||
(similar as for TX).
|
||
Alternately, the odd RX bits can contain special information (probably an
|
||
extension of the original transfer protocol). Presence of that special info is
|
||
determined as so:
|
||
(EvenRxBytes <> (OddRxBytes XOR FFFFFFh)) AND Parity(1stOddRxByte)=odd
|
||
If that condition is true, then the 3 odd bytes are a fragment of a 24-byte
|
||
special array; it does thus take 8 packets to transfer the whole array; the
|
||
array-start is indicated by bit6 of the "button" byte.
|
||
XXX content of the array is unknown ...
|
||
XXX the software seems to manage only ONE array (not 2 arrays for 2 bikes)
|
||
|
||
Control Panel
|
||
The control panel connects to both controller ports, which leaves no room for
|
||
connecting joypads or other controllers. So, menu selections are solely
|
||
controlled by the 6 buttons on the control panel. The only other inputs are the
|
||
rear-wheels rotation speed, and the pulse sensor.
|
||
.-------------------------.
|
||
| CompuTrainer |
|
||
| .---------------------. |
|
||
| | LCD | | <--- unknown display type
|
||
| | Display | | (maybe 7-segment or so)
|
||
| | | |
|
||
| '---------------------' |_____
|
||
| Stop Display _ | <--- attach to handle-bars here
|
||
| [RESET] [ F2 ] [ + ] _____|
|
||
| [ F1 ] [ F3 ] [ - ] |
|
||
| Start Set |
|
||
| RACERMATE |
|
||
| Computer Aided Trainer |
|
||
| MODEL 8000? |
|
||
'-------------------------'
|
||
|
||
Components
|
||
Hardware at Bike Side:
|
||
Control Panel (LCD display, 6 buttons, wired to flywheel, NES, pulse sensor)
|
||
Front Stand (small stand, holds front-wheel in straight-forward direction)
|
||
Rear Stand with electronic flywheel (resistance, speed-meter, stand upright)
|
||
Power Supply (for flywheel)
|
||
Pulse sensor, cables, screws
|
||
Bicycle (not included) (can be used with regular "ourdoor" bicycles)
|
||
Hardware at NES Side:
|
||
NES Connector Box (2x7pin NES connector, 2x3pin 3.5mm sockets; for 2 bikes)
|
||
NES Console with CIC disabled (or top-loading NES without CIC)
|
||
NES Challenge II cartridge (without CIC, except, old versions had CIC clone)
|
||
There are several hardware revisions (including some for newer
|
||
computers/consoles). For the NES, there are at least two front-panel variants
|
||
(with connectors located in different places), and at least two
|
||
rear-stand/fly-wheels (marked CompuTrainer, or CompuTrainer Pro), and, there
|
||
are reportedly several EPROM versions:
|
||
3.11.088 05-02-1991 20:41:04
|
||
5.01.033 02-01-1994 19:28:10
|
||
5.01.036 05-15-1996 19:47:57
|
||
6.02.002 05-21-1996 12:22:18
|
||
9.03.128 (PAL) 03-22-1996 11:57:11
|
||
|
||
The game does also require a special mapper (and a NES with CIC disabled):
|
||
--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ
|
||
|
||
Controllers - Tablets
|
||
---------------------
|
||
|
||
Games
|
||
Oeka Kids - Anpanman no Hiragana Daisuki (J)
|
||
Oeka Kids - Anpanman to Oekaki Shiyou!! (J)
|
||
|
||
Controller Access
|
||
4016h.W.Bit0 Oeka Kids Tablet Strobe (inverse of normal joypad strobe)
|
||
4016h.W.Bit1 Oeka Kids Tablet Clock (manually clocked, unlike joypads)
|
||
4017h.R.Bit2 Oeka Kids Tablet Ack (confirm Strobe/Clock signals)
|
||
4017h.R.Bit3 Oeka Kids Tablet Data (18bits)
|
||
To start the transmission & read the 18 databits:
|
||
[4016h]=00h, wait for [4017h].Bit2=0 ;\strobe 0-then-1 (start transfer)
|
||
[4016h]=01h, wait for [4017h].Bit2=1 ;/
|
||
[4016h]=03h, wait for [4017h].Bit2=0 ;\read databit (repeat 18 times)
|
||
databit = [4017h].Bit3 ; (note: the final wait after 18th
|
||
[4016h]=01h, wait for [4017h].Bit2=1 ;/bit can/should/must? be ommitted)
|
||
The separate databits are:
|
||
1st..8th X-coordinate, MSB first, inverted (0=High=One, 1=Low=Zero)
|
||
9st..16th Y-coordinate, MSB first, inverted (0=High=One, 1=Low=Zero)
|
||
17th Soft-Pressure (Pen touches tablet) (0=High=Yes, 1=Low=No)
|
||
18th Hard-Pressure (Click/Draw) ??????? (0=High=Yes, 1=Low=No)
|
||
XXX or is there a "click" button; the gray bar at front? So one must
|
||
push that button, and the thing can't sense "hard pressure" at all?
|
||
To convert tablet coordinates to 256x240 pixel screen coordinates:
|
||
tablet.x = tablet.x XOR FFh ;\undo inversion of databits
|
||
tablet.y = tablet.y XOR FFh ;/
|
||
screen.x = tablet.x + (tablet.x/10h) - 08h ;\scale to screen dimensions
|
||
screen.y = tablet.y - (tablet.y/10h) + 0Dh ;/
|
||
screen.x = minmax(screen.x,00h..FFh) ;\clip to min/max range
|
||
screen.y = minmax(screen.x,00h..EDh) ;/
|
||
(of course, the coordinates are valid only if the pen touches the tablet)
|
||
The touch area is divided into eight sections: seven small "holes" at the top
|
||
of the tablet, and the main drawing area. Note: The horizontal coordinates of
|
||
these "holes" aren't exactly the same as of the corresponding screen buttons.
|
||
.----------------------------.
|
||
/ ( LOGO/TEXT ) (<===pen====) \
|
||
| __ __ __ __ __ __ __ |
|
||
| (__)(__)(__) (__)(__)(__) (__) | <-- touch-sensitive holes
|
||
| ____________________________ |
|
||
| | ' ' ' | |
|
||
| | | | <-- touch-sensitive tablet
|
||
| |- + + + -| |
|
||
/ | | \
|
||
| |- + + + -| |
|
||
| | | |
|
||
| |- + + + -| |
|
||
| | | | <-- lower half of case=click button?
|
||
| |______.______.______._______| |
|
||
\__________________________________/
|
||
|
||
Famicom Titler
|
||
A special NES console from Sharp. The thing has built-in Tablet and Keypad.
|
||
|
||
Controllers - Trackball and Mouse
|
||
---------------------------------
|
||
|
||
Hori Track
|
||
Moero Pro Soccer (J) 1988 Jaleco
|
||
Operation Wolf (J) (U) 1989 Taito (also supports Zapper lightgun)
|
||
Putt Putt Golf (FDS) 1989 Pack-In-Video
|
||
US Championship V'Ball (J) 1989 Technos Japan Corp
|
||
Hori seems to have planned both NES and Famicom versions of the controller; as
|
||
far as known, the NES version wasn't released, but, most of the existing games
|
||
(except Putt Putt Golf) do contain both NES and Famicom controller protocol
|
||
versions:
|
||
Version Input Data from ID Bits Connector Released
|
||
Famicom [4016h/4017h].Bit1 0,1 15pin Yes
|
||
NES [4016h/4017h].Bit0 1,0 7pin No
|
||
Controller Bits:
|
||
(to be preceeded by normal joypad like 1-then-0 strobing on OUT-0)
|
||
1st..8th bit --> Same as normal joypad data
|
||
9th..12th bit --> Axis 1, signed 4bit (MSB first, inverted, 1=Low=Zero)
|
||
13th..16th bit --> Axis 2, signed 4bit (MSB first, inverted, 1=Low=Zero)
|
||
17th --> L/R mode switch (0=High=R-Mode, 1=Low=L-Mode)
|
||
18th --> Unknown/unused (probably SPEED LO/HI switch) (=?)
|
||
19th --> ID Bit1 (0=High=Famicom, 1=Low=NES)
|
||
20th --> ID Bit0 (0=High=NES, 1=Low=Famicom)
|
||
21th..24th --> Unknown/unused (read by software, but seems to be unused)
|
||
25th and up --> Unknown/unused (probably whatever padding bits)
|
||
Trackball Orientation:
|
||
When 17th Bit=1: (L-Mode) (supported by all games)
|
||
Axis 1 is to be treated as Y-axis (POSITIVE = DOWN = towards DPAD)
|
||
Axis 2 is to be treated as X-axis (POSITIVE = RIGHT = towards START/SELECT)
|
||
When 17th Bit=0: (R-Mode) (not supported by Operation Wolf)
|
||
Axis 1 is to be treated as X-axis (POSITIVE = LEFT = towards DPAD)
|
||
Axis 2 is to be treated as Y-axis (POSITIVE = DOWN = towards START/SELECT)
|
||
DPAD orientation is unknown (according to manual, it sounds like UP=Towards
|
||
Ball, RIGHT=Towards B-Button) (in software, this should be probably always kept
|
||
handled as so, regardless of the L/R switch).
|
||
___________ L-Mode R-Mode ___________
|
||
| ___ |\ __________ __________ /| ___ |
|
||
| .' '. | | |\ /| _ | | .' '. | HORI TRACK
|
||
| | BALL | | | STA | | | | _| |_ | | | BALL | |
|
||
| | | | | // SEL | | | | |_ _| | | | | | HORI ELECTRIC
|
||
| '.___.' | | // | | | | |_| | | '.___.' | CO.LTD.
|
||
|___________| | A | | | | | |___________| MODEL TRK-7
|
||
| \| .''. | | | | .''. |/ | MADE IN JAPAN
|
||
|_____________| | | | | | | | | |_____________|
|
||
| _ B '..' | | | | '..' B | Note:
|
||
| _| |_ .''. | | | | .''. STA | L/R switch and
|
||
| |_ _| | | | | | | | | SEL \\ | SPEED LO/HI
|
||
| |_| '..' | | | | '..' A \\ | switch are at
|
||
|________________________| | | |________________________| bottom-side
|
||
| H O R I T R A C K \ | | / |
|
||
|_________________________\| |/_________________________|
|
||
|
||
Joyball Note
|
||
There's also a roughly similar looking controller called Joyball. However, that
|
||
thing is just a regular joystick with "ball-shaped" handle, not a trackball.
|
||
|
||
Subor Mouse
|
||
The Subor Mouse is bundled with a keyboard-shaped NES clone; the mouse is
|
||
supported by only one known cartridge (bundled with the mouse & NES clone):
|
||
Educational Computer 2000 (RU) (with mimmicked russian Win95 GUI)
|
||
Reading a mouse byte is done as so:
|
||
[4016h]=01h
|
||
wait 28 clks (14 NOPs)
|
||
[4016h]=06h
|
||
read 8bits from [4017h].R.Bit0 (MSB first) (bits are NOT inverted!)
|
||
Mouse response can be a single-byte (max +/-1 mickey), or 3-byte (max +/-31
|
||
mickeys). The response type & index is indicated in lower 2bit of the bytes.
|
||
Single-Byte Packet:
|
||
7 Left Button (1=Pressed)
|
||
6 Right Button (1=Pressed)
|
||
5-4 Step X (0=None, 1=Plus 1/Right, 2=Treated same as 1, 3=Minus 1/Left)
|
||
3-2 Step Y (0=None, 1=Plus 1/Down, 2=Treated same as 1, 3=Minus 1/Up)
|
||
1-0 Must be 0 for single-byte packet
|
||
1st-byte of Three-byte Packet:
|
||
7 Left Button (1=Pressed)
|
||
6 Right Button (1=Pressed)
|
||
5 Direction X (0=Plus/Right, 1=Minus/Left)
|
||
4 Unsigned Step X, Bit4
|
||
3 Direction Y (0=Plus/Down, 1=Minus/Up)
|
||
2 Unsigned Step Y, Bit4
|
||
1-0 Must be 1 for 1st byte of multi-byte packet
|
||
2nd-byte of Three-byte Packet:
|
||
7-6 Unused (maybe copy of buttons)
|
||
5-2 Unsigned Step X, Bit3-0
|
||
1-0 Must be 2 for 2nd byte of multi-byte packet
|
||
3rd-byte of Three-byte Packet:
|
||
7-6 Unused (maybe copy of buttons)
|
||
5-2 Unsigned Step Y, Bit3-0
|
||
1-0 Must be 3 for 3rd byte of multi-byte packet
|
||
Threshold must be implemented by software (as done in Educational Computer
|
||
2000):
|
||
00h..0Eh Mickeys ---> Mul 1.0 --> 00h..0Eh Pixels
|
||
0Fh..13h Mickeys ---> Mul 1.5 --> 16h..1Ch Pixels
|
||
14h..18h Mickeys ---> Mul 2.0 --> 28h..30h Pixels
|
||
19h..1Dh Mickeys ---> Mul 2.5 --> 3Eh..48h Pixels
|
||
1Eh..1Fh Mickeys ---> Mul 3.5 --> 69h..6Ch Pixels
|
||
Motion counters are reset to zero after reading. Data should be read per NMI
|
||
(read at least one byte, and, in case of 3-byte response: read all 3 bytes).
|
||
Caution:
|
||
The Subor Clone does also contain a keyboard (and joypads), reading the
|
||
controllers might somehow interfere. Namely, Subor is doing the keyboard
|
||
reading AFTER and ONLY AFTER single-byte-mouse reads (in case of
|
||
multi-byte-mouse reads, it's completely omitting keyboard reading in that
|
||
frame) (though unknown if that kind of handling is really required).
|
||
--> Controllers - Typewriter Keyboards
|
||
|
||
Controllers - Power Glove
|
||
-------------------------
|
||
|
||
--> Controllers - Power Glove Transmission Protocol (RX/TX)
|
||
--> Controllers - Power Glove TX Packets (Configuration Opcodes)
|
||
--> Controllers - Power Glove RX Packets (Position/Sensor Data)
|
||
--> Controllers - Power Glove Games and Compatibilty Modes
|
||
--> Controllers - Power Glove Drawings
|
||
--> Controllers - Power Glove Pinouts
|
||
|
||
Controllers - Power Glove Transmission Protocol (RX/TX)
|
||
-------------------------------------------------------
|
||
|
||
Transmit (TX) (Configuration)
|
||
Transmission mode is entered by outputting a LONG strobe signal:
|
||
Set [4016h].W.Bit0=1, then wait around 3330 clks ;-Enter TX Mode
|
||
Thereafer, the TX packet can be sent bit-by-bit:
|
||
Set [4016h].W.Bit0=Databit ;-Output Data Bit
|
||
Do dummy-read from [4016h].R ;-Output Clk Pulse
|
||
Bytes are sent MSB first. Insert a small delay between each two bytes:
|
||
1280 clks should be fine; as used by Super Glove Ball ;-Delay between bytes
|
||
(the older Bad Street Brawler game used 2304 clks)
|
||
For the standard Analog mode with 9-byte response, the transmitted packet
|
||
should be usually following 7 bytes: 06h,C1h,08h,00h,02h,FFh,01h. For details
|
||
on other TX packets, see:
|
||
--> Controllers - Power Glove TX Packets (Configuration Opcodes)
|
||
After the transfer, the value of the lastmost databit may be left on the strobe
|
||
line; the glove doesn't seem to treat this as new LONG strobe.
|
||
|
||
Receive (RX) (Read Sensors/Buttons)
|
||
Read one Status Byte per frame (ie. via 60Hz NMI handler), just like normal
|
||
joypad reading:
|
||
Set [4016h].W.Bit0 to 1-then-0 ;-Strobe
|
||
Read 8bits from [4016h].R.Bit0 (MSB first, inverted) ;-Read Byte
|
||
This byte indicates if the glove is ready to send a new data packet:
|
||
5Fh (received) aka A0h (when XORing by FFh) --> analog mode, ready
|
||
00h? (received) aka FFh? (when XORing by FFh) --> analog mode, not ready (?)
|
||
other (joypad data) --> joypad emulation mode
|
||
If the Status Byte indicates Ready, then the next some bytes (usually 9 bytes)
|
||
are packet data, these can be read as so:
|
||
wait 100 clks ;-Delay between bytes
|
||
Set [4016h].W.Bit0 to 1-then-0 ;-Strobe (on each byte)
|
||
Read 8bits from [4016h].R.Bit0 (MSB first, inverted) ;-Read Byte
|
||
XOR byte by FFh ;-Undo inversion
|
||
For details on the packet content, see:
|
||
--> Controllers - Power Glove RX Packets (Position/Sensor Data)
|
||
After the transfer, a long pause may be required (it seems as if the glove
|
||
terminates RX mode via a timeout); best wait until next 60Hz frame before
|
||
trying to receive a new packet.
|
||
The conversion time isn't constant (for example, flex A/D conversion time seems
|
||
to increase when making a tight fist). Normally, status "Ready" should be
|
||
received around every 3 frames. Generate a timeout if ready isn't seen after 20
|
||
frames; that might happen if the glove isn't connected, or not initialized (not
|
||
in analog mode), or if the user has hit the PROG button.
|
||
|
||
Caution
|
||
Reading [4016h].R.Bit0 does, of course, work on NES ONLY. Unknown how to read
|
||
data from the japanese PAX Power Glove; [4016h].R.Bit1 should be a good guess.
|
||
|
||
The existing games expect the glove connected to port 1 (4016h.R), alternately
|
||
it should also work in port 2 (4017h.R). When trying to connect two gloves, the
|
||
ultrasonic speakers would disturb each other, so only Flex and Buttons would
|
||
work.
|
||
|
||
Controllers - Power Glove TX Packets (Configuration Opcodes)
|
||
------------------------------------------------------------
|
||
|
||
Overall TX Packet Format
|
||
The overall transmit packet format is:
|
||
1. Length Byte (total number of following bytes) (used range is 05h..32h)
|
||
2. 16bit Opcode Area (convert analog positions to temporary flags)
|
||
3. 8bit Opcode Area (forward temporary flags to joypad bits; can use logic)
|
||
4. Optional 6 extra bytes (whatever purpose, used only in one program)
|
||
|
||
Analog Mode TX Packets
|
||
To enter the Analog mode, this should be usually the following 7 bytes:
|
||
06h Length, total number of following bytes
|
||
C1h Analog Mode (bit7), one 16bit opcode (bit3-0)
|
||
08h,00h Opcode 0800h (maybe analog request, or maybe just a dummy-opcode)
|
||
02h Two 8bit "opcodes" (in Analog mode, they are "masks", not "opcodes")
|
||
FFh,01h Mask Word 01FFh (bit0-8: request 1st..9th response byte)
|
||
The 7th..8th response bytes contain unknown/unused values, changing the mask
|
||
from 01FFh to 013Fh should omit them (and save around 500 clks per received
|
||
packet); the Error Flags (normally in 9th byte) would then appear in 7th byte.
|
||
Setting Mask bit9..15 causes the glove to send extra garbage bytes.
|
||
|
||
Digital Mode TX Packets
|
||
Digital mode would be required only if you want to use the joypad emulation
|
||
mode (ie. cripple the 3D analog position data to 2D digital joypad signals).
|
||
For details on doing that, read on below:
|
||
|
||
======================== 16bit Opcode Area (Part 1) ========================
|
||
|
||
Header Byte for 16bit Opcode Area
|
||
7 Low level mode (0=Digital Joypad Emulation, 1=Analog Low-Level Mode)
|
||
6 Unknown (always 1 in known packets)
|
||
5 Configure glove for use with other games (1=Survive POWER-OFF ?)
|
||
4 Unknown (always 0 in known packets) "prevent re-flash later"?
|
||
3-0 Number of following 16bit commands (used range is 01h..09h)
|
||
|
||
16bit Opcodes
|
||
The upper 8bit (first byte) are:
|
||
15 Unknown (always 0 in known packets)
|
||
14 Unknown (maybe only-if-NEWLY?) ;-can be used together with bit13-8
|
||
13 Examine Thumb Finger Flex ;\
|
||
12 Examine Index Finger Flex ; only one of these
|
||
11 Examine Middle Finger Flex ; bits should be set
|
||
10 Examine Ring Finger Flex ; (usually)
|
||
9 Examine Wrist Rotation Angle ;
|
||
8 Examine X/Y/Z Coordinate ;/
|
||
The lower 8bit (second byte) can have following uses:
|
||
For Finger Flex:
|
||
7-4 Unknown (usually 0) (except, can be 1 when checking TWO fingers...?)
|
||
3-2 Wanted flex or so (3 or 2=Want Flex, 0=Want NO Flex)
|
||
1-0 Unwanted flex or so (0 or 2=Want Flex, 3=Want NO Flex)
|
||
For Wrist Rotation:
|
||
7-4 Max Angle (00h..0Bh) ;\eg. wanted clock range 3:00 .. 6:00 should be
|
||
3-0 Min Angle (00h..0Bh) ;/defined as Min=3, Max=6; or maybe Max=7, or so
|
||
For X/Y/Z Coordinate:
|
||
7-3 Unknown, maybe flag(s) and/or boundary value
|
||
2 Select Direction (0=Right/Up/Back, 1=Left/Down/Forward)
|
||
1-0 Select Parameter (0=X, 1=Y, 2=Z, 3=Fourth Axis??)
|
||
The opcodes are computing if the glove is moved in the specified way, and the
|
||
result is then stored in a flag array: Input(1..9) = Result of 1st..9th 16bit
|
||
opcode (used as "Input" to the 8bit Opcodes in Part 2).
|
||
|
||
Unknown/uncommon 16bit opcodes
|
||
Some very strange ones:
|
||
1D18 ; right?? ;\these are used in combination with
|
||
0000 ; left ?? ; "normal" left/right opcodes...
|
||
1D18 ; ... ?? ; might be somehow related to near & far
|
||
0000 ; ... ?? ;/transformed to slow/pulsed & fast/normal
|
||
(Maybe flex on 3 fingers, with two 2x2bit flex pairs in LSBs if first word,
|
||
plus bit8=whatever, plus an extra 2x2bit flex pair somewhere in 2nd word?)
|
||
Some other odd ones:
|
||
440C ;\maybe "true if ring is NEWLY bent"?
|
||
440C ;/
|
||
040C ;-looks like "ring", but is undocumented in manual
|
||
6418 ;-two fingers bent?
|
||
011E ;-looks like hand forward, but is undocumented in manual
|
||
|
||
======================== 8bit Opcode Area (Part 2) ========================
|
||
|
||
Header Byte for 8bit Opcode Area
|
||
7 Append EXTRA SIX BYTES after 8bit Opcode Area (0=Normal, 1=Extra)
|
||
6-5 Unknown (always 0 in known packets)
|
||
4-0 Number of following 8bit commands (used range is 01h..18h)
|
||
|
||
Boolean Registers used with 8bit Opcodes
|
||
flg 1-bit accumulator
|
||
CondFlag Conditional Flag (false: skip all but opcode 6nh/7nh or so)
|
||
Input(0) General purpose flag (can be used to memorize current "mode")
|
||
Input(1..9) Results from 1st..9th 16bit Opcode (see Part 1)
|
||
Input(Ah..Dh) Unknown/unused
|
||
Input(Eh) Another general purpose flag (used as frame-toggle or so)
|
||
Input(Fh) Another general purpose flag (used as frame-toggle or so)
|
||
Output(0) Should be BEEP sound (judging from description in manual)
|
||
Output(1..8) Joypad Shift Register (R,L,D,U,?,?,B,A) ;?,?=probably STA,SEL
|
||
Output(9) Used in Brawler init and in "Joust" program (... LED?)
|
||
Output(Ah) Unknown/unused
|
||
Output(Bh) Maybe abort opcode execution... or LED control?
|
||
Output(Ch..Fh) Unknown/unused
|
||
PulseA Pulse generator 1 (mainly used for auto-fire on Button A)
|
||
PulseB Pulse generator 2 (mainly used for auto-fire on Button B)
|
||
For the first opcode, incoming flg and CondFlag seem to be initially true.
|
||
PulseA and PulseB can be also used to pulse DPAD bits, the pulse rate can be
|
||
changed and enabled/disabled via numeric keypad.
|
||
The Joypad DPAD outputs are reportedly also affecting the Direction LEDs on the
|
||
receiver unit. And, the other two LEDs are reportedly also affected by
|
||
"autofire", which probably means Joypad A/B buttons, or the PulseA/PulseB
|
||
generators. And the 9th LED (on the controller pad): unknown if it's software
|
||
controlled, or just a Power LED.
|
||
|
||
8bit Opcodes
|
||
0nh Unknown/unused
|
||
1nh flg = Input(n)
|
||
2nh CondFlag = flg, and, thereafter, flg = Input(0..9) ;IF command
|
||
3nh Used... 33h is related to Input(3) and related to CondFlag?
|
||
4nh flg = flg AND Input(n)
|
||
5nh flg = flg OR Input(n)
|
||
6nh Used... somehow related to CondFlag stuff... ;ELSE/ELSEIF?
|
||
7nh Exchange flg <--> Input(n) ;or so? or CondFlag? ;ENDIF?
|
||
8nh Output(n) = flg
|
||
9nh Output(n) = flg AND PulseA
|
||
Anh Output(n) = flg AND PulseB
|
||
Bnh Input(n) = Input(n) XOR flg ;or so? or Input(n) = (NOT?) flg
|
||
Cnh Output(n) = NOT flg
|
||
Dnh Unknown/unused
|
||
Enh Unknown/unused
|
||
Fnh Used... FEh is used, related to Input(n) .. and CondFlag?
|
||
|
||
Extra Six
|
||
Finally, "PROGRAM E" has EXTRA SIX BYTES after the 8bit opcode area (indicated
|
||
in bit7 of the 8bit Area's header). The bytes there are
|
||
00h,00h,00h,00h,57h,57h, purpose is unknown.
|
||
|
||
Controllers - Power Glove RX Packets (Position/Sensor Data)
|
||
-----------------------------------------------------------
|
||
|
||
Packet Summary
|
||
The standard packets are 9 bytes in size (not counting the preceeding "ready"
|
||
byte; and obviously not counting the preceeding/following "not ready" bytes).
|
||
1st byte: Signed X-Coordinate
|
||
2nd byte: Signed Y-Coordinate
|
||
3rd byte: Signed Z-Coordinate
|
||
4th byte: Wrist Rotation Angle (around Z-axis)
|
||
5th byte: Finger Flex Sensors
|
||
6th byte: Control Pad Buttons
|
||
7th byte: Unknown/unused (00h)
|
||
8th byte: Unknown/unused (00h)
|
||
9th byte: Error Flags
|
||
Note: It is possible to disable some of the response bytes (via Mask Word in
|
||
configuration packet). For example, one may want to disable 7th..8th byte
|
||
(since they seem to be useless, and waste around 500 clks RX time); when doing
|
||
so, the numbering of the following bytes changes (ie. in that example, Error
|
||
Flags in "9th" byte would move to location of "7th" byte).
|
||
|
||
1st/2nd/3rd byte: Signed X/Y/Z-Coordinates
|
||
1st byte: X-coordinate (-80h=Left, +7Fh=Right)
|
||
2nd byte: Y-coordinate (-80h=Down, +7Fh=Up)
|
||
3rd byte: Z-coordinate (-80h=Forward, +7Fh=Back) ;Forward=Towards Screen
|
||
All coordinates are relative to the "Center" (the location where one has most
|
||
recently pushed the Center button).
|
||
Warning: There's a software bug in the Super Glove Ball game: When moving the
|
||
glove too fast, the sprite jumps to random locations in left screen half,
|
||
and/or stays stuck at botton-most screen coordinate. As a workaround, emulators
|
||
may limit the distance to max 31 units per packet.
|
||
|
||
UNKNOWN if the glove is calibrating itself to biggest/smallest coordinates it
|
||
has seen (similar as for the finger flex calibration).
|
||
If so, the calibrated range would "grow" each time when moving towards the
|
||
boundaries; to avoid that "growing" effect, it may be a good idea to clip
|
||
values to -40h..3Fh in software (that, being the "used" range, and values
|
||
beyond that range being a "dead" zone) (if the user gets into the dead zone,
|
||
nothing bad happens as it's still far to the -80h/+7Fh maximum boundaries where
|
||
the growing effect might take place).
|
||
|
||
4th byte: Wrist Rotation Angle (around Z-axis)
|
||
7-4 Unused (always 0?)
|
||
3-0 Clockwise rotation in 30 degree steps (00h..0Bh)
|
||
Rotation around Z-axis is determined by sensing X and Y coordinates of the two
|
||
ultrasonic speakers in relation to each other. Examples for the four major
|
||
rotation angles are:
|
||
Val Clock-face Degrees Back-side-of-Hand Thumb
|
||
00h 12:00 0' Points up Points left
|
||
03h 3:00 +90' Points right Points up
|
||
06h 6:00 +180' Points down Points right
|
||
09h 9:00 -90' Points left Points down
|
||
Mind that there are some body-mechanic restrictions:
|
||
In general, forearm can be be turned clockwise from around 0:00 to 6:00
|
||
When using your shoulder you may also go anti-clockwise from 11:00 to 8:00
|
||
When breaking your arm, or maybe doing a salto, you might also get to 7:00
|
||
Note: Rotation around X-axis or Y-axis won't work: The speakers are no longer
|
||
aimed at the microphones, so the signals get lost, and the glove cannot compute
|
||
position & rotation values.
|
||
|
||
5th byte: Finger Flex Sensors
|
||
7-6 Thumb (hard to use) (0..3; 0=Straightest, 3=Most Bent)
|
||
5-4 Index Finger (0..3; 0=Straightest, 3=Most Bent)
|
||
3-2 Middle Finger (0..3; 0=Straightest, 3=Most Bent)
|
||
1-0 Ring Finger (0..3; 0=Straightest, 3=Most Bent)
|
||
N/A Little Finger (there is no flex sensor for this finger)
|
||
The glove is automatically calibrating itself to the minimum/maximum flex
|
||
positions that it has seen; ie. before using it, one should stretch/bend all
|
||
fingers a few times. When not doing that, it defaults to return all 3's (ie.
|
||
highest flex seen so far).
|
||
Note: The flex sensors seem to be somehow fragile; it appears to be more or
|
||
less common that only 3 of the 4 sensors are working (unknown what is causing
|
||
that problem; maybe they are broken, or maybe just dirty).
|
||
|
||
6th byte: Control Pad Buttons
|
||
7-0 Button number of currently pressed button
|
||
Button numbers are:
|
||
00h Keypad "0" or Center (glove beeps & centers when pressing Center?)
|
||
01h-09h Keypad "1".."9"
|
||
0Ah Button A
|
||
0Bh Button B
|
||
0Ch DPAD Left ;XXX or Up ?
|
||
0Dh DPAD Up ;XXX or Right ?
|
||
0Eh DPAD Down
|
||
0Fh DPAD Right ;XXX or Left ?
|
||
80h Enter (glove beeps when pressing this button?)
|
||
82h Start
|
||
83h Select
|
||
84h (?) PROG (glove goes into program-mode when pressing this button)
|
||
FFh (?) None (no button pressed)
|
||
There can be only one button pressed. Priority order is reportedly (starting
|
||
with highest priority):
|
||
Left,Up,Down,Right, Enter,Start,Select,Center, 0,1,2,3,4,5,6,7,8,9, A,B.
|
||
Center and Enter are to-be-avoided as they beep the glove and wreck (?) one
|
||
sample or so of data. WHEREAS, "wrecking" sounds unlikely... maybe it does
|
||
rather stay not-ready for a while during centering? "0" and "Center" are
|
||
returning the same value according to two sources (but both being unaware of
|
||
the "ready" status-byte; so maybe they are seeing status=00h=centering/not
|
||
ready, rather than seeing button=00h=center).
|
||
|
||
7th byte: Unknown/unused
|
||
8th byte: Unknown/unused
|
||
These two bytes seem to be always 00h. Purpose unknown.
|
||
|
||
9th byte: Error Flags
|
||
7-6 Unused (always 0)
|
||
5 Right speaker (on little finger) to Sensor 3 (lower-right mic) (1=Okay)
|
||
4 Right speaker (on little finger) to Sensor 2 (upper-right mic) (1=Okay)
|
||
3 Right speaker (on little finger) to Sensor 1 (upper-left mic) (1=Okay)
|
||
2 Left speaker (on index finger) to Sensor 3 (lower-right mic) (1=Okay)
|
||
1 Left speaker (on index finger) to Sensor 2 (upper-right mic) (1=Okay)
|
||
0 Left speaker (on index finger) to Sensor 1 (upper-left mic) (1=Okay)
|
||
Indicates if the speaker pings have reached the microphones. Should be 3Fh when
|
||
everything is fine, otherwise coordinate & rotation bytes may contain garbage
|
||
and one should ignore them.
|
||
Note: The six LEDs in the receiver unit seem to be wired to the serial joypad
|
||
data. So, after reading the last byte of a packet, the LEDs should reflect
|
||
Bit0-3 and Bit6-7 of the Error Flag byte (until the NMI handler reads the
|
||
following "Not Ready" byte in next frame).
|
||
|
||
Controllers - Power Glove Games and Compatibilty Modes
|
||
------------------------------------------------------
|
||
|
||
Games with Glove Support
|
||
There have been only two games released. The first one with "faked" support
|
||
(merely configures the glove to simulate a joypad). The second one does
|
||
actually support analog inputs.
|
||
Bad Street Brawler (U) 1989 Mattel/Beam Software (uses digital mode only)
|
||
Super Glove Ball (U) 1990 Mattel/Rare/Novak (uses real analog low-level mode)
|
||
As far as known, these games have been sold only in USA. So, japanese users
|
||
have been stuck with the 14 built-in compatibility modes.
|
||
|
||
Built-in Compatibilty Modes (Program 1-14)
|
||
The glove BIOS contains 14 built-in "programs" that are allowing to use it with
|
||
different existing games.
|
||
1. Put the game into NES and press POWER. (Glove turns on and beeps.)
|
||
2. Press PROG on glove.
|
||
3. Press the number of the program you want to use on the number pad.
|
||
4. Press ENTR. (The glove makes a dim beep.)
|
||
5. Press ENTR again. (The glove beeps.)
|
||
6. Press START or SELECT on your glove. (LED Panel turns on.)
|
||
7. Make a fist a few times and center before you start playing.
|
||
8. Repeat steps 2-5 to change programs.
|
||
Always make a fist a few times and re-center after you change programs.
|
||
Programs 1-13 are simulating joypad buttons when sensing special gestures.
|
||
Program 14 disables all sensors and allows to use the glove's control pad as
|
||
normal joypad.
|
||
|
||
Extended Compatibilty Modes (Program A-I)
|
||
Aside from the actual game, the Bad Street Brawler game cartridge additionally
|
||
contains another 9 compatibility modes (for games like Gyruss and Gunsmoke).
|
||
1. Put a special series game into the NES and press POWER.
|
||
2. Select special program option as prompted.
|
||
3. Select special series program as prompted.
|
||
4. Turn off NES. You have 30 seconds to complete step 5.
|
||
5. Put game you want to play in the NES and turn it back on.
|
||
6. Make fists and center as usual, then press START, to start playing game.
|
||
BUG: The menu selection for the right column doesn't work (trying to select
|
||
Program F-I will mirror to Program A-D), and, Program C seems to have
|
||
accidently swapped clockwise & anti-clockwise directions.
|
||
|
||
Controllers - Power Glove Drawings
|
||
----------------------------------
|
||
|
||
.-------. sensor 1 sensor 2 .-------..__
|
||
| .-. |_____________________________________________| .-. | ''. LEDs:
|
||
| ((O)) |_____________________________________________| ((O)) | o | up
|
||
| '-' | upper-left upper-right | '-' | o o | lt rt
|
||
'-------' microphone microphone '-------' o | dn
|
||
.-----------------------------------------------------. | |
|
||
| .----------------------------------. ___ | | o o | rapid
|
||
| | | .' '. | |_____| fire
|
||
| | | | // | | | | LEDs
|
||
| | | | // | | | |
|
||
| | TV-Set | '.___.' | | |
|
||
| | | | | |
|
||
| | | ( ) ( ) | | |
|
||
| | | | | |
|
||
| | | ::::::::::::: | | |
|
||
| | | ::::::::::::: | | |
|
||
| | | ::::::::::::: | | |
|
||
| | | ::::::::::::: | | | sensor 3
|
||
| | | | .--'-'--.
|
||
| '----------------------------------' | | .-. |
|
||
|_____________________________________________________| | ((O)) |###,
|
||
lower-right | '-' | #
|
||
,###########################, microphone '-------' #
|
||
#" long cable "##, #
|
||
.------"------. "############################"
|
||
| junction |
|
||
.##| box : <--- ######################################,
|
||
# | | connect glove here "##########,
|
||
# '-------------' #
|
||
# short cable #
|
||
#' to NES very short long cable #
|
||
#' cable ___________________________________ #
|
||
..------.. |''---..########/ Aup Aon Bup Bon \####"
|
||
| !!! !! ! ''-| |------/ LED (0) (1) (2) (3) (4) (PROG) \--.
|
||
.!.-------.. |speaker| !!!!| o SloMo Adn Aof Bdn Bof | |
|
||
| !!! !! ! '''| unit | !!!!| _ (5) (6) (7) (8) (9) (ENTER) | |
|
||
.!.---------.. | | !!!!| _| |_ | |
|
||
| !!! !! ! '''| | !!!!| |_ _| | |
|
||
'...---------... | | !!!!| |_| (CENTER) (SEL) (STA) (B) (A) | |
|
||
| !!! !! ! ''| __| !!!!|_______________________________________| |
|
||
'....----------...|___/' ''!! !! !! !! ________ !! !! !! |
|
||
/ ,--------------------######---------------------'
|
||
.--''' / wrist-strap
|
||
| ...'''
|
||
'-----''
|
||
Note: The "speaker unit" contains 2 ultrasonic speakers (above index finger
|
||
and little finger), plus one regular speaker (for producing beep sounds),
|
||
plus wires going to the flex sensors. The ultrasonic speakers must be aimed
|
||
towards the microphones for position sensing.
|
||
According to the glove manual, the microphones are intended to be hung on
|
||
the TV-Set. However, the surface of the screen may produce echos, and thus
|
||
mess-up signal sensing; results can be reportedly improved by depositing
|
||
the microphones elsewhere, possibly backed with towels for avoiding echos.
|
||
|
||
Controllers - Power Glove Pinouts
|
||
---------------------------------
|
||
|
||
Pinouts for the CPU should be as shown below (info from Tim Deagan;
|
||
descriptions in middle column are assuming that the CPU has COP888CLMH-style
|
||
pinouts; but it might actually be a different COP888xxx variant).
|
||
Pin COP888 Power Glove
|
||
1 C2,I/O INPUT C on 4021 ;\serial data
|
||
2 C3,I/O INPUT D on 4021 ;/to NES and LEDs?
|
||
3 G4,I/O,SO ?
|
||
4 G5,I/O,SK DATA LATCH ;\serial data
|
||
5 G6,I,SI,ME DATA CLOCK ;/from NES?
|
||
6 G7,I/CKO,HALT RESTART XTAL
|
||
7 CKI XTAL
|
||
8 Vcc +5VDC
|
||
9 I0,I R1 pullup,Button0,Button8,RIGHT
|
||
10 I1,I R2 pullup,Button1,Button9,LEFT
|
||
11 I2,I R3 pullup,Button2,ENTER ,DOWN
|
||
12 I3,I R4 pullup,Button3,PROG ,UP
|
||
13 I4,I R5 pullup,Button4, ,START
|
||
14 I5,I R6 pullup,Button5, ,SELECT ;but, where
|
||
15 I6,I R7 pullup,Button6, ,B ;is Center?
|
||
16 I7,I R8 pullup,Button7, ,A
|
||
17 L0,I/O,MIWU R26 gnd,THUMB
|
||
18 L1,I/O,MIWU R27 gnd,INDEX
|
||
19 L2,I/O,MIWU R28 gnd,MIDDLE
|
||
20 L3,I/O,MIWU R29 gnd,RING
|
||
21 C4,I/O ? ;\maybe these are
|
||
22 C5,I/O Button0-7 & CENTER ; outputs to 8x3
|
||
23 C6,I/O ENTER ;/keypad matrix?
|
||
24 C7,I/O GND
|
||
25 L4,I/O,MIWU,T2A CLK on 4021
|
||
26 L5,I/O,MIWU,T2B RC net to LBlu,->|- red finger wires
|
||
27 L6,I/O,MIWU ?
|
||
28 L7,I/O,MIWU GRY from top of glove (XMTR2 ?)
|
||
29 D0,O, I/O BIT 0 YEL from top of glove (XMTR1)
|
||
30 D1,O, I/O BIT 1 GRN from top of glove (XMTR2)
|
||
31 D2,O, I/O BIT 2 BLU from top of glove (BEEPER)
|
||
32 D3,O, I/O BIT 3 PUR from top of glove (XMTR1 ?)
|
||
33 D4,O, I/O BIT 4 INPUT E on 4021 ;\
|
||
34 D5,O, I/O BIT 5 INPUT F on 4021 ; serial data
|
||
35 D6,O, I/O BIT 6 INPUT G on 4021 ; to NES and LEDs?
|
||
36 D7,O, I/O BIT 7 INPUT H on 4021 ;/
|
||
37 GND GND
|
||
38 RESET# ?
|
||
39 G0,I/O,INT,ALE ?
|
||
40 G1,WDOUT ?
|
||
41 G2,I/O,T1B,WR# BRN to junct box (pin1 LM324 near rcvrs)
|
||
42 G3,I/O,T1A,RD# ORG to junct box (RCs to LM324 near rcvrs)
|
||
43 C0,I/O INPUT A on 4021 ;\serial data
|
||
44 C1,I/O INPUT B on 4021 ;/to NES and LEDs?
|
||
|
||
Power Glove Component List
|
||
Glove Speaker PCB
|
||
two ultrasonic speakers (near index finger/little finger knuckles)
|
||
one normal speaker (beeper)
|
||
three transistors, resistors, capacitors, diodes
|
||
wires to control-pad PCB, wires to finger flex sensors
|
||
Glove Control Pad PCB
|
||
(components here are mostly unknown)
|
||
Seems to consist of a 44pin National Semiconductor COP888-family CPU,
|
||
a 4021 shift-register, and possibly whatever other components.
|
||
one LED (on solder side), 21 buttons (on solder side)
|
||
Junction Box PCB
|
||
two LM324 chips (two quad-amplifiers)
|
||
three diodes, and many resistors and capacitors
|
||
DB9 connector (to glove), and wire to NES, and wire to microphone units
|
||
Microphone PCBs (three pieces)
|
||
TL062 (dual-amplifier)
|
||
one microphone, one capacitor, six resistors
|
||
LED PCB (near upper-right microphone PCB)
|
||
SN74LS164N (8bit serial-in, parallel-out shift-register)
|
||
six LEDs, six resistors, one capacitor
|
||
|
||
Controllers - UForce
|
||
--------------------
|
||
|
||
--> Controllers - UForce I/O
|
||
--> Controllers - UForce Drawings
|
||
--> Controllers - UForce Games and Game Switches
|
||
|
||
How the UForce Works (directly from the manual)
|
||
"UForce uses an array of sensors to create a three-dimensional Power Field
|
||
about 8 to 10 inches above or in front of each sensor. The Power Field senses
|
||
the position and motion of objects within it by combining information from all
|
||
its sensors."
|
||
Note: The so-called "Power Field" consists of 9 infra-red transmitters, each
|
||
one bundled with an infra-red receiver, meant to sense reflections from the
|
||
player's hands.
|
||
|
||
Controllers - UForce I/O
|
||
------------------------
|
||
|
||
For reading analog data: Set Game Switches SW1+SW2+SW3 to the "Down" position
|
||
(otherwise the UForce will simulate a digital joypad). And, the UForce should
|
||
be connected to 1st controller port (the prototype cartridge supports only
|
||
4016h reads, not 4017h).
|
||
|
||
Byte Reading
|
||
Bytes are read the same way as joypad1 (strobe 4016h.W.Bit0 1-then-0, then read
|
||
8 bits from 4016h.R.Bit, MSB first). Data appears to be transferred through a
|
||
shift-register (so no delays should be needed within the byte reading part),
|
||
however, short delays appear to be required between the separate bytes (exact
|
||
cycle values are unknown).
|
||
|
||
Status Byte
|
||
1st..6th Status Bits (00h=AllSixBitsHigh=Ready, Other=SomeBitLow=Busy)
|
||
7th Select Button (0=High=Released, 1=Low=Pressed)
|
||
8th Start Button (0=High=Released, 1=Low=Pressed)
|
||
The status byte should be usually polled within the NMI handler. If it's
|
||
indicating "Ready" (which reportedly happens about 10 times per second), then
|
||
the NMI handler should read 8 more bytes (containing the analog data described
|
||
below).
|
||
The Start/Select bits are usually read from "Ready" bytes (unknown if they can
|
||
be also read from "Busy" bytes).
|
||
|
||
Analog Data Bytes
|
||
1st Analog Data, Bit4 ;\5bit analog sensor value,
|
||
2nd Analog Data, Bit3 ; bits are inverted (0=High=One, 1=Low=Zero),
|
||
3rd Analog Data, Bit2 ; after undoing that inversion (XOR by 1Fh),
|
||
4th Analog Data, Bit1 ; values are: 00h..1Eh = Distant..Closest
|
||
5th Analog Data, Bit0 ;/(aka least..most IR light reflection)
|
||
6th Analog Data, Bit0 (according to Kevin: duplicated, same as above)
|
||
7th Presence Bit (according to Kevin: 0=High=Low=Sensor covered, heh?)
|
||
8th Unused (according to Kevin: "0=NOT(0)=0" uh, that can't be true?)
|
||
The existing prototype software is merely treating the byte as "8bit analog
|
||
value", without giving special attention to the stuff in lower bits (so,
|
||
although the content of the LSBs is rather unclear, their exact values don't
|
||
really matter for emulation purposes). Also note: Kevin claims the analog range
|
||
to be only 00h..1Eh (not 00h..1Fh), this may be true, but he also claims that
|
||
the closest value is most distant, so better don't count on it.
|
||
|
||
UForce Sensor Locations
|
||
Byte Number Official Naming Other Numbering
|
||
(within packet) (from manual) (kevtris doc)
|
||
8th Top 1
|
||
6th 7th 1. 2. 2 3
|
||
5th 3rd'a 3. 4. 4 5
|
||
4th - 5. 6. 6 dummy
|
||
1st 2nd 7. 8. 7 8
|
||
3rd'b Bottom 9
|
||
The UForce has 9 sensors (plus one dummy location without sensor installed in
|
||
it). Of that 9 sensors, only 8 can be used at once (the 3rd byte in the 8-byte
|
||
data packet contains either the 3rd'a or 3rd'b value, depending on the SW4
|
||
switch setting).
|
||
|
||
Controllers - UForce Drawings
|
||
-----------------------------
|
||
|
||
UForce Main Unit (with sensor numbers as ordered in the 8-byte data packet)
|
||
.---- sensor #8
|
||
/
|
||
_______________________ _______ _______________________
|
||
| . | ##### | . |
|
||
| | | | ..mmM | | | |
|
||
| | |_| FORCE | | | |
|
||
| | / \ | |
|
||
| | / \ | |
|
||
| |________________ / \ ________________| |
|
||
| _________________________________________________ |
|
||
| | | |
|
||
sensor | |'''. .'''| | sensor
|
||
#6---> | | :---------------------------------------: | | <--- #7
|
||
| |...' '...| |
|
||
| | : : | |
|
||
| | : : | |
|
||
| | : : | |
|
||
| | : : | |
|
||
| | : : | |
|
||
| | : : | |
|
||
sensor | |'''. .'''| | sensor
|
||
#5---> | | :---------------------------------------: | | <--- #3a
|
||
| |...' '...| |
|
||
| | : : | |
|
||
_| |_:_____________________________________________:_| |_
|
||
| | ______ ______ | | hinge
|
||
| |____| |_______________________________| |____| | <---
|
||
|_| _________________________________________________ |_|
|
||
| | : : | |
|
||
| | : : | |
|
||
sensor | |'''. .'''| | dummy
|
||
#4---> | | :---------------------------------------: | | <---
|
||
| |...' '...| | (no
|
||
| | : : | | sensor)
|
||
| | : : | |
|
||
| | : : | |
|
||
| | : add-on : | |
|
||
| | : .--- socket : | |
|
||
| | : / : | |
|
||
sensor | |'''. .'''. .'''| | sensor
|
||
#1---> | | :--------------- | ( ) | ---------------: | | <---#2
|
||
| |...' | | '...| |
|
||
| |_____________________| |_____________________| |
|
||
| |
|
||
| ________________ \ / ________________ |
|
||
| | \ \ / / TURBO | |
|
||
| | ( ) \ \ / / ON A B | |
|
||
| | SELECT | | | | OFF ' ' | |
|
||
| | ( ) | | | | . . . . | |
|
||
| ' START ' | ##### | ' 1 2 3 4 ' |
|
||
|_______________________|_______|____GAME SWITCHES______|
|
||
\
|
||
'--- sensor #3b
|
||
Of the 9 sensors, only 8 can be used at once. Game Switch 4 allows to select
|
||
between using sensor #3a or #3b. The other Game Switches select analog mode, or
|
||
digital joypad emulation modes.
|
||
|
||
UForce Power Bar Accessory
|
||
_________________________________________________
|
||
|\ POWER BAR /|
|
||
mirror --> \ For use with... / <-- mirror
|
||
|_ \___________________ ___________________/ _|
|
||
|___| <-- plug this nibble into socket
|
||
|
||
This thing is badged "UForce Power Bar, For use with Mike Tysons's Punch Out!!
|
||
(and future games)". The bar can be plugged into the add-on socket between the
|
||
bottom-most sensor pair, there seem to be mirrors at the bar ends, which do
|
||
redirect that sensors towards the sides.
|
||
|
||
UForce T-Bar with removeable Firing Grips Accessory
|
||
push-down _ _ push-down
|
||
button --> |_| _______________________________ |_| <-- button
|
||
| __| .-' '-. |__ |
|
||
.-' |-' L _____________ _____________ R '-| '-.
|
||
| | .-' | | '-. | |
|
||
\ |-' | | \ '-| /
|
||
grip --> | | | | \ | | <-- grip
|
||
| | | | T-shaped | |
|
||
| | | | handle-bar | |
|
||
|___| | | |___|
|
||
mirror --> | / | | | | \ | <-- mirror
|
||
|_____| | | |_____|
|
||
| |
|
||
| |
|
||
| |
|
||
| |
|
||
|___| <-- plug this end into socket
|
||
|
||
This thing can be plugged into the add-on socket between bottom-most sensor
|
||
pair. It can be turned into all three directions. There aren't any
|
||
electronics/mechanics in the T-bar; it's only intended to keep the player's
|
||
hands at the height of the top-most sensor pair, which may then eventually
|
||
react to the player's steering efforts.
|
||
The two removeable handles have thumb buttons, which appear to turn mirrors
|
||
inside of the handles, which do then trigger the bottom-most sensors.
|
||
|
||
Controllers - UForce Games and Game Switches
|
||
--------------------------------------------
|
||
|
||
Digital Game Modes
|
||
The five digital modes (called "Mode A-E") are used for compatibility with
|
||
existing games; where the UForce is using it's analog inputs to simulate
|
||
digital joypad signals matched for different game types. Naturally this isn't
|
||
working too well, as it's best it may be useful for adding some extra
|
||
difficulty to the games.
|
||
|
||
Analog Game Mode
|
||
The analog mode (called "Mode F") was intended for future games that do
|
||
directly read the analog sensors. However, there hasn't been any such future
|
||
game ever released. There's only one prototype cartridge, that has leaked into
|
||
internet:
|
||
Uforce Power Games (USA) (Prototype) (1990) Broderbund
|
||
The cartridge contains four crude mini-games (Hose 'em Down, Nuclear Rat
|
||
Attack, Rock on Air, and Power Field B-Ball). The usage of the sensors is as
|
||
so:
|
||
Hose'em Down:
|
||
Use "Top" as ANALOG left/right
|
||
Use "Lower-Left in Lower Area" as ANALOG up/down
|
||
Nuclear Rat Attack:
|
||
Use upper-four sensors as DIGITAL push buttons
|
||
Rock on Air:
|
||
Use left four sensors as DIGITAL push buttons
|
||
Use "Top" as ANALOG pitch
|
||
Use "Bottom" as ANALOG volume
|
||
Power Field B-Ball
|
||
Use "Upper-Left in Upper Area" as walk left
|
||
Use "Lower-Left in Upper Area" as walk right
|
||
Use "Upper-right in Upper Area" as throw
|
||
Use whatever as jump
|
||
|
||
UForce Game Modes
|
||
Mode SW1 SW2 SW3 SW4 Hinge/Angle Add-on Purpose
|
||
A Up Up Up Down Upright 85' T-Bar Various Games (Forward View)
|
||
B Down Up Up Up Tilt 110' Pow-Bar Mike Tyson's Punch-Out!!
|
||
C Up Down Up Down Upright 85' - Rad Racer
|
||
D Down Down Up Up Upright 85' - Excitebike
|
||
E Down Up Down Down Flat 180' - Various Games (Side Scroll)
|
||
F Down Down Down (Down) (var) (var) Analog (UForce Power Games)
|
||
Aside from the official 6 mode settings, there are some more possible settings
|
||
for SW1-SW3:
|
||
- Up Up Down (any) (any) (any) Reportedly same as Mode A
|
||
- Up Down Down (any) (any) (any) Unknown
|
||
SW4 does simply select which of the two "shared" sensors to use (either
|
||
bottom-most one, or the lower-right in upper-field one), so changing SW4 may
|
||
allow some desired or undesired variations.
|
||
|
||
UForce Turbo A/B Switches
|
||
The two turbo switches can apply auto-fire to joypad button A/B signals.
|
||
Accordingly, they are used only in digital joypad emulation modes, not in
|
||
analog mode. The auto-fire rate is reportedly around 10Hz.
|
||
|
||
Controllers - Barcode Readers
|
||
-----------------------------
|
||
|
||
Datach - Joint ROM System (Bandai) (1992)
|
||
A mini-cartridge adaptor with built-in barcode reader. The device connects to
|
||
cartridge slot, and can be used (only) with seven special mini-cartridge games
|
||
(six of them actually supporting the barcode feature):
|
||
Dragon Ball Z: Gekito Tenkaichi Budokai (December 1992)
|
||
Ultraman Club: Spokon Fight!! (April 1993)
|
||
SD Gundam: Gundam Wars (April 1993)
|
||
Crayon Shin-Chan: Orato Poi Poi (August 1993) (this WITHOUT barcode support)
|
||
Yu Yu Hakusho: Bakuto Ankoku Bujutsue (October 1993)
|
||
Battle Rush: Build Up Robot Tournament (November 1993)
|
||
J League: Super Top Players (April 1994)
|
||
The barcode reader hardware can see only one pixel at a time:
|
||
[6000h].R.Bit3 Barcode Sensor (0=Black, 1=White)
|
||
The data seen during scanning is:
|
||
All Black ;no card inserted
|
||
61 pixels White ;leading white space (ca. 61 pixels on included cards)
|
||
95 pixels Stripes ;barcode (95 pixels for EAN-13 and UPC-A codes)
|
||
61 pixels White ;ending white space (ca. 61 pixels on included cards)
|
||
All Black ;no card inserted
|
||
Example: In Dragon Ball Z, barcode 062982-144233 gives HP:51500, BP:32500,
|
||
DP:25000.
|
||
The included cards measure roughly 8.55cm x 5.9cm each. The existing games
|
||
support UPC-A and EAN-13 barcodes (both have 30 black stripes), EAN-8 barcodes
|
||
(22 black stripes), and, an unknown variable-length barcode format (with 27 or
|
||
more black stripes). UPC-E barcodes (17 black stripes) aren't supported.
|
||
The scanning software uses 8bit counters (incremented at 73 clk rate), for a
|
||
reasonable resolution & avoiding overflows (on wide 4pixel stripes), the
|
||
scanning time should be around 300..4600 clks per pixel.
|
||
The games are using a variant of "Mapper 16", but apparently with VRAM instead
|
||
of VROM. The VRAM has unknown size, and it's probably contained in the "Datach"
|
||
adaptor.
|
||
--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM
|
||
Note: Bandai also made a similar mini-cartridge device (named Sufami Turbo) for
|
||
the Super Famicom; that device features two cartridge slots, but doesn't
|
||
include a barcode reader.
|
||
|
||
Barcode Battler II (Epoch) (1992)
|
||
A handheld console with built-in barcode reader and very simple LCD display.
|
||
The device can be used as standalone handheld console, or as external barcoder
|
||
reader for other consoles. Supported by only one Famicom game:
|
||
Barcode World (1992) Sunsoft (JP) (includes cable with 15pin connector)
|
||
Note: The Barcode Battler II is also supported by a couple of SNES games.
|
||
--> Controllers - Barcode Battler (barcode reader)
|
||
--> Controllers - Barcode Battler Transmission I/O
|
||
--> Controllers - Barcode Battler Drawings
|
||
In short: The Barcode Battler outputs barcodes as 20-byte ASCII string, at 1200
|
||
Baud, 8N1. The NES software receives that bitstream via Port 4017h.Bit2.
|
||
|
||
Barcode Format
|
||
--> Controllers - Barcode Formats
|
||
|
||
Controllers - Barcode Battler (barcode reader)
|
||
----------------------------------------------
|
||
|
||
The Barcode Battler from Epoch allows to scan barcodes (either from special
|
||
paper cards, or from daily-life products like food packagings), games can then
|
||
use the barcode digits as Health Points, or other game attributes.
|
||
|
||
Standalone-Mode
|
||
The device was originally designed as stand-alone gaming console with some push
|
||
buttons, a very simple LCD screen with 7-segment digits & some predefined LCD
|
||
symbols, and a built-in game BIOS (ie. without external cartridge slot, and
|
||
without any bitmap graphics).
|
||
|
||
Link-Mode
|
||
Later versions (with black case) include an "EXT" link port, allowing to link
|
||
to other Barcode Battler hardware, or to Famicom/Super Famicom consoles. The
|
||
EXT port is probably bi-directional, but existing Famicom/Super Famicom games
|
||
seem to be using it only for reading barcodes (without accessing the LCD
|
||
screen, push buttons, speaker, or EEPROM).
|
||
|
||
Barcode Battler Famicom (NES) Games
|
||
Barcode World (1992) Sunsoft (JP) (includes cable with 15pin connector)
|
||
|
||
Barcode Battler Super Famicom (SNES) Games
|
||
Alice's Paint Adventure (1995)
|
||
Amazing Spider-Man, The - Lethal Foes (19xx)
|
||
Barcode Battler Senki Coveni Wars (1993) Epoch
|
||
Donald Duck no Mahou no Boushi (19xx)
|
||
Doraemon 2: Nobita's Great Adventure Toys Land (1993)
|
||
Doraemon 3: Nobita and the Jewel of Time (1994)
|
||
Doraemon 4 - Nobita to Tsuki no Oukoku (19xx)
|
||
Doroman (canceled)
|
||
Dragon Slayer - Legend of Heroes 2 (1993) Epoch
|
||
J-League Excite Stage '94 (1994)
|
||
J-League Excite Stage '95 (1995)
|
||
Lupin Sansei - Densetsu no Hihou wo Oe! (19xx)
|
||
Super Warrior Combat (19xx - does this game exist at all?)
|
||
|
||
Barcode Battler Hardware Versions
|
||
Region__Case___EXT___Barcode-Reader__Name__________________Year___
|
||
Japan White None Yes Barcode Battler 1991
|
||
Japan Black 1 Yes Barcode Battler II 1992
|
||
Japan Black 2 None Barcode Battler II^2 199x
|
||
Europe Black 1 Yes Barcode Battler 1992/1993
|
||
The versions with one EXT socket can be connected to NES/SNES, or to one or
|
||
more of the "II^2" units (allowing more players to join the game).
|
||
|
||
Connection to SNES/NES consoles
|
||
Connection to Super Famicom or SNES requires a "BBII INTERFACE": a small box
|
||
with 4 LEDs and two cables attached (with 3pin/7pin connectors), the interface
|
||
has been sold separetedly, it's needed to add a SNES controller ID code to the
|
||
transmission protocol.
|
||
Connection to Famicom consoles requires a simple cable (without interface box)
|
||
(with 3pin/15pin connectors), the cable was shipped with the "Barcode World"
|
||
Famicom cartridge, connection to NES would require to replace the 15pin Famicom
|
||
connector by 7pin NES connector.
|
||
The required 3pin EXT connector is available only on newer Barcode Battlers
|
||
(with black case), not on the original Barcode Battler (with white case).
|
||
Unknown if all 3 pins are actually used by NES/SNES cable/interface?
|
||
Unknown if NES/SNES software can access LCD/buttons/speaker/EEPROM ?
|
||
|
||
Connectivity
|
||
"Connectivity mode is accessible if you plug in a standard 3.5mm mono jack plug
|
||
into the expansion port on the left hand side of the unit, hold down the
|
||
R-Battle and R-Power buttons and turn the unit on, the Barcode Battler II goes
|
||
into scanner mode."
|
||
|
||
Barcode Battler II Interface
|
||
The hardware itself was manufactured by Epoch, and licensed by Nintendo (it
|
||
says so on the case).
|
||
The four lights, from left to right, indicate as follows:
|
||
"OK" All is well, the device is operating as normal.
|
||
"ER" Maybe there's something wrong?
|
||
"BBII" The Barcode Battler is sending data to the device.
|
||
"SFC" The SFC/SNES is waiting for a signal from the Barcode Battler.
|
||
|
||
Component List (may be incomplete)
|
||
80pin NEC uPD75316GF (4bit CPU with on-chip 8Kx8 ROM, 512x4 RAM, LCD driver)
|
||
8pin Seiko S2929A (Serial EEPROM, 128x16 = 2Kbit) (same/similar as S29290)
|
||
3pin EXT socket (3.5mm "stereo" jack) (only in new versions with black case)
|
||
LCD Screen (with 7-segment digits and some predefined words/symbols)
|
||
Five LEDs (labelled "L/R-Battle Side")
|
||
Seven Push Buttons (L/R-POWER, L/R-Battle, Power on/off, Select, Set)
|
||
Speaker with sound on/off switch (both on bottom side)
|
||
Barcode reader (requires card-edges to be pulled through a slot)
|
||
Batteries (four 1.5V AA batteries) (6V)
|
||
|
||
Controllers - Barcode Battler Transmission I/O
|
||
----------------------------------------------
|
||
|
||
The Barcode Battler outputs barcodes as 20-byte ASCII string, at 1200 Baud,
|
||
8N1. The NES software receives that bitstream via Port 4017h.Bit2. The SNES
|
||
software requires a BBII Interface, which converts the 8bit ASCII digits into
|
||
4bit nibbles, and inserts SNES controller ID and status codes, the interface
|
||
should be usually connected to Controller Port 2 (although the existing SNES
|
||
games seem to accept it also in Port 1).
|
||
|
||
Barcode Battler (with BBII Interface) SNES Controller Bits
|
||
1st..12th Unknown/unused (probably always 0=High?)
|
||
13th..16th ID Bits3..0 (MSB first, 1=Low=One) (must be 0Eh)
|
||
17th..24th Extended ID Bits7..0 (MSB first, 1=Low=One) (must be 00h..03h)
|
||
(the SNES programs accept extended IDs 00h..03h, unknown
|
||
if/when/why the BBII hardware does that send FOUR values)
|
||
25th Status: Barcode present (1=Low=Yes)
|
||
26th Status: Error Flag 1 ?
|
||
27th Status: Error Flag 2 ?
|
||
28th Status: Unknown ?
|
||
Following bits need/should be read ONLY if the "Barcode Present" bit is set.
|
||
29th-32th 1st Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
33th-36th 2nd Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
37th-40th 3rd Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
41th-44th 4th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
45th-48th 5th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
49th-52th 6th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
53th-56th 7th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
57th-60th 8th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
61th-64th 9th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
65th-68th 10th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
69th-72th 11th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
73th-76th 12th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
77th-80th 13th Barcode Digit, Bits3..0 (MSB first, 1=Low=One)
|
||
81th and up Unknown/unused
|
||
Above would be 13-digit EAN-13 codes
|
||
Unknown how 12-digit UPC-A codes are transferred ;\whatever leading
|
||
Unknown if/how 8-digit EAN-8 codes are transferred ; or ending padding?
|
||
Unknown if/how 8-digit UPC-E codes are transferred ;/
|
||
For some reason, delays should be inserted after each 8 bits (starting with
|
||
24th bit, ie. after 24th, 32th, 40th, 48th, 56th, 64th, 72th bit, and maybe
|
||
also after 80th bit). Unknown if delays are also needed after 8th and 16th bit
|
||
(automatic joypad reading does probably imply suitable delays, but errors might
|
||
occur when reading the ID bits via faster manual reading).
|
||
|
||
Barcode Battler RAW Data Output
|
||
Data is send as 20-byte ASCII string. Bytes are transferred at 1200 Bauds:
|
||
1 Start bit (must be 1=LOW)
|
||
8 Data bits (LSB first, 1=LOW=Zero, 0=HIGH=One)
|
||
1 Stop bit (must be 0=HIGH)
|
||
The first 13 bytes can contain following strings:
|
||
"nnnnnnnnnnnnn" ;13-digit EAN-13 code (ASCII chars 30h..39h)
|
||
<Unknown> ;12-digit UPC-A code (with ending/leading padding?)
|
||
" nnnnnnnn" ;8-digit EAN-8 code (with leading SPC-padding, ASCII 20h)
|
||
<Unknown> ;8-digit UPC-E code (with ending/leading padding?)
|
||
"ERROR " ;indicates scanning error
|
||
The last 7 bytes must contain either one of following ID strings:
|
||
"EPOCH",0Dh,0Ah ;<-- this is sent/accepted by existing hardware/software
|
||
"SUNSOFT" ;<-- this would be alternately accepted by the NES game
|
||
There are rumours that one "must" use a mono 3.5mm plug in order to receive
|
||
data - that's obviously bullshit, but it might indicate that the middle pin of
|
||
stereo plugs must be GNDed in order to switch the Barcode Battler into transmit
|
||
mode(?)
|
||
|
||
Controllers - Barcode Battler Drawings
|
||
--------------------------------------
|
||
|
||
Barcode Battler - Handheld Console (Front)
|
||
_______________________________
|
||
.---""" _______________________ """---.
|
||
| /\ | | /\ |
|
||
| \ \ | | / / |
|
||
| L \/ | LCD Screen | \/ R |
|
||
| POWER | | POWER |
|
||
| /\ | | /\ |
|
||
| \ \ | | / / |
|
||
| L \/ |_______________________| \/ R |
|
||
| BATTLE BATTLE |
|
||
| O O O O O |
|
||
| L <-- Battle Side --> R |
|
||
) EXT |
|
||
| On/off Select Set |
|
||
| [====] [====] [====] |
|
||
'---_____________________________________---'
|
||
--> : _____________________________ : --> --> pull card this way
|
||
:/ CARD IN --> \:
|
||
|_______________________________|
|
||
|
||
Barcode Battler - Handheld Console (Back)
|
||
_______________________________
|
||
.---""" : : """---.
|
||
| : Battery Lid : |
|
||
| : (Four AA Batteries) : |
|
||
| : : |
|
||
| :.........................: |
|
||
| |
|
||
| |
|
||
| |
|
||
| __ |
|
||
| o |__| |
|
||
| o o o Sound |
|
||
| o on/off ( <-- 3.5mm 3pin
|
||
| Speaker | EXT socket
|
||
| |
|
||
'---__ __---'
|
||
| |
|
||
| |
|
||
|_______________________________|
|
||
|
||
Barcode Battler - LCD Screen Layout
|
||
_______________ ___________ _______________
|
||
| .-------. _|__ESCAPE___|_ .-------. |
|
||
| | FIGHT | / < SUPER HIT > \ |RECOVER| |
|
||
| |BARCODE| /|_______________|\ | MISS | |
|
||
| '-------' '-------' |
|
||
| (*) (/) (K) POWER INPUT (i) (/) (*) |
|
||
| _ _ _ _ _ _______ _ _ _ _ _ |
|
||
| |_||_||_|| || | |ENERGY | |_||_||_|| || | |
|
||
| |_||_||_||_||_| |DAMAGE | |_||_||_||_||_| |
|
||
| _ _ _ _ _ |_______| _ _ _ _ _ |
|
||
| |_||_||_|| || | |ATTACK | |_||_||_|| || | |
|
||
| |_||_||_||_||_| | MAGIC | |_||_||_||_||_| |
|
||
| _ _ _ _ _ |_______| _ _ _ _ _ |
|
||
| |_||_||_|| || | |DEFENCE| |_||_||_|| || | |
|
||
| |_||_||_||_||_| |SURVIVA| |_||_||_||_||_| |
|
||
|_________________|_______|_________________|
|
||
|
||
Barcode Batter II Interface (SNES/SuperFamicom) & Simple Cable (Famicom)
|
||
_________________
|
||
cables -> / _______ '''---> 3pin 3.5mm "stereo" EXT connector
|
||
_____|_____|____ '''---> 7pin SNES/SuperFamicom connector
|
||
___| |___
|
||
| | _.----> 3pin 3.5mm "stereo" EXT connector
|
||
| BBII INTERFACE | .-'
|
||
| | |
|
||
| O O O O | '-_ cable
|
||
|________________________| ''-------> 15pin Famicom connector
|
||
|
||
Paper-Card Front (Picture Side)
|
||
_________________________________________________
|
||
| |
|
||
| NINJA STAR WEAPON-17 |
|
||
| > INSERT |
|
||
| ----------------------^------------------------ |
|
||
| | | |
|
||
| ___ /___\ ____ |
|
||
| ___---""" /__/ \__\ """---___ |
|
||
| ---___ __ O __ ___--- |
|
||
| """---___\ _\ /_ /___---""" / |
|
||
| \ / / |
|
||
| | | /_ |
|
||
| ----------------------V--------------------'( ) |
|
||
| ST 400 ||| |
|
||
|_________________________________________________|
|
||
|
||
Paper-Card Back (Description & Barcode)
|
||
_________________________________________________
|
||
| |
|
||
| BARCODE BATTLER |
|
||
| NINJA STAR |
|
||
| 1992 Epoch |
|
||
| A lethal weapon which demands skill, patience |
|
||
| and, most important, perfect timing. Send it |
|
||
| spinning at the enemy when the Battler spirit is|
|
||
| with you and the effect can be devasting. Time |
|
||
| it wrong and the star may harmlessly bounce off |
|
||
| their defences. |
|
||
| || || |||| || || |||| || || |||| |
|
||
| || || |||| || || |||| || || |||| |
|
||
| || || |||| || || |||| || || |||| |
|
||
|_________________________________________________|
|
||
|
||
Controllers - Barcode Formats
|
||
-----------------------------
|
||
|
||
Common Barcode Formats
|
||
EAN-13 13-digits in 12 symbols (extra digit encoded in parity)
|
||
UPC-A 12-digits in 12 symbols
|
||
EAN-8 8-digits in 8 symbols
|
||
UPC-E 8-digits in 6 symbols (extra digits encoded in parity)
|
||
|
||
Barcode Symbols
|
||
Each symbol consists of 7 pixels with 4 bars: White-Black-White-Black in first
|
||
half, and vice-versa in second half; this allows to determine the scanning
|
||
speed per symbol. There are 3 possible symbols (with inverse and/or reverse
|
||
pixels) for each digit:
|
||
Digit Left/Odd Left/Even Right/Even
|
||
0 ...##.# .#..### ###..#.
|
||
1 ..##..# .##..## ##..##. "." = White
|
||
2 ..#..## ..##.## ##.##.. "#" = Black
|
||
3 .####.# .#....# #....#.
|
||
4 .#...## ..###.# #.###..
|
||
5 .##...# .###..# #..###.
|
||
6 .#.#### ....#.# #.#.... Left Sync Mark: #.#
|
||
7 .###.## ..#...# #...#.. Center Sync Mark: .#.#.
|
||
8 .##.### ...#..# #..#... Right Sync Mark: #.#
|
||
9 ...#.## ..#.### ###.#..
|
||
12-digit UPC-A (and 8-digit EAN-8) barcodes use "Left/Odd" for the first 6 (or
|
||
4) symbols, and "Right/Even" for the remaining 6 (or 4) symbols. The
|
||
"Left/Even" symbols are used only for 13-digit EAN-13 and 8-digit UPC-E
|
||
barcodes (see below).
|
||
|
||
UPC-A (12-digits in 12 symbols)
|
||
This is the original barcode format, used mainly in North America, but also
|
||
found on products that imported/exported to/from that area (namely, on many
|
||
Audio CDs).
|
||
|
||
EAN-13 (13-digits in 12 symbols; extra digit encoded in parity)
|
||
This is an extension of the UPC-A format, with an additional leading digit (if
|
||
the digit is "0" then it's an UPC-A barcode, otherwise an international EAN-13
|
||
barcode).
|
||
EAN-13 barcodes are having only 12 symbols (as UPC-A), the 13th digit is
|
||
encoded in the "parity" of the 2nd..6th symbol; the other symbols are fixed:
|
||
1st=Odd and 12th=Even allow to determine scanning direction; 7th..11th=Even
|
||
aren't containing any special information.
|
||
The parity (E=Left/Even, O=Left/Odd) for the 1st..6th symbol (aka 2nd..7th
|
||
digit) depends on the 1st digit:
|
||
Digit 1st=0 1st=1 1st=2 1st=3 1st=4 1st=5 1st=6 1st=7 1st=8 1st=9
|
||
Parity OOOOOO OOEOEE OOEEOE OOEEEO OEOOEE OEEOOE OEEEOO OEOEOE OEOEEO OEEOEO
|
||
The parity for the 7th..12th symbol (aka 8nd..13th digit) is fixed (always
|
||
Right/Even).
|
||
|
||
EAN-8 (8-digits in 8 symbols)
|
||
A short barcode for international use. Encoded as UPC-A, but only 4 symbols in
|
||
each half.
|
||
|
||
UPC-E (8-digits in 6 symbols; extra digits encoded in parity)
|
||
This is a compressed UPC-A barcode; with the "middle zeros" removed from the
|
||
manufacturer/product number field. Unlike UPC-A, these barcodes are rarely
|
||
found outside of North America.
|
||
UPC-E UPC-A
|
||
tMmpppXc --> tMmX0000pppc ;with X=0..2 ;\for UPC-E, first digit (t)
|
||
tMmmpp3c --> tMmm00000ppc ; may be 0..1 only),
|
||
tMmmmp4c --> tMmmm00000pc ; last digit (c) must be checksum
|
||
tMmmmmXc --> tMmmmm0000Xc ;with X=5..9 ;/of the "decompressed" UPC-A code
|
||
The first digit (0 or 1), and the last digit (checksum, 0..9) are encoded as
|
||
"parity" of the six symbols:
|
||
Digit 8th=0 8th=1 8th=2 8th=3 8th=4 8th=5 8th=6 8th=7 8th=8 8th=9
|
||
1st=0 EEEOOO EEOEOO EEOOEO EEOOOE EOEEOO EOOEEO EOOOEE EOEOEO EOEOOE EOOEOE
|
||
1st=1 OOOEEE OOEOEE OOEEOE OOEEEO OEOOEE OEEOOE OEEEOO OEOEOE OEOEEO OEEOEO
|
||
Left Sync Mark: #.# Center Sync Mark: None Right Sync Mark: .#.#.#
|
||
Whereas, E=Left/Even, O=Left/Odd (Right/Even symbols aren't used by UPC-E).
|
||
|
||
Checksums
|
||
The barcode checksum is located in the last digit. This value must be chosen so
|
||
that the sum of all digits, plus twice the sum of each second digit sums up to
|
||
a decimal value ending with zero.
|
||
EAN-13 Checksum Weighting: 1-313131-313131 ;1=counted once
|
||
UPC-A Checksum Weighting: 313131-313131 ;3=counted thrice
|
||
EAN-8 Checksum Weighting: 3131-3131
|
||
UPC-E Decompress UPC-E to UPC-A, then do UPC-A checksumming
|
||
|
||
Notes
|
||
Scanning direction can be determined by checking "Odd/Even" parity of the first
|
||
& last symbol.
|
||
Error checking can be done by verifying the checksum digit and by rejecting any
|
||
invalid symbols.
|
||
|
||
Controllers - Pachinko
|
||
----------------------
|
||
|
||
Pachinko Controller Games
|
||
Pachinko Daisakusen (J) 1991 Coconuts/C*Dream
|
||
Pachinko Daisakusen 2 (J) 1992 Coconuts/C*Dream
|
||
Pachio Kun 4 (J) 1991 Coconuts/C-Dream
|
||
Pachio Kun 5 (J) 1993 Coconuts/C-Dream
|
||
Pachinko is a japanese gambling game; its appearance is resembling pinball, but
|
||
concerning stupidity it's more resembling one-armed-bandit-style slot machines.
|
||
|
||
Pachinko Controller Access
|
||
The controller is accessed like normal Joypad 3, but with the 8bit joypad data
|
||
being followed by additional 8bit ADC data. First do the normal 1-then-0
|
||
strobing, then read 16bit from [4016h].Bit1:
|
||
1st..8th bit --> same as normal joypad data
|
||
9th..16th bit --> analog ADC data (MSB first, inverted, 1=Low=Zero)
|
||
17th and up --> unknown/unused
|
||
Average analog range returned on real hardware is unknown. In software, the
|
||
used range is 00h=Stopped through 63h=Fastest.
|
||
|
||
Coconuts Japan Pachinko Controller
|
||
The controller consists of normal joypad buttons, plus an analog trigger (or
|
||
analog dial?) in the middle of the controller. The joypad is used for menu
|
||
selections, the analog thing for firing the pachinko balls.
|
||
.----------. __.---------.
|
||
| ) | / \
|
||
| / // \
|
||
| _ | /| |
|
||
| _| |_ | /_| |
|
||
| |_ _| | \ B A |
|
||
| |_| \ ) ( ) ( ) |
|
||
| \___/ /
|
||
| SEL STA /
|
||
| coconuts japan /
|
||
'--------------------------'
|
||
|
||
Controllers - Microphones
|
||
-------------------------
|
||
|
||
Standard Famicom Microphone
|
||
On older Famicoms, the second control pad (that without Start and Select
|
||
buttons) has a microphone with volume control built-in. The signal goes to Bit
|
||
2 of Port 4016h (simple 1bit input, not an analogue ADC-converted input).
|
||
The signal is also merged with the PPUs sound output signals, as such, allowing
|
||
to use the television set/speaker as amplifier/megaphone.
|
||
Games that do use the Standard Microphone
|
||
* Atlantis no Nazo (NES = Super Pitfall II) - get the microphone power-up
|
||
and then yell into the microphone to freeze and kill most enemies.
|
||
* Hikari Shinwa: Palutena no Kagami (NES = Kid Icarus) - talk into the
|
||
microphone to bargain for lower shop prices.
|
||
* Raid on Bungeling Bay (NES = Raid on Bungeling Bay) - ?
|
||
* SD Kamen Rider -- in one of the mini games, blow air into the microphone
|
||
to get a windmill to spin.
|
||
* Takeshi no Chousenjou - microphone section, where players are required to
|
||
sing a verse of karaoke or talk whilst playing a pachislo minigame (the
|
||
microphone section was replaced in later versions of the game once the
|
||
microphone was dropped from the Famicom).
|
||
* Zelda no Densetsu: The Hyrule Fantasy (cart/disk) (NES = The Legend of
|
||
Zelda) - yell into the microphone to kill Pols Voice enemies.
|
||
Note: Many Coconuts games do also contain a Famicom Microphone reading
|
||
function: I Love Softball, Pachio Kun 1-6, Pachinko Daisakusen 1-2 (though
|
||
unknown when/if/which games do actually use that function).
|
||
|
||
Bandai Microphone
|
||
Cartridge with attached "stage" microphone, two 2 push buttons (A and B), and
|
||
ROM expansion slot.
|
||
--> Mapper 188: UNROM-reversed
|
||
|
||
NES LaserScope / Famicom Gun Sight (Konami)
|
||
This is basically a regular "Zapper" lightgun in form of a headset. The thing
|
||
contains a microphone that replaces the Zapper's trigger button; thus allowing
|
||
"voice activated" shooting.
|
||
|
||
Controllers - Reset Button
|
||
--------------------------
|
||
|
||
Reset Button
|
||
As an additional "control" the console is equipped with a reset button, which
|
||
is grounding the 2A03s /RST pin (resets CPU and APU).
|
||
On NES consoles (not on Famicom consoles), the reset signal is also connected
|
||
to PPU /SYNC input, causing the picture to be disabled during reset (the PPU
|
||
registers are left unchanged though). For curiosity, the NES reset signal is
|
||
also connected to the power LED, the LED goes off when pressing Reset (or when
|
||
the lockout chip generates a reset).
|
||
Anyways, RAM and VRAM is left unaffected, so that the program may recover from
|
||
reset by invoking a warmboot rather than complete coldboot. As simple example,
|
||
it may, if desired, preserve high score values, etc.
|
||
The cartridge bus doesn't include a reset signal, so mapper registers would be
|
||
usually left unaffected as well - unless any mappers figure out any ridiculous
|
||
ways to detect resets, for example by examining address signals.
|
||
|
||
SRAM Protection via Reset Button
|
||
The Reset button is also important for some games with battery backed SRAM: The
|
||
consoles cartridge bus becomes unstable during power-off, so that SRAM content
|
||
may get overwritten randomly.
|
||
As workaround, some games prompt the user to hold down the reset button during
|
||
power-off (eg. Maniac Mansion, MMC1). Other games include mappers that can
|
||
enable/disable SRAM, and don't need that trick (eg. Kirby's Adventure, MMC3).
|
||
|
||
Controllers - Arcade Machines
|
||
-----------------------------
|
||
|
||
VS Unisystem
|
||
Arcade Machine with additional coin-detection and DIP-switch inputs. Joysticks
|
||
and Lightguns are accessed slightly different as on NES.
|
||
--> VS System
|
||
|
||
Play Choice 10
|
||
Arcade Machine with additional coin-detection, DIP-switch, and game-select
|
||
inputs. The inputs are controlled by a separate Z80 CPU. More info:
|
||
--> Nintendo Playchoice 10
|
||
|
||
FamicomBox
|
||
For hotel rooms.
|
||
--> FamicomBox
|
||
|
||
Storage Data Recorder
|
||
---------------------
|
||
|
||
Nintendo Data Recorder
|
||
Used to load/save BASIC programs, game positions, or custom edited levels. The
|
||
recorder is badged "Nintendo", but actually it's just an off-the-shelf audio
|
||
tape recorder (with speaker and microphone), connected via two cables
|
||
(load/save) with mono 3.5mm plugs to the "Family Basic Keyboard".
|
||
|
||
Connection
|
||
The Data Recorder connects to the Famicom BASIC Keyboard (which itself connects
|
||
to 15pin controller port).
|
||
--> Controllers - Typewriter Keyboards
|
||
Note: There is also a device called S.D. Station (from Hori) which seems to
|
||
have Headphone and Recorder IN/OUT sockets... unknown if the recorder part is
|
||
identical with the Famicom Keyboard recorder connectors.
|
||
|
||
Software that supports the Data Recorder
|
||
Castle Excellent (supports both Data Recorder and Turbo File)
|
||
Excitebike
|
||
Family Basic
|
||
Lode Runner (unknown HOW to access LOAD/SAVE menu... maybe via keyboard?)
|
||
Mach Rider
|
||
Wrecking Crew
|
||
Note: Accessing the load/save functions may be a difficult task: In Castle
|
||
Excellent it involves using 2nd Joypad, and to confirm selections by this or
|
||
that button (for selecting either Data Recorder, or Turbo File mode).
|
||
|
||
Storage Turbo File
|
||
------------------
|
||
|
||
The Turbo File is an external battery-backed RAM-Disk made by ASCII. The device
|
||
connects to 15pin Famecom expansion port, accordingly, it's been sold only in
|
||
japan, and it's mainly supported by ASCII's own games.
|
||
|
||
Turbofile (AS-TF02)
|
||
Original version, contains 8Kbytes battery backed RAM, and a 2-position PROTECT
|
||
switch, plus a LED (unknown purpose).
|
||
|
||
Turbo File II (TFII)
|
||
Newer version, same as above, but contains 32Kbytes RAM, divided into four
|
||
8Kbyte slots, which can be selected with a 4-position SELECT switch.
|
||
|
||
Turbo File Adapter
|
||
Allows to connect a Turbo File or Turbo File II to SNES consoles. Aside from
|
||
the pin conversion (15pin NES to 7pin SNES), it does additionally contain some
|
||
electronics (for generating a SNES controller ID, and a more complicated
|
||
protocol for entering the data-transfer phase). Aside from storing SNES game
|
||
positions, this can be also used to import NES files to SNES games.
|
||
|
||
Turbo File NES I/O Ports
|
||
4016h.Write.Bit0 = Data.Out (must be same as OLD data when READING data)
|
||
4016h.Write.Bit1 = Reset Address to Offset 0000h
|
||
4016h.Write.Bit2 = Data.Clock
|
||
4017h.Read.Bit2 = Data.In (can be ignored when WRITING data)
|
||
To reset the address to offset 0000h:
|
||
[4016h]=00h ;reset address to zero
|
||
[4016h]=02h ;release reset
|
||
To read a bit (and to write-back the same unchanged value):
|
||
old=[4017h].bit2 ;get old data
|
||
[4016h]=old+06h ;output data and clk=high
|
||
[4016h]=old+02h ;output data and clk=low
|
||
To write a bit:
|
||
[4016h]=new+06h ;output data and clk=high
|
||
[4016h]=new+02h ;output data and clk=low
|
||
Bytes are usually transferred LSB first. Except, the oldest game (Castle
|
||
Excellent from 1986) did use MSB first. The address increments after each 8
|
||
bits. To seek a specific address: Reset address to 0000h, then issue dummy
|
||
reads until the desired address is reached.
|
||
|
||
Turbo File Memory
|
||
The first byte (at offset 0000h) is unused (possibly because that there is a
|
||
risk that other games with other controller access functions may destroy it);
|
||
after resetting the address, one should read one dummy byte to skip the unused
|
||
byte. The used portion is 8191 bytes (offset 0001h..1FFFh). The "filesystem" is
|
||
very simple: Each file is attached after the previous file, an invalid file ID
|
||
indicates begin of free memory (though SOME games seem to keep searching for
|
||
valid IDs even after that point?).
|
||
|
||
Turbo File Fileformat (newer files) (1987 and up)
|
||
Normal files are formatted like so:
|
||
2 ID "AB" (41h,42h)
|
||
2 Filesize (16+N+2) (including title and checksum)
|
||
16 Title in ASCII (terminated by 00h or 01h)
|
||
N Data Portion
|
||
2 Checksum (all N bytes in Data Portion added together)
|
||
|
||
Turbo File Fileformat (old version) (1986)
|
||
The oldest Turbo File game (Castle Excellent from 1986) doesn't use the above
|
||
format. Instead, it uses the following format, without filename, and with
|
||
hardcoded memory offset 0001h..01FFh (511 bytes):
|
||
1 Don't care (should be 00h) ;fixed, at offset 0001h
|
||
2 ID AAh,55h ;fixed, at offset 0002h..0003h
|
||
508 Data Portion (Data, end code "BEDEUTUN", followed by some unused bytes)
|
||
CAUTION:
|
||
The early version has transferred all bytes in reversed bit-order,
|
||
so above ID bytes AAh,55h will be seen as 55h,AAh in newer versions!
|
||
Since the address is hardcoded, Castle Excellent will forcefully destroy any
|
||
other/newer files that are located at the same address. Most newer NES/SNES
|
||
games (like NES Fleet Commander from 1988, and SNES Wizardry 5 from 1993) do
|
||
include support for handling the Castle Excellent file. One exception that
|
||
doesn't support the file is NES Derby Stallion - Zenkoku Ban from 1992.
|
||
|
||
Deleting Files
|
||
Delting files would require to relocate all following files - since the NES has
|
||
only 2K WRAM, this would require to do the relocation in smaller blocks - which
|
||
is simply not supported by most games. So far, the only way for deleting files
|
||
is to remove the batteries (wheras it may take some minutes until the data is
|
||
lost).
|
||
NES Derby Stallion - Zenkoku Ban (1992) does have some limited delete-support:
|
||
If there isn't free enough memory, then it does allow to erase the last-most
|
||
file(s); which can be done without relocations.
|
||
SNES Wizardry 5 (1993) does allow to delete individual files (the SNES has 128K
|
||
WRAM, so relocating the following files is pretty simple).
|
||
|
||
NES Games that do support the Turbo File / Turbo File II
|
||
Best Play Pro Yakyuu (1988) ASCII (J)
|
||
Best Play Pro Yakyuu '90 (1990) (J)
|
||
Best Play Pro Yakyuu II (1990) (J)
|
||
Best Play Pro Yakyuu Special (1992) (J)
|
||
Castle Excellent (1986) ASCII (J) (early access method without filename)
|
||
Derby Stallion - Zenkoku Ban (1992) Sonobe Hiroyuki/ASCII (J)
|
||
Downtown - Nekketsu Monogatari (19xx) Technos Japan Corp (J)
|
||
Dungeon Kid (1990) Quest/Pixel (J)
|
||
Fleet Commander (1988) ASCII (J)
|
||
Haja no Fuuin (19xx) ASCII/KGD (J)
|
||
Itadaki Street - Watashi no Mise ni Yottette (1990) ASCII (J)
|
||
Ninjara Hoi! (J)
|
||
Wizardry - Legacy of Llylgamyn (19xx?) (J)
|
||
Wizardry - Proving Grounds of the Mad Overlord (1987) (J)
|
||
Wizardry - The Knight of Diamonds (1991) (J)
|
||
NES games that do support Turbo File should have a "TF" logo on the cartridge.
|
||
|
||
Plus... (?)
|
||
Searching for: ad17404a4a290109068d1640 (late_nes_recv_joy2_byte opcodes)
|
||
Searching for: ad174029044a4a09068d1640 (newer_nes_recv_joy2_byte opcodes)
|
||
!! Best Keiba - Derby Stallion (1991) Sonobe Hiroyuki/ASCII (J)
|
||
!! Famicom Shougi - Ryuuousen (1991) I'MAX/HOME DATA (J)
|
||
!! Money Game 2 - Kabutochou no Kiseki, The (1989) Sofel Ltd (J)
|
||
! Castlequest (U) US VERSION of Castle Excellent (FUNCTIONAL???)
|
||
! Kunio 8-in-1 [p1] (pirate multicart, probably contains a TF-game?)
|
||
|
||
SNES Games that support Turbo File Adapter & Turbo File Twin in TFII-Mode
|
||
Ardy Lightfoot (1993)
|
||
Derby Stallion II (1994)
|
||
Derby Stallion III (1995) (supports both TFII and STF modes)
|
||
Derby Stallion 96 (1996) (supports TFII and STF and Satellaview-FLASH-cards)
|
||
Derby Stallion 98 (NP) (1998) (supports both TFII and STF modes)
|
||
Down the World: Mervil's Ambition (1994)
|
||
Kakinoki Shogi (1995) ASCII Corporation
|
||
Tactics Ogre - Let Us Cling Together (supports both TFII and STF modes)
|
||
Wizardry 5 - Heart of the Maelstrom (1992) Game Studio/ASCII (JP)
|
||
BS Wizardry 5 (JP) (Satellaview BS-X version)
|
||
Note: The US version of Wizardry 5 (1993) contains 99% of the turbo file
|
||
functions, but lacks one opcode that makes the hardware detection
|
||
nonfunctional. Wizardry 5 was announced to be able to import game positions
|
||
from NES to SNES.
|
||
|
||
Turbo File Schematic
|
||
.--------. 74HC368 .---||--GND .--------. D0-----PORT1.2
|
||
GND---|1A /Y1|---NC | 680pF |4024 Q1|---NC
|
||
OUT2---|2A /Y2|-------------o-----/OUT2 | Q2|---NC
|
||
/OUT2---|3A /Y3|--------[100]--o------------|/CLK Q3|---NC
|
||
GND---|/OE1 | |1000pF | Q4|-------.
|
||
| - - - -| '--||-GND | Q5|---NC |
|
||
OUT1---|4A /Y4|-----------------------o----|RST Q6|---NC |
|
||
OUT0---|5A /Y5|----------. | | Q7|---NC |
|
||
GND---|6A /Y6|---NC | | '--------' |
|
||
/OUT2---|/OE2 | | | .-------------o-----' SRAM 8Kx8
|
||
'--------' | | | | .-------.LH5164L-10
|
||
OUT1-----[10K]---GND | | | .--------. '-|A0 NC|--NC
|
||
OUT2-----[10K]---GND | | | |4040 Q1|---|A1 D0|--D0
|
||
.--------. 74HC573 | | | | Q2|---|A12 D1|--D1
|
||
/OUT2---|G | | | '--|/CLK Q3|---|A7 D2|--D2
|
||
/OUT2---|/OE | | | | Q4|---|A6 D3|--D3
|
||
D7---|D0 Q0|---D6 | '----|RST Q5|---|A4 D4|--D4
|
||
D6---|D1 Q1|---D5 | | Q6|---|A3 D5|--D5
|
||
D5---|D2 Q2|---D4 | | Q7|---|A5 D6|--D6
|
||
D4---|D3 Q3|---D3 | | Q8|---|A11 D7|--D7
|
||
D3---|D4 Q4|---D2 o OFF | Q9|---|A10 /OE|--GND
|
||
D2---|D5 Q5|---D1 \ PROTECT | Q10|---|A9 /WE|--/OUT2
|
||
D1---|D6 Q6|---D0 \ SWITCH | Q11|---|A8 /CE|--/GOOD
|
||
D0---|D7 Q7|-------o o-----------D7 | Q12|---|A2 CE2|--OUT1
|
||
'--------' ON '--------' '-------'
|
||
Plus, a bunch of transistors, resistors, diodes that control supply and
|
||
battery, power LED, and power /GOOD signal. Battery standby supply is
|
||
wired to the SRAM, and also to the 74HC368.
|
||
Note: Turbo File II uses 32Kx8 SRAM which lacks CE2 pin, so schematic
|
||
may be a bit different; and of course, A13 and A14 are somehow wired
|
||
to the 4-position switch for 8K bank selection.
|
||
|
||
Storage Battle Box
|
||
------------------
|
||
|
||
The Battle Box from IGS is an external storage device with 512 byte capactity.
|
||
--> Storage Battle Box I/O Access
|
||
--> Storage Battle Box Filesystem
|
||
|
||
Battle Box Games
|
||
Armadillo (J) 199x
|
||
Battle Stadium - Senbatsu Pro Yakyuu (J) 1990 IGS
|
||
J-League Fighting Soccer - The King of Ace Strikers (J) 1993 IGS
|
||
Seiryaku Simulation - Inbou no Wakusei - Shancara (J) 1992 IGS
|
||
|
||
Battle Box Schematic (BB-10)
|
||
.-------.
|
||
VCC--||--GND GND--|RES Q|---------------------------.
|
||
GND--|SET | 4027 TOSHIBA | TOSHIBA
|
||
PORT1.CLK--[330]--o------|CLK | Dual J-K TC89102P | TC89102P
|
||
| .---|J | flip-flop .---------. | .---------.
|
||
| | .-|K /Q|-------------|/CS | '---|/CS |
|
||
| | | '-------' VCC---|ORG |-------|ORG |
|
||
OUT0------------- | -o-o-----------------------|/CLK |-------|/CLK |
|
||
| .-------. | | | |
|
||
GND-|>|-PORT1.3 | GND--|RES Q|-------------|DI |-------|DI |
|
||
GND-|>|-PORT1.4 | GND--|SET | .---|DO |-------|DO |
|
||
GND-|>|-OUT0 '------|CLK | | '---------' '---------'
|
||
GND-|>|-PORT1.CLK VCC--|J | '----------------PORT1.3
|
||
VCC--|K /Q|--------------------------PORT1.4
|
||
Components: '-------'
|
||
1x 4027 (dual J-K flip-flops)
|
||
2x TOSHIBA TC89102P (two 256x8 bit EEPROMs) (=512 bytes total capacity)
|
||
4x Z-diodes 6.2V, 1x resistor 330 ohm, 1x capacitor 100nF, 15pin connector
|
||
Note: ORG=VCC selects 128x16bit chip mode (ORG=GND would be 256x8bit mode)
|
||
|
||
Storage Battle Box I/O Access
|
||
-----------------------------
|
||
|
||
Battle Box
|
||
[4016h].W.Bit0 --> CLK to EEPROM (and, when set, enable chipselect toggle)
|
||
[4017h].R --> toggle DATA to EEPROM (always)
|
||
[4017h].R --> toggle 1st/2nd EEPROM chipselect (when [4016h].W.Bit0=1)
|
||
[4017h].R.Bit3 <-- DATA from EEPROM
|
||
[4017h].R.Bit4 <-- DATA to EEPROM (status of current toggled output value)
|
||
|
||
Commands
|
||
Binary Toshiba NES
|
||
10000000 01h 80h --> Read
|
||
01100000 06h 60h --> Program
|
||
00110000 0Ch 30h --> Chip Erase
|
||
10110000 0Dh B0h --> Busy Monitor
|
||
10010000 09h 90h --> Erase/Write Enable
|
||
11010000 0Bh D0h --> Erase/Write Disable
|
||
|
||
battle_box_command(cmd,addr,data)
|
||
if cmd<>B0h then battle_box_command(B0h,addr,0) ;-
|
||
[4016h]=01h ;OUT0=1 ;\start transfer,
|
||
dummy=[4017] ;toggle chipsel ; toggle chipsel
|
||
if (addr AND 1)<>battle_box_chipsel then dummy=[4017] ; depending on addr.0
|
||
battle_box_chipsel = (addr AND 1) ;/
|
||
battle_box_send_byte(((addr/2) AND FEh)+(addr AND 01h)) ;\send addr/cmd
|
||
battle_box_send_byte(cmd+addr/200h) ;/
|
||
if cmd=B0h ;Busy Mode ;\wait busy (if any)
|
||
wait until battle_box_recv_bit=0 ;/
|
||
if cmd=80h ;Read Word ;\
|
||
data1st=battle_box_recv_byte ; read data (if any)
|
||
data2nd=battle_box_recv_byte ;/
|
||
if cmd=60h ;Write Word ;\
|
||
battle_box_send_byte(data1st) ; write data (if any)
|
||
battle_box_send_byte(data2nd) ;/
|
||
dummy=[4017h] ;toggle chipsel ;\finish transfer
|
||
[4016h]=00h ;OUT0=0 ;/
|
||
|
||
battle_box_detect_which_chip_is_selected:
|
||
battle_box_command(80h,000h,data) ;read ID ("B"=42h, or "X"=58h) from addr 0
|
||
battle_box_chipsel=battle_box_chipsel XOR data.bit3
|
||
|
||
battle_box_send_byte(data)
|
||
data=data XOR FFh ;-invert
|
||
for i=7 downto 0
|
||
[4016h]=00h ;OUT0=0
|
||
dummy=[4017h] ;toggle DTA.OUT and get output level
|
||
if dummy.bit4<>data.bit(i) then dummy=[4017h] ;toggle DTA.OUT
|
||
[4016h]=01h ;OUT0=1
|
||
next i
|
||
|
||
battle_box_recv_byte:
|
||
for i=7 downto 0
|
||
data.bit(i)=battle_box_recv_bit
|
||
next i
|
||
data=data XOR FFh ;-invert
|
||
|
||
battle_box_recv_bit:
|
||
[4016h]=00h ;OUT0=0
|
||
dummy=[4017h] ;read DATA
|
||
bit=dummy.bit3
|
||
[4016h]=01h ;OUT0=1
|
||
|
||
Notes
|
||
The Program command seems to be able to rewrite data without needing any prior
|
||
Erase.
|
||
After power-on, wait 1ms before accessing the chip. Then send Erase/Write
|
||
Enable or Disable as first command.
|
||
|
||
Storage Battle Box Filesystem
|
||
-----------------------------
|
||
|
||
Battle Box Filesystem
|
||
Overall Format
|
||
000h..005h Root Header (6 bytes)
|
||
006h..xxxh File(s) (variable size) (max 1F9h bytes)
|
||
yyyh First Free byte (1Ah) (1 byte)
|
||
zzzh..1FFh Unused Space (FFh filled or garbage or so)
|
||
Root Header (6 bytes)
|
||
00h ID "B" for Chip 1 (42h)
|
||
01h ID "X" for Chip 2 (58h)
|
||
02h 00h ;\maybe total chip size 0200h ?
|
||
03h 02h ;/
|
||
04h LSB ;\address of first FREE byte (ie. address of the 1Ah byte)
|
||
05h MSB ;/
|
||
File Format (0Dh+N+02h bytes per file)
|
||
00h 42h "B" ;-File ID (42h="B"=Used File) (or 1Ah=First Free Byte)
|
||
01h SIZE.LSB ;\Total Filesize (including File ID and Checksum)
|
||
02h SIZE.MSB ;/
|
||
03h GAME.LSB ;\Game ID (0000h=Stadium, 0001h=Armadillo, 0002h=Soccer)
|
||
04h GAME.MSB ;/
|
||
05h GAME.TITLE ;-Game Title (ASCII, 8 chars) (eg. "F SOCCER" or "RMADILLO")
|
||
0Dh.. file body ;-Body (total_filesize minus 0Fh bytes)
|
||
... CHK.LSB ;\Checksum (all bytes in BODY added together)
|
||
... CHK.MSB ;/
|
||
The existing games seem to allow only two files (if there are already two
|
||
files, they do erase a file before saving a new file; this is done even if
|
||
there would be enough free space for a third file).
|
||
|
||
Battle Box Logical Byte Order
|
||
Offset Physical Content (Usage)
|
||
000h 1st byte of 1st Word of Chip 1 (ID Byte: "B" for Chip 1)
|
||
001h 1st byte of 1st Word of Chip 2 (ID Byte: "X" for Chip 2)
|
||
002h 2nd byte of 1st Word of Chip 1 (00h)
|
||
003h 2nd byte of 1st Word of Chip 2 (02h)
|
||
004h 1st byte of 2nd Word of Chip 1 (address LSB of first free byte)
|
||
005h 1st byte of 2nd Word of Chip 2 (address MSB of first free byte)
|
||
006h 2nd byte of 2nd Word of Chip 1 (File ID: "B") (or 1Ah if no file)
|
||
007h 2nd byte of 2nd Word of Chip 2 (File Size LSB) (or unused)
|
||
... (...)
|
||
1FCh 1st byte of 128th Word of Chip 1
|
||
1FDh 1st byte of 128th Word of Chip 2
|
||
1FEh 2nd byte of 128th Word of Chip 1
|
||
1FFh 2nd byte of 128th Word of Chip 2
|
||
Emulators should use the same logical byte order (so that data and ASCII
|
||
filenames show up correctly in .sav files). However, games may more or less
|
||
randomly initialize the "B" and "X" ID bytes, so Chip 1 and Chip 2 may be
|
||
exchanged.
|
||
|
||
Bit Order
|
||
The NES software is doing all transfers in reversed bit-order: Namely, commands
|
||
are opposite as in datasheet (eg. NES: 80h=Read, Toshiba: 01h=Read). Data is
|
||
also reversed (read-reversion and write-reversion are compensating themselves).
|
||
The 7bit addresses are also reversed (data is written to shuffled-addresses,
|
||
but de-shuffled on reading). The 7bit address should be normally followed by a
|
||
padding bit (with value "0"), the NES software seems to replace that padding
|
||
bit by the 1st/2nd chipselect bit (maybe somehow intended to allow to use one
|
||
chip with 8bit-address intead of two chips with 7bit address). Moreover, the
|
||
NES software puts additional address bits into unused locations of the command
|
||
byte (maybe also somehow intended for expansion to chips with more memory).
|
||
|
||
Hori Game Repeater
|
||
------------------
|
||
|
||
The Game Repeater (GR-7) from Hori is a device that can record and playback
|
||
controller data. The data is stored in 16Kbytes of SRAM (assuming that many
|
||
games read 1 byte per frame, this allows to record about 5 minutes). The SRAM
|
||
isn't battery backed, but, for permanent storage, the SRAM content can be
|
||
loaded/saved to external tape recorder.
|
||
The device can be used to create "movies" that play back a whole level, and it
|
||
may be also useful for recording short button-sequences for getting through
|
||
difficult sections of a game. The playback function may obviously fail if a
|
||
game contains random elements (such like starting with different random seeds).
|
||
The recorded data is taken from the controller input, so it should be
|
||
impossible to <output> data from the console (for using the SRAM as expansion
|
||
memory or writing game positions to tape) (unless the device should happen to
|
||
have support for doing that via another controller pin?).
|
||
|
||
Chipset/Components
|
||
1x Toshiba N (42pin 4bit single-chip CPU: ROM:2048x8, RAM:128x4)
|
||
2x Toshiba TC5563APL-15 (28pin static ram: RAM:8192x8)
|
||
1x TC4011BP 14pin (quad NAND)
|
||
1x TC4062UBP ? (or is it "8"UBP?) 14pin
|
||
1x TC4078BP 16pin (is that "8"BP?)
|
||
1x TC4021BP 16pin (8bit parallel-in, serial-out shift register)
|
||
1x NEC D4094BC ? 16pin (8bit serial-in, parallel-out shift register)
|
||
3x small buttons (tape recorder LOAD,SAVE,VERIFY)
|
||
1x bigger button (sampling START)
|
||
2x two-position switches (REPEAT/RECORD, and STOP/STANDBY)
|
||
2x small LEDs (tape recorder LOAD,SAVE)
|
||
2x cassette connector (tape recorder LOAD,SAVE)
|
||
1x male dsub 15pin connector (to famicom console)
|
||
1x female dsub 15pin connector (to external joystick)
|
||
1x DC input socket (from power supply)
|
||
1x DC output cable (to famicom console)
|
||
1x 7805 ? voltage converter
|
||
1x unknown thing/unknown purpose (on front side) (connector? dip-switches?)
|
||
Plus one XTAL, plus resistors/diodes/capacitors. There's no battery on the SRAM
|
||
chips.
|
||
|
||
Headphones
|
||
----------
|
||
|
||
Headphones can be connected to the 15pin Famicom Expansion Port.
|
||
S.D. Station (Hori) (adaptor for Headphones and Tape Recorder)
|
||
Joycard Sanusui SSS (Hudson) (with adapter for headphones)
|
||
Multi Adapter AX-1 (headphones plus auto-fire or so)
|
||
LaserScope/Gun Sight (Konami) (headset: headphones + voice-activated zapper)
|
||
|
||
R.O.B. (Robotic Operating Buddy)
|
||
--------------------------------
|
||
|
||
R.O.B. (Robotic Operating Buddy) is a small wireless plastic robot, about 24 cm
|
||
in height. Command transmission from console to robot is done via flashing TV
|
||
frames. There is no direct feedback from the robot to the console (except that,
|
||
in Gyromite, the robot can be maneuvered to push buttons on joypad 2).
|
||
|
||
R.O.B. Games
|
||
The Robot is used by two games:
|
||
Gyromite (Robot Gyro) (1985) (JP) (US) (EU)
|
||
Stack Up (Robot Block) (1985) (JP) (US)
|
||
Gyromite is a platform game in which the robot must be used to unlock red/blue
|
||
barriers (by dropping heavy spintops on the red/blue trays). In Stack-Up, one
|
||
must stack colored plastic blocks in a specific order.
|
||
|
||
Hardware Accessories
|
||
General Accessories:
|
||
Sun-glasses (dark transparent cover, for compensating brightness of the TV)
|
||
4 AA batteries (for powering the robot)
|
||
Gyromite Accessories:
|
||
2 robot-gloves with zig-zagged surface (for holding the spinning gyros)
|
||
2 gyros (heavy spintops that can be used to depress red/blue trays)
|
||
2 red/blue trays (with levers to push buttons on joypad 2)
|
||
2 black trays (for depositing gyros when not using them)
|
||
1 spinner (accellerates the gyros; for stabilizing them on red/blue trays)
|
||
1 battery (for powering the spinner motor)
|
||
Stack-Up Accessories:
|
||
2 robot-gloves with flat rubber-coated surface (for holding blocks)
|
||
5 differently colored stack-able blocks (to be arranged in specific orders)
|
||
5 gray trays (for depositing the blocks on them)
|
||
|
||
Drawings
|
||
--> R.O.B. Technical Drawings
|
||
|
||
Robot Motors
|
||
Left/Right Motor five stopping points (60'/step, 240' total range)
|
||
Up/Down Motor six stopping points (1.4 cm/step, 7 cm total range)
|
||
Open/Close Motor two stopping points (7 cm/step, 7 cm total range)
|
||
|
||
CRT-Signals
|
||
Command <------- Command Transfer Phase (13 Frames) -------->
|
||
Left xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.GGG.GGG.___.GGG.___.xxx.xxx
|
||
Right xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.___.GGG.___.GGG.___.xxx.xxx
|
||
Up xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.GGG.GGG.___.GGG.___.xxx.xxx
|
||
Down xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.___.GGG.GGG.GGG.___.xxx.xxx
|
||
Open xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.___.GGG.GGG.GGG.___.xxx.xxx
|
||
Close xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.GGG.GGG.GGG.GGG.___.xxx.xxx
|
||
Test ___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___
|
||
Picture xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx
|
||
Whereas, "xxx"=Picture Frame, "___"=Black Frame, "GGG"=Green Frame "."=Vblank.
|
||
|
||
Joypad 1 (user input)
|
||
In Gyromite, the joypad buttons are assigned as follows (in one game mode, the
|
||
joypad is also used to move the player character on the screen, in that mode,
|
||
Start-button must be pressed prior to each robot-command):
|
||
Left/Right --> Turn Shoulders & Arms & Shaft Left/Right (in 60' steps)
|
||
Up/Down --> Move Shoulders & Arms Up/Down (in 1.4cm steps)
|
||
Button A --> Open Arms (Release)
|
||
Button B --> Close Arms (Grab)
|
||
Stack-Up uses some sort of GUI to enter commands, so there's no direct relation
|
||
between joypad-buttons and motors in that game.
|
||
|
||
Joypad 2 (attached to Gyromite Trays, for feedback from robot to console)
|
||
In Gyromite, dropping spintops on trays results in following feedback:
|
||
Red-Tray (Slot 2) ---> lever pushes B-Button on Joypad 2
|
||
Blue-Tray (Slot 3) ---> lever pushes A-Button on Joypad 2
|
||
There's no automatic feedback in Stack-Up (the user must manually push
|
||
Start-Button on Joypad 1 once when having finished a level).
|
||
|
||
R.O.B. Technical Drawings
|
||
-------------------------
|
||
|
||
Robot (Side View)
|
||
|
||
Sun- Eyes (with CRT light sensor)
|
||
glasses |
|
||
| | LED (glows when sensing CRT signals)
|
||
_ __o____
|
||
| --> |-| |_ <------ Head (to be aimed at TV Set)
|
||
|_ |-|_________|
|
||
_#_ <-------- Inner Shaft (holds head, not rotating)
|
||
| |
|
||
Hand | | <-------- Outer Shaft (rotates alongside with shoulders)
|
||
_ Arm __|___|____
|
||
| |======| | <---- Shoulders (moves up/down along outer shaft)
|
||
|_|======|___________|----.
|
||
| | \
|
||
Slot2 | | Slot1 \ <-- Spiral Cable (from base to shoulders)
|
||
Slot3 | | | | Pwr \
|
||
\ ____|__|___|__|__|_ \
|
||
|: # : # :|-'
|
||
|:________:________:| <---- Base
|
||
|
||
|
||
Robot Shoulders/Arms (Top View)
|
||
__ _______________ __ __ _______________ __
|
||
/ | Shaft | \ Shoulder / | Shaft | \
|
||
| | ___ | | (top-view) | | ___ | |
|
||
|_ / | | \ _| |_ / | | \ _|
|
||
/ || |___| || \ | || |___| || |
|
||
/ | \_______________/ | \ | \\_______________// |
|
||
/ / \ \ | |_ _| |
|
||
\ \ Open/Spread / / Arms |___ \ Close / ___|
|
||
\ \ (Release) / / \ \ (Grab) / /
|
||
| | | | \ \ / /
|
||
_|___|_ _|___|_ _\___\_ _/___/_
|
||
| | O | | | | O | | Hands | | O | | | | O | |
|
||
|_|___|_| |_|___|_| |_|___|_| |_|___|_|
|
||
|
||
Robot Base (Top View)
|
||
|
||
Power Switch ----------. /////// <----- Spiral Cable
|
||
(for four AA batteries) _____|_____ (to shoulders)
|
||
_| |_| |_
|
||
/ | | \
|
||
/ | | \
|
||
Accessory Slot 5 --> /5 | | 1\ <-- Accessory Slot 1
|
||
(for stack-up tray, / / ___ \ \ (for stack-up tray,
|
||
or gyromite / | | | | \ or gyromite spinner)
|
||
black tray) \ | |___| | /
|
||
\ \ Shaft / /
|
||
Accessory Slot 4 --> \4 | | 2/ <-- Accessory Slot 2
|
||
(for stack-up tray, \ | | / (for stack-up tray,
|
||
or gyromite \_| __3__ |_/ or gyromite red-tray
|
||
black tray) |__| ^ |__| with lever to B-Button)
|
||
|
|
||
Accessory Slot 3 (for stack-up tray,
|
||
or gyromite blue-tray with lever to A-Button)
|
||
|
||
Stack-Up Accessories (five Blocks, five Trays, two Gloves)
|
||
__ __
|
||
| \_/ | <------ white block |Arm| Block |Arm|
|
||
|__ __| | | _ __ _ | |
|
||
| \_/ | <------ red block _|___|_| # / \ # |_|___|_
|
||
|__ __| | | O | | # | | # | | O | |
|
||
.===\_/===. <------ tray (gray ring) |_|___|/ # | | # \|___|_|
|
||
\\ Hand |__# \__/ #__| Hand
|
||
\\ <------ to slot on base unit Glove Glove
|
||
|
||
Gyromite Accessories (two gyros, two gloves, one spinner, four trays)
|
||
____
|
||
Grab here ------------> (____) |Arm| Gyro |Arm|
|
||
(with robot claws) | | | | _ _ Axis _ | |
|
||
| | <-- Axis _|___|_| | / /| |_|___|_
|
||
| | | | O | | |/ /\ \| | | O | |
|
||
Gyro | | (Spintop) |_|___|/ |\ \/ /| \|___|_|
|
||
________|__|________ Hand |__|_\ \|__| Hand
|
||
Disk ---------> (____________________) Glove Glove
|
||
(side view) | |
|
||
| |
|
||
\/
|
||
___ ___ ___ ___ __
|
||
| | | | (__ | | __) Lever | |
|
||
| | | | || || _ _ Lever Axis | |
|
||
|____\/____| | \/ | \\______//___________________ | |
|
||
_|______ | |____| \______/__________________ O\_ | |
|
||
| Motor \_____|_ | | | | / \___|(| |
|
||
| with Battery | | | | |_________________/_/______| |_
|
||
|________________| |__| |__|________________________|_|__|_|
|
||
Spinner Black Trays Blue/Red Trays Joypad
|
||
|
||
Cartridges and Mappers
|
||
----------------------
|
||
|
||
General Cartridge Info
|
||
--> Cartridge Overview
|
||
--> Cartridge ROM-Image File Formats
|
||
--> Cartridge IRQ Counters
|
||
--> Cartridge Bus Conflicts
|
||
--> Cartridge Cicurity Chip (CIC) (Lockout Chip)
|
||
--> Cartridge Cheat Devices
|
||
--> Cartridge Pin-Outs
|
||
--> Cartridge Shell Dimensions
|
||
|
||
NES Mappers (Numbers as used in .NES fileformat)
|
||
--> Mapper 0: NROM - No Mapper (or unknown mapper)
|
||
--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT
|
||
--> Mapper 2: UNROM - PRG/16K
|
||
--> Mapper 3: CNROM - VROM/8K
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc.
|
||
--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
--> Mapper 7: AOROM - PRG/32K, Name Table Select
|
||
--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ
|
||
--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH
|
||
--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH
|
||
--> Mapper 11: Color Dreams - PRG/32K, VROM/8K
|
||
--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ
|
||
--> Mapper 13: CPROM - 16K VRAM
|
||
Mapper 14: Reportedly SL1632
|
||
--> Mapper 15: X-in-1 - PRG/32K/16K, NT
|
||
--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM
|
||
(above with 24C02)
|
||
--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT
|
||
--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND
|
||
--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND
|
||
--> Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT
|
||
--> Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ)
|
||
--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 28: Action 53 homebrew X-in-1
|
||
--> Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT
|
||
--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ
|
||
--> Mapper 34: Nina-1 - PRG/32K, VROM/4K
|
||
(above and/or BNROM ?)
|
||
Mapper 37: Reportedly ZZ
|
||
Mapper 39: Reportedly BMC Study & Game 32-in-1
|
||
--> Mapper 40: FDS-Port - Lost Levels
|
||
--> Mapper 41: Caltron 6-in-1
|
||
--> Mapper 42: FDS-Port - Mario Baby
|
||
--> Mapper 43: X-in-1
|
||
--> Mapper 44: 7-in-1 MMC3 Port A001h
|
||
--> Mapper 45: X-in-1 MMC3 Port 6000hx4
|
||
--> Mapper 46: 15-in-1 Color Dreams
|
||
(above called "Rumble Station"?)
|
||
--> Mapper 47: 2-in-1 MMC3 Port 6000h
|
||
--> Mapper 48: Taito TC190V
|
||
--> Mapper 49: 4-in-1 MMC3 Port 6xxxh
|
||
--> Mapper 50: FDS-Port - Alt. Levels
|
||
--> Mapper 51: 11-in-1
|
||
--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM
|
||
Mapper 53: Reportedly Supervision 16-in-1
|
||
Mapper 54: Reportedly BMC Noveldiamond 9999999-in-1
|
||
Mapper 55: Reportedly BTL Mario1-Malee2
|
||
--> Mapper 56: Pirate SMB3
|
||
--> Mapper 57: 6-in-1
|
||
--> Mapper 58: X-in-1
|
||
Mapper 59: Reportedly ..
|
||
Mapper 60: Reportedly ..
|
||
--> Mapper 61: 20-in-1
|
||
--> Mapper 62: X-in-1
|
||
--> Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ
|
||
--> Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 66: GNROM - PRG/32K, VROM/8K
|
||
--> Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ
|
||
--> Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM
|
||
(Nantettatte Baseball Double Cassette System for mapper 68)?
|
||
--> Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ
|
||
--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT
|
||
--> Mapper 71: Camerica - PRG/16K
|
||
--> Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K
|
||
--> Mapper 73: Konami VRC3 - PRG/16K, IRQ
|
||
--> Mapper 74: Whatever MMC3-style
|
||
--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT
|
||
--> Mapper 76: Namco 109 - PRG/8K, VROM/2K
|
||
--> Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K
|
||
--> Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K
|
||
--> Mapper 79: AVE Nina-3 - VROM/8K
|
||
--> Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT
|
||
--> Mapper 81: AVE Nina-6
|
||
--> Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K
|
||
--> Mapper 83: Cony
|
||
--> Mapper 84: Whatever
|
||
--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K
|
||
--> Mapper 87: Jaleco/Konami 16K VROM - VROM/8K
|
||
--> Mapper 88: Namco 118
|
||
--> Mapper 89: Sunsoft Early - PRG/16K, VROM/8K
|
||
--> Mapper 90: Pirate MMC5-style
|
||
--> Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ
|
||
--> Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K
|
||
--> Mapper 93: 74161/32 - PRG/16K
|
||
--> Mapper 94: 74161/32 - PRG/16K
|
||
--> Mapper 95: Namcot MMC3-Style
|
||
--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH
|
||
--> Mapper 97: Irem - PRG HI
|
||
--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K)
|
||
--> Mapper 100: Whatever
|
||
Mapper 101: Reportedly ...
|
||
--> Mapper 105: X-in-1 MMC1
|
||
Mapper 107: Reportedly Magicseries
|
||
--> Mapper 112: Asder - PRG/8K, VROM/2K/1K
|
||
--> Mapper 113: Sachen/Hacker/Nina
|
||
--> Mapper 114: Super Games
|
||
--> Mapper 115: MMC3 Cart Saint
|
||
--> Mapper 116: Whatever
|
||
--> Mapper 117: Future
|
||
--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ
|
||
--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ
|
||
--> Mapper 122: Whatever
|
||
Mapper 123: Reportedly H2288
|
||
Mapper 132: Reportedly TXC 22211
|
||
--> Mapper 133: Sachen
|
||
Mapper 137: Reportedly S8259D
|
||
Mapper 138: Reportedly S8259C
|
||
Mapper 139: Reportedly S8259B
|
||
Mapper 140: Reportedly Jaleco JF-xx
|
||
Mapper 141: Reportedly S8259A
|
||
Mapper 142: Reportedly KS 202
|
||
Mapper 143: Reportedly TCA01
|
||
Mapper 144: Reportedly AGCI 50282
|
||
Mapper 145: Reportedly SA72007
|
||
Mapper 146: Reportedly SA0161M
|
||
Mapper 147: Reportedly TCU01
|
||
Mapper 148: Reportedly SA0037
|
||
Mapper 149: Reportedly SA0036
|
||
Mapper 150: Reportedly S74LS37AN
|
||
--> Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards
|
||
--> Mapper 152: Whatever
|
||
(above Bandai 74161/32+MIRR)
|
||
Mapper 153: No info (reportedly a variant of Mapper 16) BANDAI+WRAM
|
||
Mapper 154: Reportedly NAMCOT 118 +A0.D6.MIRR
|
||
Mapper 155: Reportedly MMC1A
|
||
Mapper 156: Reportedly DAOU 306
|
||
Mapper 157: No info (reportedly a variant of Mapper 16) BANDAI+BARCODE (Datach)
|
||
Mapper 159: No info (reportedly a variant of Mapper 16) BANDAI+24C01
|
||
--> Mapper 160: Same as Mapper 90
|
||
--> Mapper 161: Same as Mapper 1
|
||
Mapper 163: Reportedly NANJING
|
||
Mapper 164: Reportedly WAIXING / MARS PRODUCTION
|
||
Mapper 165: Reportedly WAIXING SHENGHUO HUIZHANG 2
|
||
Mapper 166: Reportedly SUBOR (Russian)
|
||
Mapper 167: Reportedly SUBOR (Chinese)
|
||
--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ
|
||
Mapper 169: Reportedly N625092
|
||
Mapper 170: Reportedly FUJIYA NROM +SECURITY
|
||
Mapper 171: Reportedly KAISER KS7058
|
||
Mapper 172: Reportedly IDEA-TEK CNROM +SECURITY
|
||
--> Mapper 180: Nihon Bussan - PRG HI
|
||
(above UNROM M5)
|
||
--> Mapper 182: Same as Mapper 114
|
||
(Mapper 182: Reportedly HOSENKAN ELECTRONICS)
|
||
Mapper 183: Reportedly BTL SHUI GUAN PIPE
|
||
--> Mapper 184: Sunsoft - VROM/4K
|
||
--> Mapper 185: VROM-disable
|
||
Mapper 186: Reportedly SBX
|
||
Mapper 187: No Info --> Mapper 187: Reportedly BTL SFZ297/KOF96/S3DB6
|
||
--> Mapper 188: UNROM-reversed
|
||
(Mapper 188: Reportedly BANDAI KARAOKE STUDIO)
|
||
--> Mapper 189: MMC3 Variant
|
||
(Mapper 189: Reportedly YOKOSOFT / TXC)
|
||
Mapper 191: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.2K
|
||
Mapper 192: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.4K
|
||
Mapper 193: Reportedly MEGA SOFT (NTDEC)
|
||
Mapper 194: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.2K (alt)
|
||
Mapper 195: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.4K (alt)
|
||
Mapper 196: Reportedly MMC3 +A0/A2
|
||
Mapper 197: Reportedly SUPER FIGHTER III
|
||
Mapper 198: Reportedly WAIXING MMC3 +XRAM.4K
|
||
Mapper 199: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.8K
|
||
Mapper 200: Reportedly BMC 1200/36-IN-1
|
||
Mapper 201: Reportedly BMC 21/8-IN-1
|
||
Mapper 202: Reportedly BMC 150-IN-1
|
||
Mapper 203: Reportedly BMC 35-IN-1
|
||
Mapper 204: Reportedly BMC 64-IN-1
|
||
Mapper 205: Reportedly BMC 15/3-IN-1
|
||
Mapper 206: Reportedly DE1ROM (aka DxROM, aka pre-MMC3)
|
||
Mapper 207: Reportedly TAITO X-005 +MIRR
|
||
Mapper 208: Reportedly GOUDER BTL SF4
|
||
Mapper 209: Reportedly J.Y.COMPANY +EXT.MIRR.CTRL
|
||
Mapper 210: Reportedly NAMCOT
|
||
Mapper 211: Reportedly J.Y.COMPANY +EXT.MIRR.ON
|
||
Mapper 212: Reportedly BMC SUPER HIK 300-IN-1
|
||
Mapper 213: Reportedly BMC 9999999-IN-1
|
||
Mapper 214: Reportedly BMC SUPER GUN 20-IN-1
|
||
Mapper 215: Reportedly BMC SUPER 308 3-IN-1 / M-E3
|
||
Mapper 216: Reportedly RCM MAGIC JEWELRY 2
|
||
Mapper 217: Reportedly BMC SPC009
|
||
--> Mapper 218: Nocash Single-Chip
|
||
--> Mapper 222: Dragon Ninja
|
||
--> Mapper 225: X-in-1
|
||
--> Mapper 226: X-in-1
|
||
--> Mapper 227: X-in-1
|
||
--> Mapper 228: X-in-1 Homebrewn
|
||
--> Mapper 229: 31-in-1
|
||
--> Mapper 230: X-in-1 plus Contra
|
||
--> Mapper 231: 20-in-1
|
||
--> Mapper 232: 4-in-1 Quattro Camerica
|
||
--> Mapper 233: X-in-1 plus Reset
|
||
--> Mapper 234: Maxi-15
|
||
(Mapper 234: Reportedly AVE D-1012)
|
||
Mapper 235: Reportedly BMC GOLDEN GAME 150/260-IN-1
|
||
Mapper 236: Reportedly BMC 800/70-IN-1
|
||
--> Mapper 240: C&E/Supertone - PRG/32K, VROM/8K
|
||
--> Mapper 241: X-in-1 Education
|
||
(Mapper 241: Reportedly MXMDHTWO / TXC)
|
||
--> Mapper 242: Waixing - PRG/32K, NT
|
||
--> Mapper 243: Sachen Poker - PRG/32K, VROM/8K
|
||
(Mapper 243: Reportedly SACHEN 74LS374N)
|
||
--> Mapper 244: C&E - PRG/32K, VROM/8K
|
||
(Mapper 244: Reportedly C&E DECATHLON)
|
||
Mapper 245: No Info (seems to be some sort of MMC3 variant)
|
||
(Mapper 245: Reportedly WAIXING MMC3 +EX.PRG)
|
||
--> Mapper 246: C&E - PRG/8K, VROM/2K, SRAM
|
||
(Mapper 246: Reportedly C&E PHONE SERM BERM)
|
||
Mapper 248: No Info
|
||
Mapper 249: No Info --> Mapper 249: Reportedly WAIXING MMC3 +EX.PRG/CHR
|
||
Mapper 250: No Info --> Mapper 250: Reportedly NITRA MMC3
|
||
Mapper 251: No Info
|
||
Mapper 252: No Info --> Mapper 252: Reportedly WAIXING SAN GUO ZHI
|
||
Mapper 254: No Info --> Mapper 254: Reportedly BTL PIKACHU Y2K
|
||
--> Mapper 255: X-in-1 - (Same as Mapper 225)
|
||
XXX NROM-368 variant of NROM (and similar CPROM, CNROM variants)
|
||
Note: Mapper numbers in range 0..255 seem to be ALL used by now.
|
||
Mapper numbers 256..4095 can be defined in the "NES 2.0" file format.
|
||
|
||
More Info
|
||
A still very incomplete (but growing) mapper list can be found here:
|
||
http://wiki.nesdev.com/w/index.php/Category:INES_Mappers
|
||
(when inventing new mapper numbers, best include them in above list)
|
||
There is some very detailed info on Kevin Horton's kevtris pages, which are,
|
||
unfortunately very messy. I think, most of the info is lost in chaos.
|
||
A lot of mappers are hiding here:
|
||
http://kevtris.org/mappers/mappers.html ;<-- secret undocumented link!?
|
||
For some reason, this page also hides some mappers:
|
||
http://kevtris.org/nes/mappers.html ;<-- official link on NES page!?
|
||
Plus some completely unlinked pages for konami mappers, eg. for VRC 7:
|
||
http://kevtris.org/nes/vrcvii.txt ;<-- or vrcvi for VRC 6
|
||
And, there might be a couple of further mapper pages hiding elsewhere.
|
||
|
||
Cartridge Overview
|
||
------------------
|
||
|
||
Standard Mappers
|
||
There are more than hundred different mappers, though most are unimportant, the
|
||
standard types are Mapper 0,1,2,3,4 for ROM-cartridges. And Mapper 20 for
|
||
Floppy disks.
|
||
Type Games Percent
|
||
Mapper 0 (NROM) 446 12.5%
|
||
Mapper 1 (MMC1) 723 20.3%
|
||
Mapper 2 (UNROM) 397 11.2%
|
||
Mapper 3 (CNROM) 273 7.7%
|
||
Mapper 4 (MMC3) 784 22.1%
|
||
Mapper 20 (FDS) ? x.x%
|
||
Other Mappers 932 26.2%
|
||
Total 3555 100.0%
|
||
Other mapper types are used by less than 2% per type, though together they make
|
||
up 26.2%.
|
||
|
||
Non-standard Mappers
|
||
Some mappers like MMC5 have been used only in a few newer cartridges. Several
|
||
third-party companies (Konami, Irem, Jaleco, Bandai, Sunsoft, etc.) have
|
||
developed their own mappers which are used only for their own games. That
|
||
mappers may be important to play specific games, though they are often used
|
||
only by 1-2 titles.
|
||
Also, there have been various pirate / multi-game cartridges manufactured,
|
||
containing modified ROM-images with custom mapper circuits, these mappers are
|
||
completely unimportant since the original games used standard mappers.
|
||
|
||
Maximum manufactured ROM Size
|
||
The largest single NES game that I know of is Dragonquest 4 / Dragon Warrior 4
|
||
(XXX that's wrong). It has 1 megabyte of program ROM. Also, the Japanese game
|
||
Metal Slader Glory has 512K of PRG and 512K of CHR ROM, making it also a full
|
||
megabyte. Several pirate/unlicenced Famicom games are also pretty large.
|
||
|
||
Minimum manufactured ROM Size
|
||
Although the .NES fileformat deems 16K PRG ROM games as the minimum, there have
|
||
been some 8K games manufactured, such as Galaxian. Later on, skilled
|
||
programmers have learned to squeeze better code into even less memory, but
|
||
nowadays most are probably dead.
|
||
|
||
Banking Granularity
|
||
PRG ROM is usually split into banks of 8K, 16K, or 32K, a few mappers like MMC5
|
||
also have smaller 1K SRAM banks. VROM is usually split into banks of 1K, 2K,
|
||
4K, or 8K.
|
||
|
||
Note on Mapper Descriptions
|
||
In this document Bank Selections are sometimes described as 4K, or as 4x1K.
|
||
The linear address for a 4K bank is (N*4096).
|
||
The linear address for a 4x1K bank is ((N AND (NOT 3))*1024).
|
||
Ie. in the latter case, the bank value is specified in 1K-steps, with lower
|
||
bits ignored, and rounded down to a 4K boundary.
|
||
|
||
Mapper Reset
|
||
In general, mapper registers are uninitialized on reset/power-up, and should be
|
||
initialized by software; if memory at FFFCh is mappable, then valid reset
|
||
vectors (and reset handlers) should be contained in all banks.
|
||
There is no reset signal available on cartridge bus, possible ways to detect
|
||
reset are to sense inactivity on A0 or PHI2 lines, to sense reads from the
|
||
reset vector at FFFCh, or to use power-up capacitors for coldboot detection
|
||
(though that not for warmboot).
|
||
Caution: Several mappers in this document are described to have initial
|
||
settings on reset or power-up. Most of that info has been taken from other
|
||
documents, in most cases that is unconfirmed, and probably incorrect. A few
|
||
mappers seem to be actually containing reset circuits though.
|
||
|
||
Cartridge ROM-Image File Formats
|
||
--------------------------------
|
||
|
||
iNES Format (.NES)
|
||
This fileformat and mapper-numbers have been designed/assigned by Marat
|
||
Fayzullin (author of iNES emulator), please contact him if you want to make any
|
||
changes to the format or numbers. The file header is 16 bytes:
|
||
00h File ID ("NES",1Ah) (aka 4Eh,45h,53h,1Ah)
|
||
04h Number of 16K PRG-ROM pages
|
||
05h Number of 8K CHR-ROM pages (00h=None / VRAM)
|
||
06h Cartridge Type LSB
|
||
Bit7-4 Mapper Number (lower 4bits)
|
||
Bit3 1=Four-screen VRAM layout
|
||
Bit2 1=512-byte trainer/patch at 7000h-71FFh
|
||
Bit1 1=Battery-backed SRAM at 6000h-7FFFh, set only if battery-backed
|
||
Bit0 0=Horizontal mirroring, 1=Vertical mirroring
|
||
07h Cartridge Type MSB (ignore this and further bytes if Byte 0Fh nonzero)
|
||
Bit7-4 Mapper Number (upper 4bits)
|
||
Bit3-2 Reserved (zero)
|
||
Bit1 1=PC10 game (arcade machine with additional 8K Z80-ROM) (*)
|
||
Bit0 1=VS Unisystem game (arcade machine with different palette)
|
||
08h Number of 8K RAM (SRAM?) pages (usually 00h=None-or-not-specified)
|
||
09h Reserved (zero)
|
||
0Ah Reserved (zero) (sometimes 03h,10h,13h,30h,33h purpose unknown) (*)
|
||
0Bh Reserved (zero)
|
||
0Ch Reserved (zero)
|
||
0Dh Reserved (zero)
|
||
0Eh Reserved (zero)
|
||
0Fh Nonzero if [07h..0Fh]=GARBAGE, if so, assume [07h..0Fh]=ALL ZERO (*)
|
||
The overall file structure is, in following order:
|
||
16 byte Header
|
||
512 byte Trainer ;-if any, see Byte 6, Bit2, mainly FFE games
|
||
N*16K PRG-ROM ;-see Byte 4
|
||
N*8K CHR-ROM ;-if any, see Byte 5
|
||
8K (*) PC10 INST-ROM ;-if any, see Byte 7, Bit1
|
||
16 byte (*) PC10 PROM Data ;-if any, see Byte 7, Bit1 ;\required, but
|
||
16 byte (*) PC10 PROM CounterOut;-if any, see Byte 7, Bit1 ;/often missing
|
||
128 byte (*) Title ;-if any (rarely used)
|
||
Items marked as (*) are regulary used, but not offical part of the format.
|
||
Many PC10 files declare Z80-ROM as additional VROM bank (instead Byte7/Bit1).
|
||
|
||
"NES v2.0"
|
||
This is an extension to the above iNES format, specs are at:
|
||
http://wiki.nesdev.com/w/index.php/NES_2.0
|
||
according to that webpage, it's supported by only 1 emulator.
|
||
|
||
.UNF - Universal NES Image File Format (UNIF) by Tennessee Carmel-Veilleux
|
||
A "newer" fileformat dated back to 2000, the relation between iNES mapper
|
||
numbers and UNIF MAPR names is still undocumented, and of course nobody uses
|
||
files with .UNF extension. Still, it's having one or two useful features, and
|
||
may become more popular if somebody dares to fix the MAPR problem, and to
|
||
rename it from .UNF to .NES extension.
|
||
File Header (32 bytes)
|
||
00h-03h: "UNIF" tag identifier
|
||
04h-07h: Revision number ("currently 4, for REV 7b, Revision 6 of UNIF" Huh!)
|
||
08h-1Fh: Reserved for future usage
|
||
The header is followed by whatever chunks, all chunks are optional, and may or
|
||
may not be included in the file, only the PRG0 one is obviously required.
|
||
Software may skip any chunks which are uninteresting or unrecognized, each
|
||
chunk formatted as such:
|
||
00h-03h: Chunk ID string (4-letter ASCII, described below)
|
||
04h-07h: Length of Data Block in bytes (excluding above ID and length entry)
|
||
08h... : Data
|
||
MAPR - Board Name (aka Mapper) (ASCIZ, suggested max: 32 chars)
|
||
This uses ASCIZ strings to describe the board names (instead of iNES
|
||
mapper numbers), it's meant to be more specific than mapper numbers,
|
||
for example, it's using different names for different MMC1-boards.
|
||
http://www.parodius.com/~veilleux/boardtable.txt
|
||
http://www.parodius.com/~veilleux/boardnames
|
||
PRG0..PRGF - Binary data of the PRG ROM
|
||
CHR0..CHRF - Binary data of the CHR ROM (aka VROM in general)
|
||
Normally using only PRG0 (and CHR0, if VROM used).
|
||
In rare cases, if the cart contains more than 1 PRG (or CHR) ROM chip,
|
||
then PRG1-F and CHR1-F may be used for the additional chips.
|
||
TVCI - Television Standards Compatability Information (One Byte)
|
||
00h 60Hz/NTSC (USA, Japan, etc.)
|
||
01h 50Hz/PAL (Germany, etc.)
|
||
02h Compatible with both 50Hz and 60Hz refresh rates
|
||
CTRL - Controllers used by the cartridge (currently only 1 Byte / 8bit)
|
||
Bit0 Regular Joypad
|
||
Bit1 Zapper
|
||
Bit2 R.O.B.
|
||
Bit3 Arkanoid Controller (Paddle)
|
||
Bit4 Power Pad
|
||
Bit5 Four-Score adapter (NES 4-player adapter) (Not Famicom adapter!)
|
||
Bit6-7 Reserved
|
||
MIRR - Name Table Mirroring (1 Byte)
|
||
00h Two-Screen Horizontal Mirroring (Hard Wired)
|
||
01h Two-Screen Vertical Mirroring (Hard Wired)
|
||
02h Single-Screen BLK0 (Hard Wired)
|
||
03h Single-Screen BLK1 (Hard Wired)
|
||
04h Four-Screens of VRAM (Hard Wired)
|
||
05h Mirroring Controlled By Mapper Hardware
|
||
BATR - Battery installed on Board (1 dummy byte)
|
||
Presence of this chunk means yes, absence means no.
|
||
NAME - Game Title, ASCIZ String
|
||
Game Title
|
||
READ - Readme/Comments/Notes/Credits
|
||
Probably some sort of ASCII text of unspecified formatting
|
||
VROR - Allow homebrewn games to over-write VROM (1 dummy byte)
|
||
Presence of this chunk means yes, absence means no.
|
||
PCK0..PCKF - 32-bit CRCs for PRG0..PRGF blocks (4 bytes, each)
|
||
CCK0..CCKF - 32-bit CRCs for CHR0..CHRF blocks (4 bytes, each)
|
||
Intended "to make sth sure on EPROMs" ;-) Checksum algorythm not specified.
|
||
DINF - Dumper information block (204 Bytes)
|
||
100 bytes ASCIZ name of the person who dumped the cart
|
||
4 bytes day, month, year-lsb, year-msb when cartridge was dumped
|
||
100 bytes ASCIZ agent "name of the ROM-dumping means used"
|
||
Note: All words and dwords in header/chunks stored LSB first.
|
||
|
||
Cartridge IRQ Counters
|
||
----------------------
|
||
|
||
The MMC3's scanline counter
|
||
The MMC3 bases it's scanline counter on PPU address line A13 (which is why
|
||
IRQ's can be fired off manually by toggling A13 a bunch of times via $2006).
|
||
A13 cycles (0 -> 1) exactly 42 times per scanline, whereas the CPU count of
|
||
cycles per scanline is not an exact integer (113.67).
|
||
|
||
Konami IRQ counters
|
||
Running at 113.75 cycles, including during VBlank.
|
||
|
||
Famicom Disk System IRQ counters
|
||
Allows to count clock cycles, rather than scanlines.
|
||
|
||
Cartridge Bus Conflicts
|
||
-----------------------
|
||
|
||
/PRG Pin - Indicates CPU Memory Access to 8000h-FFFFh (LOW=Read or Write)
|
||
R/W Pin - Indicates CPU Direction (LOW=Write, HIGH=Read)
|
||
|
||
The /PRG Pin indicates read-or-write access to the PRG ROM memory area at
|
||
8000h-FFFFh, the read/write direction could be determined by R/W Pin. Most
|
||
cartridges are ignoring the R/W signal, and are assuming all memory accesses to
|
||
be read-requests (which makes sense since ROM is read-only).
|
||
However, many cartridges have write-only mapper ports at 8000h-FFFFh, activated
|
||
when /PRG=LOW and R/W=LOW. Many of these carts (especially simple TTL circuits
|
||
like UNROM, CNROM, etc.) still activate ROM on any /PRG signal without checking
|
||
R/W, so that ROM outputs data simultaneously with the CPU writing data to the
|
||
mapper port.
|
||
Common workaround is to write to a ROM address that contains a value equal to
|
||
the written value. Also one could probably write to an address that contains
|
||
FFh (low signals are stronger than high signals, so the values would be
|
||
logically, or 'forcefully' ANDed. Don't know about any games using that method
|
||
though). Another workaround is to interprete the lower address bits instead of
|
||
the data bits (eg. Mapper 225), that's of course still producing a bus-conflict
|
||
(shortcut), but without disturbing the program flow.
|
||
|
||
Cartridge Cicurity Chip (CIC) (Lockout Chip)
|
||
--------------------------------------------
|
||
|
||
Lockout chips are contained in most NES consoles, and in all NES cartridges.
|
||
Both chips are generating an identical serial data stream, and, everything
|
||
works fine if the streams match. Otherwise the chip in the console issues a
|
||
reset signal to the NES.
|
||
|
||
That mechanism is intended both to prevent software piracy, and to prevent
|
||
third party developers from distributing (unlicensed) games. Also, an US
|
||
cartridge won't work on a UK console and vice versa, because of different
|
||
lockout chip versions used in different countries.
|
||
|
||
The chips have been invented when releasing the NES in 1985, the original
|
||
Famicom didn't have lockout chips (nor do newer Famicoms; for backwards
|
||
compatibility reasons). There have been also some lockout chip revisions to
|
||
make newer NES consoles incompatible with some "faked" lockout chips from other
|
||
manufacturers.
|
||
|
||
The lockout chips are 4bit microprocessors in DIL16 package with a built-in
|
||
program called 10NES, and are connected to S0,S1,S2,4MHz pins of the 72pin NES
|
||
cartridge slot. Pin 4 of the chip is used to configure the chip:
|
||
HIGH (+5V) Lock, used in console
|
||
LOW (GND) Key, used in cartridge
|
||
To disable the chip in the console, wire that pin to GND instead of 5V, the NES
|
||
will then work with any cartridges with or without lockout chip, and with
|
||
cartridges from other countries - though some NTSC (60Hz) games may be
|
||
incompatible with PAL (50Hz) refresh rates, and vice versa.
|
||
|
||
NES cartridges are required to contain a CIC chip (security chip aka lockout
|
||
chip). The CIC is a small 4bit CPU with built-in ROM. An identical CIC is
|
||
located in the NES console. The same 4bit CPU (but with slightly different code
|
||
in ROM) is also used in SNES consoles/cartridges.
|
||
The CIC in the console is acting as "lock", and that in the cartridge is acting
|
||
as "key". The two chips are sending random-like bitstreams to each other, if
|
||
the data (or transmission timing) doesn't match the expected values, then the
|
||
"lock" issues a RESET signal to the console. Thereby rejecting cartridges
|
||
without CIC chip (or such with CICs for wrong regions).
|
||
|
||
CIC Details
|
||
--> Cartridge CIC Pseudo Code
|
||
--> Cartridge CIC Instruction Set
|
||
--> Cartridge CIC Notes
|
||
--> Cartridge CIC Versions
|
||
--> Cartridge CIC Pinouts
|
||
And, for Tengen CIC clone's instruction set:
|
||
--> Cartridge CIC Tengen Clone
|
||
|
||
Cartridge CIC Pseudo Code
|
||
-------------------------
|
||
|
||
CicMain
|
||
CicInitFirst, CicInitTiming, CicRandomSeed, CicInitStreams
|
||
time=data_start, a=1, noswap=1, if snes then noswap=0
|
||
mainloop:
|
||
for x=a to 0Fh
|
||
if nes then Wait(time-5), else if snes then (time-7) ;\verify idle
|
||
if (nes_6113=0) and (P0.0=1 or P0.1=1) then Shutdown ;/
|
||
Wait(time+0) ;\
|
||
if (console xor snes) then a=[00h+x].0, else a=[10h+x].0 ; output data
|
||
if noswap then P0.0=a, else P0.1=a ;/
|
||
Wait(time+2-data_rx_error) ;\
|
||
if (console xor snes) then a=[10h+x].0, else a=[00h+x].0 ; verify input
|
||
if noswap then a=(a xor P0.1), else a=(a xor P0.0) ;
|
||
if a=1 then Shutdown ;/
|
||
Wait(time+3) ;\output idle
|
||
if noswap then P0.0=0, else P0.1=0 ;/
|
||
if snes then time=time+92, else if nes then time=time+79
|
||
next x
|
||
CicMangle(00h), CicMangle(10h) ;\mangle
|
||
if snes then CicMangle(00h), CicMangle(10h) ; (thrice on SNES)
|
||
if snes then CicMangle(00h), CicMangle(10h) ;/
|
||
if snes then noswap=[17h].0 ;eventually swap input/output pins (SNES only)
|
||
a=[17h]
|
||
if a=0 then a=1, time=time+2
|
||
if snes then time=time+44, else if nes then time=time+29
|
||
goto mainloop
|
||
|
||
CicMangle(buf)
|
||
for i=[buf+0Fh]+1 downto 1
|
||
a=[buf+2]+[buf+3h]+1
|
||
if a<10h then x=[buf+3], [buf+3]=a, a=x, x=1, else x=0
|
||
[buf+3+x]=[buf+3+x]+a
|
||
for a=x+6 to 0Fh, [buf+a]=[buf+a]+[buf+a-1]+1, next a
|
||
a=[buf+4+x]+8, if a<10h then [buf+5+x]=[buf+5+x]+a, else [buf+5+x]=a
|
||
[buf+4+x]=[buf+4+x]+[buf+3+x]
|
||
[buf+1]=[buf+1]+i
|
||
[buf+2]=NOT([buf+2]+[buf+1]+1)
|
||
time=time+84-(x*6)
|
||
next i
|
||
Note: All values in [buf] are 4bit wide (aka ANDed with 0Fh).
|
||
|
||
CicInitFirst
|
||
timer=0 ;reset timer (since reset released)
|
||
P0=00h
|
||
console=P0.3 ;get console/cartridge flag
|
||
if console
|
||
while P0.2=1, r=r+1 ;get 4bit random seed (capacitor charge time)
|
||
P1.1=1, P1.1=0 ;issue reset to CIC in cartridge
|
||
timer=0 ;reset timer (since reset released)
|
||
if nes_6113 and (console=1)
|
||
Wait(3), nes_6113_in_console=1, P0.0=1 ;request special 6113 mode
|
||
if nes_6113 and (console=0)
|
||
Wait(6), nes_6113_in_console=P0.1 ;check if 6113 mode requested
|
||
|
||
CicRandomSeed
|
||
time=seed_start
|
||
for i=0 to 3 ;send/receive 4bit random seed (r)
|
||
bit=((i+3) and 3) ;bit order is 3,0,1,2 (!)
|
||
if console=1 Wait(time+0+i*15), P0.0=r.bit, Wait(time+3+i*15), P0.0=0 ;send
|
||
if console=0 Wait(time+2+i*15), r.bit=P0.1 ;recv
|
||
next i
|
||
|
||
CicInitStreams
|
||
if snes
|
||
if ntsc then x=9, else if pal then x=6
|
||
[01h..0Fh]=B,1,4,F,4,B,5,7,F,D,6,1,E,9,8 ;init stream from cartridge (!)
|
||
[11h..1Fh]=r,x,A,1,8,5,F,1,1,E,1,0,D,E,C ;init stream from console (!)
|
||
if nes_usa ;3193A
|
||
[01h..0Fh]=1,9,5,2,F,8,2,7,1,9,8,1,1,1,5 ;init stream from console
|
||
[11h..1Fh]=r,9,5,2,1,2,1,7,1,9,8,5,7,1,5 ;init stream from cartridge
|
||
if nes_6113_in_console then overwrite [01h]=5 or so ??? ;special-case
|
||
if nes_europe ;3195A
|
||
[01h..0Fh]=F,7,B,E,F,8,2,7,D,7,8,E,E,1,5 ;init stream from console
|
||
[11h..1Fh]=r,7,B,D,1,2,1,7,E,6,7,A,7,1,5 ;init stream from cartridge
|
||
if nes_hongkong_asia ;3196A
|
||
[01h..0Fh]=E,6,A,D,F,8,2,7,E,6,7,E,E,E,A ;init stream from console
|
||
[11h..1Fh]=r,6,A,D,E,D,E,8,E,6,7,A,7,1,5 ;init stream from cartridge
|
||
if nes_uk_italy_australia ;3197A
|
||
[01h..0Fh]=3,5,8,9,3,7,2,8,8,6,8,5,E,E,B ;init stream from console
|
||
[11h..1Fh]=r,7,9,A,A,1,6,8,5,8,9,1,5,1,7 ;init stream from cartridge
|
||
if_nes_famicombox ;3198A
|
||
(unknown)
|
||
Note: In most cases, the PAL region changes are simply inverted or negated NTSC
|
||
values (not/neg), except, one NES-EUR value, and most of the NES-UK values are
|
||
somehow different. The rev-engineered NES-UK values may not match the exact
|
||
original NES-UK values (but they should be working anyways).
|
||
|
||
CicInitTiming
|
||
if snes_d411 -> seed_start=630, data_start=817 ;snes/ntsc
|
||
if snes_d413 -> (unknown?) (same as d411?) ;snes/pal
|
||
if nes_3193 -> (seems to be same as nes_3195?) ;nes/usa (v1)
|
||
if nes_3195 -> seed_start=32, data_start=200 ;nes/europe
|
||
if nes_3196 -> (unknown?) ;nes/asia
|
||
if nes_3197 -> (unknown?) ("burns five") ;nes/uk
|
||
if nes_6113 -> seed_start=32, data_start=201 ;nes/usa (v2)
|
||
if nes_6113_in_console -> seed_start=33, data_start=216 ;nes/special
|
||
if nes_tengen -> seed_start=32, data_start=201 ;nes/cic-clone
|
||
;now timing errors...
|
||
data_rx_error=0 ;default
|
||
if console=0 and nes_3193a -> randomly add 0 or 0.25 to seed_start/data_start
|
||
if console=0 and snes_d413 -> always add 1.33 to seed_start/data_start (bug)
|
||
if console=0 and nes_6113 -> data_rx_error=1 (and maybe +1.25 on seed/data?)
|
||
if other_chips & chip_revisions -> (unknown?)
|
||
Note: 3197 reportedly "burns five extra cycles before initialization", but
|
||
unknown if that is relative to 3193 <or> 3195 timings, and unknown if it
|
||
applies to <both> seed_start and data_start, and unknown if it means 1MHz <or>
|
||
4MHz cycles.
|
||
Note: The "data_rx_error" looks totally wrong, but it is somewhat done
|
||
intentionally, so there might be a purpose (maybe some rounding, in case 6113
|
||
and 3193 are off-sync by a half clock cycle, or maybe an improper bugfix in
|
||
case they are off-sync by 1 or more cycles).
|
||
|
||
Wait(time)
|
||
Wait until "timer=time", whereas "timer" runs at 1MHz (NES) or 1.024MHz (SNES).
|
||
The "time" values are showing the <completion> of the I/O opcodes (ie. the I/O
|
||
opcodes <begin> at "time-1").
|
||
|
||
Shutdown (should never happen, unless cartridge is missing or wrong region)
|
||
a=0, if nes then time=830142, else if snes then time=1037682
|
||
endless_loop: ;timings here aren't 100.000% accurate
|
||
if nes_3195 then time=xlat[P1/4]*174785 ;whereas, xlat[0..3]=(3,2,4,5)
|
||
if (console=0) and (snes or nes_6113) then P0=03h, P1=01h
|
||
if (console=1) then P1=a, Wait(timer+time), a=a xor 4 ;toggle reset on/off
|
||
goto endless_loop
|
||
|
||
Cartridge CIC Instruction Set
|
||
-----------------------------
|
||
|
||
CIC Registers
|
||
A 4bit Accumulator
|
||
X 4bit General Purpose Register
|
||
L 4bit Pointer Register (lower 4bit of 6bit HL)
|
||
H 2bit Pointer Register (upper 2bit of 6bit HL)
|
||
C 1bit Carry Flag (changed ONLY by "set/clr c", not by "add/adc" or so)
|
||
PC 10bit Program Counter (3bit bank, plus 7bit polynomial counter)
|
||
|
||
CIC Memory
|
||
ROM 512x8bit (program ROM) (NES/EUR=768x8) (max 1024x8 addressable)
|
||
RAM 32x4bit (data RAM) (max 64x4 addressable)
|
||
STACK 4x10bit (stack for call/ret opcodes)
|
||
PORTS 4x4bit (external I/O ports & internal RAM-like ports) (max 16x4)
|
||
|
||
Newer CIC Opcodes (6113, D411) (and probably F411,D413,F413)
|
||
00 nop no operation (aka "addsk A,0" opcode)
|
||
00+n addsk A,n add, A=A+n, skip if result>0Fh
|
||
10+n cmpsk A,n compare, skip if A=n
|
||
20+n mov L,n set L=n
|
||
30+n mov A,n set A=n
|
||
40 mov A,[HL] set A=RAM[HL]
|
||
41 xchg A,[HL] exchange A <--> RAM[HL]
|
||
42 xchgsk A,[HL+] exchange A <--> RAM[HL], L=L+1, skip if result>0Fh
|
||
43 xchgsk A,[HL-] exchange A <--> RAM[HL], L=L-1, skip if result<00h
|
||
44 neg A negate, A=0-A ;(used by 6113 mode)
|
||
45 ?
|
||
46 out [L],A output, PORT[L]=A
|
||
47 out [L],0 output, PORT[L]=0
|
||
48 set C set carry, C=1
|
||
49 clr C reset carry, C=0
|
||
4A mov [HL],A set RAM[HL]=A
|
||
4B ?
|
||
4C ret return, pop PC from stack
|
||
4D retsk return, pop PC from stack, skip
|
||
4E+n ?
|
||
52 movsk A,[HL+] set A=RAM[HL], L=L+1, skip if result>0Fh
|
||
53 ? (guess: movsk A,[HL-])
|
||
54 not A complement, A=A XOR 0Fh
|
||
55 in A,[L] input, A=PORT[L]
|
||
56 ?
|
||
57 xchg A,L exchange A <--> L
|
||
58+n ?
|
||
5C mov X,A set X=A
|
||
5D xchg X,A exchange X <--> A
|
||
5E ??? "SPECIAL MYSTERY INSTRUCTION" ;(used by 6113 mode)
|
||
5F ?
|
||
60+n testsk [HL].n skip if RAM[HL].Bit(n)=1
|
||
64+n testsk A.n skip if A.Bit(n)=1
|
||
68+n clr [HL].n set RAM[HL].Bit(n)=0
|
||
6C+n set [HL].n set RAM[HL].Bit(n)=1
|
||
70 add A,[HL] add, A=A+RAM[HL]
|
||
71 ? (guess: addsk A,[HL])
|
||
72 adc A,[HL] add with carry, A=A+RAM[HL]+C
|
||
73 adcsk A,[HL] add with carry, A=A+RAM[HL]+C, skip if result>0Fh
|
||
74+n mov H,n set H=n ;2bit range, n=0..3 only (used: 0..1 only)
|
||
78+n mm jmp nmm long jump, PC=nmm
|
||
7C+n mm call nmm long call, push PC+2, PC=nmm
|
||
80+nn jmp nn short jump, PC=(PC AND 380h)+nn
|
||
- reset PC=000h
|
||
Note: "skip" means "do not execute next instruction"
|
||
|
||
Older CIC Opcodes (3195) (and probably 3193,3196,3197,etc.)
|
||
Exchanged opcodes 48 <--> 49 (set/clr C)
|
||
Exchanged opcodes 44 <--> 54 (neg/not A)
|
||
ROM Size is 768x8 (although only 512x8 are actually used)
|
||
|
||
Note
|
||
The CIC is a 4bit Sharp CPU (maybe a Sharp SM4, but no datasheet exists) (the
|
||
instruction seems to be an older version of that in the Sharp SM5K1..SM5K7
|
||
datasheets).
|
||
|
||
Cartridge CIC Notes
|
||
-------------------
|
||
|
||
Program Counter (PC)
|
||
The 10bit PC register consists of a 3bit bank (which gets changed only by
|
||
call/jmp/ret opcodes), and a 7bit polynomial counter (ie. not a linear
|
||
counter). After fetching opcode bytes, PC is "incremented" as so:
|
||
PC = (PC AND 380h) + (PC.Bit0 XOR PC.Bit1)*40h + (PC AND 7Eh)/2
|
||
Ie. the lower 7bit will "increment" through 127 different values (and wrap to
|
||
00h thereafter). Address 7Fh is unused (unless one issues a JMP 7Fh opcode,
|
||
which would cause the CPU to hang on that address).
|
||
Format <------------- Valid Address Area ----------> <--Stuck-->
|
||
Linear 00 01 02 03 04 05 06 07 08 09 0A ... 7C 7D 7E or 7F 7F 7F 7F
|
||
Polynomial 00 40 60 70 78 7C 7E 3F 5F 6F 77 ... 05 02 01 or 7F 7F 7F 7F
|
||
To simplify things, programming tools like assemblers/disassemblers may use
|
||
"normal" linear addresses (and translate linear/polynomial addressses when
|
||
needed - the polynomial addresses are relevant only for encoding bits in
|
||
jmp/call opcodes, and for how the data is physically arranged in the chip ROMs
|
||
and in ROM-images).
|
||
|
||
ROM-Images
|
||
The existing ROM-images are .txt files, containing "0" and "1" BITS in ASCII
|
||
format, arranged as a 64x64 (or 96x64) matrix (as seen in decapped chips).
|
||
Line 1..32 ---> Address X+9Fh..80h ;\Lines (Y)
|
||
Line 33..64 ---> Address X+1Fh..00h ;/
|
||
Column 1+(n*W) --> Data Bit(n) of Address 000h+Y ;\ ;\
|
||
Column 2+(n*W) --> Data Bit(n) of Address 020h+Y ; ; Columns (X)
|
||
Column 3+(n*W) --> Data Bit(n) of Address 040h+Y ; ;
|
||
Column 4+(n*W) --> Data Bit(n) of Address 060h+Y ; ; chips with 200h-byte
|
||
Column 5+(n*W) --> Data Bit(n) of Address 100h+Y ; ; (W=8) (64x64 bits)
|
||
Column 6+(n*W) --> Data Bit(n) of Address 120h+Y ; ;
|
||
Column 7+(n*W) --> Data Bit(n) of Address 140h+Y ; ;
|
||
Column 8+(n*W) --> Data Bit(n) of Address 160h+Y ; ;/
|
||
Column 9+(n*W) --> Data Bit(n) of Address 200h+Y ;
|
||
Column 10+(n*W) --> Data Bit(n) of Address 220h+Y ; chips with 300h-byte
|
||
Column 11+(n*W) --> Data Bit(n) of Address 240h+Y ; (W=12) (96x64 bits)
|
||
Column 12+(n*W) --> Data Bit(n) of Address 260h+Y ;/
|
||
Cautions: The bits are inverted (0=1, 1=0) in some (not all) dumps. Mind that
|
||
the bytes are arranged in non-linear polynomial fashion (see PC register).
|
||
Recommended format for binary ROM-images would be to undo the inversion (if
|
||
present), and to maintain the polynomial byte-order.
|
||
Note: Known decapped/dumped CICs are D411 and 3195A, and... somebody
|
||
decapped/dumped a CIC without writing down its part number (probably=6113).
|
||
|
||
CIC Timings
|
||
The NES CICs are driven by a 4.000MHz CIC oscillator (located in the console,
|
||
and divided by 4 in the NES CIC). The SNES CICs are driven by the 24.576MHz APU
|
||
oscillator (located and divided by 8 in the console's audio circuit, and
|
||
further divided by 3 in the SNES CIC).
|
||
Ie. internally, the CICs are clocked at 1.000MHz (NES) or 1.024MHz (SNES). All
|
||
opcodes are executed within 1 clock cycles, except for the 2-byte long jumps
|
||
(opcodes 78h-7Fh) which take 2 clock cycles. The "skip" opcodes are forcing the
|
||
follwing opcode to be executed as a "nop" (ie. the skipped opcode still takes 1
|
||
clock cycle; or possibly 2 cycles when skipping long jump opcodes, in case the
|
||
CPU supports skipping 2-byte opcodes at all).
|
||
After Reset gets released, the CICs execute the first opcode after a short
|
||
delay (3195A: randomly 1.0 or 1.25 cycles, D413A: constantly 1.33 cycles)
|
||
(whereas, portions of that delay may rely on a poorly falling edge of the
|
||
incoming Reset signal).
|
||
|
||
CIC Ports
|
||
Name Pin Dir Expl
|
||
P0.0 1 Out Data Out ;\SNES version occassionally swaps these
|
||
P0.1 2 In Data In ;/pins by software (ie. Pin1=In, Pin2=Out)
|
||
P0.2 3 In Random Seed (0=Charged/Ready, 1=Charging/Busy)
|
||
P0.3 4 In Lock/Key (0=Cartridge/Key, 1=Console/Lock)
|
||
P1.0 9 Out Reset SNES (0=Reset Console, 1=No)
|
||
P1.1 10 Out Reset Key (0=No, 1=Reset Key)
|
||
P1.2 11 In Unused, or Reset Speed A (in 3195A) ;\blink speed of reset
|
||
P1.3 12 In Unused, or Reset Speed B (in 3195A) ;/signal (and Power LED)
|
||
P2.0 13 - Unused
|
||
P2.1 14 - Unused
|
||
P2.2 15 - Unused
|
||
P2.3 - - Unused
|
||
P3.0 - RAM Unused, or used as "noswap" flag (in SNES CIC)
|
||
P3.1 - - Unused
|
||
P3.2 - - Unused
|
||
P3.3 - - Unused
|
||
P0.0-P2.2 are 11 external I/O lines (probably all bidirectional, above
|
||
directions just indicates how they are normally used). P2.3-P3.3 are 5 internal
|
||
bits (which seem to be useable as "RAM"). Pin numbers are for 16pin NES/SNES
|
||
DIP chips (Pin numbers on 18pin SNES SMD chips are slightly rearranged).
|
||
P4,P5,P6,P7,P8,P9,PA,PB,PC,PD,PF are unknown/unused (maybe 12x4 further bits,
|
||
or mirrors of P0..P3).
|
||
|
||
CIC Stream Seeds
|
||
There are different seeds used for different regions. And, confusingly, there
|
||
is a NES-CIC clone made Tengen, which uses different seeds than the real CIC
|
||
(some of the differences automatically compensated when summing up values, eg.
|
||
8+8 gives same 4bit result as 0+0, other differences are manually adjusted by
|
||
Tengen's program code).
|
||
Many of the reverse-engineered NES seeds found in the internet are based on the
|
||
Tengen design (the USA-seeds extracted from the decapped Tengen chip, the
|
||
EUR/ASIA/UK-seeds based on sampled Nintendo-CIC data-streams, and then
|
||
converted to a Tengen-compatible seed format). To convert them to real CIC
|
||
seeds:
|
||
Nintendo[1..F] = Tengen[1..F] - (2,0,0,0,0,0,8,8,8,8,8,8,8,8,2)
|
||
There are other (working) variations possible, for example:
|
||
Nintendo[1..F] = Tengen[1..F] - (2,0,0,0,0,A,E,8,8,8,8,8,8,8,2)
|
||
(That, for Tengen-USA seeds. The Tengen-style-EUR/ASIA/UK seeds may differ)
|
||
Whereas, the random seed in TengenKEY[1] is meant to be "r+2" (so subtracting 2
|
||
restores "r").
|
||
|
||
CIC Stream Logs
|
||
There are some stream logs with filename "XXXX-N.b" where XXXX is the chip
|
||
name, and N is the random seed, and bytes in the file are as so:
|
||
Byte 000h, bit0-7 = 1st-8th bit on Pin 1 (DTA.OUT on NES)(DTA.OUT/IN on SNES)
|
||
Byte 001h, bit0-7 = 1st-8th bit on Pin 2 (DTA.IN on NES) (DTA.IN/OUT on SNES)
|
||
Byte 002h, bit0-7 = 9th-16th bit on Pin 1
|
||
Byte 003h, bit0-7 = 9th-16th bit on Pin 2
|
||
etc.
|
||
Caution: The "N" in the filename is taken as if the seed were transferred in
|
||
order Bit 3,2,1,0 (actually it is Bit 3,0,1,2). Ie. file "3195-1.b" would refer
|
||
to a NES-EUR-CIC with seed r=4. The signals in the files are sampled at 1MHz
|
||
(ie. only each fourth 4MHz cycle).
|
||
|
||
The 6113 Chip
|
||
The 6113 chip was invented in 1987, and it replaced the 3193 chip in
|
||
US/Canadian cartridges (while US/Canadian consoles kept using 3193 chips). When
|
||
used in cartridges, the 6113 does usually "emulate" a 3193 chip. But, for
|
||
whatever reason, it can do more:
|
||
Console Cartridge Notes
|
||
3193 3193 Works (the "old" way) ;\used combinations
|
||
3193 6113 Works (the "new" way) ;/
|
||
6113 6113 Works (special seed/timing) ;\
|
||
6113 3193 Doesn't work ; not used as far as known
|
||
6113 ?? Might work (??=unknown chip) ;/
|
||
When used in consoles, the 6113 uses slightly different timings and seed values
|
||
(and does request cartridges with 6113 chips to use the 6113-mode, too, rather
|
||
than emulating the 3193).
|
||
One guess: Maybe Nintendo originally used different CICs for NTSC regions (like
|
||
3193/3194 for USA/Canada/SouthKorea), and later combined them to one region (if
|
||
so, all NES consoles in Canada or SouthKorea should contain 3194/6113 chips,
|
||
unlike US consoles which have 3193 chips).
|
||
|
||
3195A Signals (NES, Europe)
|
||
The I/O ports are HIGH (for Output "1"), or LOW-Z (for Output "0" or Input).
|
||
Raising edges take circa 0.5us, falling edges take circa 3us.
|
||
4MHz Clock Units ...............................
|
||
1MHz Clock Units . . . . . . . .
|
||
___________ ;\Console+Cartridge
|
||
Data Should-be __| |________________ ;/should be 3us High
|
||
__________ ;\actually 2.5us High
|
||
Data From Console __.' ''----.......____ ;/and 3us falling
|
||
__________ ;\
|
||
Data From Cartridge __.' ''----.......____ ; either same as console
|
||
or, delayed: __________ ; or 0.25us later
|
||
Data From Cartridge ___.' ''----.......___ ;/
|
||
After Power-up, the Cartridge CIC does randomly start with good timing, or with
|
||
all signals delayed by 0.25us. In other words, the Cartridge CIC executes the
|
||
first opcode 1.0us or 1.25us (four or five 4MHz cycles) after Reset gets
|
||
released. However, for some reason, pushing the Reset Button doesn't alter the
|
||
timing, the random-decision occurs only on Power-up.
|
||
|
||
D413A Signals (SNES, Europe)
|
||
The D413A signals are looking strange. First, the software switches signals
|
||
High for 3us, but the actual signals are 3.33us High. Second, the signals on
|
||
one pin are constantly jumping back'n'forth by 1.33us (in relation to the other
|
||
pin).
|
||
3.072MHz Clock Units ...............................
|
||
1.024MHz Clock Units . . . . . . . . . .
|
||
________ ;\Console+Cartridge
|
||
Data Should-be ________| |_____________ ;/should be 3us High
|
||
_________ ;\actually 3.33us high
|
||
Data From/To Console ________| '--..._______ ;/and 2us falling
|
||
_________ ;\
|
||
Data From/To Cart ____| '--...___________ ; 1.33us earlier
|
||
or, delayed _________ ; or 1.33us later
|
||
Data From/To Cart ____________| '--...___ ;/
|
||
The earlier/later effect occurs because the SNES CICs are occassionally
|
||
reversing the data-direction of the pins. Ie. in practice, Data from Cartridge
|
||
is constantly 1.33us LATER than from Console.
|
||
Software-wise, the D411 (and probably D413A) is programmed as if the Cartridge
|
||
CIC would start "immediately", but in practice, it starts 1.33us (four 3.072MHz
|
||
cycles) after releasing Reset (that offset seems to be constant, unlike as on
|
||
the 3195A where it randomly changes between 1.0us and 1.25us).
|
||
|
||
Cartridge CIC Versions
|
||
----------------------
|
||
|
||
NES CIC Versions
|
||
3193,3193A NES NTSC Cartridges and Consoles ;\USA,Canada
|
||
6113,6113A,6113B1 NES NTSC Cartridges (not consoles) ;/(and Korea?)
|
||
3194 Unknown/doesn't exist?
|
||
3195,3193A NES PAL Cartridges and Consoles "PAL-B";-Europe
|
||
3196(A?) NES PAL Cartridges and Consoles ;-Hong Kong,Asia
|
||
3197(A?) NES PAL Cartridges and Consoles "PAL-A";-UK,Italy,Australia
|
||
3198(A?) FamicomBox CIC Cartridges and Consoles ;\
|
||
3199(A?) FamicomBox Coin Timer (not a CIC) ; Japan
|
||
N/A Famicom Cartridges and Consoles ;/
|
||
RFC-CPU10 (?) NES R.O.B. robot (no CIC, but maybe a 4bit Sharp CPU, too?)
|
||
|
||
SNES CIC Versions
|
||
F411,F411A,F411B SNES NTSC Cartridges-with-SMD-Chipset and Consoles
|
||
D411,D411A,D411B SNES NTSC Cartridges-with-DIP-Chipset
|
||
F413,F413A,F413B SNES PAL Cartridges-with-SMD-Chipset and Consoles
|
||
D413,D413A,D413B SNES PAL Cartridges-with-DIP-Chipset
|
||
SA-1,S-DD1,MCC-BSC SNES Cartridges (coprocessors/mappers with on-chip CIC)
|
||
|
||
NES CIC Clones
|
||
23C1033
|
||
337002 ;Tengen's 16pin "Rabbit" CIC clone
|
||
337006 ;Tengen's 40pin "RAMBO-1" mapper with built-in CIC clone
|
||
4051
|
||
7660
|
||
KC5373B
|
||
MX8018
|
||
NINA
|
||
Ciclone ;homebrew multi-region CIC clone (based on Tengen design)
|
||
Aside from using cloned CICs, many unlicensed NES cartridges used a different
|
||
approach: injecting "wrong" voltages to the console, and "stunning" its CIC.
|
||
|
||
SNES CIC Clones
|
||
10198 - CIC clone
|
||
noname - CIC clone (black chip without any part number)
|
||
ST10198S - NTSC CIC clone
|
||
ST10198P - PAL CIC clone
|
||
265111 - maybe also a CIC clone (used in Bung Game Doctor SF6)
|
||
D1 - maybe also a CIC clone (used in Super UFO Pro8)
|
||
74LS112 - reportedly also a CIC clone (with fake part number) (UFO Pro6)
|
||
CIVIC 74LS13 16pin - CIC/D411 clone (used in a 8-in-1 pirate cart)
|
||
CIVIC CT6911 16pin - CIC clone (used in a 7-in-1 pirate cart)
|
||
93C26 16pin - CIC clone (used in a 8-in-1 pirate cart)
|
||
D1 16pin - CIC? (used in Super VG pirate)
|
||
STS9311A 52583 16pin - CIC clone (used in Donkey King Country 3 pirate)
|
||
black blob 16pin - CIC/D411 clone (used in Sonic the Hedgehog pirate)
|
||
|
||
CIC Chip Year/Week Date Codes
|
||
Name YYWW-YYWW
|
||
3193 8539-8642
|
||
3193A 8547-8733 (in cartridges) (but should be in consoles for more years)
|
||
3195 8627-8638
|
||
3195A 8647-9512
|
||
3197A 8647-9227
|
||
6113 8734-8823
|
||
6113A 8823-8933
|
||
6113B1 8847-9344
|
||
|
||
Cartridge CIC Pinouts
|
||
---------------------
|
||
|
||
XXX below "Cart.nn" pin-numbers are for SNES carts (not NES carts).
|
||
|
||
CIC Pinouts
|
||
F411/F413: 18pin SMD-chip (used in console and in some carts)
|
||
D411/D413: 16pin DIP-chip (used in most carts)
|
||
SMD DIP Pin Dir Usage In Console In Cartridge
|
||
1 1 P00 Out DTA0 Cart.55 CIC1 Cart.24 CIC0
|
||
2 2 P01 In DTA1 Cart.24 CIC0 Cart.55 CIC1
|
||
3 3 P02 In RANDOM Via capacitor to VCC NC
|
||
4 4 P03 In MODE VCC=Console (Lock) GND=Cartridge (Key)
|
||
5 NC - (NC) NC NC
|
||
6 5 CL2 - (NC) NC SMD:NC or DIP:GND
|
||
7 6 CL1 In CLK 3.072MHz (from APU) Cart.56 CIC3 (3.072MHz)
|
||
8 7 RES In RESET From Reset button Cart.25 CIC2 (START)
|
||
9 8 GND - GND Supply Supply
|
||
10 9 P10 Out /RESET To PPU (and CPU/APU/etc) NC (or to ROM, eg. in SGB)
|
||
11 10 P11 Out START Cart.25 CIC2 NC
|
||
12 11 P12 - (NC) NC NC (or SlotID in FamicomBox)
|
||
13 12 P13 - (NC) NC NC (or SlotID in FamicomBox)
|
||
14 NC - (NC) NC NC
|
||
15 13 P20 - (NC) NC NC
|
||
16 14 P21 - (NC) NC NC (or SlotID in FamicomBox)
|
||
17 15 P22 - (NC) NC NC (or SlotID in FamicomBox)
|
||
18 16 VCC - VCC Supply Supply
|
||
P00=Out,P01=In are the initial directions (for the Random Seed transfer), later
|
||
on the directions are randomly swapped (ie. P00=In,P01=Out or P00=Out,P01=In).
|
||
START: short HIGH pulse on power-up or when releasing reset button.
|
||
/RESET: in console: to PPU, and from there to CPU,APU,Cart,Expansion.
|
||
|
||
Cartridge CIC Tengen Clone
|
||
--------------------------
|
||
|
||
Tengen Registers
|
||
PC 8bit Program Counter (00h on Reset)
|
||
Acc 4bit Accumulator (aka A)
|
||
RamDta 4bit RAM Data-Read Register (aka X)
|
||
L 4bit RAM Address Register, LSB
|
||
H 1bit RAM Address Register, MSB (0 on Reset)
|
||
Cy 1bit Carry Flag
|
||
DATA_IN 1bit Input from master CIC
|
||
DATA_OUT 1bit Output to master CIC
|
||
|
||
Tengen Memory
|
||
Program ROM = 256x12 bit
|
||
Data RAM = 32x4 bit
|
||
|
||
Type 0 Opcodes - ADD/XNOR with optional Memory Load
|
||
11-10 Must be 00b for Type 0 Opcodes
|
||
9-6 ALU Source 1 and Destination (see list)
|
||
5 ALU Source 2 (0=Zero, 1=RamDta)
|
||
4 ALU Update Carry (0=No, 1=Yes) ;<-- done AFTER ALU
|
||
3 --> RamDta=[H:L] ;<-- done BEFORE ALU
|
||
2 ALU Type (0=ADD, 1=XNOR)
|
||
1-0 ALU Source 3 (0..3 = 0,Cy,1,1-Cy) (should be 0 for XNOR?)
|
||
|
||
Type 1 Opcodes - ADD with Immediate
|
||
11-10 Must be 01b for Type 1 Opcodes
|
||
9-6 ALU Source 1 and Destination (see list)
|
||
5 Unknown/Unused (should be 0)
|
||
4 ALU Update Carry (0=No, 1=Yes) ;<-- done AFTER ALU
|
||
3-0 ALU Source 2 (Immediate 00h..0Fh)
|
||
|
||
Type 2 Opcodes - ADD with optional Special Actions
|
||
11-10 Must be 10b for Type 2 Opcodes
|
||
9-6 ALU Source 1 and Destination (see list, optionally H:0 instead H:L)
|
||
5 ALU Source 2 (0=Zero, 1=RamDta)
|
||
4 ALU Source 3 (0=Zero, 1=DATA_IN)
|
||
3 --> RamDta=[H:L] (or [H:0]) ;<-- done BEFORE ALU
|
||
2 --> Force address H:0 instead H:L ;applies to BOTH read/write [H:L]
|
||
1 --> DATA_OUT=Cy
|
||
0 --> H=Cy ;<-- done AFTER reading/writing [H:L]
|
||
|
||
Type 3 Opcodes - Jumps
|
||
11-10 Must be 11b for Type 3 Opcodes
|
||
9 Jump Condition (0=Always, 1=If Cy=0)
|
||
8 Unknown/Unused (should be 0)
|
||
7-0 Jump Target (PC=00h..FFh)
|
||
|
||
ALU Source 1 and Destination (Bit9-6 of Type 0-2 Opcodes)
|
||
00h Src=None, Dest=None 08h Src=L, Dest=[H:L]=Acc
|
||
01h Src=None, Dest=None * 09h Src=Acc, Dest=[H:L]=Acc
|
||
02h Src=Zero, Dest=Acc 0Ah Src=L, Dest=Acc
|
||
03h Src=Acc, Dest=Acc * 0Bh Src=Acc, Dest=Acc
|
||
04h Src=Zero, Dest=[H:L] 0Ch Src=L, Dest=[H:L]
|
||
05h Src=Acc, Dest=[H:L] * 0Dh Src=Acc, Dest=[H:L]
|
||
06h Src=Zero, Dest=L 0Eh Src=L, Dest=L
|
||
07h Src=Acc, Dest=L * 0Fh Src=Acc, Dest=L
|
||
Note: 01h,03h,05h,07h are (occassionally used) dupes of 00h,0Bh,0Dh,0Fh.
|
||
Mind that Type 2 Opcodes can force RAM address H:0 instead of H:L.
|
||
|
||
Update Carry (when Bit4=1 in Type 0 or 1 opcodes)
|
||
when ALU Dest = None ---> Cy = bit0 or (src2)
|
||
when ALU Type = ADD ---> Cy = carry-out of addition
|
||
when ALU Type = XNOR ---> Cy = bit3 of (src1 OR src2) (??)
|
||
|
||
Timings
|
||
All opcodes take 1 clock cycle (clock is 1MHz).
|
||
|
||
Tengen ROM-image
|
||
There is a "ROM-image" called "tengen2rom.txt" containing "0" and "1" bits in
|
||
ASCII format (mixed with some english text), the "binary" part contains the ROM
|
||
as seen under a microscope:
|
||
There are 2x6 blocks (mapped to the 12bit databus):
|
||
D11 D5
|
||
D10 D4
|
||
D9 D3
|
||
D8 D2
|
||
D7 D1
|
||
D6 D0
|
||
Each block contains 8x32 bits (for 8bit address bus):
|
||
Line 1..32 --> address X+(1Fh..00h)
|
||
Column 1..8 --> address (00h,20h,40h,60h,80h,A0h,C0h,E0h)+Y for D0..D5
|
||
Column 1..8 --> address (E0h,C0h,A0h,80h,60h,40h,20h,00h)+Y for D6..D11
|
||
Recommended format for a binary ROM-image would be padding the 12bit opcodes to
|
||
16bit (bit15-12 zero), and then storing it as a 512-byte file (with the 16bit
|
||
values in little-endian format).
|
||
Warning: The Tengen CIC stream initialization isn't done by "L=imm, [HL]=imm"
|
||
pairs, but rather by cryptic stuff like "L=L+X+cy, [HL]=A XNOR X".
|
||
|
||
Cartridge Cheat Devices
|
||
-----------------------
|
||
|
||
Game Genie (19xx)
|
||
The Game Genie is an adapter to be connected between the console and game
|
||
cartridge, it includes a BIOS ROM which prompts the user to enter 6-letter or
|
||
8-letter cheat-codes, and then starts the actual game.
|
||
The adapter compares the CPU address bus (PRG ROM area 8000h-FFFFh), and
|
||
optionally also the CPU data bus (reduces the risk to mess-up values in other
|
||
banks in cartridges with Memory Mappers), if the comparision matches, then the
|
||
value on data bus will be replaced.
|
||
Game Genie Code Format
|
||
The letters are translated into 4bit Hex-digits:
|
||
Hex 0 1 2 3 4 5 6 7 8 9 A B C D E F
|
||
Letter A P Z L G I T Y E O X U K S V N
|
||
Address/Data/Compare bits A14-A0, D7-D0, C7-C0 are scrambled as such:
|
||
Char Bit3 Bit2 Bit1 Bit0 Char Bit3 Bit2 Bit1 Bit0
|
||
1st D7 D2 D1 D0 2nd A7 D6 D5 D4
|
||
3rd LEN A6 A5 A4 4th A3 A14 A13 A12
|
||
5th A11 A2 A1 A0 6th CD3 A10 A9 A8
|
||
7th C7 C2 C1 C0 8th D3 C6 C5 C4
|
||
6-Letter code: LEN=0, CD3 used as D3, acts as "[A]=D"
|
||
8-letter code: LEN=1, CD3 used as C3, acts as "If [A]=C then [A]=D"
|
||
Example: Code "SXIOPO" changes [91D9h]=ADh (Infinite lives in smb1).
|
||
|
||
Pro Action Replay (PAR) (Datel) (1992)
|
||
XXX...
|
||
|
||
Pro Action Rocky (by Cyber Gadget) (2003) (Japan/Famicom)
|
||
This thing seems to be the first and only cheat device released for the
|
||
japanese Famicom (although it came out much later than the NES cheat devices).
|
||
The strange name is apparently inspired on Elvis Presley or Sylvester Stallone
|
||
& on Datel's Pro Action Replay. The hardware uses ROM patches (and thus works
|
||
more like Game Genie than Pro Action Replay). Codes are 8-digit hex values in
|
||
following format.
|
||
DDCCAAAA ;Data,Compare,Address, ie. "if [AAAA]=CC then [AAAA]=DD"
|
||
And, of course, there's some annoying encryption...
|
||
Pro Action Rocky Encode (raw to code):
|
||
raw=raw AND FFFF7FFFh ;strip unused address MSB from the DDCCAAAAh value
|
||
for i=0 to 31
|
||
code=code SHR 1
|
||
if raw AND (1 SHL xlat[i]) then code=code XOR B8309722h
|
||
next i
|
||
code=code XOR FCBDD275h
|
||
Pro Action Rocky Decode (code to raw):
|
||
code=code XOR FCBDD275h, raw=00000000h
|
||
for i=31 to 0
|
||
if code AND 80000000h then raw=raw+(1 SHL xlat[i]), code=code XOR B8309722h
|
||
code=code SHL 1
|
||
next i
|
||
raw=raw OR 00008000h ;add unused/fixed address MSB to the DDCCAAAAh value
|
||
Pro Action Rocky Bit Translation (xlat[0..31]):
|
||
15, 3,13,14, 1, 6, 9, 5, 0,12, 7, 2, 8,10,11, 4
|
||
19,21,23,22,20,17,16,18,29,31,24,26,25,30,27,28
|
||
|
||
Cartridge Pin-Outs
|
||
------------------
|
||
|
||
60-Pin Famicom Cartridge connector
|
||
1 GND 19-25 PPU A6-A0 45 EXP SND_IN
|
||
2-13 CPU A11-A0 26-29 PPU D0-D3 45,46 EXP SND_OUT
|
||
14 CPU R/W 30-31 +5VDC 47 PPU /WR
|
||
15 CPU /IRQ 32 PHI2 CLK 48 PPU NT /CS
|
||
16 GND 33,35 CPU A12-A14 49 PPU NT /A13
|
||
17 PPU /RD 36-43 CPU D7-D0 49-56 PPU A7-A12,A13
|
||
18 PPU NT A10 44 CPU /PRG 57-60 PPU D7-D4
|
||
The Famicom connector uses standard 2.54mm pitch.
|
||
|
||
72-Pin NES Cart connector
|
||
Pin Dir Use Expl. __________________________
|
||
1 Out VEE GND 1| |36
|
||
2-13 Out CPU A11-A0 37|__________________________|72
|
||
14 Out CPU R/W
|
||
15 I/O CPU /IRQ
|
||
16-20 I/O EXP Expansion Port Pins 42-38 (not used by the console itself)
|
||
21 Out PPU /R
|
||
22 In PPU VA10 (A10 of internal 2K VRAM, ie. select BLK0 or BLK1)
|
||
23-29 Out PPU A6-A0
|
||
30-33 I/O PPU D0-D3
|
||
34-35 I/O CIC S0-S1 (cicurity/lockup chip protocol signals)
|
||
36 Out VCC +5VDC
|
||
37 Out CPU 21.47727MHz (NTSC), 26.601712MHz (PAL)
|
||
38 Out CPU PHI2
|
||
39-41 Out CPU A12-A14
|
||
42-49 I/O CPU D7-D0
|
||
50 Out CPU /PRG (PRG-ROM access, logical NAND of PHI2 and CPU A15)
|
||
51-55 I/O EXP Expansion Port Pins 06-10 (not used by the console itself)
|
||
56 Out PPU /W
|
||
57 In PPU /VCS (internal 2K VRAM Chip-Select)
|
||
58 Out PPU /A13 (inverted A13, wired to /VCS when used as name table)
|
||
59-65 Out PPU A7-A9,A11,A10,A12-A13
|
||
66-69 I/O PPU D7-D4
|
||
70 I/O CIC S2 (cicurity/lockup chip protocol signals)
|
||
71 Out CIC 4Mhz (cicurity/lockout chip clock line)
|
||
72 Out VEE GND
|
||
Caution: The NES edge connector uses a nonstandard 2.5mm pitch (not 2.54mm).
|
||
And, the PCBs (including copper layers) are only 1.2mm thick (not 1.5mm).
|
||
There's no tolerance there (2.54mm pitch would produce short-cuts, and
|
||
inserting or removing 1.5mm PCBs works only with extreme force).
|
||
|
||
Cartridge Shell Dimensions
|
||
--------------------------
|
||
|
||
NES Cart-Shell with NES-NROM PCB Dimensions
|
||
|------------------119.7mm----------------|
|
||
_________________________________________ _ _
|
||
| |.......| | |
|
||
| |.......| | |
|
||
| |_______| | |
|
||
| | | 87.0mm
|
||
| | |
|
||
| 3.25mm 1.5mm | |
|
||
| |-|-|---------93.25mm---------|-| | |
|
||
_ _ | 1.5mm _________________________ | _ _ _|_
|
||
_|_ 2.5mm | _| NES-NROM-256-06 | | | 6.0mm |
|
||
_|_ 6.0mm | _| |_ | _|_ |
|
||
| | | PCB, 100x40 mm | | | |
|
||
| | O| |O | | |
|
||
| |_ _ | Component Side | _ _| | 19.5mm | 40.0mm
|
||
| 17.0mm | || || | | |
|
||
_|_ | ||_ Edge-Connector, 2.5mm pitch _|| | _|_ |
|
||
| 14.5mm | | | ||||||||||||||||||||||||| | | | | 14.5mm |
|
||
_|_ | | |___________________________| | | _|_ _|_
|
||
| | | | |
|
||
| | |-----------93.5mm----------| | | | 7.0mm
|
||
| ||------------100.0mm------------|| | |
|
||
|_|_________________________________|_| _|_
|
||
|
||
|-------------100.5mm-------------|
|
||
|---------------106.0mm---------------|
|
||
|
||
NES Cart-Shell, Connector Side
|
||
6.4mm 3.0mm 3.0mm 6.4mm Front/Component
|
||
|----|-| |-|----| Side
|
||
_ _ ____ _________________________________ ____ _ _ _ _
|
||
_|_ 3.0mm | | _____________________________ | | | 13.0 |
|
||
| 10.75mm | | | _________________________ | | | | mm | 16.75
|
||
_|_ '. | |_____________________________| | .' - -3.75 | mm
|
||
_|_ 3.0mm '._|_________________________________|_.' _|_ mm _|_
|
||
2.0mm 4.4mm
|
||
|-| |-----------100.5mm-----------| |--| Back/Solder
|
||
|-------------106.0mm-------------| Side
|
||
|------------------119.7mm------------------|
|
||
|
||
NES Cart-Shell, Side View
|
||
|-24.0mm-|----------109.7mm--------------| Front/Component Side
|
||
_ _ ________ _______________________________ _ _ _ _
|
||
_|_ 3.0mm |________| | | |
|
||
| | ____|__ __________ _ _ |||| | 13.0mm | 16.75
|
||
| 10.75mm | |____ __:___PCB____| _|_ 1.2mm |||| | |
|
||
_|_ |________|...............................' ... | mm
|
||
_|_ 3.0mm |________|____________________________.' _|_3.75mm _|_
|
||
7.0mm 4.4mm
|
||
|---|------40.mm-------| |--|
|
||
|-----------------129.6mm-------------| Back/Solder Side
|
||
|-----------------134.0mm----------------|
|
||
|
||
Caution
|
||
Above values aren't 100% correct.
|
||
|
||
Mapper 0: NROM - No Mapper (or unknown mapper)
|
||
----------------------------------------------
|
||
|
||
NROM (No Mapper)
|
||
Used in games with (max) 32K ROM + 8K VROM, ie. games that do not require any
|
||
bank-switching hardware.
|
||
Name Table can be hardwired either to Horizontal or Vertical Mirroring.
|
||
|
||
Unknown Mappers
|
||
ROM-Images with unknown mapping hardware are also often assigned as "Mapper 0".
|
||
Namely, if the ROM is bigger than 32K+8K, then it's obviously some unknown
|
||
stuff rather than NROM.
|
||
|
||
Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT
|
||
--------------------------------------------
|
||
|
||
This mapper is used on numerous U.S. and Japanese games, including Legend of
|
||
Zelda, Metroid, Rad Racer, Mega Man 2, and many others.
|
||
8000h-FFFFh
|
||
Bit 0 Serial data loaded to 5bit shift register (LSB=1st write)
|
||
Bit 7 Clear 5bit shift register (1=Reset, next write will be "1st write")
|
||
On fifth write, data in shift register is copied to Register 0..3 (depending on
|
||
upper address bits), and the shift register is automatically cleared.
|
||
8000h-9FFFh Register 0 - Configuration Register
|
||
Bit0-1 Name Table Mirroring
|
||
0 Single-Screen BLK0
|
||
1 Single-Screen BLK1
|
||
2 Two-Screen Vertical Mirroring
|
||
3 Two-Screen Horizontal Mirroring
|
||
Bit2-3 PRG-Switching Mode (usually 3)
|
||
0,1 Switchable 32K Area at 8000h-FFFFh (via Register 3)
|
||
2 Switchable 16K Area at C000h-FFFFh (via Register 3)
|
||
And Fixed 16K Area at 8000h-BFFFh (always 1st 16K)
|
||
3 Switchable 16K Area at 8000h-BFFFh (via Register 3)
|
||
And Fixed 16K Area at C000h-FFFFh (always last 16K)
|
||
Bit4 VROM Switching Size (for carts with VROM)
|
||
0 Swap 8K of VROM at PPU 0000h
|
||
1 Swap 4K of VROM at PPU 0000h and 1000h
|
||
A000h-BFFFh Register 1
|
||
Bit4-0 Select 4K or 8K VROM bank at 0000h (4K and 8K Mode, see Reg0/Bit4)
|
||
C000h-DFFFh Register 2
|
||
Bit4-0 Select 4K VROM bank at 1000h (used in 4K Mode only, see Reg0/Bit4)
|
||
E000h-FFFFh Register 3
|
||
Bit3-0 Select 16K or 2x16K ROM bank (see Reg0/Bit3-2)
|
||
Bit4 RAM Disable (newer MMC1 revisions only)
|
||
Initially 1st and last 16K are mapped to 8000h and C000h.
|
||
In 32K PRG and 8K VROM mode, bank numbers specified in steps of two.
|
||
|
||
Register 3 is restricted to sixteen 16K banks, cartridges with more than 256K
|
||
PRG ROM use Bit4 of Register 0-2 to expand the available memory area:
|
||
Register 0, Bit 4
|
||
<1024K carts>
|
||
0 = Ignore 256K selection register 1
|
||
1 = Acknowledge 256K selection register 1
|
||
Register 1, Bit4 - 256K ROM Selection Register 0
|
||
<512K carts>
|
||
0 = Swap banks from first 256K of PRG
|
||
1 = Swap banks from second 256K of PRG
|
||
<1024K carts with bit 4 of register 0 off>
|
||
0 = Swap banks from first 256K of PRG
|
||
1 = Swap banks from third 256K of PRG
|
||
<1024K carts with bit 4 of register 0 on>
|
||
Low bit of 256K PRG bank selection
|
||
Register 2, Bit4 - 256K ROM Selection Register 1
|
||
<1024K carts with bit 4 of register 0 off>
|
||
Store but ignore this bit (base 256K selection on 256K selection Reg 0)
|
||
<1024K carts with bit 4 of register 0 on>
|
||
High bit of 256K PRG bank selection
|
||
|
||
Reportedly some MMC1 carts have 16K SRAM, of which only 8K are battery backed,
|
||
no idea how/where the additionally 8K are accessed, and no idea which 8K are
|
||
battery backed and which are not (?).
|
||
|
||
Mapper 2: UNROM - PRG/16K
|
||
-------------------------
|
||
|
||
This mapper is used on many older U.S. and Japanese games, such as Castlevania,
|
||
Mega Man, Ghosts & Goblins, and Amagon.
|
||
8000h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM at C000h-FFFFh (always last bank)
|
||
All carts using it have 8K of VRAM at PPU 0000h. Most carts with this mapper
|
||
are 128K. A few, mostly Japanese carts, such as Final Fantasy 2 and Dragon
|
||
Quest 3, are 256K.
|
||
Bus-conflicts. Uses a 74LS161 chip (connection: /PRG-CLK, R/W-/LOAD), and its
|
||
outputs are each ORed with A14 by a 74LS32 chip.
|
||
Board NES-UN-ROM-05 and Konami 531320 (both using only 3bits / 8banks)
|
||
|
||
Mapper 3: CNROM - VROM/8K
|
||
-------------------------
|
||
|
||
This mapper is used on many older U.S. and Japanese games, such as Solomon's
|
||
Key, Gradius, Cybernoid, and Hudson's Adventure Island.
|
||
8000h-FFFFh
|
||
Bit 0-1 Select 8K VROM bank at PPU 0000h (initially 1st bank)
|
||
Bit 4-5 Security Diodes (some crude copy protection)
|
||
Bus-conflicts. Contains a 74LS161 counter chip mis-used as 4bit latch
|
||
(connection: /PRG-CLK, R/W-/LOAD).
|
||
Cybernoid supports both above Port 8000h-FFFFh, and alternately Port 6000h.
|
||
|
||
Security Diodes
|
||
Some CNROM boards can be fitted with "Security Diodes", wired as so:
|
||
Mapper.Bit5 ---- D1 ---- PPU.A10
|
||
Mapper.Bit4 ---- D2 ---- PPU.A12
|
||
The diodes can be pointed in this or that direction (to or from PPU), the game
|
||
program code (or cartridge dumping device) must configure the two mapper
|
||
outputs according to the diode directions (so that no current will flow through
|
||
the diodes) (otherwise the diodes would cause shortcuts on the PPU address
|
||
lines, causing the VROM to output garbage).
|
||
There is also another board with Security Diodes and additional VROM-disable
|
||
feature:
|
||
--> Mapper 185: VROM-disable
|
||
|
||
Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
--------------------------------------------------
|
||
|
||
A great majority of newer NES games (early 90's) use this mapper, both U.S. and
|
||
Japanese. Among the better-known MMC3 titles are Super Mario Bros. 2 and 3,
|
||
Mega Man 3, 4, 5, and 6, and Crystalis.
|
||
8000h Index/Control (5bit)
|
||
Bit7 CHR Address Select (0=Normal, 1=Address Areas XOR 1000h)
|
||
Bit6 PRG Register 6 Area (0=8000h-9FFFh, 1=C000h-DFFFh)
|
||
Bit2-0 Command Number
|
||
0 - Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh, if Bit7=1)
|
||
1 - Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh, if Bit7=1)
|
||
2 - Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh, if Bit7=1)
|
||
3 - Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh, if Bit7=1)
|
||
4 - Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh, if Bit7=1)
|
||
5 - Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh, if Bit7=1)
|
||
6 - Select 8K ROM at 8000h-9FFFh (or C000h-DFFFh, if Bit6=1)
|
||
7 - Select 8K ROM at A000h-BFFFh
|
||
N/A - Fixed 8K ROM at C000h-DFFFh (or 8000h-9FFFh, if Bit6=1)
|
||
N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank)
|
||
8001h Data Register (Indexed via Port 8000h)
|
||
A000h Mirroring Select (Bit0: 0=Vertical, 1=Horizontal Mirroring)
|
||
A001h Save RAM Control for RAM at 6000h-7FFFh:
|
||
Bit7: SRAM Chip Enable (0=Disable both read/write, 1=Enable)
|
||
Bit6: SRAM Write Protect (0=Read/Write-able, 1=Read-only)
|
||
C000h IRQ Reload Value (loaded into IRQ Counter on Counter underflow)
|
||
C001h IRQ Force Reload (writing any value will set the Counter to zero,
|
||
so that underflow/reload will occur at next rising edge of A13)
|
||
E000h IRQ Disable/Acknowledge (write any value) ;doesn't change/stop counter
|
||
E001h IRQ Enable (write any value) ;doesn't change/reload counter
|
||
The fixed PRG banks are always the LAST two 8K banks in the cart.
|
||
On carts with VROM, the first 8K of VROM is swapped into PPU $0000 on reset.
|
||
On carts without VROM, as always, there is 8K of VRAM at PPU $0000.
|
||
|
||
The IRQ counter is decremented each scanline, based on PPU address line A13
|
||
which toggles between Pattern Tables (LOW) and Name Tables (HIGH) 42 times per
|
||
scanline. The counter is paused during VBlank, which allows to use the same
|
||
settings for PAL and NTSC timings. Note that the counter gets clocked when
|
||
toggling A13 a bunch of times during VBlank by software via Port 2006h.
|
||
|
||
MMC3 Boards
|
||
NES-TEROM - Max. 64K PRG, 64K CHR, optionally hardwired mirroring
|
||
NES-TQROM - Max. 128K PRG, 64K CHR, 8K CHR-RAM (see Mapper 119)
|
||
NES-TVROM - Max. 128K PRG, 64K CHR, 4-screen mirroring (Rad Racer II)
|
||
NES-TFROM - Max. 512K PRG, 64K CHR, optionally hardwired mirroring
|
||
NES-TGROM - Max. 512K PRG, 8K CHR-RAM
|
||
NES-TSROM - Max. 512K PRG, 256K CHR, 8K WRAM, Non-battery-backed.
|
||
NES-TKROM - Max. 512K PRG, 256K CHR, 8K WRAM, Battery-backed.
|
||
NES-TLROM - Max. 512K PRG, 256K CHR
|
||
NES-TLSROM - Max. ?K PRG, 128K CHR, NT-bank-select (see Mapper 118)
|
||
NES-TR1ROM - Max. 512K PRG, 64K CHR, 4-screen mirroring (Gauntlet)
|
||
|
||
MMC3 Variants
|
||
--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ
|
||
--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ
|
||
|
||
MMC6 (same as MMC3 but with on-chip PRG-RAM) (this is also named "Mapper 4")
|
||
NES-HKROM - used only by StarTropics and StarTropics 2
|
||
|
||
Multicarts with MMC3 and additional Game-Select Ports
|
||
--> Mapper 44: 7-in-1 MMC3 Port A001h
|
||
--> Mapper 45: X-in-1 MMC3 Port 6000hx4
|
||
--> Mapper 47: 2-in-1 MMC3 Port 6000h
|
||
--> Mapper 49: 4-in-1 MMC3 Port 6xxxh
|
||
--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM
|
||
|
||
Tengen MIMIC-1 (MMC3 Variant)
|
||
Tengen MIMIC-1 uses only Port 8000h (lower 3bit only) and Port 8001h.
|
||
The ROM-images are typically declared as "Mapper 4" even though it supports
|
||
only a subset of the MMC3 functions. Tengen's Gauntlet additionally contains 2K
|
||
SRAM to expand Name Table memory to 4K.
|
||
|
||
IRQ Notes form Kevin Horton...
|
||
[Observe that the A12-stuff conflicts with above 42-step-A13-prescale] [?]
|
||
[According below, IRQ when counter=00h, but reload when counter<00h] [?]
|
||
* The IRQ counter WILL NOT STOP. It will continue to decrement and reload
|
||
as long as A12 on the PPU bus toggles.
|
||
* Whenever the IRQ counter changes from a non-zero value to 00h, the IRQ
|
||
flag will be set if it is enabled.
|
||
* The exact number of scanlines before the interrupt fires is (N+1),
|
||
where N = the IRQ reload value. 2 to 256 scanlines are supported.
|
||
* Writing 00h to C000h will result in a SINGLE interrupt being generated
|
||
on the next rising edge of A12. No more interrupts will be generated
|
||
until C000h is changed to a non-zero value. The counter is still being
|
||
reloaded, however, because writing a non-zero value to C000h results in
|
||
it firing an interrupt after the new count expires.
|
||
|
||
* The IRQ counter WILL NOT DECREMENT AT ALL unless bit 3 OR bit 4 of 2000h
|
||
on the PPU are set! If both of these bits are clear, the IRQ counter will
|
||
not count no way no how!!!
|
||
If both are set, the counter decrements twice per frame on my MMC3, but
|
||
it may act erratically on your MMC3. Don't count on this effect occuring.
|
||
|
||
* For some reason, yet to be determined, if both bits 3 and 4 of PPU
|
||
register 2000h are clear, the IRQ counter will not decrement, even if
|
||
the PPU address is manually manipulated (with 2001h set to 00h to disable
|
||
rendering) through 2006h. If either or both bits are set, the counter will
|
||
decrement properly if the PPU address is manually manipulated.
|
||
|
||
Various notes and effects of the IRQ counter reloading stuff:
|
||
The IRQ counter reloading has some minor consequences that should be made
|
||
clear. Some games like Megaman 6 and Pinbot use this so emulating properly
|
||
is important for these games to work.
|
||
|
||
MM6 will write to E000h to clear the flag, E001h to re-enable interrupts,
|
||
and finally it will write to C000h to set up a new time period. This is
|
||
legal SO LONG AS C000h is written to before the next scanline (remember:
|
||
the counter is reloaded on the NEXT rising edge of A12 after the counter
|
||
reaches 00h, and thus fires).
|
||
|
||
Kevin did a little test to determine the effect of C001h on the IRQ counter
|
||
like so:
|
||
First, C000h had 02h written to it. Toggling A12 3 times resulted in an IRQ
|
||
being generated. The IRQ was cleared, then A12 was toggled 2 more times.
|
||
Next, 03h was written to C000h, C001h was written to, and finally 04h was
|
||
written to C000h. A12 was toggled again and it took *5* counts to flag an
|
||
interrupt, proving that the value of C000h is only checked at the time of
|
||
reloading on the rising edge of A12. Kevin performed other tests to
|
||
corroborate this, and they all passed (i.e. checking to see if the reload
|
||
happened on the FALLING edge of A12, etc.)
|
||
|
||
Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc.
|
||
-----------------------------------------------------------
|
||
|
||
Used by Gun Sight (Laser Invasion), Uchuu Keibitai SDF, Bandit Kings
|
||
(Suikoden), Castlevania 3, Nobunaga Sengoku (Nobunaga's Ambition 2), Nobunaga
|
||
Bushou, Shin 4 Nin Uchi Mahjong, Ishin no Arashi, L'Empereur, Ganbare Goemon
|
||
Gaiden (bugged hack?), Romance of the Three Kingdoms 2 (Sangokushi 2), Gemfire
|
||
(Royal Blood), Uncharted Waters (Daikoukai Jidai), Aoki Ookami, Just Breed,
|
||
Metal Slader Glory.
|
||
|
||
--> Mapper 5: MMC5 - I/O Map
|
||
--> Mapper 5: MMC5 - CPU Memory Control
|
||
--> Mapper 5: MMC5 - Video Name Table
|
||
--> Mapper 5: MMC5 - Video Pattern Table
|
||
--> Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit
|
||
--> Mapper 5: MMC5 - Video EXRAM
|
||
--> Mapper 5: MMC5 - Sound Control
|
||
|
||
Mapper 5: MMC5 - I/O Map
|
||
------------------------
|
||
|
||
Summary of all MMC5 Registers
|
||
5000h Sound Channel 1 Pulse Control ;\
|
||
5002h Sound Channel 1 Frequency LSB ;
|
||
5003h Sound Channel 1 Frequency MSB ;/
|
||
5004h Sound Channel 2 Pulse Control ;\
|
||
5006h Sound Channel 2 Frequency LSB ;
|
||
5007h Sound Channel 2 Frequency MSB ;/
|
||
5010h Sound Channel 3 PCM Control/Status (R/W)
|
||
5011h Sound Channel 3 PCM Data
|
||
5015h Sound Channel 1 and 2 Enable/Status (R/W)
|
||
5100h PRG Bank Size (Mode for Port 5114h-5117h)
|
||
5101h CHR Bank Size
|
||
5102h RAM Write Protect Key 1
|
||
5103h RAM Write Protect Key 2
|
||
5104h EXRAM Mode Setting
|
||
5105h Name Table Select
|
||
5106h Name Table Fill-Mode Tile Number
|
||
5107h Name Table Fill-Mode Palette Number
|
||
5113h-5117h PRG Bank Selection Registers
|
||
5120h-5127h CHR Bank Selection for Sprites and for CPU Access
|
||
5128h-512Bh CHR Bank Selection for Background
|
||
5130h CHR Bank MSBs
|
||
5200h Horizontal Split Control
|
||
5201h Horizontal Split Scroll Position
|
||
5202h Horizontal Split CHR Bank Selection
|
||
5203h Vertical IRQ Counter
|
||
5204h Vertical IRQ Control/Status (R/W)
|
||
5205h Multiply Unit input/output (R/W)
|
||
5206h Multiply Unit input/output (R/W)
|
||
5800h Unknown... (Just Breed writes 0xh to this address)
|
||
5C00h-5FFFh EXRAM (1K) (R/W)
|
||
Ports 5102h-5103h, 5105h-5107h, 5200h-5203h are Write Only.
|
||
Ports 5204h-5206h are Read/Write. Other Ports unknown.
|
||
|
||
Mapper 5: MMC5 - CPU Memory Control
|
||
-----------------------------------
|
||
|
||
5100h - PRG Bank Size Control (Mode for Port 5114h-5117h)
|
||
Bit7-2 Not used
|
||
Bit1-0 PRG Bank Size (0=32K, 1=16K, 2=Mixed, 3=8K)
|
||
|
||
5102h-5103h - RAM Write Protect Keys
|
||
5102h RAM Write Protect Key 0 (Lower 2bit must be 02h for write-enable)
|
||
5103h RAM Write Protect Key 1 (Lower 2bit must be 01h for write-enable)
|
||
RAM is always read-able, but is write-able only with above settings.
|
||
|
||
5113h-5117h - PRG Bank Selection Registers
|
||
Port Type Mode3/8K Mode2/Mixed Mode1/16K Mode0/32K
|
||
5113h RAM 8K at 6000h 8K at 6000h 8K at 6000h 8K at 6000h
|
||
5114h ROM/RAM 8K at 8000h, N/A , N/A , N/A
|
||
5115h ROM/RAM 8K at A000h, 2x8K at 8000h, 2x8K at 8000h, N/A
|
||
5116h ROM/RAM 8K at C000h, 8K at C000h, N/A , N/A
|
||
5117h ROM 8K at E000h, 8K at E000h, 2x8K at C000h, 4x8K at 8000h
|
||
Lower one or two bits of 2x8K or 4x8K bank numbers are ignored.
|
||
|
||
RAM bank selection via Port 5113h-5116h (not 5117h):
|
||
Bit7 ROM/RAM Mode (0=RAM, 1=ROM) (Port 5114h-5116h only, not 5113h,5117h)
|
||
Bit6-3 Not used
|
||
Bit2 RAM Chip Select (0=1st chip, 1=2nd chip, or open bus if single chip)
|
||
Bit1-0 Select 8K RAM Bank in currently selected RAM chip (32K chips only)
|
||
Existing RAM configurations are: 8K (single 8K chip), 16K (two 8K chips),
|
||
and 32K (single 32K chip).
|
||
|
||
On reset, 8K mode is activated, and all ROM banks are set to the LAST 8K bank
|
||
in the cartridge.
|
||
|
||
Mapper 5: MMC5 - Video Name Table
|
||
---------------------------------
|
||
|
||
5105h - Name Table Select
|
||
Bit1-0 Select NT0 VRAM at 2000h-23FFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE)
|
||
Bit3-2 Select NT1 VRAM at 2400h-27FFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE)
|
||
Bit5-4 Select NT2 VRAM at 2800h-2BFFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE)
|
||
Bit7-6 Select NT3 VRAM at 2C00h-2FFFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE)
|
||
If it isn't used for other purpose, then EXRAM can be used as 3rd Name-table.
|
||
|
||
5106h - Name Table Fill-Mode Tile Number (Bit7-0)
|
||
5107h - Name Table Fill-Mode Palette Number (only Bit1-0 used)
|
||
In FILLMODE, the entire Name-table is filled by Port 5106h/5107h settings.
|
||
|
||
Mapper 5: MMC5 - Video Pattern Table
|
||
------------------------------------
|
||
|
||
5101h - CHR Page Size
|
||
Bit7-6 Not used
|
||
Bit1-0 CHR Bank Size (0=8K, 1=4K, 2=2K, 3=1K)
|
||
Bank selection registers below are 8bit, so 1K mode can address only 256K VROM,
|
||
8K mode could address up to 2MB VROM.
|
||
|
||
5120h-5127h - CHR Bank Selection for Sprites and for CPU Access
|
||
Port Mode3/1K Mode2/2K Mode1/4K Mode1/8K
|
||
5120h 1K at 0000h N/A N/A N/A
|
||
5121h 1K at 0400h 2K at 0000h N/A N/A
|
||
5122h 1K at 0800h N/A N/A N/A
|
||
5123h 1K at 0C00h 2K at 0800h 4K at 0000h N/A
|
||
5124h 1K at 1000h N/A N/A N/A
|
||
5125h 1K at 1400h 2K at 1000h N/A N/A
|
||
5126h 1K at 1800h N/A N/A N/A
|
||
5127h 1K at 1C00h 2K at 1800h 4K at 1000h 8K at 0000h
|
||
Used for Sprite Tiles (not for Background Tiles), and also used for CPU VRAM
|
||
Access via Port 2006h/2007h.
|
||
|
||
5128h-512Bh - CHR Bank Selection for Background
|
||
5128h 1K at X000h N/A N/A N/A
|
||
5129h 1K at X400h 2K at X000h N/A N/A
|
||
512Ah 1K at X800h N/A N/A N/A
|
||
512Bh 1K at XC00h 2K at X800h 4K at X000h 8K at 0000h
|
||
Used for Background Tiles, the "XN00h" addresses in 1K,2K,4K are shared for
|
||
both Pattern Tables at 0N00h and 1N00h, ie. BG Pattern Table selection in Port
|
||
2000h/Bit4 doesn't matter (except in 8K mode).
|
||
|
||
5130h - CHR Bank MSBs
|
||
Just Breed, Gun Sight, and Uchuu Keibitai SDF write 00h to this address.
|
||
Bit7-6 Not used
|
||
Bit1-0 Upper 2bit for 8bit Port 5120h-512Bh, and for EXRAM 6bit Tile Banks
|
||
Writing to Port 5120h-512Bh copies the written 8bit value plus the 2bit port
|
||
5130h value to internal 10bit registers (subsequent writes to 5130h do not
|
||
affect those memorized 10bit bank numbers).
|
||
|
||
Other Background CHR Bank Selection Modes (which do not use 5128h-512Bh)
|
||
In Horizontal Split Mode, left or right BG Tiles use 4K CHR bank in Port 5202h.
|
||
In ExGrafix Mode, 4K CHR banks are specified for each single BG Tile in EXRAM.
|
||
|
||
Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit
|
||
------------------------------------------------------
|
||
|
||
MMC5 allows to split the screen horizontally and vertically.
|
||
Horizontal Split is handled by hardware (automatically mid-scanline).
|
||
Vertical Split is to be handled by software (upon IRQ during HBlank).
|
||
|
||
5200h - Horizontal Split Control
|
||
Bit7 For the E function (0=Don't use, 1=Use)
|
||
Bit6 Boundary's side is for using Split Mode extension of graphics
|
||
(0=Left side, 1=Right side)
|
||
Bit5 Not used
|
||
Bit4-0 Left boundary is designated with the char. # to count places
|
||
Used by Uchuu Keibitai SDF, most or all other games don't use H-Split.
|
||
Examples for 5200h Settings:
|
||
00h (not?) used yet
|
||
82h Used for SplitMode GFX extension from left 1-2 character
|
||
C2h Used for SplitMode GFX extension from the right side 3 chars.
|
||
C0h Used for SplitMode GFX extension on the whole screen
|
||
D0h Used for SplitMode GFX extension on the right side of the screen
|
||
90h Used for SplitMode GFX extension on the left side of the screen
|
||
|
||
5201h - Horizontal Split Scroll Position
|
||
"$2005 determines the vertical movement; it can also delay ext. gfx's vert.
|
||
movement if necessary. It's written 2 times in bulk in the same way as it would
|
||
slip off a grade in $2005."
|
||
|
||
5202h - Horizontal Split CHR Bank Selection
|
||
Bit7-6 Not used
|
||
Bit5-0 Select 4K VROM at both 0000h-0FFFh and 1000h-1FFFh
|
||
Presumably used for BG Tiles in the Horizontal Split area, instead of the
|
||
normal BG-CHR Bank Selection via 5128h-512Bh.
|
||
|
||
5203h - Vertical IRQ Counter
|
||
MMC3-style, decremented each scanline, paused during VBlank.
|
||
A setting of 00h seems to disable the counter (or, maybe sets it to 256 lines).
|
||
|
||
5204h - Vertical IRQ Control/Status (R/W)
|
||
Bit7/Write IRQ Enable (0=Disable, 1=Enable; forward IRQ Flag to CPU)
|
||
Bit7/Read IRQ Flag (0=No, 1=Interrupt Request; gets set even if disabled)
|
||
Bit6/Read In Frame Rendering Flag (0=Vblank, 1=Rendering/Non-Vblank)
|
||
The IRQ flag is cleared/acknowledged when reading 5204h, and also automatically
|
||
during Vblank.
|
||
|
||
5205h - Unsigned Multiply unit Factor A (W) / Result LSB (R)
|
||
5206h - Unsigned Multiply unit Factor B (W) / Result MSB (R)
|
||
Multiplication is unsigned. There is no noticable delay (the 16bit result can
|
||
be read back right after writing).
|
||
|
||
Mapper 5: MMC5 - Video EXRAM
|
||
----------------------------
|
||
|
||
5C00h-5FFFh - EXRAM
|
||
Built-in 1K RAM, can be used in different modes, as VRAM or as WRAM.
|
||
|
||
5104h - EXRAM Mode Setting
|
||
Bit7-6 Not used
|
||
Bit1-0 Select EXRAM Mode
|
||
0 VRAM Extra Name Table (via Port 5105h)
|
||
1 VRAM ExGrafix Color Expansion (see below)
|
||
2 General purpose WRAM (read/write)
|
||
3 General purpose WRAM (write protected)
|
||
In VRAM modes, EXRAM can be probably accessed during VBlank only (just as
|
||
normal VRAM). In WRAM modes, EXRAM can be probably accessed at any time, for
|
||
use as general purpose Work RAM, instead of (or additionally to) normal SRAM.
|
||
|
||
ExGrafix Mode (used by most MMC5 titles, except Castlevania 3)
|
||
5C00h-5FBFh - Tile Number banks and Palettes for 32x30 Tiles
|
||
Bit7-6 Palette Number for each Tile
|
||
Bit5-0 4K Bank Number for each Tile (upper 2bit in port 5130h)
|
||
The 6bit+2bit Bank Numbers expand each of the 8bit Tile Numbers in Name Table
|
||
entries 000h-3BFh to 16bit Tile Numbers (max 1MB VROM addressable). The Palette
|
||
Numbers allow to specify different palettes for each single Tile, instead of
|
||
the normal Name Table palettes which share one palette entry for each 4 Tiles.
|
||
Name Table entries 3C0h-3FFh and EXRAM 5FC0h-5FFFh are not used in this mode.
|
||
Also BG-CHR Bank Selection Ports 5128h-512Bh are not used.
|
||
|
||
Mapper 5: MMC5 - Sound Control
|
||
------------------------------
|
||
|
||
MMC5 Sound, Japanese 60pin Famicom carts only, not NES 72pin carts.
|
||
The MMC5 sound registers (port 50xxh) are working very similar to NES APU
|
||
registers (port 40xxh), but without sweep support, without triangle/noise
|
||
channels, without real DMA, and with a bunch of other differences.
|
||
|
||
5000h - MMC5 Sound Volume/Decay Channel 1 (Rectangle)
|
||
5004h - MMC5 Sound Volume/Decay Channel 2 (Rectangle)
|
||
0-3 Volume / Envelope decay rate
|
||
When Bit4=1: Volume (0=Silent/None..F=Loud/Max)
|
||
When Bit4=0: Envelope decay rate, 240Hz/(N+1) for MMC5
|
||
4 Envelope decay disable (0=Envelope/Decay, 1=Fixed Volume)
|
||
5 Length counter clock disable / Envelope decay looping enable
|
||
When Bit4=1: length counter clock disable
|
||
When Bit4=0: envelope decay looping enable
|
||
0: Disable Looping, stay at 0 on end of decay [ \_____ ]
|
||
1: Enable Looping, restart decay at F [ \\\\\\ ]
|
||
(Does this still affect Length counter clock disable ?)
|
||
6-7 Duty cycle type (MMC5 duty is inverse of NES APU duty)
|
||
0 [__--------------] 87.5% Whereas,
|
||
1 [____------------] 75.0% [_] = LOW (zero) (0)
|
||
2 [________--------] 50.0% [-] = HIGH (volume/decay) (0..F)
|
||
3 [____________----] 25.0%
|
||
The Duty Cycle counter is reset when the length counter of the same channel is
|
||
written to (via 5003h/5007h).
|
||
|
||
Initial Decay Volume:
|
||
Only a write out to 5003h/5007h will reset the current envelope decay counter
|
||
to a known state (to 0Fh=max) for the appropriate channel's envelope decay
|
||
hardware. Otherwise, the envelope decay counter is always counting down (by 1)
|
||
at the frequency currently contained in the volume / envelope decay rate bits
|
||
(even when envelope decays are disabled by setting bit 4), except when the
|
||
envelope decay counter contains a value of 0, and envelope decay looping (bit
|
||
5) is disabled (0).
|
||
|
||
5002h - MMC5 Sound Frequency Channel 1 (Rectangle)
|
||
5006h - MMC5 Sound Frequency Channel 2 (Rectangle)
|
||
0-7 Lower 8 bits of wavelength (upper 3 bits in Register 3)
|
||
F = 1.79MHz/(N+1)/16 for Rectangle channels
|
||
|
||
5003h - MMC5 Sound Length Channel 1 (Rectangle)
|
||
5007h - MMC5 Sound Length Channel 2 (Rectangle)
|
||
Writing to the length registers restarts the length (obviously), and also
|
||
restarts the duty cycle (channel 1,2 only), and restarts the decay volume.
|
||
0-2 Upper 3 bits of wavelength (unused on noise channel)
|
||
3-7 Length counter load register (5bit value, see below)
|
||
The above 5bit value is translated to the actual 7bit counter value as such:
|
||
Bit3=0 and Bit7=0 (Dividers matched for use with PAL/50Hz)
|
||
Bit6-4 (0..7 = 05h,0Ah,14h,28h,50h,1Eh,07h,0Dh)
|
||
Bit3=0 and Bit7=1 (Dividers matched for use with NTSC/60Hz)
|
||
Bit6-4 (0..7 = 06h,0Ch,18h,30h,60h,24h,08h,10h)
|
||
Bit3=1 (General Fixed Dividers)
|
||
Bit7-4 (0..F = 7Fh,01h..0Fh)
|
||
The 7bit counter value is decremented at 120Hz rate (ie. MMC5 decrements faster
|
||
than NES APU), the counter and sound output are stopped when reaching a value
|
||
of zero. The counter can be paused (and restarted at current location) by
|
||
Length Counter Clock Disabled bits in Register 5000h/5004h.
|
||
|
||
5010h MMC5 Sound Channel 3 PCM Control/Status (R/W)
|
||
Bit7/Write PCM IRQ upon Data=00h Enable (0=Disable, 1=Enable)
|
||
Bit7/Read PCM IRQ upon Data=00h Flag (0=None, 1=Interrupt Request)
|
||
Bit6-1 Not used
|
||
Bit0/Write Wave Output (0=Manual Write to 5011h, 1=Capture 8000h-BFFFh Reads)
|
||
|
||
5011h MMC5 Sound Channel 3 PCM Data
|
||
Bit7-0 Unsigned 8bit PCM Data (01h..FFh) (or 00h=trigger IRQ)
|
||
Used only in "Manual" mode (writes to 5011h are ignored in "Capture" mode).
|
||
|
||
MMC5 PCM Notes
|
||
Naturally, the cartridge cannot take control of the CPU bus (and thus can't
|
||
perform real DMA transfers), instead, it's supporting a semi-automatic
|
||
"Capture" mode, in that mode the CPU must read data from 8000h-BFFFh (eg. via
|
||
LDA 8xxxh), and the data is then automatically forwarded to the DAC (without
|
||
needing a STA 5011h opcode); this can save a few clock cycles.
|
||
Writing 00h to the DAC (either via Manual or Capture mode) leaves the DAC
|
||
unchanged, and does instead trigger an IRQ; which can be used to handle end of
|
||
data blocks, this can also save a few clock cycles.
|
||
|
||
5015h MMC5 Sound Channel 1 and 2 Enable/Status (R/W)
|
||
Bit7-2 Not used
|
||
Bit1 Channel 2 (0=Disable, 1=Enable)
|
||
Bit0 Channel 1 (0=Disable, 1=Enable)
|
||
|
||
Note
|
||
MMC5 Audio is used by Just Breed, Shin 4-Nin Uchi Mahjong, Metal Slader Glory.
|
||
|
||
Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
-------------------------------------------------------------------
|
||
|
||
Front Far East (FFE) disk drive "backup unit" connects to the cartridge slot,
|
||
allows to load copies of games from floppy/hdd/cdrom into RAM (max 512K) and
|
||
VRAM (max 256K).
|
||
|
||
FFE Mapper Modes
|
||
--> Mapper 2: UNROM - PRG/16K
|
||
--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ
|
||
--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ
|
||
--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ
|
||
|
||
FFE IRQ Registers
|
||
4501h IRQ Disable/Acknowledge (write any value, usually 00h)
|
||
4502h IRQ set lower 8bit of 16bit counter
|
||
4503h IRQ set upper 8bit of 16bit counter and Start/Enable IRQs
|
||
IRQ counter is incremented each clock cycle, and produces IRQ on overflow.
|
||
|
||
FFE Trainers/Patches
|
||
All FFE games are patched to work with the "FFE" mappers. In case that the
|
||
patches don't fit into normal ROM area, additional 512-byte patches are often
|
||
located in SRAM area at 7000h-71FFh (or, in a few cases, reportedly at 5D00h),
|
||
that patch-area may be used to handle FFE memory mapping, or for
|
||
cheats/trainers. Some MMC games also contain similar trainers (maybe working on
|
||
FFE device, if it supports MMC mappers?, or otherwise working on emulators
|
||
only).
|
||
|
||
FFE Configuration Registers
|
||
Configuration Registers are initialized before the game is started, so most
|
||
games don't need to access these registers, except for changing Name Table /
|
||
Mirroring bits. A few games might also change the mode bits.
|
||
42FCh-42FFh Configuration Register 1
|
||
A0 Name Table Mode (0=One-Screen, 1=Two-Screen) (with D4 below)
|
||
A1 Unknown (0=WE, 1=SW) (usually 1)
|
||
D7-D5 Memory Mode (0-7) "*MODE"
|
||
1 Mapper 6 F4xxx
|
||
2 Mapper 2 UNROM
|
||
3 Mapper ? F4xxx
|
||
4 Mapper 8 F3xxx/GNROM
|
||
0,5-7 unknown (Great Tank uses settings 1 and 6)
|
||
? unknown how to select Mapper 12 and Mapper 17
|
||
|
||
0 Mapper 17 (Kaiketsu, Saiyuuki)
|
||
7 Mapper 17 (Wing of Madoola)
|
||
D4 When A0=0: Select VRAM Page (?=BLK0, ?=BLK1)
|
||
When A0=1: ?Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
D3-D0 Unknown (usually zero)
|
||
43FEh Memory Control (apparently independendly of current Mode) (?)
|
||
D7-D2 Select ?K ROM at 8000h-?
|
||
D1-D0 Select 8K VROM at PPU 0000h-1FFFh
|
||
43FFh Memory Control (as for current mode, ie. mirror of 8000h-FFFFh) (?)
|
||
4500h Configuration Register 2
|
||
D7-D6 FDS Mode (0=Disk/Load, 1=Reserved, 2=Cartridge, 3=Disk/Execute)
|
||
D5-D4 SRAM 6000h-7FFFh BANK "Present or Not" (0-3=?)
|
||
D3 SW Pin (maybe something related with above WE/SW selection)
|
||
D2-D0 PPU Mode Select (1or2?="*MODE" (32K), 5=256K, VRAM EXT, 7=256K)
|
||
|
||
Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
-----------------------------------------------
|
||
|
||
Several hacked Japanese titles use this mapper, such as the hacked version of
|
||
Wai Wai World. The unhacked versions of these games seem to use a Konami VRC
|
||
mapper, and it's better to use them if possible.
|
||
8000h-FFFFh Memory Control (6bit)
|
||
Bit1-0 Select 8K VRAM (read/write-able) at PPU 0000h-1FFFh
|
||
Bit5-2 Select 16K ROM at 8000h-BFFFh (bank 0-0Fh)
|
||
N/A Fixed 16K ROM at C000h-FFFFh (always bank 7) (!)
|
||
Additional FFE registers:
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
|
||
Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
-----------------------------------------------
|
||
|
||
10% of games declared as "Mapper 6" are this (and not Mapper 6).
|
||
8000h-FFFFh Memory Control (6bit)
|
||
Bit3-0 Select 16K ROM at 8000h-BFFFh
|
||
Bit5-4 Select 8K VROM at PPU 0000h-1FFFh
|
||
Lower bits are ROM bank, upper bits VROM bank, ie. vice-versa as Mapper 6.
|
||
Additional FFE registers:
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
|
||
Mapper 7: AOROM - PRG/32K, Name Table Select
|
||
--------------------------------------------
|
||
|
||
Numerous games released by Rare Ltd. use this mapper, such as Battletoads,
|
||
Wizards & Warriors, and Solar Jetman.
|
||
8000h-FFFFh Memory Control
|
||
Bit2-0 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank)
|
||
Bit4 One-Screen Name Table Select (0=BLK0, 1=BLK1)
|
||
Bit3,5-7 Not used
|
||
Uses a single 74LS161 chip (connection: /PRG-CLK, R/W-/LOAD). ANROM
|
||
additionally uses a 74LS02 to enable ROM only when R/W=HIGH and /PRG=LOW.
|
||
Board NES-AOROM-03: 256K PRG ROM (8 banks) (32pin ROM) (with bus-conflicts)
|
||
Board NES-ANROM-03: 128K PRG ROM (4 banks) (28pin ROM) (without bus-conflicts)
|
||
Board NES-AMROM: ?
|
||
All carts using it have 8K of VRAM at PPU 0000h.
|
||
|
||
BNROM
|
||
Board NES-BNROM-01: 128K PRG ROM (4 banks) (28pin ROM) (with bus-conflicts)
|
||
Deadly Towers uses BNROM (with horizontal mirroring, instead of Bit4), the game
|
||
is typically marked as mapper 7 or mapper 34, although it's NOT AOROM nor
|
||
NINA-001.
|
||
|
||
Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ
|
||
-----------------------------------------------
|
||
|
||
Several hacked Japanese titles use this mapper, such as the hacked version of
|
||
Doraemon.
|
||
8000h-FFFFh Memory Control (same as GNROM, Mapper 66)
|
||
Bit1-0 Select 8K VROM (usually read-only) at PPU 0000h-1FFFh
|
||
Bit5-4 Select 32K ROM at 8000h-FFFFh (initially 1st bank)
|
||
Additional FFE registers:
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
|
||
Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH
|
||
-----------------------------------------------
|
||
|
||
Used only by Punch-Out, and Mike Tyson's Punch-Out.
|
||
A000h-AFFFh Select 8K ROM at 8000h-9FFFh (initially 1st bank)
|
||
N/A Fixed 24K ROM at A000h-FFFFh (always last three 8K banks)
|
||
B000h-CFFFh Select 4K VROM at PPU 0000h-0FFFh
|
||
D000h-DFFFh Select 4K VROM at PPU 1000h-1FFFh (used when latch=FDh)
|
||
E000h-EFFFh Select 4K VROM at PPU 1000h-1FFFh (used when latch=FEh)
|
||
F000h-FFFFh Mirroring Select (Bit0: 0=Vertical, 1=Horizontal mirroring)
|
||
PPU 1FD0h-1FDFh Access to Pattern Table 0, Tile FDh --> sets latch=FDh
|
||
PPU 1FE0h-1FEFh Access to Pattern Table 0, Tile FEh --> sets latch=FEh
|
||
The latch contains FEh on reset. The latch is automatically written to on any
|
||
access to PPU 1FD0h-1FEFh, which does usually happen when the PPU fetches
|
||
bitmap data for Tile FDh or FEh from Pattern Table 1.
|
||
The latches might also get changed on access to PPU 0FD0h-0FEFh (?)
|
||
|
||
Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH
|
||
---------------------------------------------
|
||
|
||
Used only by Fire Emblem, Fire Emblem Gaiden, and Family War.
|
||
A000h-AFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
B000h-BFFFh Select 4K VROM bank at PPU 0000h-0FFFh (used when latch0=FDh)
|
||
C000h-CFFFh Select 4K VROM bank at PPU 0000h-0FFFh (used when latch0=FEh)
|
||
D000h-DFFFh Select 4K VROM bank at PPU 1000h-1FFFh (used when latch1=FDh)
|
||
E000h-EFFFh Select 4K VROM bank at PPU 1000h-1FFFh (used when latch1=FEh)
|
||
F000h-FFFFh Mirroring Select (Bit0: 0=Vertical, 1=Horizontal mirroring)
|
||
PPU 0FD0h-0FDFh Access to Pattern Table 0, Tile FDh --> sets latch0=FDh
|
||
PPU 0FE0h-0FEFh Access to Pattern Table 0, Tile FEh --> sets latch0=FEh
|
||
PPU 1FD0h-1FDFh Access to Pattern Table 1, Tile FDh --> sets latch1=FDh
|
||
PPU 1FE0h-1FEFh Access to Pattern Table 1, Tile FEh --> sets latch1=FEh
|
||
The latches contain FEh on reset. Latches are automatically written to on any
|
||
access to PPU 0FD0h-0FEFh or 1FD0h-1FEFh, which does usually happen when the
|
||
PPU fetches bitmap data for Tile FDh or FEh. The new latch setting is then used
|
||
for all <further> tiles (tiles FDh/FEh are still fetched from the <old> latch
|
||
setting).
|
||
|
||
Mapper 11: Color Dreams - PRG/32K, VROM/8K
|
||
------------------------------------------
|
||
|
||
This mapper is used on several unlicensed Color Dreams titles, including
|
||
Crystal Mines and Pesterminator. Not sure if their religious ("Wisdom Tree")
|
||
games use the same mapper or not.
|
||
8000h-FFFFh Memory Control
|
||
Bit3-0 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank)
|
||
Bit7-4 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank)
|
||
Many games using this mapper are somewhat glitchy. Bus-conflicts.
|
||
Uses a single 74LS377 (8bit D flip-flop with clock enable).
|
||
|
||
Mapper 12: FFE F6xxx - Not specified, NT, IRQ
|
||
---------------------------------------------
|
||
|
||
No info. Don't have a ROM-image.
|
||
Maybe this meant to be "Mapper ?",
|
||
--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
Additional FFE registers:
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
|
||
Mapper 13: CPROM - 16K VRAM
|
||
---------------------------
|
||
|
||
Used by Videomation (a bitmap drawing program).
|
||
N/A Fixed 4K VRAM at PPU 0000h-0FFFh (always Bank 0)
|
||
8000h-FFFFh Select 4K VRAM at PPU 1000h-1FFFh (Bank 0-3)
|
||
16K VRAM for 32x30 different BG tiles (plus 64 sprites). Bus-conflicts.
|
||
|
||
Mapper 15: X-in-1 - PRG/32K/16K, NT
|
||
-----------------------------------
|
||
|
||
Used by Contra 100-in-1 (fake multicart with less than 100 different games),
|
||
and hacked versions of Crazy Climber, Dragon Ball, and Mobile Suit (single game
|
||
carts).
|
||
8000h-FFFFh Memory Control (Decoded by address AND data lines)
|
||
D5-D0 Select 16K ROM Bank (X)
|
||
D6 Mirroring Control (0=Vertical, 1=Horizontal Mirroring)
|
||
D7 Select 8K ROM Bank (Y) (should be zero in non-8K-modes)
|
||
A1-A0 ROM Bank Mode (0=32K, 1=128K, 2=8K, 3=16K)
|
||
Mapping in different modes is:
|
||
8K Mode - Bank (X*2+Y) at each 8000h, A000h, C000h, E000h
|
||
16K Mode - Bank (X) at 8000h-BFFFh and (X) at C000h-FFFFh
|
||
32K Mode - Bank (X) at 8000h-BFFFh and (X OR 1) at C000h-FFFFh
|
||
128K Mode - Bank (X) at 8000h-BFFFh and LAST bank at C000h-FFFFh
|
||
Initially first 32K ROM selected. The cartridge contains 8K VRAM.
|
||
|
||
Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM
|
||
------------------------------------------------
|
||
|
||
This mapper is used on several Japanese titles by Bandai, such as the
|
||
DragonBall Z series and the SD Gundam Knight series.
|
||
6000h,7FF0h,8000h Select 1K VROM at PPU 0000h-03FFh
|
||
6001h,7FF1h,8001h Select 1K VROM at PPU 0400h-07FFh
|
||
6002h,7FF2h,8002h Select 1K VROM at PPU 0800h-0BFFh
|
||
6003h,7FF3h,8003h Select 1K VROM at PPU 0C00h-0FFFh
|
||
6004h,7FF4h,8004h Select 1K VROM at PPU 1000h-13FFh
|
||
6005h,7FF5h,8005h Select 1K VROM at PPU 1400h-17FFh
|
||
6006h,7FF6h,8006h Select 1K VROM at PPU 1800h-1BFFh
|
||
6007h,7FF7h,8007h Select 1K VROM at PPU 1C00h-1FFFh
|
||
6008h,7FF8h,8008h Select 16K ROM at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM at C000h-FFFFh (always last bank)
|
||
6009h,7FF9h,8009h Mirroring/Page Select (Bit1-0)
|
||
0 Two-Screen Vertical mirroring
|
||
1 Two-Screen Horizontal mirroring
|
||
2 Single-Screen BLK0
|
||
3 Single-Screen BLK1
|
||
600Ah,7FFAh,800Ah IRQ Control Register (Bit 0)
|
||
0 Disable/Acknowledge IRQ
|
||
1 Enable IRQ
|
||
600Bh,7FFBh,800Bh Low byte of IRQ counter
|
||
600Ch,7FFCh,800Ch High byte of IRQ counter
|
||
600Dh,7FFDh,800Dh EPROM I/O Port - unknown how this works.
|
||
The IRQ counter is decremented each clock cycle if active, and set off when it
|
||
reaches zero. An IRQ interrupt is executed at that point.
|
||
|
||
Datach Variant
|
||
Bandai's "Datach" games are using a Mapper 16 variant (with VRAM instead VROM),
|
||
and with built-in barcode reader. This seems to be occassionally referred to as
|
||
"Mapper 157" (though older Datach ROM-images are typically declared as "Mapper
|
||
16").
|
||
--> Controllers - Barcode Readers
|
||
|
||
Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ
|
||
-----------------------------------------------
|
||
|
||
Several hacked Japanese titles use this mapper, such as the hacked versions of
|
||
Parodius and DragonBall Z 3.
|
||
4504h Select 8K ROM at 8000h-9FFFh (initially 1st half of 1st 16K)
|
||
4505h Select 8K ROM at A000h-BFFFh (initially 2nd half of 1st 16K)
|
||
4506h Select 8K ROM at C000h-DFFFh (initially 1st half of last 16K)
|
||
4507h Select 8K ROM at E000h-FFFFh (initially 2nd half of last 16K)
|
||
4510h Select 1K VROM at PPU 0000h-03FFh
|
||
4511h Select 1K VROM at PPU 0400h-07FFh
|
||
4512h Select 1K VROM at PPU 0800h-0BFFh
|
||
4513h Select 1K VROM at PPU 0C00h-0FFFh
|
||
4514h Select 1K VROM at PPU 1000h-13FFh
|
||
4515h Select 1K VROM at PPU 1400h-17FFh
|
||
4516h Select 1K VROM at PPU 1800h-1BFFh
|
||
4517h Select 1K VROM at PPU 1C00h-1FFFh
|
||
Additional FFE registers:
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
|
||
Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT
|
||
--------------------------------------------------------
|
||
|
||
This mapper is used on several Japanese titles by Jaleco, such as Baseball 3,
|
||
Lord of Kings, etc.
|
||
8000h/8001h Select 8K ROM at 8000h-9FFFh (Lower/Upper 4bits)
|
||
8002h/8003h Select 8K ROM at A000h-BFFFh (Lower/Upper 4bits)
|
||
9000h/9001h Select 8K ROM at C000h-DFFFh (Lower/Upper 4bits)
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always last bank)
|
||
9002h Battery Back SRAM (Bit0: 0=Enable, 1=Disable)
|
||
(unused by Lord of Kings)
|
||
9003h Unknown
|
||
(used by Lord of Kings)
|
||
A000h/A001h Select 1K VROM at PPU 0000h-03FFh (Lower/Upper 4bits)
|
||
A002h/A003h Select 1K VROM at PPU 0400h-07FFh (Lower/Upper 4bits)
|
||
B000h/A001h Select 1K VROM at PPU 0800h-0BFFh (Lower/Upper 4bits)
|
||
B002h/A003h Select 1K VROM at PPU 0C00h-0FFFh (Lower/Upper 4bits)
|
||
C000h/C001h Select 1K VROM at PPU 1000h-13FFh (Lower/Upper 4bits)
|
||
C002h/C003h Select 1K VROM at PPU 1400h-17FFh (Lower/Upper 4bits)
|
||
D000h/D001h Select 1K VROM at PPU 1800h-1BFFh (Lower/Upper 4bits)
|
||
D002h/D003h Select 1K VROM at PPU 1C00h-1FFFh (Lower/Upper 4bits)
|
||
E000h/E001h Lower 8bit of decrementing 16bit IRQ counter (Lower/Upper 4bits)
|
||
E002h/E003h Upper 8bit of decrementing 16bit IRQ counter (Lower/Upper 4bits)
|
||
F000h IRQ Control Register 0
|
||
Bit0 Maybe 1=Load Counter?
|
||
F001h IRQ Control Register 1
|
||
Bit0 IRQ Enable (0=Disabled, 1=Enable)
|
||
Bit1-3 IRQ Counter Width (0=16bit, 1=12bit, 2-3=8bit, 4-7=4bit)
|
||
With widths less than 16bit, underflows recurse only lower counter bits.
|
||
F002h Name Table Select (2bit)
|
||
0 Two-Screen, Horizontal Mirroring
|
||
1 Two-Screen, Vertical Mirroring
|
||
2-3 Single-Screen BLK0
|
||
F003h Unused (or an External I/O Port which is unused?)
|
||
|
||
Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND
|
||
--------------------------------------------------------
|
||
|
||
This mapper is used on several Japanese titles by Namcot, such as Splatterhouse
|
||
and Family Stadium '90.
|
||
|
||
Pattern Table Control
|
||
8000h-87FFh Select 1K VROM at PPU 0000h-03FFh (with E800h/Bit6)
|
||
8800h-8FFFh Select 1K VROM at PPU 0400h-07FFh ("")
|
||
9000h-97FFh Select 1K VROM at PPU 0800h-0BFFh ("")
|
||
9800h-9FFFh Select 1K VROM at PPU 0C00h-0FFFh ("")
|
||
A000h-A7FFh Select 1K VROM at PPU 1000h-13FFh (with E800h/Bit7)
|
||
A800h-AFFFh Select 1K VROM at PPU 1400h-17FFh ("")
|
||
B000h-B7FFh Select 1K VROM at PPU 1800h-1BFFh ("")
|
||
B800h-BFFFh Select 1K VROM at PPU 1C00h-1FFFh ("")
|
||
The upper two bits Port E800h-EFFFh are used to select VROM/VRAM mode (mind
|
||
that the lower six bits of that port Select 8K ROM at A000h-BFFFh).
|
||
E800h, Bit6 VROM/VRAM Mode for PPU 0000h-0FFFh (0=VROM+VRAM, 1=VROM-Only)
|
||
E800h, Bit7 VROM/VRAM Mode for PPU 1000h-1FFFh (0=VROM+VRAM, 1=VROM-Only)
|
||
In VROM-Only mode, VROM banks 0-FFh can be selected. In VROM+VRAM mode only
|
||
VROM banks 0-DFh can be selected, and values E0h-FFh select VRAM.
|
||
|
||
Name Table Control
|
||
C000h-C7FFh Select 1K VROM/VRAM at PPU 2000h-23FFh (E0h and up = VRAM)
|
||
C800h-CFFFh Select 1K VROM/VRAM at PPU 2400h-27FFh (E0h and up = VRAM)
|
||
D000h-D7FFh Select 1K VROM/VRAM at PPU 2800h-2BFFh (E0h and up = VRAM)
|
||
D800h-DFFFh Select 1K VROM/VRAM at PPU 2C00h-2FFFh (E0h and up = VRAM)
|
||
Only VROM banks 0-DFh can be selected, and values E0h-FFh activate internal
|
||
VRAM, Bit0 of the bank number is then used to select BLK0 or BLK1.
|
||
|
||
CPU Memory Control
|
||
E000h-E7FFh Select 8K ROM at 8000h-9FFFh (initially 1st half of 1st 16K)
|
||
Bit5-0 Page_number
|
||
E800h-EFFFh Select 8K ROM at A000h-BFFFh (initially 2nd half of 1st 16K)
|
||
Bit5-0 Page_number
|
||
Bit6 Select at CHR_address $0000-$0FFF 0:ROM&RAM 1:ROM
|
||
Bit7 Select at CHR_address $1000-$1FFF 0:ROM&RAM 1:ROM
|
||
F000h-F7FFh Select 8K ROM at C000h-DFFFh (initially 1st half of last 16K)
|
||
Bit5-0 Page_number
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always 2nd half of last 16K)
|
||
The lower 6bit of these registers specify ROM bank numbers. Caution: The upper
|
||
2bit of E800h-EFFFh are used to select Pattern Table VROM/VRAM Mode.
|
||
|
||
IRQ Control
|
||
5000h-57FFh Bit7-0: Lower 8bit of 15bit IRQ counter (R/W) (!)
|
||
5800h-5FFFh Bit6-0: Upper 7bit of 15bit IRQ counter (R/W) (!)
|
||
Bit7: 0=Disable IRQs, 1=Enable IRQs
|
||
The IRQ counter is incremented each clock cycle, an IRQ is generated when it
|
||
overflows (at 7FFFh, since it's a 15bit value). Sangokushi 2 uses IRQs, but
|
||
many other Namcot games don't use IRQs.
|
||
|
||
Sound Control
|
||
4800h Expand I/O Data Register
|
||
F800h Expand I/O Address Register
|
||
Bit7 Auto Increment (0=Disable, 1=Enable)
|
||
Bit6-0 Address (00h-7Fh)
|
||
Index Addresses: (Dots "..." = Japanese text, not translated)
|
||
00h-3Fh See NAMCO.TXT, Japanese (.............)
|
||
40h,48h,50h,58h,60h,68h,70h,78h Channel 1-8, Frequency Lower 8bit
|
||
41h,49h,51h,59h,61h,69h,71h,79h See NAMCO.TXT, Japanese (......)
|
||
42h,4Ah,52h,5Ah,62h,6Ah,72h,7Ah Channel 1-8, Frequency Middle 8bit
|
||
43h,4Bh,53h,5Bh,63h,6Bh,73h,7Bh See NAMCO.TXT, Japanese (......)
|
||
44h,4Ch,54h,5Ch,64h,6Ch,74h,7Ch Channel 1-8, Frequency Upper 2bit & Option
|
||
Bit7-5 Not used
|
||
Bit4-2 VVV: 8-(....)(... 2byte) ..: VVV=000... 16byte,VVV=100..8byte....
|
||
Bit1-0 Frequency Upper 2bit
|
||
45h,4Dh,55h,5Dh,65h,6Dh,75h,7Dh See NAMCO.TXT, Japanese (......)
|
||
46h,4Eh,56h,5Eh,66h,6Eh,76h,7Eh Channel 1-8, Offset Address (00h-3Fh)
|
||
Bit7-1 AAAAAAA [6bit address stored in a 7bit value?]
|
||
Bit0 Not used
|
||
47h,4Fh,57h,5Fh,67h,6Fh,77h,7Fh Channel 1-8
|
||
Bit7-4 ????: 7...(kingofkings),3...
|
||
Bit3-0 VVVV: ....
|
||
Frequency: 0=Lowest, 3FFFFh=Highest.
|
||
According to Gorohs frequency table, Tone "C" of Octave "1-8" is: 1:47Eh,
|
||
2:8FBh, 3:11F6h, 4:23ECh, 5:47DAh, 6:8FB3h, 7:11F66h, 8:23ECCh.
|
||
According to my CPC frequency table, middle "C" of octave "0" should be
|
||
261.626Hz. No idea how to match that into a formula.
|
||
|
||
Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND
|
||
--------------------------------------------------------
|
||
|
||
Used by Famicom Disk System only.
|
||
--> Famicom Disk System (FDS)
|
||
|
||
Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ
|
||
--------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT
|
||
---------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ)
|
||
----------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
-------------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ
|
||
--------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
-------------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
VRC6 Sound Registers
|
||
Two Rectangle channels with 4bit volume levels each, one Saw channel with 5bit
|
||
volume level. These are added into a 6bit output level, and then merged with
|
||
normal Famicom sound signal.
|
||
|
||
9000h/A000h - Channel 1/2 - Square Volume/Duty
|
||
Bit7-4 Duty Cycle bits:
|
||
0000 - 1/16 "-_______________-_______________" ( 6.25%)
|
||
0001 - 2/16 "--______________--______________" (12.50%)
|
||
0010 - 3/16 "---_____________---_____________" (18.75%)
|
||
0011 - 4/16 "----____________----____________" (25.00%)
|
||
0100 - 5/16 "-----___________-----___________" (31.25%)
|
||
0101 - 6/16 "------__________------__________" (37.50%)
|
||
0110 - 7/16 "-------_________-------_________" (43.75%)
|
||
0111 - 8/16 "--------________--------________" (50.00%)
|
||
1xxx - 16/16 "--------------------------------" (100.00%)
|
||
Bit3-0 Linear Volume (0=Silence, 0Fh=Loudest)
|
||
100% Duty can be used as digitized mode, the channel permanently outputs high
|
||
level, ie. the current volume setting, and isn't affected by the frequency
|
||
registers.
|
||
|
||
B000h - Channel 3 - Saw Volume Step
|
||
Bit7-6 Not used
|
||
Bit5-0 Volume Step (V) (0..2Ah=Silent..Loudest) (2Bh..3Fh=Wraps/Garbage)
|
||
The overall output looks like "//////" whereas each "/" is split into 7 steps,
|
||
the output level on step 1-7 is calculated as such:
|
||
FOR I=1 to 7 ;step 1-7
|
||
IF I=1 THEN X=0 ;reset to 0 in 1st step
|
||
ELSE X=(X+V) AND FFh ;add accumulator
|
||
Output=(X/8) ;output upper 5bit of X
|
||
NEXT
|
||
Note: X is an 8bit value, and wraps on overflow, ie. if V>2Ah.
|
||
|
||
9001h/A001h/B001h - Channel 1/2/3 - Frequency LSB
|
||
Bit7-0 Lower 8 bits of frequency data
|
||
|
||
9002h/A002h/B002h - Channel 1/2/3 - Frequency MSB
|
||
Bit7 Channel disable (0=Disable, 1=Enable)
|
||
Bit6-4 Not used
|
||
Bit3-0 Upper 4 bits of frequency data
|
||
To calculate output frequency:
|
||
Channel 1/2: F=1.79MHz/16/(N+1) ;16-step duty cycles
|
||
Channel 3: F=1.79MHz/14/(N+1) ;7-step phases
|
||
|
||
Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
-----------------------------------------
|
||
|
||
This chapter describes all known VRC variants. The different Port addresses are
|
||
specified as X.Y.Z which may look a bit abstract at the first glance, at second
|
||
glance it should be easier to understand as than using separate chapters for
|
||
each of the 13 variants.
|
||
|
||
VRC Chip Versions
|
||
Type PRG Bank VROM Banks NT IRQ Sound
|
||
VRC1 PRG/8K VROM/4K NT - -
|
||
VRC2 PRG/8K VROM/1K NT - -
|
||
VRC3 PRG/16K VRAM IRQ -
|
||
VRC4 PRG/8K VROM/1K NT IRQ -
|
||
VRC6 PRG/16K/8K VROM/1K NT IRQ SOUND
|
||
VRC7 PRG/16K/8K VROM/1K NT IRQ SOUND
|
||
For most chips, there are different connection variants, VRC2a, VRC2b, etc.
|
||
|
||
VRC Data Bus
|
||
VRC1, VRC2, and VRC3 use a 4bit data bus, connected to D3-D0, any 8bit
|
||
registers are thus split into two 4bit ports. VRC4 seems to have an additional
|
||
D4 pin, which is used only for 5bit PRG ROM banks. VRC6 and VRC7 have a full
|
||
8bit data bus.
|
||
|
||
VRC Address Bus
|
||
Most VRCs have a 6bit address bus, described here as X.Y.Z - the upper four
|
||
address bits are always A15-A12 (X), however, the connection of the lower two
|
||
address bits (Y and Z) varies. VRC7 normally uses only X.Y bits (only the Sound
|
||
registers use X.Y.Z). VRC1/VRC3 uses only the X address bits. A15 serves as
|
||
chip select, and must be HIGH for all VRC registers.
|
||
|
||
VRC Connection Variants of Lower two bits of X.Y.Z addresses
|
||
Mapper Y Z Used by
|
||
75 VRC1 - - Ganbare Goemon 1, Junior Basket - Two on Two, King Kong 2,
|
||
Exciting Boxing, Jajamaru Ninpou Chou, Tetsuwan Atom
|
||
22 VRC2a A0 A1 Twin Bee 3, Ganbare Pennant Race
|
||
23 VRC2b A1 A0 Wai Wai World 1, Getsufuu Maden, Kaiketsu Yanchamaru 2
|
||
Dragon Scroll, Gryzor/Contra, Jarinko Chie, Ganbare Goemon
|
||
73 VRC3 - - Salamander
|
||
21 VRC4a A2 A1 Wai Wai World 2
|
||
21 VRC4c A7 A6 Ganbare Goemon Gaiden 2
|
||
25 VRC4b A0 A1 Bio Miracle Bokutte Upa, Ganbare Goemon Gaiden, Gradius 2,
|
||
Racer Mini Yonku
|
||
25 VRC4d A2 A3 Teenage Mutant Hero Turtles 1+2, Goal!!
|
||
23 VRC4e A3 A2 Parodius da!, Akumajou Special, Crisis Force,
|
||
Tiny Toon Adventures 1, Moe Pro!
|
||
24 VRC6a A1 A0 Akumajou Densetsu (Castlevania 3)
|
||
26 VRC6b A0 A1 Esper Dream 2, Mouryou Senki Madara
|
||
85 VRC7 A4 (A5) Lagrange Point (Z=A5 used for Sound only)
|
||
85 VRC7b A3 (?) Tiny Toon Adventures 2 (no Sound - maybe not a VRC7 ?)
|
||
Note that most mapper numbers are shared for two different connection variants,
|
||
mapper 23 is even shared for different chip versions, the unused address bits
|
||
are usually zero, so that software and hardware could, for example, reproduce
|
||
Z=(A0 OR A2) for mapper 23.
|
||
VRC2a variant uses VROM bank outputs Bit1-7, all other VRCs use Bit0 and up.
|
||
|
||
PRG ROM Bank Registers (decoded by X or X.Y parts of the X.Y.Z address)
|
||
VRC1 VRC2 VRC3 VRC4 VRC6 VRC7 Expl.
|
||
- - F - 8 - Select 16K ROM at 8000h-BFFFh
|
||
8 8 - 8 - 8.0 Select 8K ROM at 8000h-9FFFh
|
||
A A - A - 8.1 Select 8K ROM at A000h-BFFFh
|
||
C - - - C 9.0 Select 8K ROM at C000h-DFFFh
|
||
- FIX FIX FIX - - Fixed 8K ROM at C000h-DFFFh (last-1 8K)
|
||
FIX FIX FIX FIX FIX FIX Fixed 8K ROM at E000h-FFFFh (last-0 8K)
|
||
The 16K banks of VRC3/VRC6 are Linear Addresses divided by 16K (not by 8K).
|
||
VRC4 can swap 8000h-9FFFh and C000h-DFFFh, see VRC4 Memory Control below.
|
||
|
||
VROM Bank Registers (VRC2,VRC4=2x4bit LSB/MSB, VRC6,VRC7=8bit)
|
||
VRC2,4 VRC6 VRC7 Expl.
|
||
B.0.0/1 D.0.0 A.0 Select 1K VROM bank at PPU 0000h-03FFh
|
||
B.1.0/1 D.0.1 A.1 Select 1K VROM bank at PPU 0400h-07FFh
|
||
C.0.0/1 D.1.0 B.0 Select 1K VROM bank at PPU 0800h-0BFFh
|
||
C.1.0/1 D.1.1 B.1 Select 1K VROM bank at PPU 0C00h-0FFFh
|
||
D.0.0/1 E.0.0 C.0 Select 1K VROM bank at PPU 1000h-13FFh
|
||
D.1.0/1 E.0.1 C.1 Select 1K VROM bank at PPU 1400h-17FFh
|
||
E.0.0/1 E.1.0 D.0 Select 1K VROM bank at PPU 1800h-1BFFh
|
||
E.1.0/1 E.1.1 D.1 Select 1K VROM bank at PPU 1C00h-1FFFh
|
||
Note that VRC2A uses Bit7-1 of the 2x4bit register, VRC2B uses Bit6-0, VRC4 and
|
||
up use Bit6-0 (or all bits, Bit7-0, for large VROMs).
|
||
Lagrange Point contains VRAM instead VROM, the VRAM <is> map-able.
|
||
Salamander (VRC3) contains VRAM, which appears to be <not> map-able.
|
||
|
||
VRC1 VROM Bank Registers (5bit values, split into 4+1 bits)
|
||
9 Bit0: Mirroring, Bit1-2: MSBs of VROM banks, Bit3: Unused/zero
|
||
E Lower 4bit of 4K VROM bank at PPU 0000h-0FFFh (MSB in Bit1 of Register 9)
|
||
F Lower 4bit of 4K VROM bank at PPU 1000h-1FFFh (MSB in Bit2 of Register 9)
|
||
|
||
IRQ Registers (VRC1,VRC2=N/A, VRC3,VRC4=2x4bit, VRC6,VRC7=8bit)
|
||
VRC4 VRC6 VRC7 VRC3 Expl.
|
||
F.0.0/1 F.0.0 E.1 A/B IRQ Reload value
|
||
F.1.0 F.0.1 F.0 C IRQ Control (Bit0: 0=Disable, Bit1: 0=One-Shot)
|
||
F.1.1 F.1.0 F.1 D IRQ Acknowledge (write any value to this address)
|
||
IRQ Reload is loaded to actual counter on write to IRQ Control Register, and on
|
||
Counter overflow. If IRQ Control Regiser Bit1 is set, then the counter is
|
||
automatically Restarted and Reloaded on Overflow.
|
||
The IRQ counter is incremented each 113.75 cycles (or each 114 cycles?), which
|
||
is almost exactly once per NTSC-scanline, including for "hidden" scanlines
|
||
during VBlank (only exception is VRC3, which is incremented every 256 cycles).
|
||
Mind that PAL/NTSC have different VBlank/Hblank times, and so, need different
|
||
counter values. The VRC4 games Goal! and Moe Pro! appear to be bugged pirate
|
||
ports from original Jaleco mapper to Konami-style mapper, these games do
|
||
incorrectly acknowledge IRQs by writing zero to the IRQ Control register rather
|
||
than by writing any value to the IRQ Acknowledge register, not sure if that
|
||
works on real VRC4 hardware.
|
||
|
||
VRC4 Memory Control (VRC4 only - not VRC2,6,7)
|
||
9.0.1 (or 9.1.0?) Memory Control (2bit)
|
||
Bit1: PRG ROM Swap (0=Normal, 1=Swap) When swapped: Port 8.0.0 controls ROM at
|
||
C000h-DFFFh, and ROM at 8000h-9FFFh becomes fixed, containing the 1st half of
|
||
<last> 16K.
|
||
Bit0: Enable SRAM at 6000h-7FFFh (0=Disable, 1=Enable), VRC6 is having an
|
||
equivalent function Bit7 of Name Table Control register.
|
||
|
||
Name Table Control
|
||
VRC1 VRC2,4 VRC6 VRC7 Expl.
|
||
9 9.0.0 B.1.1 E.0 Mirroring/Page Select
|
||
Mirroring selection VRC2,VRC4,VRC7: Bit1-0, VRC6: Bit3-2, VRC1: Bit0:
|
||
0 Two-Screen Vertical mirroring (VRC1: Register 9, Bit0=0)
|
||
1 Two-Screen Horizontal mirroring (VRC1: Register 9, Bit0=1)
|
||
2 Single-Screen BLK1 (VRC1: N/A)
|
||
3 Single-Screen BLK0 (VRC1: N/A)
|
||
On VRC6, bit5 additionally inverts the BLK-outputs, BLK0 then becomes BLK1, and
|
||
vice versa, that also applies in Two-Screen modes, ie. the upper-left name
|
||
table may be either BLK1 or BLK0.
|
||
And, on VRC6, Bit7 controls SRAM (0=Disable, 1=Enable).
|
||
Note: VRC1 is also used by some VS System games. The VS System has 4K VRAM for
|
||
Four-Screen nametables (so, the VRC1's mirroring flag is probably ignored on
|
||
the VS System).
|
||
|
||
VRC6 Sound Registers
|
||
--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
|
||
VRC7 OPL2 Sound Registers
|
||
9.1.0 Index Register
|
||
9.1.1 Data Register
|
||
--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
|
||
Unknown Registers
|
||
VRC3 - Salamander writes 00h to Port 8000h and 9000h.
|
||
|
||
Mapper 28: Action 53 homebrew X-in-1
|
||
------------------------------------
|
||
|
||
Used by the Action 53 homebrew multicart series. Supports NROM (1x16K/1x32K
|
||
PRG), UNROM (max 16x16K PRG), AOROM/ANROM/BNROM (max 8x32K PRG), CNROM (max
|
||
4x8K CHR).
|
||
The menu should initialize the four registers per game (for CHR ROM games it
|
||
should also relocate data to CHR RAM), and should finally set {5000h]=00h/01h
|
||
to select CHR/PRG mapping. The games can then simply use [8000h] to change CHR
|
||
ot PRG mapping (and usually don't need to touch [5000h] themselves; unless they
|
||
want to use both CHR and PRG banking, or want to change Hori/Vert mirroring).
|
||
|
||
Registers
|
||
4444h Unknown (used by menu software)
|
||
5000h-5FFFh Select index (00h,01h,80h,81h) (bit1-6=Reserved)
|
||
8000h-FFFFh Write data to selected register
|
||
Some games ported from SGROM (=what?) may rewrite Reg[80h], usually to change
|
||
mirroring.
|
||
|
||
Reg[00h]: CHR bank (CNROM style)
|
||
0-1 Select 8K VRAM at PPU 0000h-1FFFh (max 32Kbyte addressable)
|
||
2-3 Reserved (0)
|
||
4 One-Screen Name Table Select (0=BLK0, 1=BLK1)
|
||
5-7 Reserved (0)
|
||
Bit4 is copied to Reg[80h].Bit0 when Reg[80h].Bit1=0 (otherwise bit4 is
|
||
ignored).
|
||
|
||
Reg[01h]: PRG bank (inner bank) (AOROM/ANROM/BNROM/UNROM style)
|
||
0-3 Select 16K/32K ROM bank at 8000h-HFFFh or C000h-FFFFh or 8000h-FFFFh
|
||
4 One-Screen Name Table Select (0=BLK0, 1=BLK1)
|
||
5-7 Reserved (0)
|
||
Bit4 is copied to Reg[80h].Bit0 when Reg[80h].Bit1=0 (otherwise bit4 is
|
||
ignored).
|
||
|
||
Reg[80h]: Mode
|
||
0-1 Nametable mode (0=BLK0, 1=BLK1, 2=VertMirroring, 3=HoriMirroring)
|
||
2-3 PRG bank mode (0=32K, 1=Same as 0, 2=16K at C000h, 3=16K at 8000h)
|
||
4-5 PRG outer bank size (0=32K, 1=64K, 2=128K, 3=256K)
|
||
6 Reserved (0)
|
||
7 Reserved (0 or 1 used by menu, but has no function)
|
||
If Reg[80h].Bit1=0 then Reg[80h].Bit0 can be also changed via writes to
|
||
Reg[00h/01h].Bit4.
|
||
PRG Bank Mode 8000h-BFFFh C000h-FFFFh
|
||
32K at 8000h Var: outer*2+inner*2+0 Var: outer*2+inner*2+1 ;AOROM etc
|
||
16K at 8000h Var: outer*2+inner*1 Fixed: outer*2+1 ;UNROM
|
||
16K at C000h Fixed: outer*2+0 Var: outer*2+inner*1
|
||
Merging "outer+inner" is masking off outer.LSBs and inner.MSBs depending on
|
||
outer bank size (ie. it's no real addition with overlapping bits). However, the
|
||
fixed banks are NOT masking off outer.LSBs.
|
||
|
||
Reg[81h]: PRG bank (outer bank) (max 8Mbyte)
|
||
0-7 Select 32K ROM bank at 8000h-FFFFh (initially last 16K at C000h)
|
||
When the outer bank size is set greater than 32K, the bank number is not barrel
|
||
shifted. Instead, the least significant bits are ignored. Bits 5 through 3, for
|
||
example, always control PRG ROM A20 through A18.
|
||
|
||
Reset
|
||
Power-up reset maps last 16K of ROM to C000h-FFFFh (and leaves everything else
|
||
uninitialized). Soft reset does not affect any hardware registers, however,
|
||
games should contain some stub for redirecting their reset vector(s) to restart
|
||
the menu.
|
||
|
||
Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT
|
||
-------------------------------------------
|
||
|
||
This mapper is used on several Japanese titles by Irem, such as ImageFight 2.
|
||
9FFFh Control Register (Bit1,0)
|
||
Bit0 - Name Table ?Mirroring (0=Horizontal, 1=Vertical Mirroring)
|
||
Bit1 - Port 8FFFh Switching Mode (see above)
|
||
8FFFh When 9FFFh/Bit1=0:
|
||
Select 8K ROM bank at 8000h-9FFFh (initially 1st 8K bank)
|
||
Fixed 8K ROM bank at C000h-DFFFh (always 1st half of last 16K)
|
||
When 9FFFh/Bit1=1:
|
||
Fixed 8K ROM bank at 8000h-9FFFh (always 1st 8K bank)
|
||
Select 8K ROM bank at C000h-DFFFh (initially probably 9FFFh/Bit1=0)
|
||
AFFFh Select 8K ROM bank at A000h-BFFFh (initially 2nd 8K bank)
|
||
N/A Fixed 8K ROM bank at E000h-FFFFh (always last 8K bank)
|
||
BFF0h Select 1K VROM bank at PPU 0000h-03FFh
|
||
BFF1h Select 1K VROM bank at PPU 0400h-07FFh
|
||
BFF2h Select 1K VROM bank at PPU 0800h-0BFFh
|
||
BFF3h Select 1K VROM bank at PPU 0C00h-0FFFh
|
||
BFF4h Select 1K VROM bank at PPU 1000h-13FFh
|
||
BFF5h Select 1K VROM bank at PPU 1400h-17FFh
|
||
BFF6h Select 1K VROM bank at PPU 1800h-1BFFh
|
||
BFF7h Select 1K VROM bank at PPU 1C00h-1FFFh
|
||
|
||
Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ
|
||
------------------------------------------------------------
|
||
|
||
Used by Don Doko Don I, II, Flintstones - Rescue of Dino & Hoppy, Bakushou
|
||
Jinsei Gekijou I, II, III, Insector X, Operation Wolf, Power Blazer, Golf Ko
|
||
Open, Akira, Takeshi no Sengoku Fuuunji, Jetsons - Cogswell's Caper, Bubble
|
||
Bobble 2, Captain Saver.
|
||
|
||
TC0190 and TC0350 are slightly different, one has IRQs, one doesn't. No idea
|
||
which is which, so they'll be referenced as Type I and II.
|
||
|
||
Type I and II - Memory Banking Registers
|
||
8000h Select 8K ROM bank at 8000h-9FFFh (Type I: Bit6=Mirroring, see below)
|
||
8001h Select 8K ROM bank at A000h-BFFFh
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last 16K)
|
||
8002h Select 2K VROM bank at PPU 0000h-07FFh
|
||
8003h Select 2K VROM bank at PPU 0800h-0FFFh
|
||
A000h Select 1K VROM bank at PPU 1000h-13FFh
|
||
A001h Select 1K VROM bank at PPU 1400h-17FFh
|
||
A002h Select 1K VROM bank at PPU 1800h-1BFFh
|
||
A003h Select 1K VROM bank at PPU 1C00h-1FFFh
|
||
|
||
Type I - Mirroring
|
||
8000h Bit4-0:See above, Bit6:Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
Ignore this bit if Type II registers are used.
|
||
|
||
Type II - Mirroring and IRQ
|
||
C000h IRQ Counter (incremented every scanline, paused during VBlank)
|
||
C001h IRQ Related (write same value as to C000h)
|
||
C002h IRQ Start/Enable (write any value)
|
||
C003h IRQ Acknowledge/Stop (write any value)
|
||
E000h Mirroring (Bit6) (0=Vertical, 1=Horizontal Mirroring)
|
||
E001h,E002h,E003h Unknown
|
||
|
||
Mapper 34: Nina-1 - PRG/32K, VROM/4K
|
||
------------------------------------
|
||
|
||
Used by Impossible Mission II.
|
||
7FFEh Select 4K VROM bank at PPU 0000h-0FFFh (4bit)
|
||
7FFFh Select 4K VROM bank at PPU 1000h-1FFFh (4bit)
|
||
7FFDh Select 32K ROM bank at 8000h-FFFFh (1bit) (initially 1st bank)
|
||
Contains 8K WRAM at 6000h-7FFFh (not sure if last three bytes can be used).
|
||
Uses six TTL chips, 2x74LS173, 74LS139, 74LS133, 74LS74, and 74LS00, and a
|
||
faux-lockout chip labelled 'NINA'.
|
||
|
||
Note: BNROM is accidentally also marked Mapper 34, although it's actually a
|
||
AOROM variant. For details, see
|
||
--> Mapper 7: AOROM - PRG/32K, Name Table Select
|
||
|
||
Mapper 40: FDS-Port - Lost Levels
|
||
---------------------------------
|
||
|
||
Used by Super Mario Bros 2 - Lost Levels.
|
||
8000h-9FFFh Disable/Reset IRQ counter (by writing any value)
|
||
A000h-BFFFh Enable/Start IRQ counter (by writing any value)
|
||
C000h-DFFFh Not Used
|
||
N/A Fixed 8K ROM at 6000h-7FFFh (always bank 6)
|
||
N/A Fixed 8K ROM at 8000h-9FFFh (always bank 4)
|
||
N/A Fixed 8K ROM at A000h-BFFFh (always bank 5)
|
||
E000h-FFFFh Select 8K ROM at C000h-DFFFh
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always bank 7, ie. last bank)
|
||
When enabled, IRQ generated after 4096 clock cycles (about 36 scanlines).
|
||
|
||
Uses different ports, but the features are about same as:
|
||
--> Mapper 50: FDS-Port - Alt. Levels
|
||
|
||
Mapper 41: Caltron 6-in-1
|
||
-------------------------
|
||
|
||
Used by Caltron 6-in-1 cartridge only.
|
||
6000h-67FFh Main Control Register (decoded by ADDRESS lines A0-A5)
|
||
A2-A0 Select 32K ROM at 8000h-FFFFh
|
||
A2 MSB of above bank number - also enables second register
|
||
A4-A3 Upper two bits of 8K VROM bank at 0000h-1FFFh
|
||
A5 Name Table (0=Vertical, 1=Horizontal Mirroring)
|
||
8000h-FFFFh Auxilary CHR control (decoded by DATA lines D0-D1)
|
||
This register is write-protected when above A2=0 (!)
|
||
D1-D0 Lower two bits of 8K VROM bank at 0000h-1FFFh
|
||
When the NES is switched on, or the reset button is pressed, both registers are
|
||
cleared to 00h, done by a cool little diode / RC circuit on the PHI2 line.
|
||
|
||
Mapper 42: FDS-Port - Mario Baby
|
||
--------------------------------
|
||
|
||
Used only by one game: A pirate copy of Bio Miracle Boukette Upa, renamed to
|
||
Mario Baby, and modified to work as cartridge (instead FDS floppy disk).
|
||
E000h-FFFCh Select 8K ROM at 6000h-7FFFh
|
||
N/A Fixed 32K ROM at 8000h-FFFFh (always last 32K)
|
||
E001h-FFFDh Select mirroring (Bit3: 0=Vertical, 1=Horizontal Mirroring)
|
||
E002h-FFFEh IRQ Control (Bit1: 0=Disable/Reset, 1=Enable/Start)
|
||
E003h-FFFFh Not used
|
||
When enabled, IRQ generated after 24576 clock cycles (about 216 scanlines).
|
||
These ports are mirrored from E000h-FFFFh, every 4 bytes.
|
||
Consists of a whopping 11 chips - 9 TTL/CMOS, 8K RAM, and 128K ROM.
|
||
|
||
Mapper number 42 is also assigned to Ai Senshi Nicol. In short, doing this:
|
||
8000h Select 8K VROM at PPU 0000h-1FFFh
|
||
F000h Select 8K ROM at 6000h-7FFFh
|
||
N/A Fixed 32K ROM at 8000h-FFFFh (always last 32K)
|
||
However, it is doing some odd initialization, writing to Port E000h (index, 1-5
|
||
used), and Port F000h (data for index 1-5, looks like 8K ROM banks at 8000h,
|
||
A000h, C000h, 6000h, E000h). Note that: A) the last 32K seem to be always
|
||
mapped to 8000h-FFFFh. B) each final write to F000h seems to be done with index
|
||
4. If that behaviour doesn't change later on in the game, then Port F000h (or
|
||
even E000h) could be interpreted exactly as for Mario Baby.
|
||
|
||
Mapper 43: X-in-1
|
||
-----------------
|
||
|
||
Used by 150-in-1 (a fake containing 56 games, plus some cheat modes, chip 0 is
|
||
1024K, chip 1 is 512K, chip 2-3 are not installed).
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A7-A0 Select 32K ROM Bank (From currently selected Chip)
|
||
A9-A8 Select ROM Chip (Empty bus if selected chip not installed)
|
||
A10 Not used (Always zero)
|
||
A11 Bank Mode (0=32K, 1=16K; Lower/Upper half via A12)
|
||
A12 Select 16K ROM Bank (0=Lower, 1=Upper) (Should be zero in 32K mode)
|
||
A13 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A14 Not used (Always zero)
|
||
Initially 1st 32K selected. The cartridge includes 8K VRAM.
|
||
|
||
Mapper 44: 7-in-1 MMC3 Port A001h
|
||
---------------------------------
|
||
|
||
Used by Super Big 7-in-1.
|
||
A001h - Select 128K ROM/VROM Block (0..5) or last 256K ROM/VROM Block (6)
|
||
Block 0 seems to be required on power-up.
|
||
|
||
The rest of both mappers is same as MMC3 (for the selected block of memory),
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 45: X-in-1 MMC3 Port 6000hx4
|
||
-----------------------------------
|
||
|
||
Used in Super 3-in-1, Super 4-in-1, Super 8-in-1, Hero 8-in-1, Super 13-in-1,
|
||
and 1000000-in-1 (a fake with 1000000 duplicated/nonsense titles).
|
||
Configuration value initialized by each FOUR writes to Port 6000h.
|
||
6000h 1st write - Configuration Bits 0-7
|
||
6000h 2nd write - Configuration Bits 8-15
|
||
6000h 3nd write - Configuration Bits 16-23
|
||
6000h 4th write - Configuration Bits 24-31
|
||
The meaning of the 32 configuration bits is:
|
||
Bit7-0 VROM base in 1K steps
|
||
Bit15-8 ROM base in 8K steps
|
||
Bit19-16 VROM mask in 1K steps, Mask=(2 SHL (X AND 7))+(X AND 8)/8
|
||
Bit23-20 VROM base in 256K steps
|
||
Bit29-24 ROM mask in 8K steps, Mask=(3Fh AND (NOT X))
|
||
Bit30 LOCK (set when menu selection completed, probably locks Port 6000h)
|
||
Bit31 ???
|
||
Memory selections are Bank=((Mmc3Bank AND ConfigMask) OR ConfigBase). For MMC3
|
||
Registers 0 and 1 (map 2x1K banks), above formula applies to both banks, ie.
|
||
VROM Mask=0 maps same 1K bank twice (instead two continous 1K banks).
|
||
128K Block 3 seems to be required on power-up, ie. the entry point is at the
|
||
end of 512K ROMs, or in the middle of 1024K ROMs. The MMC3 Port A001h
|
||
apparently can write-protect Port 6000h (just like it disables SRAM at
|
||
6000h-7FFFh). At least some carts have at least 2K SRAM (Mario 3 in Super
|
||
8-in-1 uses RAM at 7800h-7FFFh).
|
||
|
||
The rest of the mapper is same as MMC3 (for the selected block of memory),
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 46: 15-in-1 Color Dreams
|
||
-------------------------------
|
||
|
||
Used by Rumble Station 15-in-1, which contains 15 Color Dreams games.
|
||
6000h-7FFFh Multicart Memory Control
|
||
Bit0-3 Select 64K ROM Block (initially 1st bank) (always same as below)
|
||
Bit4-7 Select 64K VROM Block (initially 1st bank) (always same as above)
|
||
8000h-FFFFh Memory Control (selection within current 64K block)
|
||
Bit1 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank)
|
||
Bit6-4 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank)
|
||
Port 8000h-FFFFh is same as Mapper 11, except that it is limited to 64K, and
|
||
except that it doesn't seem to have bus-conflicts (the menu always uses Port
|
||
8888h, regardless of underlaying ROM content).
|
||
In some games ROM/VROM is less than 64K, so some memory areas are unused.
|
||
--> Mapper 11: Color Dreams - PRG/32K, VROM/8K
|
||
|
||
Note: The Rumble Station is not a cartridge - it is a complete NES with
|
||
built-in games, assembled in a "wing-shaped" gamepad case (ie. it consists of a
|
||
CPU, PPU, APU, ROM, mapper, and joypad).
|
||
|
||
There's also a "Rumble Station Mark 2" - claiming to contain 29 games -
|
||
actually containing only 16 games - which may use different mapper?
|
||
|
||
Mapper 47: 2-in-1 MMC3 Port 6000h
|
||
---------------------------------
|
||
|
||
Used by 2-in-1 cart "Super Spike V'Ball + Nintendo World Cup".
|
||
6000h Select 1st or 2nd half of ROM/VROM (0 or 1)
|
||
The rest of the mapper is same as MMC3 (for the selected block of memory),
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
The cartridge doesn't have SRAM, but the MMC3 Port A001h can apparently
|
||
write-protect Port 6000h (just like it could disable SRAM at 6000h-7FFFh).
|
||
|
||
Mapper 48: Taito TC190V
|
||
-----------------------
|
||
|
||
Reportedly "Tatio TC190V" used by "FlintStone".
|
||
Sounds like the Type II (or Type I?) variant of Mapper 33:
|
||
--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ
|
||
|
||
Mapper 49: 4-in-1 MMC3 Port 6xxxh
|
||
---------------------------------
|
||
|
||
Used by Super HIK 4-in-1.
|
||
ROM/VROM are split into 128K blocks each, done as such:
|
||
[6000h]=01h ;init
|
||
[6800h]=00h ;game 0 + [6808h]=08h crashes ?
|
||
[6841h]=41h ;game 1
|
||
[6881h]=81h ;game 2
|
||
[68C1h]=C1h ;game 3
|
||
The rest of the mapper is same as MMC3 (for the selected block of memory),
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
The cartridge doesn't have SRAM, but the MMC3 Port A001h apparently can
|
||
write-protect Ports at 6000h-7FFFh (just like it could disable SRAM at
|
||
6000h-7FFFh).
|
||
|
||
Mapper 50: FDS-Port - Alt. Levels
|
||
---------------------------------
|
||
|
||
Used by Super Mario Bros 2 - Alt. Levels.
|
||
4022h Select 8K ROM at C000h-DFFFh
|
||
Bit0 and/or Bit3 ZERO Bank 0
|
||
Bit0 and/or Bit3 SET Bank 0Ch (or maybe INCREMENT bank number?)
|
||
Other Bits Unknown
|
||
4122h IRQ Control
|
||
Bit0 and/or Bit1 ZERO Disable/Acknowledge
|
||
Bit0 and/or Bit1 SET Enable/Start
|
||
N/A Fixed 8K ROM at 6000h-7FFFh (always bank 0Fh, ie. last bank)
|
||
N/A Fixed 8K ROM at 8000h-9FFFh (always bank 08h)
|
||
N/A Fixed 8K ROM at A000h-BFFFh (always bank 09h)
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always bank 0Bh)
|
||
When enabled, IRQ generated after 4096 clock cycles (about 36 scanlines).
|
||
|
||
Uses different ports, but the features are about same as:
|
||
--> Mapper 40: FDS-Port - Lost Levels
|
||
|
||
Mapper 51: 11-in-1
|
||
------------------
|
||
|
||
Used by 11-in-1, containing ball games, like "soccer ball", and "golf ball".
|
||
6000h Mode Register
|
||
Bit1 ROM Block Size (0=128K Mode, 1=32K Mode)
|
||
Bit4 Unknown
|
||
8000h Base Address in 32K Steps (X) (0-0Fh)
|
||
32K Mode: Select 32K Bank (X) at 8000h-FFFFh (initially 1st 32K bank)
|
||
128K Mode: Select 16K Bank (X*2 OR 07h) at C000h-FFFFh
|
||
And: Select 8K Bank (X*4 OR 23h) at 6000h-7FFFh (for FDS ports)
|
||
C000h Lower 16K Select (Y) (0-1Fh) (128K Mode only, UNROM-style)
|
||
128K Mode: Select 16K Bank (Y*2 OR Y/10h) at 8000h-BFFFh
|
||
The cartridge does have 8K VRAM, even though there's a ROM-image around in
|
||
which somebody has incorrectly included a copy of above 8K VRAM as "8K VROM".
|
||
|
||
Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM
|
||
-------------------------------------------
|
||
|
||
Used by Mario Party 7-in-1 (or short, Mari7in1).
|
||
"It's MMC3 and an extra bank control register. There is 1Mbyte of PRG ROM and
|
||
1Mbyte of CHR ROM on this cart. Interestingly, all the games appear to be NTSC,
|
||
except SMB2. For some reason, this is the PAL version! It consists of 1 6264 8K
|
||
RAM chip (for WRAM), and 3 glop-tops. 2 are 1Mbyte ROMs while the remaining
|
||
chip is the mapper."
|
||
6800h Bank Control Byte
|
||
Bit7 Not used
|
||
Bit6 VROM Bank Size (0=256K, 1=128K)
|
||
Bit5,2,4 VROM 128K Bank (Bit4 not used in 256K CHR mode)
|
||
Bit3 PRG ROM Bank Size (0=256K, 1=128K)
|
||
Bit2,1,0 PRG ROM 128K Bank (Bit0 not used in 256K PRG mode)
|
||
Note: Bit2 is both MOST significant PRG bit, and MIDDLE significant CHR bit.
|
||
After a reset, this register is 00h. It can only be written once.
|
||
To reset it and allow another write, you must reset the console.
|
||
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 56: Pirate SMB3
|
||
----------------------
|
||
|
||
Used only by a pirate copy of Super Mario Bros. 3.
|
||
8000h Unknown (always 08h) (maybe counter LSBs, if any)
|
||
9000h Bit7-4 of 16bit IRQ counter
|
||
A000h Bit11-8 of 16bit IRQ counter
|
||
B000h Bit15-12 of 16bit IRQ counter
|
||
C000h IRQ Anable (FFh=Enable, 00h=Disable)
|
||
D000h IRQ Acknowledge (Always write FFh, or EFh)
|
||
E000h Ignore - MMC3-index (Port 8000h) relicts redirected to E000h
|
||
F000h Select 8K ROM at 8000h-9FFFh
|
||
F001h Select 8K ROM at A000h-BFFFh
|
||
F002h Select 8K ROM at C000h-DFFFh
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always last bank)
|
||
F003h Unknown (always 10h)
|
||
F400h Select 1K VROM at PPU 0000h-03FFh
|
||
F401h Select 1K VROM at PPU 0400h-07FFh
|
||
F402h Select 1K VROM at PPU 0800h-0BFFh
|
||
F403h Select 1K VROM at PPU 0C00h-0FFFh
|
||
F404h Select 1K VROM at PPU 1000h-13FFh
|
||
F405h Select 1K VROM at PPU 1400h-17FFh
|
||
F406h Select 1K VROM at PPU 1800h-1BFFh
|
||
F407h Select 1K VROM at PPU 1C00h-1FFFh
|
||
The cartridge often uses silly mirrors like C5A7h, mask 8000h-EFFFh by F000h,
|
||
and F000h-FFFFh by F407h. The IRQ counter is incremented every clock cycle.
|
||
|
||
Mapper 57: 6-in-1
|
||
-----------------
|
||
|
||
Used by Game Star 6-in-1 GK-L01A, 6-in-1 GK-L02A, and 54-in-1 GK-54.
|
||
8000h Extra Port for CNROM Games in 2nd 64K of VROM
|
||
Bit2-0 Select 8K VROM at PPU 0000h-1FFFh (ORed with value in Port 8800h)
|
||
Bit5-3 Not used (zero)
|
||
Bit6 Must be set for Second 64K Block of VROM
|
||
Bit7 Must be set for First 64K Block of VROM
|
||
8800h Main Port
|
||
Bit2-0 Select 8K VROM at PPU 0000h-1FFFh (ORed with value in Port 8000h)
|
||
Bit3 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
Bit4 ROM Size (0=16K; Bank X twice, 1=32K; Bank X and X+1)
|
||
Bit7-5 Select 16K ROM at 8000h-BFFFh and C000h-FFFFh (X)
|
||
All carts have 128K ROM and 128K VROM and contain 6 games (even "54-in-1").
|
||
|
||
Mapper 58: X-in-1
|
||
-----------------
|
||
|
||
Used by 68-in-1 (a fake containing only 8 games).
|
||
C000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A2-A0 Select 16K ROM Bank at 8000h-BFFFh and C000h-FFFFh (X)
|
||
A5-A3 Select 8K VROM Bank at PPU 0000h-1FFFh
|
||
A6 ROM Size (0=32K; Bank X and X+1, 1=16K; Bank X twice)
|
||
A7 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A12-A8 Unknown (Usually 0,/A6,0,/A6,A5,A3, except in yie-ar-kung-fu)
|
||
|
||
Note: Study and Game 32-in-1 declared as "Mapper 58" should be Mapper 241,
|
||
--> Mapper 241: X-in-1 Education
|
||
|
||
Mapper 61: 20-in-1
|
||
------------------
|
||
|
||
Used by 20-in-1.
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A3-0 Select 32K ROM Bank at 8000h-FFFFh
|
||
A4 Bank Size (0=32K, 1=16K; only lower/upper half via Bit5)
|
||
A5 Select lower/upper half of selected 32K bank (in 16K mode)
|
||
A7 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A6,A8-A14 Not used (always 0)
|
||
There's also a version of the same cartridge with slightly different mapper:
|
||
--> Mapper 231: 20-in-1
|
||
|
||
Mapper 62: X-in-1
|
||
------------------
|
||
|
||
Used by 700-in-1 (a fake containing only somewhat 50-100 games).
|
||
8000h-BFFFh Memory Control (Decoded by address AND data lines)
|
||
A4-A0,D1-D0 Select 8K VROM at PPU 0000h-1FFFh
|
||
A5 ROM Size (0=32K; Bank X-1 and X, 1=16K; Bank X twice)
|
||
A7 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A6,A13-A8 Select 16K ROM at 8000h-BFFFh and C000h-FFFFh (X)
|
||
A14 Always 0 ?
|
||
ROM Bank lower bit (A8) should be always SET in 32K Mode. Initially 1st 32K.
|
||
|
||
Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ
|
||
-------------------------------------------------------
|
||
|
||
Used by Shinobi, Klax, and Skull & Crossbones.
|
||
8000h Index/Control (6bit)
|
||
Bit7 CHR Address Select (0=Normal, 1=Address Areas XOR 1000h)
|
||
Bit6 PRG Address Select (0=Normal, 1=Address Areas plus 2000h)
|
||
Bit5 CHR Bank Size (0=Normal, 1=Use 1K-resolution instead 2x1K)
|
||
Bit3-0 Command Number (Note: Index 0-7 same as for MMC3)
|
||
0 - Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh, if Bit7=1)
|
||
1 - Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh, if Bit7=1)
|
||
2 - Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh, if Bit7=1)
|
||
3 - Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh, if Bit7=1)
|
||
4 - Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh, if Bit7=1)
|
||
5 - Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh, if Bit7=1)
|
||
6 - Select 8K ROM at 8000h-9FFFh (or A000h-BFFFh, if Bit6=1)
|
||
7 - Select 8K ROM at A000h-BFFFh (or C000h-DFFFh, if Bit6=1)
|
||
F - Select 8K ROM at C000h-DFFFh (or 8000h-9FFFh, if Bit6=1)
|
||
N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank)
|
||
8 - Select 1K VROM page at PPU 0400h (used only if Bit5=1)
|
||
9 - Select 1K VROM page at PPU 0C00h (used only if Bit5=1)
|
||
8001h Data Register (indexed via Port 8000h)
|
||
A000h Mirroring Select (Bit0: 0=Vertical, 1=Horizontal Mirroring)
|
||
A001h Not used
|
||
C000h IRQ Reload Value (for decrementing Scanline-/clock-cycle-counter)
|
||
C001h IRQ Clock Source (Bit0: 0=Scanline Counter, 1=System Clock div 4)
|
||
E000h IRQ Disable/Acknowledge (write any value)
|
||
E001h IRQ Enable (write any value)
|
||
|
||
Write to C000h: After N+1 clocks have occured, the IRQ flag will be set. N is
|
||
the value written to C000h. Writing a value of 00h will cause NO interrupts to
|
||
be generated at all. (Note: if C001h is written to, then a value of 00h can be
|
||
used- it will cause an interrupt to be generated in 2 clocks after C001h is
|
||
written to. No more interrupts will be generated unless C001h is written to
|
||
again).
|
||
Write to C001h: Will trigger a reload of the IRQ counter (and select the
|
||
desired clock source). One thing of note, after writing, the IRQ counter will
|
||
expire after a count of N+2 instead of N+1. In this case, a value of 00h in
|
||
C000h WILL generate an interrupt after 2 clocks. A value of FFh likewise
|
||
generates an interrupt after 257d clocks.
|
||
|
||
Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ
|
||
-------------------------------------------------
|
||
|
||
Used by Daiku no Gensan 2, Kaiketsu Yanchamaru 3, and Spartan X 2.
|
||
Note: Ai Sensei no Oshiete declared as "Mapper 65" is maybe a Konami mapper?
|
||
9000h Unknown
|
||
9001h Unknown
|
||
9003h,9004h IRQ Control (not sure about difference between 9003h/9004h)
|
||
(00h=Disable IRQ, C0h=Enable IRQ, other values unknown)
|
||
9005h IRQ Counter MSB of decrementing 16bit counter
|
||
9006h IRQ Counter LSB of decrementing 16bit counter
|
||
B000h Select 1K VROM bank at PPU 0000h-03FFh
|
||
B001h Select 1K VROM bank at PPU 0400h-07FFh
|
||
B002h Select 1K VROM bank at PPU 0800h-0BFFh
|
||
B003h Select 1K VROM bank at PPU 0C00h-0FFFh
|
||
B004h Select 1K VROM bank at PPU 1000h-13FFh
|
||
B005h Select 1K VROM bank at PPU 1400h-17FFh
|
||
B006h Select 1K VROM bank at PPU 1800h-1BFFh
|
||
B007h Select 1K VROM bank at PPU 1C00h-1FFFh
|
||
8000h Select 8K ROM bank at 8000h-9FFFh (initially 1st half of 1st 16K)
|
||
A000h Select 8K ROM bank at A000h-BFFFh (initially 2nd half of 1st 16K)
|
||
C000h Select 8K ROM bank at C000h-DFFFh (initially 1st half of last 16K)
|
||
N/A Fixed 8K ROM bank at E000h-FFFFh (always 2nd half of last 16K)
|
||
|
||
Mapper 66: GNROM - PRG/32K, VROM/8K
|
||
-----------------------------------
|
||
|
||
This mapper is used on several Japanese titles, such as Dragon Ball, and on
|
||
U.S. titles such as Gumshoe and Dragon Power.
|
||
8000h-FFFFh Memory Control (2x2bits)
|
||
Bit1-0 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank)
|
||
Bit5-4 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank)
|
||
This mapper is used on the DragonBall (NOT DragonBallZ) NES game.
|
||
|
||
Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ
|
||
-------------------------------------------
|
||
|
||
Used by Fantasy Zone 2.
|
||
8000h IRQ Acknowledge (write any data to this address)
|
||
8800h-8FFFh Select 2K VROM bank at PPU 0000h-07FFh
|
||
9800h-9FFFh Select 2K VROM bank at PPU 0800h-0FFFh
|
||
A800h-AFFFh Select 2K VROM bank at PPU 1000h-17FFh
|
||
B800h-BFFFh Select 2K VROM bank at PPU 1800h-1FFFh
|
||
C800h-CFFFh IRQ Counter (two writes: 1st=MSB, 2nd=LSB)
|
||
(16bit decrementing clock cycle counter)
|
||
D800h-DFFFh IRQ Control (Bit4: 0=Disable, 1=Enable)
|
||
E800h-EFFFh No info - maybe Mirroring control ?
|
||
F800h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
|
||
Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM
|
||
-----------------------------------------------
|
||
|
||
This mapper is used by After Burner I and II, and by Maharaja.
|
||
8000h Select 2K VROM bank at PPU 0000h-07FFh
|
||
9000h Select 2K VROM bank at PPU 0800h-0FFFh
|
||
A000h Select 2K VROM bank at PPU 1000h-17FFh
|
||
B000h Select 2K VROM bank at PPU 1800h-1FFFh
|
||
C000h Select 1K VROM bank as BLK0 (in VROM Mode) (from LAST 128 banks)
|
||
D000h Select 1K VROM bank as BLK1 (in VROM Mode) (from LAST 128 banks)
|
||
E000h Name Table Control
|
||
Bit4 Name Table VROM Mode (0=VRAM, 1=VROM via Port C000h/D000h)
|
||
Bit0 Name Table Mirroring (0=Horizontal, 1=Vertical Mirroring)
|
||
F000h Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
|
||
Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ
|
||
---------------------------------------------------------------
|
||
|
||
This mapper is used by Batman, Hebereke, Pyokotan no Da Meiro, Barcode World,
|
||
Gremlin 2, Honoo no Doukyuuji 1 and 2, and Gimmick.
|
||
8000h Index Register (4bit)
|
||
0 - Select 1K VROM at PPU 0000h-03FFh
|
||
1 - Select 1K VROM at PPU 0400h-07FFh
|
||
2 - Select 1K VROM at PPU 0800h-0BFFh
|
||
3 - Select 1K VROM at PPU 0C00h-0FFFh
|
||
4 - Select 1K VROM at PPU 1000h-13FFh
|
||
5 - Select 1K VROM at PPU 1400h-17FFh
|
||
6 - Select 1K VROM at PPU 1800h-1BFFh
|
||
7 - Select 1K VROM at PPU 1C00h-1FFFh
|
||
8 - Select 8K ROM/RAM at 6000h-7FFFh
|
||
Bit6=0 --> Select 8K ROM (Page number in bit5-0)
|
||
Bit6=1,Bit7=1 --> Select 8K SRAM
|
||
Bit6=1,Bit7=0 --> Select 8K "pseudo-random numbers?"
|
||
9 - Select 8K ROM at 8000h-9FFFh
|
||
A - Select 8K ROM at A000h-BFFFh
|
||
B - Select 8K ROM at C000h-DFFFh
|
||
C - Select Mirroring
|
||
0 Two-Screen, Vertical Mirroring
|
||
1 Two-Screen, Horizontal Mirroring
|
||
2 One-Screen, BLK0
|
||
3 One-Screen, BLK1
|
||
D - IRQ control (00h=Disable, 81h=Enable, other values?)
|
||
E - IRQ LSB of decrementing clock cycle counter
|
||
F - IRQ MSB of decrementing clock cycle counter
|
||
N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank)
|
||
A000h Data Register (indexed via Port 8000h)
|
||
|
||
Mapper 70: Bandai - PRG/16K, VROM/8K, NT
|
||
----------------------------------------
|
||
|
||
Used by Taito's Arkanoid 2, and various Bandai games: Space Shadow, Kamen Rider
|
||
Club, Saint Seiya, Pocket Zaurus, Gegege no Kitarou 2, and two Family Trainer
|
||
games.
|
||
C000h-C0FFh Memory Control
|
||
Bit7 Name Table Select (0/1 = BLK0/BLK1) (One-Screen Mode only)
|
||
Bit6-4 Select 16K ROM at 8000h-BFFFh
|
||
Bit3-0 Select 8K VROM at PPU 0000h-1FFFh
|
||
Bus-Conflicts, memory at C000h-C0FFh should be filled by 00h-FFh.
|
||
|
||
Mapper 71: Camerica - PRG/16K
|
||
-----------------------------
|
||
|
||
This mapper is used on Camerica's unlicensed NES carts, including Firehawk and
|
||
Linus Spacehead.
|
||
8000h-BFFFh Unknown
|
||
C000h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
All carts using it have 8K of VRAM at PPU 0000h-1FFFh.
|
||
Many ROMs from these games are incorrectly defined as mapper 2.
|
||
|
||
Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K
|
||
--------------------------------------------------
|
||
|
||
Used by Pinball Quest, Pro Tennis, Pro Judo.
|
||
8000h-FFFFh Memory Control
|
||
Bit7-6 Function Select
|
||
0 Confirm Selection
|
||
1 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
2 Select 16K ROM bank at 8000h-BFFFh (lower half of PRG memory)
|
||
3 Reserved (would probably select both PRG+VROM)
|
||
Bit5-4 Not used
|
||
Bit0-3 ROM or VROM Bank Number for above Selection
|
||
Bus-conflicts. Example: To select PRG Bank 7, first write 87h, then 07h.
|
||
Same as Mapper 92, except that this one maps the LOWER half of PRG memory.
|
||
|
||
Not sure if that makes sense, but it appears to consist of three latches,
|
||
latch1 directly accessed from CPU, the other latches loaded from the latch1 on
|
||
high-to-low transitions in bit6/7.
|
||
|
||
Mapper 73: Konami VRC3 - PRG/16K, IRQ
|
||
-------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 74: Whatever MMC3-style
|
||
------------------------------
|
||
|
||
Reportedly "Taiwan MMC3 -Varient Mapper#0" used by "KidNiKi3J(hacked)".
|
||
Personally, I have a ROM-image named "Ji Jia Zhan Shi", which may or may not be
|
||
same as "KidNiKi3J(hacked)".
|
||
|
||
Anyways, that ROM-image seems to be basically MMC3-compatible,
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
except that it gets wrong anytime when selecting ROM bank number 14h via
|
||
Register 7, don't know what is/should be happenening there (?)
|
||
|
||
Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT
|
||
----------------------------------------------------------
|
||
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
Mapper 76: Namco 109 - PRG/8K, VROM/2K
|
||
--------------------------------------
|
||
|
||
Used by Digital Devil / Megami Tensei.
|
||
8000h Index/Control (3bit)
|
||
Bit2-0 Command Number
|
||
0 - Not used
|
||
1 - Not used
|
||
2 - Select 2K VROM at PPU 0000h-07FFh
|
||
3 - Select 2K VROM at PPU 0800h-0FFFh
|
||
4 - Select 2K VROM at PPU 1000h-17FFh
|
||
5 - Select 2K VROM at PPU 1800h-1FFFh
|
||
6 - Select 8K ROM at 8000h-9FFFh
|
||
7 - Select 8K ROM at A000h-BFFFh
|
||
N/A - Fixed 16K ROM at C000h-FFFFh (always last bank)
|
||
8001h Data Register (Indexed via Port 8000h)
|
||
|
||
Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K
|
||
----------------------------------------------
|
||
|
||
Used by Napoleon Senki.
|
||
8000h-FFFFh Memory Control
|
||
Bit0-1 Select 32K ROM bank at 8000h-FFFFh
|
||
Bit2-3 Not used
|
||
Bit4-7 Select 2K VROM bank at PPU 0000h-07FFh
|
||
6K VRAM at PPU 0800h-1FFFh (ie. upper 6K of Pattern Tables are VRAM)
|
||
2K VRAM at PPU 2800h-2FFFh (ie. uses Four-Screen Name Tables)
|
||
Bus-conflicts.
|
||
|
||
Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K
|
||
---------------------------------------------
|
||
|
||
Used by Holy Diver, and Cosmo Carrier (Uchuusen). The two games seem to be
|
||
using different/incompatible mapper circuits for name table control?
|
||
8000h-FFFFh Memory Control
|
||
Bit2-0 Select 16K ROM bank at 8000h-BFFFh (initially 1st bank)
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
Bit3 Name Table Control
|
||
Jaleco/Cosmo Carrier: One-Screen (0=BLK0, 1=BLK1)
|
||
Irem/Holy Diver: Two-Screen (0=Horizontal, 1=Vertical Mirroring)
|
||
Bit7-4 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
|
||
Mapper 79: AVE Nina-3 - VROM/8K
|
||
-------------------------------
|
||
|
||
[See also]
|
||
--> Mapper 113: Sachen/Hacker/Nina
|
||
Made by American Video Entertainment (AVE), used by Krazy Kreatures, Double
|
||
Strike, etc.
|
||
4100h Bit1-0 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
Port decoded as A14=A8=HIGH, A15=A13=LOW, ie. with mirrors at 4100h-41FFh,
|
||
4300h-43FFh ... 5F00h-5FFFh. Contains 74LS175, 74LS138, and "Nina"-lockout
|
||
chip.
|
||
|
||
Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT
|
||
-----------------------------------------------
|
||
|
||
Used by Fudou Myouou Den (Demon Sword), Kyonshiizu 2, Mirai Shinwa Jarvas,
|
||
Taito Grand Prix - Eikou heno License, Yamamura Misa Suspense - Kyouto Ryuu no
|
||
Tera Satsujin, Minelvaton Saga.
|
||
7EF0h Select 2x1K VROM at PPU 0000h-07FFh (Bit7: Name Table, see below)
|
||
7EF1h Select 2x1K VROM at PPU 0800h-0FFFh (Bit7: Name Table, see below)
|
||
7EF2h Select 1K VROM at PPU 1000h-13FFh
|
||
7EF3h Select 1K VROM at PPU 1400h-17FFh
|
||
7EF4h Select 1K VROM at PPU 1800h-1BFFh
|
||
7EF5h Select 1K VROM at PPU 1C00h-1FFFh
|
||
7EF6h Unknown (usually FFh, 01h, or 00h)
|
||
7EF8h SRAM Enable (A3h=Enable, FFh=Disable)
|
||
7EFAh Select 8K ROM 8000h-9FFFh
|
||
7EFCh Select 8K ROM A000h-BFFFh
|
||
7EFEh Select 8K ROM C000h-DFFFh
|
||
N/A Fixed 8K ROM E000h-FFFFh (always last bank)
|
||
7EF7h,7EF9h Not used
|
||
7EFBh,7EFDh,7EFFh Dupes of 7EFAh,7EFCh,7EFEh used by Kyonshiizu 2 only
|
||
7F00h-7FFFh SRAM Area (seems to be only 256 bytes or less used)
|
||
Bit7 of 7EF0h and Bit7 of 7EF1h are somehow related to Name Tables: Most carts
|
||
use Vertical Mirroring, these carts always have both bits cleared. Demon Sword
|
||
uses One-Screen mode, either both bits cleared (BLK0), or both bits set (BLK1).
|
||
|
||
Mapper 81: AVE Nina-6
|
||
---------------------
|
||
|
||
Made by American Video Entertainment (AVE), used by Deathbots, Mermaids of
|
||
Atlantis, etc.
|
||
No info. For Deathbots, see:
|
||
--> Mapper 113: Sachen/Hacker/Nina
|
||
|
||
Also, presumably mis-numbered "Mapper 81 - Taito C075"
|
||
Reportedly "Tatio C075" used by "(many Japanese title from tatio)".
|
||
Don't have a ROM-image that is assigned as Mapper 81. Don't know which titles
|
||
are using it. Maybe meant to be Taito's Arkanoid 2, ie. this mapper:
|
||
--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT
|
||
|
||
Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K
|
||
-------------------------------------------
|
||
|
||
Used by SD Keiji Blader, and Kyuukyoku Harikiri 1, 2, 3.
|
||
7EF0h Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh if swapped)
|
||
7EF1h Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh if swapped)
|
||
7EF2h Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh if swapped)
|
||
7EF3h Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh if swapped)
|
||
7EF4h Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh if swapped)
|
||
7EF5h Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh if swapped)
|
||
7EF6h Swap PPU 0000h-0FFFh / 1000h-1FFFh (Bit1: 0=Normal, 1=Swap)
|
||
7EF7h SRAM .... CAh,00h,01h,40h
|
||
7EF8h SRAM .... 69h,00h,40h
|
||
7EF9h SRAM .... 84h,00h,40h
|
||
7EFAh Select 8K ROM 8000h-9FFFh (Bit7-2)
|
||
7EFBh Select 8K ROM A000h-BFFFh (Bit7-2)
|
||
7EFCh Select 8K ROM C000h-DFFFh (Bit7-2)
|
||
N/A Fixed 8K ROM E000h-FFFFh (unknown?)
|
||
7EFDh SRAM .... FFh
|
||
7EFEh SRAM .... FFh,07h
|
||
7EFFh SRAM .... FFh
|
||
6000h-7FFFh SRAM Area (probably 8K size, at least 6000h-73xxh used)
|
||
|
||
Mapper 83: Cony
|
||
---------------
|
||
|
||
There are different Cony variants for cartridges of different size:
|
||
Cony (A) 128K+256K Fatal Fury 2
|
||
Cony (B) 256K+512K World Heroes 2
|
||
Cony (C) 4x256K+4x256K Dragon Ball Z 4-in-1
|
||
Also used by Garou Densetsu Special?
|
||
Cony (A) and (C) only - 8bit bank numbers (256x1K=256K):
|
||
8310h Select 1K VROM at PPU 0000h-03FFh (in current 256K block)
|
||
8311h Select 1K VROM at PPU 0400h-07FFh (in current 256K block)
|
||
8312h Select 1K VROM at PPU 0800h-0BFFh (in current 256K block)
|
||
8313h Select 1K VROM at PPU 0C00h-0FFFh (in current 256K block)
|
||
8314h Select 1K VROM at PPU 1000h-13FFh (in current 256K block)
|
||
8315h Select 1K VROM at PPU 1400h-17FFh (in current 256K block)
|
||
8316h Select 1K VROM at PPU 1800h-1BFFh (in current 256K block)
|
||
8317h Select 1K VROM at PPU 1C00h-1FFFh (in current 256K block)
|
||
Cony (B) only - 8bit bank numbers (256x2K=512K):
|
||
8310h Select 2K VROM at PPU 0000h-07FFh
|
||
8311h Select 2K VROM at PPU 0800h-0FFFh
|
||
8316h Select 2K VROM at PPU 1000h-17FFh
|
||
8317h Select 2K VROM at PPU 1800h-1FFFh
|
||
Cony (A) only - 4bit bank numbers (16x8K=128K):
|
||
8300h Select 8K ROM at 8000h-9FFFh
|
||
8301h Select 8K ROM at A000h-BFFFh
|
||
8302h Select 8K ROM at C000h-DFFFh
|
||
N/A Fixed 8K ROM at E000h-FFFFh (always last bank)
|
||
Cony (B) and (C) only - 4bit bank numbers (16x16K=256K):
|
||
8000h Select 16K ROM at 8000h-BFFFh (in current 256K block)
|
||
N/A Fixed 16K ROM at C000h-FFFFh (last bank in current 256K block)
|
||
Cony (A) and (B) and (C):
|
||
8200h IRQ Counter LSB, writing to this address acknowledges IRQs
|
||
8201h IRQ Counter MSB, writing to this address starts counting
|
||
Cony (A) and (B) only:
|
||
8100h IRQ Control (Bit7=Enable IRQs) (other bits unknown) Bit7, unlike C
|
||
5000h Unknown, program reads from this address
|
||
Cony (C) only:
|
||
8100h IRQ Control (Bit1=Enable IRQs) (other bits unknown) Bit1, unlike A/B
|
||
B000h Select 256K ROM/VROM Windows (upper two address bits)
|
||
Bit0-3 Unknown
|
||
Bit4,6 Bit0 of 256K Block Number
|
||
Bit5,7 Bit1 of 256K Block Number
|
||
Used values are 00h,50h,A0h,F0h. Other values could probably select
|
||
separate 256K banks for ROM/VROM. The ROM selection also affects
|
||
the "fixed" 16K at C000h-FFFFh (last bank in current 256K block).
|
||
B0FFh Probably same as B000h
|
||
B1FFh Probably same as B000h
|
||
510Xh Unknown, program reads/writes to/from this address
|
||
430Xh Unknown, program reads from this address
|
||
|
||
Mapper 84: Whatever
|
||
-------------------
|
||
|
||
No info. Reportedly "PC-SMB2J" used by "SMBJ2".
|
||
Don't have a ROM-image, unless it is meant to be same as Mapper 40 or 50:
|
||
--> Mapper 40: FDS-Port - Lost Levels
|
||
--> Mapper 50: FDS-Port - Alt. Levels
|
||
|
||
Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
---------------------------------------------------------------
|
||
|
||
VRC7 General Memory and IRQ Registers
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
|
||
VRC7 Sound Registers
|
||
The sound generation is done using FM synthesis, so the music sounds like
|
||
"Adlib" OPL2 music. All sound registers are accessed through only two physical
|
||
registers.
|
||
9010h (aka 9.1.0) Index register
|
||
9030h (aka 9.1.1) Data Register
|
||
There are 6 channels, each containing three registers, and 8 custom instrument
|
||
control registers.
|
||
|
||
Index 10h-15h - Channel 0-5, Frequency LSB
|
||
Bit7-0 Lower 8bit of 9bit Frequency (f; 0-1FFh)
|
||
|
||
Index 20h-25h - Channel 0-5, Frequency MSB, Octave, Trigger
|
||
Bit7-5 Unknown
|
||
Bit4 Channel trigger
|
||
Bit3-1 Octave Select (o; 0-7)
|
||
Bit0 Upper 1bit of 9bit Frequency (f; 0-1FFh)
|
||
Frequency is calculated as: F = 49722Hz * f / 2^(19-o)
|
||
|
||
Index 30h-35h - Channel 0-5, Instrument and Volume
|
||
Bit7-4 Instrument number (0=Custom, 1-0Fh=Fixed Instruments)
|
||
Bit3-0 Volume
|
||
|
||
Index 00h-07h - Custom Instrument (Instrument 0)
|
||
Note: I will not provide too extensive documentation of the instrument
|
||
registers since their functions are identical to those of the OPL2 chip,
|
||
commonly found on Adlib/Soundblaster/compatible cards, and there is alot
|
||
of information out on how to program these. I will use terminology
|
||
similar to that found in said documents. My VRC7 "emulator" test program
|
||
I wrote simply re-arranged and tweaked the register writes to correspond
|
||
with the OPL2 registers.
|
||
Here's a link to a good document about this chip:
|
||
http://www.ccms.net/~aomit/oplx/
|
||
The tremolo depth is set to 4.3db and the vibrato depth is set to 14 cent
|
||
(in reguards to OPL2 settings; to achieve this you would write 0C0h to
|
||
OPL register 0BDh). All operator connections are fixed in FM mode. (Where
|
||
Modulator modulates the Carrier).
|
||
|
||
Index 00h (Modulator)
|
||
Index 01h (Carrier)
|
||
Bit7 Tremolo Enable
|
||
Bit6 Vibrato Enable
|
||
Bit5 Sustain Enable
|
||
Bit4 KSR
|
||
Bit3-0 Multiplier
|
||
|
||
Index 02h
|
||
Bit7-6 Key Scale Level
|
||
Bit5-0 Output Level
|
||
|
||
Index 03h
|
||
Bit7-5 Not used (Write 0's)
|
||
Bit4 Carrier Waveform
|
||
Bit3 Modulator Waveform
|
||
There are only two waveforms available. Sine and rectified sine (only
|
||
the positive cycle of the sine; negative cycle "chopped off".)
|
||
Bit2-0 Feedback Control
|
||
|
||
Index 04h (Modulator)
|
||
Index 05h (Carrier)
|
||
Bit7-4 Attack
|
||
Bit3-0 Decay
|
||
|
||
Index 06h (Modulator)
|
||
Index 07h (Carrier)
|
||
Bit7-4 Sustain
|
||
Bit3-0 Release
|
||
|
||
Register Settings for the 15 fixed instruments
|
||
These instruments are not 100% correct! There is no way to extract the register
|
||
settings from the chip short of an electron microscope.
|
||
I have "tuned" these instruments best I could, though I know a couple
|
||
are not exactly right.
|
||
Table shows Register 0-7 settings for Instrument 1-0Fh
|
||
1 - 05 03 10 06 74 A1 13 F4
|
||
2 - 05 01 16 00 F9 A2 15 F5
|
||
3 - 01 41 11 00 A0 A0 83 95
|
||
4 - 01 41 17 00 60 F0 83 95
|
||
5 - 24 41 1F 00 50 B0 94 94
|
||
6 - 05 01 0B 04 65 A0 54 95
|
||
7 - 11 41 0E 04 70 C7 13 10
|
||
8 - 02 44 16 06 E0 E0 31 35
|
||
9 - 48 22 22 07 50 A1 A5 F4
|
||
A - 05 A1 18 00 A2 A2 F5 F5
|
||
B - 07 81 2B 05 A5 A5 03 03
|
||
C - 01 41 08 08 A0 A0 83 95
|
||
D - 21 61 12 00 93 92 74 75
|
||
E - 21 62 21 00 84 85 34 15
|
||
F - 21 62 0E 00 A1 A0 34 15
|
||
|
||
Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K
|
||
---------------------------------------------------
|
||
|
||
Used only by Moero Pro Baseball (Red/Black).
|
||
6000h Memory Control
|
||
Bit6,1,0 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
Bit5,4 Select 32K ROM bank at 8000h-FFFFh
|
||
Bit7,3,2 Not used (always zero)
|
||
7000h Unknown
|
||
Also used by Lum no Wedding Bell though that does use only VROM banking.
|
||
Functional same as Mapper 87, though that does as well use only VROM banking.
|
||
|
||
Mapper 87: Jaleco/Konami 16K VROM - VROM/8K
|
||
-------------------------------------------
|
||
|
||
Used only by Hyper Olympic, Goonies, Choplifter, Argus, Ninja Jajamaru Kun,
|
||
City Connection.
|
||
6000h Select 8K VROM bank at PPU 0000h-1FFFh (Bit 1 used only)
|
||
|
||
Mapper 88: Namco 118
|
||
--------------------
|
||
|
||
Used by Devil Man, Dragon Spirit, Namcot Mahjong 3, Quinty.
|
||
8000h Index/Control (3bit)
|
||
Bit2-0 Command Number
|
||
0 - Select 2x1K VROM at PPU 0000h-07FFh (Banks 0-63)
|
||
1 - Select 2x1K VROM at PPU 0800h-0FFFh (Banks 0-63)
|
||
2 - Select 1K VROM at PPU 1000h-13FFh (Banks 64-127)
|
||
3 - Select 1K VROM at PPU 1400h-17FFh (Banks 64-127)
|
||
4 - Select 1K VROM at PPU 1800h-1BFFh (Banks 64-127)
|
||
5 - Select 1K VROM at PPU 1C00h-1FFFh (Banks 64-127)
|
||
6 - Select 8K ROM at 8000h-9FFFh
|
||
7 - Select 8K ROM at A000h-BFFFh
|
||
N/A - Fixed 16K ROM at C000h-FFFFh (always last bank)
|
||
8001h Data Register (Indexed via Port 8000h)
|
||
The carts have 128K VROM, of which the lower 64K can be mapped only to Pattern
|
||
Table 0, the upper 64K only to Pattern Table 1.
|
||
Devil Man additionally writes 00h to Port C000h, purpose unknown.
|
||
Devil Man ROM-image is declared as 4-screen-vertical-mirror, that is nonsense.
|
||
|
||
Mapper 89: Sunsoft Early - PRG/16K, VROM/8K
|
||
-------------------------------------------
|
||
|
||
Used by only by Mito Koumon.
|
||
8000h-FFFFh Memory Control
|
||
Bit7 Unknown - maybe Name Table related, maybe not.
|
||
Bit6-4 Select 16K ROM bank at 8000h-BFFFh
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank)
|
||
Bit3-0 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
The program seems to attempt (unsuccesfully) to resolve bus-conflicts.
|
||
|
||
Mapper 90: Pirate MMC5-style
|
||
----------------------------
|
||
|
||
Used by some pirate titles (Taiwan) such as Super Mario World, Tekken2 and
|
||
Mortal Kombat. Features similar functions as MMC5, though the Port addresses
|
||
are completely different.
|
||
|
||
5000h(W) Maths Coprocessor Parameter A
|
||
5001h(W) Maths Coprocessor Parameter B
|
||
5000h(R) Maths Coprocessor 8bit Result of A*B
|
||
8000h PRG 8K at 8000h-9FFFh
|
||
8001h PRG 8K at A000h-BFFFh or 16k PRG bank at $A000-?
|
||
8002h PRG 8K at C000h-DFFFh
|
||
8003h PRG 8K at E000h-FFFFh
|
||
9000h/A000h LSB/MSB of VROM bank at PPU 0000h (1K,2K,4K,8K)
|
||
9001h/A001h LSB/MSB of VROM bank at PPU 0400h (1K)
|
||
9002h/A002h LSB/MSB of VROM bank at PPU 0800h (1K,2K)
|
||
9003h/A003h LSB/MSB of VROM bank at PPU 0C00h (1K)
|
||
9004h/A004h LSB/MSB of VROM bank at PPU 1000h (1K,2K,4K)
|
||
9005h/A005h LSB/MSB of VROM bank at PPU 1400h (1K)
|
||
9006h/A006h LSB/MSB of VROM bank at PPU 1800h (1K,2K)
|
||
9007h/A007h LSB/MSB of VROM bank at PPU 1C00h (1K)
|
||
B000h/B004h LSB/MSB of 1K VROM bank at PPU 2000h (Name Table VROM mode)
|
||
B001h/B005h LSB/MSB of 1K VROM bank at PPU 2400h (Name Table VROM mode)
|
||
B002h/B006h LSB/MSB of 1K VROM bank at PPU 2800h (Name Table VROM mode)
|
||
B003h/B007h LSB/MSB of 1K VROM bank at PPU 2C00h (Name Table VROM mode)
|
||
|
||
$C000 irq registers Unknown
|
||
$C001 irq registers Unknown
|
||
$C006 irq registers Unknown
|
||
$C007 irq registers Unknown
|
||
$C002 irq clear irq_flag=0 and INT signal is clear
|
||
$C003 irq reset if $C005=0, irq_flag=0
|
||
else, irq_flag=1 and irq_counter=irq_latch
|
||
$C004 irq reset It seems same of $C003
|
||
$C005 irq counter irq_flag=1, irq_latch = irq_counter = value
|
||
IRQs work like MMC3 does.
|
||
IRQ counter is decremented at every scanline, always while not blanking
|
||
(scanline < 240), and background or sprites are enabled. When it reaches
|
||
zero (or a negative value), IRQ is triggered _IF_ the irq_flag is set,
|
||
clearing the irq_flag and irq_latch.
|
||
|
||
|
||
D000h Bank Mode
|
||
Bit1-0 PRG Bank Size
|
||
0 Fixed last 32K at 8000h-FFFFh (initial setting)
|
||
1 16K Banks, and Fixed last 16K at C000h-FFFFh
|
||
2 8K Banks, via Bits 2,7, and Ports 8000h-8003h
|
||
3 8K in reverse mode?
|
||
Bit2 PRG Bank at E000h in 8K Mode (0=Last 8K, 1=Port 8003h)
|
||
Bit4-3 VROM Bank Size (0=8K, 1=4K, 2=2K, 3=1K)
|
||
Bit5 Name Table Source (0=VRAM via D001h, 1=VROM via B00Xh)
|
||
Bit6 Not used
|
||
Bit7 PRG Bank at 6000h (1=enabled) (Similiar/Instead E000h?)
|
||
D001h Name Table Control (in VRAM mode) (only lower 2bit used)
|
||
0 Two-Screen, Vertical mirroring
|
||
1 Two-Screen, Horizontal mirroring
|
||
2,3 One-Screen, BLK0
|
||
|
||
$D002 unknown Unused?
|
||
$D003 bank page Only used by larger carts
|
||
|
||
if (bankmode.bit5), map CHR data in the nametable area using $B00x values,
|
||
But, if (high byte, low byte) != (0,0) or (0,1) or (0,2) or (0,3),
|
||
so bankmode.bit5 is cleared, and mirroring does not change.
|
||
for(i=0;i<4;i++) {
|
||
if(!nam_high_byte[i] && (nam_low_byte[i] == i)) {
|
||
bankmode &= 0xdf; //clear bit5 --> use VRAM with mirroring
|
||
return;
|
||
next
|
||
If you ignore it, a lot of crappy gfx might be displayed.
|
||
|
||
Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ
|
||
----------------------------------------
|
||
|
||
This mapper is used on the pirate cart with a title screen reading "Street
|
||
Fighter 3". It may or may not have been used in other bootleg games.
|
||
6000h Select 2K VROM bank at PPU 0000h-07FFh
|
||
6001h Select 2K VROM bank at PPU 0800h-0FFFh
|
||
6002h Select 2K VROM bank at PPU 1000h-17FFh
|
||
6003h Select 2K VROM bank at PPU 1800h-1FFFh
|
||
7000h Select 8K ROM bank at 8000h-9FFFh
|
||
7001h Select 8K ROM bank at A000h-BFFFh
|
||
N/A Fixed 16K ROM bank at C000h-FFFFh (always last 16K)
|
||
7006h IRQ Disable/Acknowledge (write any value)
|
||
7007h IRQ Enable (write any value)
|
||
When enabled, IRQs are requested every 8 scanlines, except during VBlank.
|
||
Vertical mirroring is always active.
|
||
|
||
Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K
|
||
--------------------------------------------------
|
||
|
||
Used by Moero Pro Soccer, Moero Pro Baseball'88.
|
||
8000h-FFFFh Memory Control
|
||
Bit7-6 Function Select
|
||
0 Confirm Selection
|
||
1 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
2 Select 16K ROM bank at C000h-FFFFh (upper half of PRG memory)
|
||
3 Reserved (would probably select both PRG+VROM)
|
||
Bit5-4 Not used
|
||
Bit0-3 ROM or VROM Bank Number for above Selection
|
||
Bus-conflicts. Example: To select PRG Bank 7, first write 87h, then 07h.
|
||
Same as Mapper 72, except that this one maps the UPPER half of PRG memory.
|
||
|
||
Mapper 93: 74161/32 - PRG/16K
|
||
-----------------------------
|
||
|
||
Used only by Fantasy Zone.
|
||
8000h-FFFFh Memory Control
|
||
Bit0 Unknown, seems to be always set.
|
||
Bit1-3 Always zero
|
||
Bit4-6 Select 16K ROM bank at 8000h-BFFFh
|
||
Bit7 Always zero
|
||
Bus-conflicts. Uses VRAM.
|
||
|
||
Mapper 94: 74161/32 - PRG/16K
|
||
-----------------------------
|
||
|
||
Used only by Senjou no Okami (Capcom's Commando, japanese version).
|
||
8000h-FFFFh Memory Control
|
||
Bit0-1 Always zero
|
||
Bit2-4 Select 16K ROM bank at 8000h-BFFFh
|
||
Bit5-7 Always zero
|
||
Bus-conflicts. Uses VRAM.
|
||
|
||
Mapper 95: Namcot MMC3-Style
|
||
----------------------------
|
||
|
||
Looks like MMC3, but doesn't seem to have IRQs and various other functions.
|
||
Used by Dragon Buster 1, and maybe many other "MMC3" games.
|
||
8000h Index/Control (3bit)
|
||
Bit2-0 Command Number
|
||
0 - Select 2x1K VROM at PPU 0000h-07FFh
|
||
1 - Select 2x1K VROM at PPU 0800h-0FFFh
|
||
2 - Select 1K VROM at PPU 1000h-13FFh
|
||
3 - Select 1K VROM at PPU 1400h-17FFh
|
||
4 - Select 1K VROM at PPU 1800h-1BFFh
|
||
5 - Select 1K VROM at PPU 1C00h-1FFFh
|
||
6 - Select 8K ROM at 8000h-9FFFh
|
||
7 - Select 8K ROM at A000h-BFFFh
|
||
N/A - Fixed 16K ROM at C000h-FFFFh (always last bank)
|
||
8001h Data Register (Indexed via Port 8000h)
|
||
|
||
Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH
|
||
------------------------------------------------
|
||
|
||
Used by Oeka Kids Anpanman no Hiragana Daisuki, and Oeka Kids Anpanman to
|
||
Oekaki Shiyou (note: these games do require the Oeka Kids Tablet controller,
|
||
see Controllers chapter for details).
|
||
8000h-FFFFh
|
||
Bit0-1 Select 32K PRG-ROM bank at 8000h-FFFFh (2bit) (AOROM-style)
|
||
Bit2 Select 16K CHR-RAM bank at PPU:0000h-1FFFh (via below 4K banks)
|
||
PPU:2000h-20FFh Select 1st 4K (of above 16K) at PPU:0000h-0FFFh (Latch=0)
|
||
PPU:2100h-21FFh Select 2nd 4K (of above 16K) at PPU:0000h-0FFFh (Latch=1)
|
||
PPU:2200h-22FFh Select 3rd 4K (of above 16K) at PPU:0000h-0FFFh (Latch=2)
|
||
PPU:2300h-23FFh Select 4th 4K (of above 16K) at PPU:0000h-0FFFh (Latch=3)
|
||
N/A Fixed Last 4K (of above 16K) at PPU:1000h-1FFFh
|
||
PPU:2400h-2FFFh Other Nametables (same 4K mapping as PPU:2000h-23FFh)
|
||
Name table seems to be mapped in One-Screen mode (though maybe one of the four
|
||
bits of the 74HC161 chip allows to select Two-Screen mode, or to swap BLK0 and
|
||
BLK1)?
|
||
Reading (and probably writing) PPU name table entries (PPU:2000h-23FFh) does
|
||
automatically change the 4K bank at for lower half of 8K CHR-RAM (this allows
|
||
to display full-screen 16K bitmaps).
|
||
For manually setting the 4K bank, it's enough to set the PPU address to
|
||
2000h-23FFh via Port 2006h (without actually needing to read/write anything
|
||
from/to that address via Port 2007h) (ie. apparently, the PPU does output the
|
||
selected address immediately, even though no reading/prefetching occurs at that
|
||
time yet).
|
||
Bus-conflicts. Chipset: 128K PRG-ROM, 32K CHR-RAM, 74HC02 (quad NOR), 74HC161
|
||
(4bit-counter; probably used as simple 4bit latch; without counting), 74HC74
|
||
(dual flipflop).
|
||
|
||
Mapper 97: Irem - PRG HI
|
||
------------------------
|
||
|
||
Used by Kaiketsu Yanchamaru.
|
||
8000h-FFFFh Memory Control
|
||
Bit7-6 Unknown (used values are 1,2 - values 0,3 unused)
|
||
(Maybe Name Table Mirroring)
|
||
Bit5-4 Not used (always zero)
|
||
Bit3-0 Select 16K ROM bank at C000h-FFFFh (upper block!)
|
||
N/A Fixed 16K ROM bank at 8000h-BFFFh (always LAST 16K bank)
|
||
Bus-conflicts.
|
||
|
||
Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K)
|
||
------------------------------------------------------
|
||
|
||
This is the standard "on-board" mapper used by most VS System games.
|
||
--> VS System
|
||
|
||
Mapping is done via "controller" port,
|
||
Port 4016h/Write:
|
||
Bit2 VS Unisystem Select 8K VROM bank at PPU 0000h-1FFFh
|
||
Bit1 VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ)
|
||
Bit0 Joypad Strobe (as usually)
|
||
For games with 40K PRG-ROM (VS Gumshoe has 40K PRGROM+16K CHRROM):
|
||
Bit2 additionally selects 8K PRG-ROM (bank 0 or 4) at 8000h-9FFFh,
|
||
Note: Due to .NES fileformat, the 40K PRG-ROM is zeropadded to 48K.
|
||
Above bank selection uses an expansion port output, which does not show up on
|
||
NES/Famicom cartridge bus, and thus works only with VS Unisystem arcade
|
||
machines.
|
||
Most (or all?) of these games use 4-screen mirroring.
|
||
|
||
The standard VS System games are consisting of EPROM Sets rather than of
|
||
Cartridges. Typically consisting of up to six EPROMs:
|
||
1A PRG-ROM E000h-FFFFh 2A CHR-ROM Bank 1
|
||
1B PRG-ROM C000h-DFFFh 2B CHR-ROM Bank 0
|
||
1C PRG-ROM A000h-BFFFh
|
||
1D PRG-ROM 8000h-9FFFh
|
||
For the VS Dualsystem's second CPU, the PRG-ROMs are 6A..6D and CHR-ROMs are
|
||
8A-8B accordingly. The names are based on the mainboard coordinates, eg. "1A"
|
||
is located somewhere near "row 1, column A".
|
||
|
||
Mapper 100: Whatever
|
||
--------------------
|
||
|
||
No info. Don't have any such ROM-images.
|
||
Reportedly "MMC3/Nestice/Trainer/Buugy Mode Used in hacked roms !!"
|
||
Sounds like homebrew hacks that work only on certain emulators, but not on real
|
||
MMC3 hardware. Or it is just meant to be corrupted .NES files with garbage in
|
||
reserved header entries at [07h..0Fh], thus changing mapper number 04h (MMC3)
|
||
to 64h (100 decimal).
|
||
|
||
Mapper 105: X-in-1 MMC1
|
||
-----------------------
|
||
|
||
Used by Nintendo World Championships 1990. Works similar like normal MMC1:
|
||
--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT
|
||
However, the four registers are used like this:
|
||
Register 0 Configuration Register (same as MMC1)
|
||
Register 1 ROM Bank Base (Bit4 unknown)
|
||
Register 2 Not used
|
||
Register 3 ROM Bank (same as MMC1, but ORed with Base)
|
||
And, accessing Register 3 via Port FFF0h (instead normal FFFFh) appears to mask
|
||
(zero) the new Register 3 bank number, until writing to Register 1.
|
||
Initially first 32K.
|
||
|
||
NB. The Championships 3-in-1 multicart doesn't have a game selection menu, it
|
||
runs game 1 until reaching a certain score, and then switches to game 2, and so
|
||
on. The controls are strange: it appears one can start the cartridge only when
|
||
connecting a zapper to port 1, or a joypad to port 2, whilst gameplay works
|
||
only with joypad at port 1.
|
||
|
||
Mapper 112: Asder - PRG/8K, VROM/2K/1K
|
||
--------------------------------------
|
||
|
||
Used by Huang Di, and San Guo Zhi - Qun Xiong Zheng Ba.
|
||
8000h Index (0-7)
|
||
0 Select 8K ROM at 8000h-9FFFh
|
||
1 Select 8K ROM at A000h-BFFFh
|
||
2 Select 2x1K VROM at PPU 0000h-07FFh
|
||
3 Select 2x1K VROM at PPU 0800h-0FFFh
|
||
4 Select 1K VROM at PPU 1000h-13FFh
|
||
5 Select 1K VROM at PPU 1400h-17FFh
|
||
6 Select 1K VROM at PPU 1800h-1BFFh
|
||
7 Select 1K VROM at PPU 1C00h-1FFFh
|
||
N/A Fixed 16K ROM at C000h-FFFFh (always last 16K)
|
||
A000h Data (indexed via Port 8000h)
|
||
C000h Unknown, always 00h
|
||
E000h Unknown, always 00h
|
||
|
||
Mapper 113: Sachen/Hacker/Nina
|
||
------------------------------
|
||
|
||
[Seems to be same as Nina-3 and/or Nina-6]
|
||
--> Mapper 79: AVE Nina-3 - VROM/8K
|
||
--> Mapper 81: AVE Nina-6
|
||
|
||
Used by Metal Fighter, Side Winder, Rad Racket - Deluxe Tennis II, AV Hanafadu
|
||
Club, AV Soccer, Papillion, Deathbots, Mahjong Companion, 4-in-1 Total Funpack.
|
||
4100h-41FFh Memory Control (commonly used addresses: 4100h, 4101h, 4120h)
|
||
Bit0-2 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
Bit3-4 Select 32K ROM bank at 8000h-FFFFh (bigger carts only)
|
||
Many of these games seem to have been originally desiged for mappers at
|
||
8000h-FFFFh, and do still write to these addresses. Also, "16 Mahjong" is
|
||
declared as Mapper 113, though it uses 8000h-FFFFh only?
|
||
|
||
There's also a variant in which ROM selection is moved to Bit2:
|
||
--> Mapper 133: Sachen
|
||
|
||
Mapper 114: Super Games
|
||
-----------------------
|
||
|
||
Used by Lion King, Super Donkey Kong, and Pocohontos. Mask addresses by E001h.
|
||
6000h Unknown (usually zero, except Lion King before crashing?)
|
||
8000h Unknown (see notes below)
|
||
A000h Memory Control Index (see list below)
|
||
C000h Memory Control Data (indexed via A000h)
|
||
E000h IRQ Acknowledge (write any value)
|
||
6001h Unknown (always zero)
|
||
8001h Unknown (see notes below)
|
||
A001h IRQ Counter (MMC3-style, decremented per scanline, paused in VBlank)
|
||
C001h IRQ Counter
|
||
E001h IRQ Start
|
||
Memory Control Indexes are:
|
||
0 Select 2x1K VROM at PPU 0000h-07FFh
|
||
1 Select 1K VROM at PPU 1400h-17FFh
|
||
2 Select 2x1K VROM at PPU 0800h-0FFFh
|
||
3 Select 1K VROM at PPU 1C00h-1FFFh
|
||
4 Select 8K ROM at 8000h-9FFFh
|
||
5 Select 8K ROM at A000h-BFFFh
|
||
6 Select 1K VROM at PPU 1000h-13FFh
|
||
7 Select 1K VROM at PPU 1800h-1BFFh
|
||
Port 8001h, Bit0 seems to be used as IRQ disable in Lion King. All games seem
|
||
to use Vertical Mirroring, but Pocohontos seems to toggle Name Tables via Port
|
||
8000h and 8001h during initialization.
|
||
|
||
Mapper 115: MMC3 Cart Saint
|
||
---------------------------
|
||
|
||
Used by Yuu Yuu Hakusho Final - Makai Saikyou Retsuden.
|
||
6000h Unknown (used values 00h, A0h, A4h)
|
||
6001h Unknown (always 00h)
|
||
No idea how it does <really> work, but the game appears to work when selecting
|
||
8K ROM bank number 8 at 8000h-9FFFh when [6000h]=A4h. Otherwise the mapper
|
||
works like MMC3:
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
Note: MMC3 Register 7 <must> be initialized to 01h on reset.
|
||
|
||
Mapper 116: Whatever
|
||
--------------------
|
||
|
||
No info. Don't have a ROM-image.
|
||
Reportedly "PC-Reserved" used by "AV beautiy fighting(not playable yet)".
|
||
|
||
Mapper 117: Future
|
||
------------------
|
||
|
||
Used by Sangokushi 4 (a clone of Warrior of Fate).
|
||
Appears related with Mapper 90.
|
||
8000h Select 8K ROM at 8000h-9FFFh
|
||
8001h Select 8K ROM at A000h-BFFFh
|
||
8002h Select 8K ROM at C000h-DFFFh
|
||
N/A Fixed 8K ROM at E000h-FFFFh (last bank)
|
||
9000h Unknown (always FFh)
|
||
9001h Unknown (always 08h)
|
||
9003h Unknown (always 00h)
|
||
A000h Select 1K VROM at PPU 0000h-03FFh
|
||
A001h Select 1K VROM at PPU 0400h-07FFh
|
||
A002h Select 1K VROM at PPU 0800h-0BFFh
|
||
A003h Select 1K VROM at PPU 0C00h-0FFFh
|
||
A004h Select 1K VROM at PPU 1000h-13FFh
|
||
A005h Select 1K VROM at PPU 1400h-17FFh
|
||
A006h Select 1K VROM at PPU 1800h-1BFFh
|
||
A007h Select 1K VROM at PPU 1C00h-1FFFh
|
||
A008h-A00Fh Unknown (always 01h, probably VROM bank related)
|
||
C001h IRQ Counter/Start (MMC3, decremented per scanline, paused in VBlank)
|
||
C002h IRQ Acknowledge (write any value)
|
||
C003h IRQ Counter/Start (always write same value as to C001h)
|
||
D000h Unknown (always 00h)
|
||
E000h IRQ Enable (Bit0), upper 7bit unknown (always 0000011b)
|
||
F000h Unknown (always 00h)
|
||
|
||
Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ
|
||
------------------------------------------------------------------
|
||
|
||
Used by Goal 2, Pro Sport Hockey, Armadillo, and Ys III.
|
||
MMC3 variant with special Name Tables connnection. The CHR ROM bank numbers are
|
||
limited to 7bit values (128 1K-banks), the normal MMC3 Name Table Mirroring
|
||
Register (Port A000h) is not used. Instead, Bit7 of the CHR ROM bank(s) is
|
||
connected to VA10 line (selecting name table BLK0 or BLK1). The relation
|
||
between the separate CHR bank registers and VA10 is unknown? Probably, NT0 at
|
||
2000h-23FFh is controlled by CHR bank for 0000h-03FFh, NT1 at 2400h-27FFh by
|
||
CHR bank for 0400h-07FFh, and so on.
|
||
Otherwise same as MMC3:
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ
|
||
---------------------------------------------------------------
|
||
|
||
Used by Pinbot and High Speed.
|
||
Contains 64K CHR ROM plus 8K CHR-RAM, selected by Bit6 of the CHR bank numbers
|
||
(0=ROM, 1=RAM). The CHR-RAM can be banked and mapped like the CHR ROM. Mapping
|
||
hardware consists of MMC3B plus 74HC32 (used to disable ROM when RAM enabled by
|
||
CE=A16=HIGH).
|
||
Otherwise same as MMC3:
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 122: Whatever
|
||
--------------------
|
||
|
||
No info. Don't have a ROM-image.
|
||
Reportedly "74161/32" used by "Madoola No Tsubasa".
|
||
Maybe "Madoola No Tsubasa" is same as "Wing of Madoola" (?)
|
||
--> Mapper 184: Sunsoft - VROM/4K
|
||
|
||
Mapper 133: Sachen
|
||
------------------
|
||
|
||
Used by Jovial Race.
|
||
4120h Memory Control
|
||
Bit1-0 Select 8K VROM at PPU 0000h-1FFFh
|
||
Bit2 Select 32K ROM at 8000h-FFFFh
|
||
Appears to be a variant of Mapper 113, with PRG ROM selection moved to Bit2.
|
||
|
||
Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards
|
||
----------------------------------------------------
|
||
|
||
This is a nonsense mapper number for VS Unisystem games with daughterboards.
|
||
--> VS System
|
||
Namely, this mapper number is used for VS Gradius (VRC1), VS Goonies (VRC1),
|
||
and VS TKO Boxing (MMC3-style). The correct mappers for that games should be:
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT
|
||
|
||
Mapper 152: Whatever
|
||
--------------------
|
||
|
||
The readme of Pocketnes (for Gameboy Advance) mentions existance Mappper 152.
|
||
No info. Don't have any ROM-images.
|
||
|
||
Mapper 160: Same as Mapper 90
|
||
-----------------------------
|
||
|
||
Seems to be duplicate/nonsense, same as Mapper 90, used by Aladdin.
|
||
--> Mapper 90: Pirate MMC5-style
|
||
|
||
Mapper 161: Same as Mapper 1
|
||
----------------------------
|
||
|
||
Seems to be duplicate/nonsense, same as Mapper 1, used by Hanjuku Eiyuu.
|
||
--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT
|
||
|
||
Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ
|
||
-------------------------------------------
|
||
|
||
Used only by RacerMate Challenge II.
|
||
6000h..600Fh Unknown (looks like Debug LED Control or so)
|
||
B000h Memory Banking (74LS174; 6bit D flip-flop)
|
||
N/A Fixed 4K CHR-RAM at PPU:0000h-0FFFh (bank 00h)
|
||
D0-D3 Select 4K CHR-RAM at PPU:1000h-1FFFh (bank 00h..0Fh)
|
||
D4-D5 Unused
|
||
D6-D7 Select 16K PRG-ROM at 8000h-BFFFh (bank 00h..03h)
|
||
N/A Fixed 16K PRG-ROM at C000h-FFFFh (bank 03h)
|
||
F000h IRQ/counter control or so ;\maybe IRQ ack,reset,enable,disable
|
||
F080h IRQ/counter control or so ;/or whatever (maybe 7474 flipflop)
|
||
The game does also require a special controller:
|
||
--> Controllers - RacerMate Bicycle Training System
|
||
Note: The IRQ function is used as baudrate timer for the controller data
|
||
transfers (not as video/scanline interrupt). Used ports/values are:
|
||
[F080h]=FFh disable IRQ and/or reset IRQ-counter or so
|
||
[F000h]=00h enable IRQ and/or start IRQ-counter or so
|
||
Above two ports are mirrored to C000h-FFFFh, they are actually only ONE port,
|
||
using either A7 (old PCB design) or D2 (revised PCB design) as input to one of
|
||
the 7474's flipflops. The output from 1st flipflop is somehow forwarded to the
|
||
2nd flipflop (eventually unlocking SRAM writes at some point).
|
||
|
||
Unknown Details
|
||
Unknown if both SRAM chips are battery backed. Unknown what the 7474 is used
|
||
for (maybe IRQ/counter control related). Port 6000h-600Fh seems to have no
|
||
function; there are no latches or RAM in the cartridge that could be mapped to
|
||
that addresses (except maybe the 7474), and there should be nothing special in
|
||
the "modified NES" console (the game does reportedly work on any normal NES
|
||
with "CIC disabled").
|
||
|
||
Racer-Mate PCB R982-073
|
||
U1 28pin HY52256A SRAM 32Kx8 (CHR-RAM)
|
||
U2 28pin HY52256A SRAM 32Kx8 (CHR-RAM)
|
||
U3 28pin 27C512 EPROM 64Kx8 (badged V903_128) (PRG-ROM)
|
||
U4 16pin 74LS174 (6bit D flip-flop with reset) ;memory banking
|
||
U5 14pin 74HCT32 (quad OR gates)
|
||
U6 14pin 74LS00 (quad NAND gates)
|
||
U7 14pin 74HCT32 (quad OR gates)
|
||
U8 14pin 74LS00 (quad NAND gates)
|
||
U9 14pin 74HCT74 (dual flipflop) ;maybe IRQ status/control?
|
||
U10 16pin 74HCT4040N (12bit counter with reset) ;IRQ counter (input=PHI2)
|
||
U11 16pin Unknown, maybe CIC (not installed)
|
||
B1 2pin Maxell Battery
|
||
J1J2 3pin Jumpers (J2 installed)
|
||
J3J4 3pin Jumpers (J3 installed)
|
||
J1 72pin Cart-edge connector (for NES consoles) (not Famicom)
|
||
Plus 2 transistors, 2 diodes (near battery), resistors, capacitors.
|
||
Early cartridges used Tengen CIC clones. Later cartridges didn't include any
|
||
CICs for legal reasons (and instead, beared a sticker saying says that it'll
|
||
work only with special modified NES consoles; ie. such with CIC disabled).
|
||
|
||
Cautions/Confusions
|
||
Existing ROM-images may include 64K VROM (ie. the video RAM dumped as if it
|
||
were ROM); this is wrong, ignore that garbage, and instead, allocate 64K VRAM.
|
||
There's some info that claims memory to be controlled by Port 8000h, with
|
||
D0,D1,D2=PRG-ROM/16K, and D3,D6,D7=CHR-RAM/8K; this is wrong on about every
|
||
single detail, ignore that.
|
||
The cartridge does reportedly use horizontal mirroring (but, that info seems to
|
||
come from same person who dumped RAM as ROM, and who talked about Port 8000h,
|
||
so chances are around 80% that this info is wrong, too).
|
||
|
||
Mapper 180: Nihon Bussan - PRG HI
|
||
---------------------------------
|
||
|
||
Used by Crazy Climber. And MGC 2011?
|
||
8000h-FFFFh Memory Control
|
||
Bit7-3 Not used (always zero)
|
||
Bit2-0 Select 16K ROM bank at C000h-FFFFh (upper block!)
|
||
N/A Fixed 16K ROM bank at 8000h-BFFFh (always FIRST 16K bank)
|
||
Bus-conflicts.
|
||
Same as UNROM, but with fixed bank at 8000h-BFFFh instead of C000h-FFFFh.
|
||
Note: Crazy Climber uses two standard joypads, but wants them to be held
|
||
rotated by 90 degrees.
|
||
|
||
Mapper 182: Same as Mapper 114
|
||
------------------------------
|
||
|
||
--> Mapper 114: Super Games
|
||
|
||
Mapper 184: Sunsoft - VROM/4K
|
||
-----------------------------
|
||
|
||
Used by Atlantis no Nazo, Kanshakudama, and Wing of Madoola.
|
||
6000h Select VROM Banks
|
||
Bit2-0 Select 4K VROM at PPU 0000h-0FFFh
|
||
Bit6-4 Select 4K VROM at PPU 1000h-1FFFh
|
||
|
||
Mapper 185: VROM-disable
|
||
------------------------
|
||
|
||
Used for copy-protected "NROM" games with (max) 32K PRG-ROM and 8K VROM.
|
||
8000h-FFFFh
|
||
Bit 0-1 Select 8K VROM or Open Bus at PPU 0000h
|
||
Bit 4-5 Security Diodes (some crude copy protection)
|
||
The actual board is a CNROM variant, with the VROM bank-selection bits misused
|
||
to deselect VROM (the games do verify that feature and refuse to run if the
|
||
deselection doesn't work), plus CNROM-style Security Diodes. For details see:
|
||
--> Mapper 3: CNROM - VROM/8K
|
||
|
||
Example Values
|
||
Values used to switch VROM on/off are:
|
||
Off On Title
|
||
F0h 0Fh Bird Week
|
||
00h 33h B-Wings
|
||
00h 11h Mighty Bomb Jack
|
||
20h 22h Sansuu 1 Nen - Keisan Game
|
||
20h 22h Sansuu 2 Nen - Keisan Game
|
||
00h FFh Sansuu 3 Nen - Keisan Game
|
||
13h 21h Spy vs Spy
|
||
Above games are working when mapping an empty VROM bank (FFh-filled) either
|
||
when (X)=13h, or when (X AND 0Fh)=0.
|
||
|
||
Mapper 188: UNROM-reversed
|
||
--------------------------
|
||
|
||
Used by Karaoke Studio. Appears to be same as UNROM, but the first/second 128K
|
||
are exchanged in the ROM-image (for unknown reason), ie. all bank numbers
|
||
(including the fixed "last" bank) are XORed by 08h.
|
||
... aka bit3 = chipselect (1=Main ROM, 0=Expansion ROM)
|
||
--> Mapper 2: UNROM - PRG/16K
|
||
Or, maybe only the first 8 banks are used, and the further banks are garbage?
|
||
Bus-conflicts.
|
||
|
||
Microphone
|
||
The cartridge does have an external microphone attached to it.
|
||
As far as known, the microphone signal is passed to the Audio In pin on the
|
||
cartridge slot (and thus forwarded to the speaker in the TV Set).
|
||
Reportedly, the game can "judge" good/bad singers, so there must be some way to
|
||
read the microphone level by software; I/O ports and bit-depth are unknown.
|
||
The game does read whatever 3bit value from Port 6000h.
|
||
|
||
Karaoke Studio (main cartridge with microphone and 128K main ROM) (Jul 1987)
|
||
Karaoke Studio Senyou Cassette Vol. 1 (128K expansion ROM) (Oct 1987)
|
||
Karaoke Studio Senyou Cassette Vol. 2 (128K expansion ROM) (Feb 1988)
|
||
The expansion ROMs are small cartridges that can be plugged into the main
|
||
cartridge; ROM-images for expansion carts should be 256K in size (the 128K main
|
||
ROM plus 128K expansion ROM badged together).
|
||
|
||
See also
|
||
--> Controllers - Microphones
|
||
|
||
Mapper 189: MMC3 Variant
|
||
------------------------
|
||
|
||
Used by Master Figher 2, and Street Fighter 2. There are three Master Fighter 2
|
||
versions, the 1st works as described below, the 2nd works but has distorted
|
||
background, the 3rd doesn't work - ROM addresses appear corrupted (?). And,
|
||
Street Fighter 2 works completely different - uses Ports 4132h for ROM, and
|
||
4122h/4123h for VROM (?) Anyways, the one working one works as such:
|
||
610xh Select 32K ROM Block (D7-D0 should match A7-A0, eg. [6103h]=03h)
|
||
The rest of the mapper is same as MMC3 (for the selected block of memory),
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
|
||
Mapper 218: Nocash Single-Chip
|
||
------------------------------
|
||
|
||
Used by Magic Floor (2012) and Starfight (2018). Contains only one single
|
||
PRG-ROM chip (and a CIC, if required) (and, in case of the bewitched Magic
|
||
Floor cartridge: it's planned to contain a hair, a finger nail, and a drop of
|
||
blood; the existing prototype PCB lacks these components though).
|
||
There's no CHR-ROM or CHR-RAM. Instead, the console's internal 2Kbyte Name
|
||
Table RAM is mapped as CHR-RAM. The 2K RAM is permanently selected (/VCS wired
|
||
to GND), and can be used in four modes by wiring VA10 to one of the
|
||
PPU.A10..A13 address lines:
|
||
VA10 Effect on iNES Byte 6 UNIF "MIRR"
|
||
to Name Tables Bit3.Bit0 Bit7-0
|
||
PPU.A10 Two-Screen, Vertical Mirroring 0.1 01h
|
||
PPU.A11 Two-Screen, Horizontal Mirroring 0.0 00h
|
||
PPU.A12 One-Screen, BLK0 1.0 02h
|
||
PPU.A13 One-Screen, BLK1 1.1 03h
|
||
Note: Bit 3 in Byte 6 of iNES header would be usually Four-Screen flag,
|
||
but, for this mapper it is used as One-Screen flag.
|
||
The VA10 connection does, of course, also affect the CHR-RAM mapping at
|
||
0000h-1FFFh. BLK1 would be the most common case (1K NT plus 1K CHR-RAM). BLK0
|
||
would allow to swap CHR RAM via Port 2000h.Bit3-4. Two-Screen would allow to
|
||
use two NTs (and to squeeze CHR data into unused NT areas). Two-Screen would
|
||
also allow to use 2K OBJ tiles (when leaving BG unused).
|
||
Note: 1K CHR-RAM allows to use as much as 64 tiles of 2bpp (or, with suitable
|
||
color attributes, 128 monochrome tiles of 1bpp).
|
||
|
||
Mapper 222: Dragon Ninja
|
||
------------------------
|
||
|
||
Used by a pirate copy of Dragon Ninja.
|
||
8000h Select 8K ROM at 8000h-9FFFh
|
||
A000h Select 8K ROM at A000h-BFFFh
|
||
N/A Fixed 16K ROM at C000h-FFFFh (last 16K)
|
||
9000h Unknown (always E0h = Vertical Mirroring)
|
||
B000h/B001h Lower/upper 4bit of 1K VROM bank at PPU 0000h-03FFh
|
||
B002h/B003h Lower/upper 4bit of 1K VROM bank at PPU 0400h-07FFh
|
||
C000h/C001h Lower/upper 4bit of 1K VROM bank at PPU 0800h-0BFFh
|
||
C002h/C003h Lower/upper 4bit of 1K VROM bank at PPU 0C00h-0FFFh
|
||
D000h/D001h Lower/upper 4bit of 1K VROM bank at PPU 1000h-13FFh
|
||
D002h/D003h Lower/upper 4bit of 1K VROM bank at PPU 1400h-17FFh
|
||
E000h/E001h Lower/upper 4bit of 1K VROM bank at PPU 1800h-1BFFh
|
||
E002h/E003h Lower/upper 4bit of 1K VROM bank at PPU 1C00h-1FFFh
|
||
F000h IRQ Counter/Stop/Set/Ack
|
||
F001h IRQ Counter/Stop/Set/Ack
|
||
F002h IRQ Counter/Start (incrementing approx every 120 (?) cycles)
|
||
|
||
Mapper 225: X-in-1
|
||
------------------
|
||
|
||
Used by 52-in-1, 58-in-1, 64-in-1, 72-in-1, 110-in-1, 115-in-1 carts. The reset
|
||
vectors in all games are redirected to the game selection menu, and all
|
||
copyright messages have been shamelessly removed.
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A14,A5-0 Select 8K VROM bank at PPU 0000h-1FFFh
|
||
A14,A11-A6 Select PRG 2x16K ROM bank at 8000h-FFFFh
|
||
A12 Select PRG page size (0=32K, 1=16K)
|
||
0 32K page at 8000h-FFFFh (LSB/A6 of bank number ignored)
|
||
1 16K page mirrored to 8000h-BFFFh and C000h-FFFFh
|
||
A13 ?Mirroring select (0=Vertical, 1=Horizontal Mirroring)
|
||
A15 Must be "1"
|
||
5800h-5FFFh 4x4bit Register File (D0-D3 data bits, addressed via A0-A1)
|
||
The 4x4bit latch is used as 16bit "RAM", used to restore the old menu selection
|
||
when re-entering the menu by pushing the Reset button.
|
||
A14 is shared for both PRG/VROM in larger 2048K+1024K carts (those with more
|
||
than 100 games), smaller 1024K+512K carts don't use A14.
|
||
|
||
Mapper 226: X-in-1
|
||
------------------
|
||
|
||
Used by Super 42-in-1 (1024K), and 76-in-1 (2048K).
|
||
Typically booted with opcode 8E 8E 8E 00 - MOV [8E8E],X; BRK in RAM.
|
||
8000h,8E8Eh Memory Control
|
||
Bit4-0 Bank Number Bit4-0
|
||
Bit5 Mode
|
||
0 Map 32K ROM at 8000h-FFFFh (bank bits 6-1 used, bit0 ignored)
|
||
1 Map the same 16K ROM bank at both 8000h-BFFFh and C000h-FFFFh
|
||
Bit6 Name Table (0=Horizontal, 1=Vertical Mirroring)
|
||
Bit7 Bank Number Bit5
|
||
8001h Upper Bit of bank selection (2048K carts only)
|
||
Bit0 Bank Number Bit6
|
||
The "VROM" banks of the original games are contained in PRG ROM, and are copied
|
||
to 8K VRAM at PPU 0000h-1FFFh when starting a game.
|
||
See also:
|
||
--> Mapper 233: X-in-1 plus Reset
|
||
--> Mapper 230: X-in-1 plus Contra
|
||
|
||
FROM 226.TXT
|
||
Mapper hardware is provided by five 74-series ICs; LS74A, LS273, LS139, LS02
|
||
and LS153. A diode and capacitor are arranged to reset the mapping when the
|
||
Reset button is pressed.
|
||
Register 1, Bit 1 - controls whether the CHR-RAM is write-protected:
|
||
0 - not write-protected
|
||
1 - write-protected
|
||
When the Reset button is pressed, both registers are reset to all zero bits.
|
||
|
||
Mapper 227: X-in-1
|
||
------------------
|
||
|
||
Used by 1200-in-1 (a fake containing only 14 different games).
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A6-A2 Select 16K ROM at 8000h-BFFFh (X)
|
||
A1 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A14-A13 Menu mode (00b=Menu, 11b=Other)
|
||
A9 128K Mode (1=128K, 0=Other)
|
||
A0 32K Mode (1=32K, 0=Other)
|
||
A11-A10,A8 Always 0
|
||
A12 Usually 1 (except when initializing VRAM for game)
|
||
A7 Usually 1 (except menu/contra/galaxian)
|
||
16K ROM at C000h-FFFFh is Bank 0 in Menu Mode (and on reset), Bank (X OR 1) in
|
||
32K Mode, Bank (X OR 7) in 128K Mode, or otherwise Bank (X) in 16K mode.
|
||
|
||
Mapper 228: X-in-1 Homebrewn
|
||
----------------------------
|
||
|
||
Used in two carts with incredible crude homebrewn games: Action 52 (multicart
|
||
52-in-1) and Cheetah Men 2 (single game cart).
|
||
8000h-FFFFh Memory Control (Decoded by address AND data lines)
|
||
A3-A0,D1-D0 Select 8K VROM at PPU 0000h-1FFFh
|
||
A12-A7 Select 32K ROM at 8000h-FFFFh
|
||
A14-A13,A6-A4,D7-D2 Not used (always zero)
|
||
5FF0h-5FF3h 4x4bit Register File (D0-D3 data bits, addressed via A0-A1)
|
||
The 4x4bit latch is used as 16bit "RAM", used to restore the old menu selection
|
||
when re-entering the main menu (used in Action52 multicart only).
|
||
|
||
Notes
|
||
Action52 has an odd ROM-size of 1.5MB, Banks 30h-3Fh are probably mirrors.
|
||
There seems to be no Name Table control bit (unless it is shared with
|
||
bank-selection bits), most games look better at Vertical Mirroring (eg.
|
||
cheetahmen, silversword), though some look better at Horizontal Mirroring (eg.
|
||
criticalbp).
|
||
|
||
Mapper 229: 31-in-1
|
||
-------------------
|
||
|
||
Used by 31-in-1 (512K+256K).
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A4-A0 Bank Selection, shared for PRG and VROM:
|
||
Select 8K VROM bank at PPU 0000h-1FFFh
|
||
Select 16K ROM bank at 8000h-BFFFh and same bank at C000h-FFFFh
|
||
A selection of 01h works special, it maps 16K ROM banks 0 and 1,
|
||
and bank 1 VROM, used for Super Mario which has 32K PRG ROM.
|
||
A6-A5 Name Table
|
||
0 Two-Screen, Vertical Mirroring
|
||
1 Two-Screen, Horizontal Mirroring
|
||
2 Probably one-screen, used on boot
|
||
3 Probably one-screen, used in menu
|
||
A14 The menu sets this bit when accessing bank 0
|
||
|
||
Mapper 230: X-in-1 plus Contra
|
||
------------------------------
|
||
|
||
Used in a 640K ROM-image. The 1st 128K contain a single game (Contra), the
|
||
remaining 512K contain a 22-in-1 multicart. NB. the multicart menu also tries
|
||
to detect further ROM, and if any such found, displays a 63-in-one menu.
|
||
No idea if/how selection between Contra and 22-in-1 works. The 22-in-1 part is
|
||
identical with Mapper 226 (banks 0..31 located AFTER the 1st 128K):
|
||
--> Mapper 226: X-in-1
|
||
|
||
Mapper 231: 20-in-1
|
||
-------------------
|
||
|
||
Used by 20-in-1.
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A7-A6 Name Table Setting (0-3)
|
||
0 Probably one-screen (used by menu only)
|
||
1 Two-Screen Vertical Mirroring
|
||
2 Two-Screen Horizontal Mirroring
|
||
3 Not used
|
||
A5 Always opposite of A1, ie. A5=(A0 XOR 1), probably 2nd chip-select
|
||
A4-A1 Select 32K ROM bank at 8000h-FFFFh
|
||
A0 Mode (0=Normal, 1=Mirror 1st half selected 32K bank to C000h-FFFFh)
|
||
The "VROM" banks of the original games are contained in PRG ROM, and are copied
|
||
to 8K VRAM at PPU 0000h-1FFFh when starting a game.
|
||
There's also a version of the same cartridge with slightly different mapper:
|
||
--> Mapper 61: 20-in-1
|
||
|
||
Mapper 232: 4-in-1 Quattro Camerica
|
||
-----------------------------------
|
||
|
||
Used by Camerica 4-in-1 games with 256K ROM and 8K VRAM - Quattro Adventure,
|
||
Quattro Arcade, and Quattro Sports.
|
||
9000h Select 64K block for 8000h-FFFFh (block number in Bit4-3)
|
||
C000h-Fxxxh Select 16K ROM bank at 8000h-BFFFh (within current 64K)
|
||
N/A High 16K ROM bank at C000h-FFFFh (last 16K of current 64K)
|
||
FFF0h,FFF1h Unknown - Write any value at proper timing (maybe lockout)
|
||
In some (not all) ROM-images, 2nd/3rd game seem to be mis-exchanged.
|
||
|
||
Mapper 233: X-in-1 plus Reset
|
||
-----------------------------
|
||
|
||
Used by "42 Games" which is almost the same as "Super 42-in-1" (Mapper 226,
|
||
which comes with separate 22 and 20 games menues, prompting the user to press
|
||
Select to switch to the next menu).
|
||
|
||
42 Games (1024K ROM) comes with a "Level 1-4" main menu, each "Level" allows to
|
||
select from 10 or 11 games. That main menu shows up only if the cartridge
|
||
detects a special reset function, if that detection fails, then it assumes to
|
||
be a 512K ROM, and enters a 22 or 20 games menu. That means, the cartridge can
|
||
be split into two fully functional 512K ROMs when removing the reset function.
|
||
That reset function appears to work like this:
|
||
FFFDh Reading from this address (the MSB of reset vector) destroys the
|
||
current Bank selection, probably setting it to a value of FFh, at
|
||
least anything different than 00h or 80h
|
||
Aside from the extra reset function, it is same as Mapper 226,
|
||
--> Mapper 226: X-in-1
|
||
|
||
There's also ROM named "Unknown" numbered as Mapper 233 with other
|
||
functionality?
|
||
|
||
Mapper 234: Maxi-15
|
||
-------------------
|
||
|
||
Used by the AVE Maxi 15 Game Cartridge.
|
||
Registers are set by writing *or reading* certain locations. In the case
|
||
of writing, the programmer would need to ensure that the written value and
|
||
that put on the data bus by the program ROM do not conflict.
|
||
On power-up, and when the Reset button is pressed, registers R1 and R2 are
|
||
cleared. R3 is not cleared when Reset is pressed. After R1 has been set to a
|
||
non-zero value, it cannot be changed until the Reset button is pressed.
|
||
FF80h-FF9Fh Configuration Register (R1)
|
||
Bit7 Name Table Control (0=Vertical, 1=Horizontal Mirroring)
|
||
Bit6 Page Mode ROM/VROM Size (0=32K, 1=64K)
|
||
Bit5-0 Select 32K ROM/VROM bank (LSB ignored in 64K Page Mode)
|
||
Bit5 is wired to /CS or /OE of the ROM chips, ie. both ROM
|
||
and VROM are disabled when bit5 is set (unless additional ROMs
|
||
would be connected to inverted Bit5, in larger carts).
|
||
FFE8h-FFF7h Memory Banking Register (R2)
|
||
Bit7 Not Used
|
||
Bit6-4 Select 8K VROM at PPU 0000h-1FFFh (Bit6 not used in 32K Page mode)
|
||
Bit3-1 Not Used
|
||
Bit0 Select 32K ROM at 8000h-FFFFh (Bit0 not used in 32K Page mode)
|
||
FFC0h-FFDFh Lockout Register (R3)
|
||
Initially it is not possible to access R3. This is only possible
|
||
after R1 has been set to a non-zero value.
|
||
Bit7-2 Not Used
|
||
Bit1 CIC RST
|
||
Bit0 CIC OUT
|
||
Memory-mapping hardware consists of eleven chips: 74LS273, 2x74LS322,
|
||
2x74LS175, 2x74LS138, 74LS30, 74HC08, 74HC04 and a 4053. There are several
|
||
discrete components, mostly related to the CIC-defeating function.
|
||
|
||
Mapper 240: C&E/Supertone - PRG/32K, VROM/8K
|
||
--------------------------------------------
|
||
|
||
Used by Jing Ke Xin Zhuan (via Port 4800h), and Sheng Huo Lie Zhuan (via Port
|
||
4120h, or alternately GNROM-style via Port 8000h-FFFFh with bus-conflicts).
|
||
4120h,4800h,8000h-FFFFh Memory Control
|
||
Bit7-6 Not used (always zero)
|
||
Bit5-4 Select 32K ROM at 8000h-FFFFh (initially any 32K bank)
|
||
Bit3-0 Select 8K VROM at PPU 0000h-1FFFh
|
||
|
||
Mapper 241: X-in-1 Education
|
||
----------------------------
|
||
|
||
Used by Education Games 18-in-1, and Study and Game 32-in-1.
|
||
8000h-FFFFh Select 32K ROM at 8000h-FFFFh (initially 1st 32K bank)
|
||
5FF0h-5FFFh/Write Unknown (No info)
|
||
5FF0h-5FFFh/Read Unknown (somewhat Bit6: 1=Ready/Okay)
|
||
Both cartridges require a special keyboard controller, similar as the Famicom
|
||
keyboard, but with different keyboard matrix.
|
||
--> Controllers - Typewriter Keyboards
|
||
|
||
Mapper 242: Waixing - PRG/32K, NT
|
||
---------------------------------
|
||
|
||
Used by Wai Xing Zhan Shi.
|
||
8000h-FFFFh Memory Control (Write any data, port decoded by address lines)
|
||
A6-A3 Select 32K ROM at 8000h-FFFFh (initially 1st 32K bank)
|
||
A1 Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
A7,A0 Always 1
|
||
A14-A8,A2 Always 0
|
||
Similar as Mapper 227 (without using the various memory modes though),
|
||
--> Mapper 227: X-in-1
|
||
|
||
Mapper 243: Sachen Poker - PRG/32K, VROM/8K
|
||
-------------------------------------------
|
||
|
||
Used by Mei Nu Quan (Honey Peach), and Poker III 5-in-1.
|
||
4100h Index (0-7)
|
||
4101h Data for above index
|
||
The separate register indexes are:
|
||
0 Unknown, always 00h
|
||
1 Unknown, always 00h
|
||
2 Bit3 of 8K VROM at PPU 0000h-1FFFh
|
||
3 Unknown, always 00h
|
||
4 Bit0 of 8K VROM at PPU 0000h-1FFFh
|
||
5 Select 32K ROM at 8000h-FFFFh
|
||
6 Bit2,1 of 8K VROM at PPU 0000h-1FFFh
|
||
7 Unknown, always 05h
|
||
Formula for VROM Registers 2,4,6: Bank=(R2*8)+(R4 AND 1)+(R6 AND 3)*2
|
||
|
||
Mapper 244: C&E - PRG/32K, VROM/8K
|
||
----------------------------------
|
||
|
||
Used by Decathlon only. Note: Cat Ninden Teyandee translations declared as
|
||
"Mapper 244" seem to be MMC3 games.
|
||
8000h-FFFFh Memory Control
|
||
Bit7 Not used (zero)
|
||
Bit6-4 Swap bits (some sort of confusion / copy protection, see below)
|
||
Bit3 Set ROM or VROM bank (0=ROM, 1=VROM)
|
||
Bit2-0 Select 32K ROM at 8000h-FFFFh or 8K VROM at PPU 0000h-1FFFh
|
||
Swap bits for ROM Bank Number:
|
||
Bit4=1: XOR bank number by 03h
|
||
Bit5=1: Exchange bank number Bit0,1
|
||
Bit6=1: Not used
|
||
Swap bits for VROM Bank Number:
|
||
Bit4=1, Bit5=1, Bit6=1: XOR bank number by 07h (without further exchanges)
|
||
Bit4=0, Bit5=1, Bit6=1: Not used
|
||
Bit4=1: Exchange bank number Bit 0,1 (processed first)
|
||
Bit5=1: Exchange bank number Bit 1,2
|
||
Bit6=1; Exchange bank number Bit 2,0 (processed last)
|
||
Bus-conflicts.
|
||
|
||
Mapper 246: C&E - PRG/8K, VROM/2K, SRAM
|
||
---------------------------------------
|
||
|
||
Used by Fong Shen Bang - Zhu Lu Zhi Zhan.
|
||
6000h Select 8K ROM at 8000h-9FFFh
|
||
6001h Select 8K ROM at A000h-BFFFh
|
||
6002h Select 8K ROM at C000h-DFFFh
|
||
6003h Select 8K ROM at E000h-FFFFh (initially probably last bank, or bank 3)
|
||
6004h Select 2K VROM at PPU 0000h-07FFh
|
||
6005h Select 2K VROM at PPU 0800h-0FFFh
|
||
6006h Select 2K VROM at PPU 1000h-17FFh
|
||
6007h Select 2K VROM at PPU 1800h-1FFFh
|
||
The cartridge also contains SRAM at 6000h-7FFFh.
|
||
Not sure if SRAM at 6000h-6007h can be used.
|
||
|
||
Mapper 255: X-in-1 - (Same as Mapper 225)
|
||
-----------------------------------------
|
||
|
||
Duplicated/nonsense mapper number, 255 is functional same as 225.
|
||
|
||
--> Mapper 225: X-in-1
|
||
|
||
Famicom Disk System (FDS)
|
||
-------------------------
|
||
|
||
Famicom Disk System (FDS) is a Famicom extension unit which was produced by
|
||
Nintendo and only sold in Asian countries. It consists of a disk drive
|
||
accepting 2.5" or 3" (?) floppies, 32K of RAM to load programs into, 8K of
|
||
VRAM, and some other hardware described below.
|
||
|
||
--> FDS Memory and I/O Maps
|
||
--> FDS I/O Ports - Timer
|
||
--> FDS I/O Ports - Disk
|
||
--> FDS I/O Ports - Sound
|
||
--> FDS BIOS Disk Format
|
||
--> FDS BIOS Disk Functions
|
||
--> FDS BIOS Disk Errors
|
||
--> FDS BIOS Data Areas in WRAM
|
||
--> FDS Disk Drive Operation
|
||
|
||
FDS Memory and I/O Maps
|
||
-----------------------
|
||
|
||
FDS Memory Map
|
||
4020h-40FFh I/O Ports (2C33) (Disk, Sound, Timer)
|
||
6000h-DFFFh 32K WRAM
|
||
E000h-FFFFh 8K FDS BIOS ROM
|
||
Caution: Parts of the FDS 32K WRAM, and of the built-in 2K WRAM are reserved
|
||
for use by the FDS BIOS: 0000h-000Eh, 00F9h-0103h, and DFF6h-DFFFh.
|
||
|
||
FDS VRAM Map
|
||
0000h-1FFFh Pattern Tables - 8K VRAM
|
||
Note: Horizontal/Vertical Name Table Mirroring can be selected via Port 4025h.
|
||
|
||
FDS I/O Map (2C33 Registers)
|
||
4020h Timer IRQ Counter Reload value LSB (W)
|
||
4021h Timer IRQ Counter Reload value MSB (W)
|
||
4022h Timer IRQ Enable/Disable (W)
|
||
4023h 2C33 I/O Control Port
|
||
4024h Disk Data Write Register (W)
|
||
4025h Disk Control Register (W)
|
||
4026h Disk External Connector Output (W)
|
||
4030h Disk Status Register 0 (R)
|
||
4031h Disk Data Read Register (R)
|
||
4032h Disk Status Register 1 (R)
|
||
4033h Disk External Connector Input (R)
|
||
4040h..407Fh Sound Wave RAM - 64 x 6bit sample data (R/W)
|
||
4080h Sound Volume Envelope (W)
|
||
4082h Sound Wave RAM Sample Rate LSB (W)
|
||
4083h Sound Wave RAM Sample Rate MSB and Control (W)
|
||
4084h Sound Sweep Envelope (W)
|
||
4085h Sound Sweep Bias (W)
|
||
4086h Sound Modulation Frequency LSB (W)
|
||
4087h Sound Modulation Frequency MSB (W)
|
||
4088h Sound Modulation Table (W)
|
||
4089h Sound Wave RAM Control (W)
|
||
408Ah Sound Envelope Base Frequency (W)
|
||
4090h Sound Current Volume Gain Level (6bit) (R)
|
||
4092h Sound Current Sweep Gain Level (6bit) (R)
|
||
|
||
FDS I/O Ports - Timer
|
||
---------------------
|
||
|
||
Interrupt Timer intended to produce mid-screen scanline interrupts.
|
||
|
||
4020h - Timer IRQ Counter Reload value LSB (W)
|
||
4021h - Timer IRQ Counter Reload value MSB (W)
|
||
Reload value loaded to actual 16bit counter register on write to 4022h,
|
||
and on counter underflow. Counter is decremented once per CPU clock cycle.
|
||
|
||
4022h - Timer IRQ Enable/Disable (W)
|
||
Bit1 Enable (0=Stop/Acknowledge? Timer IRQ, 1=Start/Enable Timer IRQ)
|
||
Note: Timer IRQ Flag is found in Bit0 of Port 4030h (Disk Status Register 0);
|
||
reading that status register does (also?) acknowledge IRQs.
|
||
|
||
The IRQ Vector is controlled by the BIOS via [0101h] and [DFFEh],
|
||
--> FDS BIOS Data Areas in WRAM
|
||
|
||
FDS I/O Ports - Disk
|
||
--------------------
|
||
|
||
Disk access can be handled by using the FDS BIOS, so there's usually no need to
|
||
write to below ports directly, the only exception would be the Screen Mirroring
|
||
flag, to change it: Read the current value from [FAh], change Bit3, then write
|
||
the new value to both [FAh] and [4025h].
|
||
|
||
4025h - Disk Control Register (W) (Read-able copy in WRAM at 00FAh)
|
||
Bit0 Drive Motor (0=On, 1=Off)
|
||
When active (0), causes disk drive motor to stop. During this time,
|
||
$4025.1 has no effect. Uh, Active=0=Stop ?
|
||
Bit1 \ = Set drive head to the start of the first track.
|
||
When active (0), causes disk drive motor to turn on. This bit must stay
|
||
active throughout a disk transfer, otherwise $4032.1 will always return 1.
|
||
When deactivated, disk drive motor stays on until disk head reaches most
|
||
inner track of disk.
|
||
Bit2 Disk Data Direction (0=Write, 1=Read)
|
||
Bit3 Screen Mirroring (0=Vertical, 1=Horizontal Mirroring)
|
||
Bit4 Enable CRC Phase (0=Read/Write Data, 1=Verify/Write CRC)
|
||
Bit5 Unknown (Should be always 1)
|
||
Bit6 GAP Control, Read Mode: 1=Reset CRC, and wait for end of GAP.
|
||
Write Mode: 1=Reset CRC, and start writing data. 0=Write GAP (zeros)
|
||
Bit7 Disk IRQs on every byte transfer (0=Disable, 1=Enable)
|
||
|
||
4030h - Disk Status Register 0 (R)
|
||
Bit0 Timer IRQ Flag (0=None, 1=IRQ: Timer Underflow)
|
||
Bit1 Disk IRQ Flag (0=None, 1=IRQ: Request Data Transfer via 4024h/4031h)
|
||
Reset when $4024, $4031, or $4030 has been serviced.
|
||
Bit4 CRC Status (0=Okay, 1=Error, Checksum at end of block not matching)
|
||
Bit6 Lost Data (0=Okay, 1=Error, CPU didn't process 4024h/4031h in time)
|
||
Bit7 Unknown
|
||
Bits in this register seem to be reset to zero after reading; namely, IRQs are
|
||
acknowledge after reading, and, error flags are probably cleared, too.
|
||
|
||
4032h - Disk Status Register 1 (R)
|
||
Bit0 Disk Presence (0=Inserted, 1=Not inserted)
|
||
Bit1 Disk Rewind Flag (0=Ready/Playback, 1=Rewind Active)
|
||
Bit2 Write Protection (0=Writeable, 1=Read-only, or Disk not inserted)
|
||
Bit6 Usually 1 (probably relict of recent opcode byte)
|
||
|
||
4031h - Disk Data Read Register (R)
|
||
4024h - Disk Data Write Register (W)
|
||
8bit data received from / to be written to disk (least significant first).
|
||
Note: Disk IRQ Flag indicates when next byte is to be transferred.
|
||
|
||
4026h - External Connector Output (W) (Read-able copy in WRAM at 00F9h)
|
||
4033h - External Connector Input (R) (Inputs work only if Outputs=High)
|
||
Bit0-6 External Connector Pins 3-9 (0=Low, 1=High/Input)
|
||
Bit7 Power Good (0=Okay, 1=Battery power low)
|
||
Port 4026h should output High to any input pins, especially Bit7 should be
|
||
always set to configure Power Good as input.
|
||
|
||
4023h - 2C33 I/O Control Port
|
||
Bit0 Disk I/O (0=Disable, 1=Enable)
|
||
Bit1 Sound (0=Disable, 1=Enable)
|
||
|
||
FDS I/O Ports - Sound
|
||
---------------------
|
||
|
||
4040h..407Fh - Wave RAM - 64 x 6bit sample data (Read/Write)
|
||
Writes to these registers are ignored unless Write Mode is turned on (see
|
||
register 4089h).
|
||
|
||
4089h - Wave RAM Control (Write Only)
|
||
Bit7 Wave Write Mode (1=Stop Sound output & Allow to write to Wave RAM)
|
||
Bit6-2 Not used
|
||
Bit1-0 Master Volume (0-3 = 100%,66%,50%,40% = 30/30,20/30,15/30,12/30)
|
||
|
||
4082h - Wave RAM Sample Rate LSB (Write Only)
|
||
Bit7-0 Lower 8 bits of the main unit's frequency (upper 4 bits in 4083h)
|
||
4083h - Wave RAM Sample Rate MSB and Control (Write Only)
|
||
Bit7 Main Unit disable (0=Enable, 1=Disable Sound Output)
|
||
Bit6 Envelope disable (0=Normal, 1=Disable Volume/Sweep Envelopes)
|
||
Bit5-4 Not used
|
||
Bit3-0 Upper 4 bits of the main unit's frequency
|
||
Main Unit / Sample Rate: (per entry of the 64-entry wave ram)
|
||
F = 1.79MHz * (Freq + Mod) / 65536
|
||
Mod = Frequency change based on the Modulation unit
|
||
If the 12bit frequency is zero, the Main unit is disabled (channel silent).
|
||
|
||
408Ah - Envelope Base Frequency (Write Only)
|
||
Bit7-0 Envelope Base Frequency, Fbase=1.79MHz/8/N
|
||
Fbase used by 4080h and 4084h. Volume/Sweep Envelope are disabled if N=0.
|
||
|
||
4080h - Volume Envelope (Write Only)
|
||
Bit7 Volume Envelope Mode (0=Volume Envelope, 1=Fixed Volume)
|
||
Bit6 Volume Envelope Direction (When enabled / at specified rate)
|
||
0=Decrease Volume by 1 (only if Volume>00h)
|
||
1=Increase Volume by 1 (only if Volume<20h)
|
||
Bit5-0 When Bit7=1: Volume Level (0-20h=Muted-Loudest, 21h-3Fh=Same as 20h)
|
||
Bit5-0 When Bit7=0: Volume Envelope Rate, F=Fbase/(N+1)
|
||
The volume level can be set to 00h-3Fh by write with Bit7=1, this level is also
|
||
used as initial volume when switching to envelope mode by setting Bit7=0.
|
||
In decrease mode, initial values 21h-3Fh are resulting delayed decrease; volume
|
||
stays at maximum level until the value gets smaller than 20h.
|
||
|
||
4084h - Sweep Envelope (Write Only)
|
||
Bit7 Sweep Envelope Disable (1=Disable)
|
||
Bit6 Sweep Envelope Mode (0=Decrease, 1=Increase sweep gain)
|
||
Bit5-0 When Bit7=1: Sweep Gain
|
||
Bit5-0 When Bit7=0: Sweep Envelope Rate, F=Fbase/(N+1)
|
||
|
||
4085h - Sweep Bias (Write Only)
|
||
Bit7 Not used
|
||
Bit6-0 Sweep Bias (signed 7bit; -40h..+3Fh)
|
||
Sweep Bias is a used by the Modulation unit in calculating frequency bend.
|
||
Sweep Bias negative: Modulation unit will be bending frequency down.
|
||
Sweep Bias positive: Modulation unit will be bending frequency up.
|
||
Any write to Sweep Bias register resets Modulation Unit's address to zero. This
|
||
address is used by the Modulation Unit when looking up entries written to the
|
||
Modulation table (via $4088).
|
||
|
||
4086h - Modulation Frequency LSB (Write Only)
|
||
Bit7-0 Lower 8bit of 12bit Modulation frequency
|
||
4087h - Modulation Frequency MSB (Write Only)
|
||
Bit7 Modulation Enable/Disable (0=Enable, 1=Disable)
|
||
Bit6-4 Not used
|
||
Bit3-0 Upper 4bit of 12bit Modulation frequency
|
||
Modulation Unit: Modulation Rate (per entry of the 64-entry modulation table)
|
||
F = 1.79MHz * ModFreq / 65536
|
||
If the 12bit frequency is zero, the Modulation unit is disabled.
|
||
|
||
4088h - Modulation Table (Write Only)
|
||
Bit7-3 Not used
|
||
Bit2-0 Modulation input
|
||
Writing to this register puts the value written at the END of the modulation
|
||
table **twice**, and shifts each entry already in the table 2 places to the
|
||
front. The first 2 entries of the Modulation table are shifted out and lost.
|
||
old, old <-- ModTable_0 <-- ModTable_1 <-- ... <-- ModTable_63 <-- new, new
|
||
|
||
4090h - Current Volume Gain Level (6bit) (Read Only)
|
||
4092h - Current Sweep Gain Level (6bit) (Read Only)
|
||
|
||
4023h - 2C33 I/O Control Port
|
||
Bit0 Disk I/O (0=Disable, 1=Enable)
|
||
Bit1 Sound (0=Disable, 1=Enable)
|
||
|
||
FDS Sound by Disch, Release 1, 07/14/2004, based on info from Nori.
|
||
|
||
---- Sound Notes ----
|
||
|
||
Sweep Envelope and Modulation Units
|
||
Sweep Envelope unit behaves just like the Volume Envelope, only it alters Sweep
|
||
Gain instead of Volume Gain. The Envelope Unit never pushes Sweep Gain above
|
||
$20, but it still can get above $20 if set that way via $4084.
|
||
Increase/Decrease mode is determined by bit 6 of $4084
|
||
Sweep Gain is used when calculating the Frequency change in the Modulation
|
||
Unit...
|
||
The Modulation Unit, when clocked, takes 1 step through the Modulation Table
|
||
(set by writes to $4088). The Sweep Bias is adjusted based on the 3-bit value
|
||
in the table:
|
||
0:Bias=Bias+0 1:Bias=Bias+1 2:Bias=Bias+2 3:Bias=Bias+4
|
||
4:Bias=0 5:Bias=Bias-4 6:Bias=Bias-2 7:Bias=Bias-1
|
||
The address of the Modulation unit is incremented so that next clock it will
|
||
use the next 3-bit value in the table. This address wraps at 64 and can be
|
||
reset to zero by any write to $4085.
|
||
Sweep Bias wraps to fit within a signed 7-bit value, if it goes greater than
|
||
63, it wraps around to -64, and if it goes below -64, it wraps to 63.
|
||
The Modulation Unit works by altering the Frequency of the Main Unit by a value
|
||
calculated from the Sweep Gain and Sweep Bias values:
|
||
temp = Sweep_Bias * Sweep_Gain;
|
||
if temp AND 0Fh then
|
||
if Sweep_Bias<0 then temp=temp-10h else temp=temp+20h
|
||
temp=temp/10h
|
||
if temp>193 then temp -= 258; // not a typo... for some reason the wraps
|
||
if temp<-64 then temp += 256; // are inconsistent
|
||
Mod = Freq * temp / 64;
|
||
In this code, Freq is the 12-bit MAIN UNIT frequency, and Mod is the amount
|
||
that frequency is altered. This generated 'Mod' value is used in the frequency
|
||
calculation of the main unit (given earlier):
|
||
Hz = NES * (Freq + Mod) / 65536
|
||
If at any time the Modulation unit is off, 'Mod' is zero. Otherwise 'Mod' is
|
||
the above calculated value. If Freq + Mod produces a number less than or equal
|
||
to zero, the channel is presumably silenced.
|
||
|
||
Unit Activity
|
||
There are many factors that could disable a unit, here's an overview section to
|
||
cover all the needed requirements for the channel to be active.
|
||
Remember that each unit can be active regardless of the activitiy of other
|
||
units. For example... even though the main unit is off and the channel is
|
||
silent, this does not mean the Volume Envelope or Modulation units are
|
||
inactive.
|
||
If any of the supplied conditions are false... the unit is inactive and will
|
||
not be clocked. All conditions must be true for the unit to be active.
|
||
|
||
Volume Envelope Unit:
|
||
- Volume Envelope must be enabled (bit 7 of $4080 must be off)
|
||
- Envelope Speed must be nonzero (set by $408A)
|
||
- Envelope must be enabled (bit 6 of $4083 must be off)
|
||
|
||
Sweep Envelope Unit:
|
||
- Sweep Envelope must be enabled (bit 7 of $4084 must be off)
|
||
- Envelope Speed must be nonzero (set by $408A)
|
||
- Envelope must be enabled (bit 6 of $4083 must be off)
|
||
|
||
Modulation Unit:
|
||
- Modulation must be enabled (bit 7 of $4087 must be off)
|
||
- Modulation frequency must be non-zero (set by $4086/$4087)
|
||
|
||
Main Unit (Wave RAM Sound Output):
|
||
- Main Unit must be enabled (bit 7 of $4083 must be off)
|
||
- Main Unit Frequency must be non-zero (set by $4082/$4083)
|
||
- 'Freq + Mod' must be greater than zero (see Frequency Calculation section)
|
||
- Write Mode must be off (bit 7 of $4089 must be off)
|
||
|
||
FDS BIOS Disk Format
|
||
--------------------
|
||
|
||
Each disk has two sides, each side having a capacity of circa 64K, typically
|
||
less than 64K data because some space is used for gaps and headers, also the
|
||
exact capacity may vary depending on the transfer rate/rotation speed of the
|
||
drive that has recorded the disk. To change an active side, the disk has to be
|
||
removed, flipped, and inserted back into the drive.
|
||
|
||
The drive doesn't support random access, and the disk is NOT split into tracks
|
||
and sectors. The data is stored sequentially on a single "track" which is wound
|
||
in a spiral, starting at the outer edge, towards the center of the disk.
|
||
|
||
Side Header Block (56 bytes) (1st block on disk)
|
||
00h Block Type (01h)
|
||
01h-0Eh Disk ID (Must be ASCII string "*NINTENDO-HVC*")
|
||
0Fh Maker ID
|
||
10h-13h Game Name (usually 4 letter ASCII)
|
||
14h Version Number (usually 00h)
|
||
15h Side Number (00h=Side A, 01h=Side B) (00h=bootable)
|
||
16h Disk Number (00h=First, 01h=Second, etc.) (00h=bootable)
|
||
17h-18h Extra Disk ID Field
|
||
19h Highest File ID for Boot files (all files with File ID's less
|
||
or equal than this value are loaded automatically on power-up)
|
||
1Ah-37h Reserved Space (30 bytes, ignored by BIOS)
|
||
|
||
File Number Block (2 bytes) (2nd block on disk)
|
||
00h Block Type (02h)
|
||
01h Number of Files on this side
|
||
|
||
File Header Block (16 bytes) (for each file, 3rd,5th,7th... block on disk)
|
||
00h Block Type (03h)
|
||
01h File Number (00h=First file on this side, 01h=Second, etc.)
|
||
02h File ID (used to access files by Load Files function)
|
||
03h-0Ah File Name (not used, the BIOS access files by above File ID)
|
||
0Bh-0Ch Target Address (LSB, MSB)
|
||
0Dh-0Eh File Size (LSB, MSB)
|
||
0Fh Target Area (00h=WRAM, Other=VRAM)
|
||
|
||
File Data Block (1+LEN bytes) (for each file, 4th,6th,8th... block on disk)
|
||
00h Block Type (04h)
|
||
01h-LEN Data (LEN=File Size in File Header Block)
|
||
|
||
Gaps, Start Bits, CRC Values
|
||
Each block is preceded by a GAP (a stream of "0" bits), followed by a Start Bit
|
||
("1"), followed by the actual bytes contained in the block, followed by a 16bit
|
||
CRC value.
|
||
|
||
FDS Disk Images
|
||
Disk Images should have extension ".fds" and are having a 16-byte header:
|
||
00h 4 File ID ("FDS",1Ah)
|
||
04h 1 Number of Sides (usually 1 or 2; or more, eg. in Gunfight)
|
||
05h 11 Reserved (00h-filled)
|
||
Followed by the Disk Image (65500 bytes per side, padded with 00h if less bytes
|
||
are used). The image contains raw data (without low level information like
|
||
GAP-lengths, leading start bits, or trailing checksums), it should be usually
|
||
starting with the 56-byte Side Header Block (ie. 01h,"*NINTENDO-HVC*", etc.).
|
||
|
||
FDS BIOS Disk Functions
|
||
-----------------------
|
||
|
||
Disk Boot
|
||
On power-up, the FDS does call the Load Files function to load the boot files.
|
||
The DiskID is FFh-filled (wildcards), except the Side Number and Disk Number
|
||
entries which must be both 00h on boot-able disks. LoadList is empty,
|
||
indicating to load all boot files, ie. all files with File IDs less or equal
|
||
than the Disk Header's Boot ID value.
|
||
There must be at least two boot files on the disk, one containing the program
|
||
with entrypoint (16bit pointer, which must be loaded to DFFCh), the other file
|
||
containing the Nintendo License string (E0h bytes, which must be loaded to PPU
|
||
2800h, and which is verified against a copy in BIOS at ED37h).
|
||
|
||
DiskID
|
||
Used by most BIOS functions to ensure that the correct disk/side is inserted.
|
||
DiskID consists of 10 bytes which are compared against Disk Header Block
|
||
[0Fh..18h]. Each DiskID byte may be set to FFh, which is used as wildcard,
|
||
comparision always passes okay for that bytes. If the comparision does not
|
||
match then error codes 04h..10h are returned, indicating which entry didn't
|
||
match.
|
||
|
||
E1F8h - Load Files
|
||
The function scans <all> files on disk, respectively, the execution time is the
|
||
same, no matter how many/how large files are loaded. On the contrary, multiple
|
||
calls to LoadFiles would be unneccessarily slow.
|
||
RETaddr: pointer to DiskID
|
||
RETaddr+2: pointer to LoadList
|
||
A on return: error code
|
||
Y on return: count of files actually found
|
||
LoadList is a list of up to 20 File IDs, if the list contains less than 20 IDs
|
||
then it must be terminated by FFh. If LoadList is empty (FFh in the first byte)
|
||
then the boot files are loaded, that are all files with File IDs less or equal
|
||
than the Disk Header's Boot ID value.
|
||
|
||
E32Ah - Get Disk Information
|
||
RETaddr: pointer to DiskInfo
|
||
A on return: error code
|
||
The DiskInfo pointer should point to a free memory location, which will receive
|
||
the following data:
|
||
0Ah bytes Disk Header Block [0Fh..18h], manufacturer, disk name, etc.
|
||
1 byte File Number Block [01h], number of files on disk (N)
|
||
N*9 bytes File Header Block [02h..0Ah], File ID and Filename, for each file
|
||
2 bytes Disk Size (MSB,LSB)
|
||
Disk size is equal to the sum of each file's size entry, plus an extra 261 per
|
||
file.
|
||
|
||
E237h - Append File
|
||
Sets A=FFh (append after last file), ie. same as A=FileCount, then continues at
|
||
E239h (Write File).
|
||
|
||
E239h - Write File
|
||
Register A specifies how many old files are to be kept preserved on disk, these
|
||
files are read/skipped, and the new file is then written to disk after those
|
||
files, and the disks FileCount is set to A+1, making the new file to be the
|
||
last file on disk, any further files are deleted/hidden.
|
||
In a second cycle, the written data is verified, if the verification fails
|
||
(error 26h), then the file count is decremented, ie. the new file is deleted.
|
||
RETaddr: pointer to DiskID
|
||
RETaddr+2: pointer to FileInfo
|
||
A on call: File Number (00h=First) (FFh=Append after last file)
|
||
A on return: error code
|
||
FileInfo occupies 17 bytes, the first 14 bytes contain File Header entries
|
||
[02h..0Fh], ie. File ID, Filename, Load Address, Filesize, and Load Area.
|
||
The last 3 bytes contain the Source Address and Source Area (which may or may
|
||
not be same as Load Address and Load Area).
|
||
|
||
E2BBh - Adjust File count
|
||
RETaddr: pointer to DiskID
|
||
A on call: number to reduce current file count by
|
||
A on return: error code
|
||
Special error: #$31 if A is less than the disk's file count
|
||
Reads in disk's file count, decrements it by A, then writes the new value back.
|
||
|
||
E2B7h - Check File count
|
||
RETaddr: pointer to DiskID
|
||
A on call: number to set file count to
|
||
A on return: error code
|
||
Special error: #$31 if A is less than the disk's file count
|
||
Reads in disk's file count, compares it to A, then sets the disk's file count
|
||
to A.
|
||
|
||
E305h - Set File count (alt. 1)
|
||
RETaddr: pointer to DiskID
|
||
A on call: number to set file count to
|
||
A on return: error code
|
||
Sets the disk's file count to A.
|
||
|
||
E301h - Set File count (alt. 2)
|
||
RETaddr: pointer to DiskID
|
||
A on call: number to set file count to minus 1
|
||
A on return: error code
|
||
Sets the disk's file count to A+1.
|
||
|
||
Don't expect disk calls to return quick; it may take several seconds to
|
||
complete. The ROM BIOS always uses disk IRQ's to transfer data between the
|
||
disk, so programs must surrender IRQ control to the ROM BIOS during these disk
|
||
calls. The value at [$0101] however, is preserved on entry, and restored on
|
||
exit.
|
||
|
||
WRAM Target Addresses
|
||
Target Addresses should be in range 0200h-07FFh or 6000h-DFFFh. The BIOS
|
||
rejects (silently ignores) most attempts to load data to 0000h-01FFh. In
|
||
particular, it rejects Target Addresses at 0-1FFh (including mirrors at
|
||
800h,1000h,1800h), it also rejects wraps from FFFFh to 0000h.
|
||
However, it does not reject wraps to mirrors (eg. from 7FFh to 800h), clever
|
||
use of this feature might allow to modify values on stack, and to bypass the
|
||
Boot License.
|
||
Furthermore, target address 2000h can be used to enable NMIs during loading,
|
||
the games Bislot, Bisyosya, and Bishojo Control are using this trick to abort
|
||
the boot process and to start the game - without Boot License - via NMI vector
|
||
at [DFFAh].
|
||
|
||
VRAM Source/Target Addresses
|
||
Mind that the screen should be disabled when loading/writing VRAM data, Port
|
||
2001h/Bit3-4 should be zero, otherwise VRAM could be accessed only in VBlank.
|
||
Mind that physical content of VRAM addresses 2400h-2BFFh changes depending on
|
||
current mirroring. The BIOS re-initializes parts of VRAM after loading the boot
|
||
files on power up, overwriting any boot-files loaded to that areas.
|
||
|
||
Boot License String
|
||
32x7 characters in VRAM 2800h-28DFh (and copy in BIOS at ED37h)
|
||
" NINTENDO r "
|
||
" FAMILY COMPUTER TM "
|
||
" "
|
||
" THIS PRODUCT IS MANUFACTURED "
|
||
" AND SOLD BY NINTENDO CO;LDT. "
|
||
" OR BY OTHER COMPANY UNDER "
|
||
" LICENSE OF NINTENDO CO;LTD.. "
|
||
By using Non-ASCII BIOS Tile Numbers: A..Z=0Ah..23h SPC=24h .=26h ;=27h r=28h.
|
||
See WRAM Target Addresses above for methods to bypass the Boot License.
|
||
|
||
FDS BIOS Disk Errors
|
||
--------------------
|
||
|
||
Error codes are returned in both A and X registers (plus zero flag, Z=okay)
|
||
00h Okay (no error) (zero flag set)
|
||
01h No disk inserted (Port 4032h, Bit0)
|
||
02h No battery/power (Port 4033h, Bit7)
|
||
03h Disk write-protected (Port 4032h, Bit2)
|
||
04h Bad Side Header [0Fh], Maker ID
|
||
05h Bad Side Header [10h..13h], Game name
|
||
06h Bad Side Header [14h], Game version
|
||
07h Bad Side Header [15h], Side number (flip the disk)
|
||
08h Bad Side Header [16h], Disk number
|
||
09h Bad Side Header [17h], Extra ID Value 1
|
||
10h Bad Side Header [18h], Extra ID Value 2
|
||
20h Bad Nintendo License String (must be loaded to PPU 2800h-28DFh on boot)
|
||
21h Bad Side Header [01h..0Eh], Disk ID (must be "*NINTENDO-HVC*")
|
||
22h Bad Side Header [00h], Block ID must be 01h
|
||
23h Bad File Number [00h], Block ID must be 02h
|
||
24h Bad File Header [00h], Block ID must be 03h
|
||
25h Bad File Data [00h], Block ID must be 04h
|
||
26h Write-Verify Error (verification of written data failed)
|
||
27h Block CRC Read Failure (Port 4030h, Bit 4)
|
||
28h Lost Data (Port 4030h, Bit 6), CPU didn't read from 4031h in time
|
||
29h Lost Data (Port 4030h, Bit 6), CPU didn't write to 4024h in time
|
||
30h Disk Full (Port 4032h, Bit 1), Disk head has reached most inner track
|
||
31h Data number of a disk doesn't match up (?)
|
||
|
||
FDS BIOS Data Areas in WRAM
|
||
---------------------------
|
||
|
||
The BIOS uses several places in memory, but only some of them are expected to
|
||
be maintained by game code.
|
||
|
||
Addr Size Expl.
|
||
Scratch Area (destroyed by any calls to BIOS disk functions)
|
||
0000h 2 first 16bit parameter
|
||
0002h 2 second 16bit parameter
|
||
0004h 1 previous stack frame
|
||
0005h 1 error retry count
|
||
0006h 1 file counter
|
||
0007h 1 current block type
|
||
0008h 1 boot ID code
|
||
0009h 1 dummy read flag
|
||
000Ah 2 16bit destination address
|
||
000Ch 2 16bit transfer length count
|
||
000Eh 1 file found counter
|
||
Copies of I/O Ports (used to READ content of Write-Only I/O Ports)
|
||
The BIOS does (and the game should) keep these bytes in sync with the ports.
|
||
00F9h 1 value last written to [$4026] $FF on reset (disk ext connector)
|
||
00FAh 1 value last written to [$4025] $2E on reset (disk control)
|
||
00FBh 1 value last written to [$4016] 0'd on reset (joypad)
|
||
00FCh 1 value last written to [$2005]#2 0'd on reset (ppu scrolling)
|
||
00FDh 1 value last written to [$2005]#1 0'd on reset (ppu scrolling)
|
||
00FEh 1 value last written to [$2001] $06 on reset (ppu control)
|
||
00FFh 1 value last written to [$2000] $80 on reset (ppu control)
|
||
IRQ/NMI/Reset Control
|
||
0100h 1 Action on NMI (set to C0h on reset)
|
||
0101h 1 Action on IRQ (set to 80h on reset)
|
||
0102h 2 Action on Reset (AC35h after disk-boot, 5335h after warm-boot)
|
||
IRQ/NMI/Reset Vectors
|
||
DFF6h 2 Game NMI vector 1, used if [0100h]=01xxxxxxb
|
||
DFF8h 2 Game NMI vector 2, used if [0100h]=10xxxxxxb
|
||
DFFAh 2 Game NMI vector 3, used if [0100h]=11xxxxxxb
|
||
DFFCh 2 Game Reset vector, used if [0102h]=5335h or =AC35h
|
||
DFFEh 2 Game IRQ vector, used if [0101h]=11xxxxxxb
|
||
If [0100h..0102h] don't match then the IRQ/NMI/Reset is handled internally by
|
||
the BIOS, without using (and without changing) the Game vectors.
|
||
Address DFFCh contains the initial entrypoint at disk boot, and is also used as
|
||
warm-boot vector when pushing the Reset button at a later time.
|
||
|
||
There may be more structured data areas in the zero page (for example, the BIOS
|
||
joypad routines use $F5..$F8 for storing controller reads), but only the listed
|
||
ones are used by the disk call subroutines.
|
||
|
||
FDS Disk Drive Operation
|
||
------------------------
|
||
|
||
When the head reaches the end of the disk (most inner track), it returns to the
|
||
beginning of the disk (most outer track) and the cycle repeats, upon request
|
||
from the RAM adaptor. This means that on every scan, the entire disk is read
|
||
(which takes about 6 seconds). The disk drive signals the RAM adaptor when the
|
||
head has been positioned to the outer most track, and is starting a new scan.
|
||
|
||
FDS data transfer protocol
|
||
Like most disk drive units, the FDS disk drive is sending it's data out via
|
||
serial connection.
|
||
1.Data ------------__________________------______------
|
||
2.Rate ---___---___---___---___---___---___---___---___
|
||
3.XOR ___---___------___---___---______------______---
|
||
4.Write ___------_________------_________------------___
|
||
5.Read ___-_____-________-_____-________-___________-__
|
||
The 1st row shows a 8bit data value, in this example A3h, or 10100011b,
|
||
transferred LSB first. The 2nd row shows the transfer rate clock. The data/rate
|
||
signals are XORed, as shown in the 3rd row. The actual signal written to disk
|
||
is shown in the 4th row, magnetic polarity changes on any Low-to-High
|
||
transitions of the XOR-signal. When reading from disk, spikes of one
|
||
microsecond length are received on any polarity changes, as shown in the 4th
|
||
row.
|
||
|
||
The RAM adaptor expects a transfer rate of 96.4kHz, although the tolerance it
|
||
has for this rate is +/- 10%. This tolerance is neccessary since, the disk
|
||
drive can NOT turn the disk at a constant speed.
|
||
|
||
First GAP
|
||
The length of the first GAP period present on typical FDS disks (relative to
|
||
the instant the disk drive's "-ready" signal is activated) is about 40000 bits,
|
||
after which the first block start mark (indicating the beginning of the first
|
||
file) will appear.
|
||
The disk drive unit signals the RAM adaptor when the head has moved to the
|
||
beginning of the disk via the "-ready" signal it sends out (more on this
|
||
later). The "-ready" signal is based on a mechanical switch inside the drive
|
||
which is activated when the head is brought back to the outer most edge of the
|
||
disk (the beginning). Because the switch will usually be triggered prematurely,
|
||
the first 13000 bits (approx.) of data the drive will send out immediately
|
||
after this switch is activated will be invalid. To compensate for this, the RAM
|
||
adaptor purposely ignores the first 26100 bits (approx.) sent to it since it
|
||
recieves the "-ready" signal from the disk drive.
|
||
|
||
Further GAPs
|
||
The typical GAP period size used between files on FDS disks is roughly 976 bits
|
||
(this includes the bits that are ignored by the RAM adaptor).
|
||
the RAM adaptor always ignores the first 488 bits (approx.) to follow after the
|
||
immediate end of any file. This period allows the RAM adaptor (or the game
|
||
rather) an oppertunity to make the switch from reading from the disk to writing
|
||
or vice-versa.
|
||
|
||
Final "GAP"
|
||
- The rest of the disk is filled with 0's after the last file is recorded
|
||
(although it really shouldn't matter what exists on the disk after this).
|
||
|
||
CRC calculation
|
||
CRC appended to the immediate end of every file. The CRC is 16-bits, and is
|
||
generated with a 17 bit poly. The poly used is 10001000000100001b (the X25
|
||
standard). Right shift operations are used to calculate the CRC (this
|
||
effectively reverses the bit order of the polynomial, resulting in the 16-bit
|
||
poly of 8408h). The file this algorithm is designed to work on has no block
|
||
start mark in it ($80), and has 2 extra bytes at the end (where a CRC
|
||
calculation would normally reside) which are 0'd. While the block start mark is
|
||
actually used in the calculation of a FDS file CRC, you'll see in the algo
|
||
below that the block start mark ($80) is moved directly into a register.
|
||
// ax is used as CRC accumulator
|
||
// si is the array element counter
|
||
// di is a temp reg
|
||
// Size is the size of the file + 2 (with the last 2 bytes as 0)
|
||
// Buf points to the file data (with the 2 appended bytes)
|
||
mov ax,8000h // this is the block start mark
|
||
sub si,si // zero out file byte index ptr
|
||
@@lop1:
|
||
mov dl,byte ptr Buf[si]
|
||
inc si
|
||
REPT 8
|
||
shr dl,1; rcr ax,1; sbb di,di; and di,8408h; xor ax,di
|
||
ENDM
|
||
cmp si,Size
|
||
jc @@lop1
|
||
// ax now contains the CRC.
|
||
Special thanks to Val Blant for assistance in cracking the CRC algorithm used
|
||
by the FDS.
|
||
|
||
- Some unlicenced FDS games activate the "-stop motor" signal (and possibly
|
||
even "-write", even though the storage media is not intended to be written to)
|
||
when a media transfer is to be discontinued, while "-scan media" is still
|
||
active. While this is an unorthodoxed method of doing this, the best way to
|
||
handle this situation is to give the "-stop motor" signal priority over any
|
||
others, and force data transfer termination during it's activation.
|
||
|
||
- Check out the FDS loader project (which uploads *.FDS files to the RAM
|
||
adaptor) for source code to my working disk drive emulator.
|
||
|
||
Hardware disk copy protection
|
||
Apparently, Nintendo had designed FDS disk drive units so that they cannot
|
||
reprogram entire disks, while still somehow being able to write the contents of
|
||
individual files to the end of disks. Now, there's alot of undocumented things
|
||
going on inside the disk drive unit, so I'm just going to say that there are
|
||
two evil IC's you've got to watch out for inside the FDS disk drive- the 3213,
|
||
and the 3206. There is a collection of 6 "FDS-COPY" jpegs over at NESdev which
|
||
(pg. 4 right side, and pg. 5) give a pretty graphic overview of the steps
|
||
involved in modding a stock FDS disk drive, so that it may reprogram disks.
|
||
Although I haven't built the specific circuit described in the jpegs, I had
|
||
designed & built a similar working circuit to defeat the FDS's evil copy
|
||
protection circuitry, with excellent results.
|
||
|
||
Software disk copy protection
|
||
Special thanks to Chris Covell for bringing this to attention.
|
||
Apparently, some FDS disks implement a very simple copy protection scheme,
|
||
which the game relies on in order for the game to refuse to work on the copied
|
||
disk. Normally, the number of files that exist on an FDS disk is stored in the
|
||
second block recorded on it. However, some games maintain "invisible" files,
|
||
which are basically files that exist beyond what the file count number in the
|
||
file count block indicates. This poses somewhat of a problem for copy software
|
||
like FDSLOADR, since these tools rely on the file count block, and don't assume
|
||
that there is any valid data past the last file found on the disk. This means
|
||
that when these types of disks are copied, the invisible files will be lost,
|
||
and when the game loads the files that do exist, the game's going to give the
|
||
user heat about there being a file missing or somthing, gumming up the works.
|
||
However in practice, when an FDS disk is programmed, the unused end of the disk
|
||
is usually completely zeroed out, and this makes detecting the end of the disk
|
||
simple: just wait to find a GAP period of extreme length. Except in rare cases,
|
||
this model for detecting the true end of an FDS disk should generally provide
|
||
the best results for copying the complete contents for all types of FDS disks.
|
||
[That may be as well a trick to improve disk boot speed, not necessarily a copy
|
||
protection.]
|
||
|
||
Physical disk lockout mechanism
|
||
Ever wonder why Nintendo engraved their company's name along the handle edge of
|
||
all FDS disks? Inside the FDS disk drive bay, sitting just behind the lower
|
||
part of the front black plastic faceplate, is a little plastic block with the
|
||
letters "Nintendo" carved out of a hard plastic block. This basically forces
|
||
disks that don't have holes in those locations from completely loading into the
|
||
drive, circumventing usage. Now while many companies made FDS disks with those
|
||
holes cut out, I'm sure there must be some disks out there that are compatable
|
||
with the FDS, but don't have the holes. So, the solution is to simply
|
||
disassemble the FDS disk drive, remove the disk cage, and remove the two screws
|
||
securing the "Nintendo" letterblock.
|
||
|
||
VS System
|
||
---------
|
||
|
||
Nintendo's VS Systems are arcade machines with same chipset as NES consoles.
|
||
There are two versions:
|
||
VS UniSystem --> 1-2 players (1 Monitor, 1 CPU, 1 PPU, 1 ROM-Set)
|
||
VS DualSystem --> 2-4 players (2 Monitors, 2 CPUs, 2 PPUs, 2 ROM-Sets)
|
||
The DualSystem essentially contains two NES consoles that can be linked
|
||
together (or optionally can be used as two independend consoles, each one
|
||
running a different game).
|
||
|
||
--> VS System Controllers
|
||
--> VS System Games
|
||
--> VS System PPUs and Palettes
|
||
--> VS System Protections
|
||
--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K)
|
||
|
||
VS System Controllers
|
||
---------------------
|
||
|
||
Controller Ports
|
||
Port 4016h/Write:
|
||
Bit0 Joypad Strobe (as usually)
|
||
Bit1 VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ)
|
||
Bit2 Select 8K VROM bank at PPU 0000h-1FFFh (Mapper 99 games only)
|
||
Port 4016h/Read:
|
||
Bit2 Credit Service Button (0=Released, 1=Service Credit)
|
||
Bit3-4 DIP Switch 1-2 (0=Off, 1=On)
|
||
Bit5-6 Credit Left/Right Coin Slot (0=None, 1=Coin) (Acknowledge via 4020h)
|
||
Bit7 VS Dualsystem: Master/Slave ID (0=Slave CPU, 1=Master CPU)
|
||
Port 4017h/Read:
|
||
Bit2-7 DIP Switch 3-8 (0=Off, 1=On)
|
||
Port 4020h/Write:
|
||
Bit0 Acknowledge Coin Slot Signal (0=Normal, 1=Acknowledge Coin)
|
||
Memory at 6000h-67FFh:
|
||
2Kbyte of shared RAM for VS Dualsystem CPU-to-CPU communications.
|
||
Access, according to schematic:
|
||
Owner depends on OUT-1 output from MASTER(?) CPU ;<--that is: "2J" CPU
|
||
aka IRQ input from SLAVE(?) CPU (or vice-versa?) ;<--that is: "8J" CPU
|
||
Typically handshake involves IRQ from Master CPU, followed by a
|
||
response-IRQ from Slave CPU.
|
||
|
||
Joysticks
|
||
The Joysticks are working like normal Joypads, but with different bit
|
||
assignments, Start/Select are renamed to Button 1-4, and controls for Player 1
|
||
and 2 are exchanged:
|
||
Read NES/4016h VS/4016h NES/4017h VS/4017h
|
||
1st Button A (1) Button A (2) Button A (2) Button A (1)
|
||
2nd Button B (1) Button B (2) Button B (2) Button B (1)
|
||
3rd Select (1) Button 1 Select (2) Button 2
|
||
4th Start (1) Button 3 Start (2) Button 4
|
||
5th Up (1) Up (2) Up (2) Up (1)
|
||
6th Down (1) Down (2) Down (2) Down (1)
|
||
7th Left (1) Left (2) Left (2) Left (1)
|
||
8th Right (1) Right (2) Right (2) Right (1)
|
||
Reportedly, some VS games have those inputs assigned differently?
|
||
--> Controllers - Joypads
|
||
|
||
Lightguns
|
||
VS Lightguns are more or less same as NES Zappers, but the signals are injected
|
||
to the "joypad" shift registers (the normal NES-like connection would conflict
|
||
with VS DIP-Switches), for details on both VS and NES guns, see:
|
||
--> Controllers - Lightguns (Zapper)
|
||
|
||
Coin Slots
|
||
There are two coin slots (maybe for different coins?). Some games allow to
|
||
change the number of coins per game via DIP-Switches; ie. in some cases one
|
||
needs to insert more than one coin before the game starts (or push the coin
|
||
button more than once in emulators). Credit Service Button (inside the cabinet)
|
||
typically adds a free game.
|
||
Exact purpose of the Coin Acknowledge output is unknown.
|
||
At least some VS games (eg. Clu Clu Land) do accept Coin signals only if they
|
||
fall within whatever min/max lengths; there is no such timing restriction for
|
||
the service button.
|
||
|
||
DIP-Switches
|
||
Allow to configure the games. Such like: Skipping the title screen, muting
|
||
sound effects, changing difficulty, changing PPU palette (on third-party
|
||
games), changing coins per game.
|
||
Some Daughterboards do contain additional DIP-Switches (used to change capacity
|
||
of the ROMs).
|
||
|
||
VS System Games
|
||
---------------
|
||
|
||
VS System Games
|
||
PPU Mapper Title
|
||
*RP2C04-0001 MMC3+? Atari RBI Baseball
|
||
RP2C04-0003 DUAL Balloon Fight (... Dualsystem only?)
|
||
RP2C04-0001 DUAL Baseball (... Dualsystem only?)
|
||
*RP2C04-0001 - Battle City
|
||
RP2C04-0002 UNROM Castlevania
|
||
RP2C04-0004 - Clu Clu Land
|
||
RP2C04-0003 MMC1 Dr. Mario
|
||
RC2C03B - Duck Hunt (Lightgun) (one version)
|
||
RC2C03C - Duck Hunt (Lightgun) (other/same version)
|
||
RP2C04-0003 - Excite Bike (instructions in demo-mode) (Nintendo) 1984
|
||
RP2C04-0004 - Excite Bike (status-bar in demo-mode) (Nintendo) 1984
|
||
RP2C04-0001 MMC3 Freedom Force (Lightgun) (1988 Sunsoft)
|
||
RP2C04-0002 - Golf
|
||
RC2C03B ? - Golf (Japan version?) XXX doesn't match ANY palette??
|
||
RP2C04-0003 VRC1 Goonies
|
||
RP2C04-0001 VRC1 Gradius
|
||
RC2C05-03 40K+16K Gumshoe (Lightgun)
|
||
RP2C04-0001 - Hogan's Alley (Lightgun)
|
||
RP2C04-0004 - Ice Climber (Unisystem)
|
||
RP2C04-0004 DUAL Ice Climber (Dualsystem) (JAPAN) "splitscreen-vertical"
|
||
RP2C04-0002 - Ladies Golf
|
||
RP2C04-0002 - Mach Rider (Endurance Course version)
|
||
RP2C04-0001 - Mach Rider (Fighting Course version) (Japan version)
|
||
RC2C03B DUAL Mahjang (... Dualsystem only?)
|
||
RC2C05-02 - Mighty Bomb Jack (Japan)
|
||
RC2C05-01 - Ninja Jajamaru Kun (Japan)
|
||
RP2C04-0001 - Pinball
|
||
RC2C03B - Pinball (Japan)
|
||
RP2C04-0001 Sunsoft3 Platoon
|
||
RP2C04-0002 DUMMY Raid on Bungeling Bay (Japan)
|
||
RP2C04-0002 - Slalom
|
||
RP2C04-0002 - Soccer (japan version)
|
||
RP2C04-0003 - Soccer (other version)
|
||
*RC2C03B - Star Luster
|
||
RP2C04-0004 - Super Mario Bros.
|
||
RP2C04-0004 - Super Mario Bros. (alternate version)
|
||
RP2C04-0004 - Super Mario Bros. (Super Skater/Skate Kids CHR-ROM hack)
|
||
*RP2C04-0001 MMC3 Super Sky Kid
|
||
*RP2C04-0001 MMC3+? Super Xevious
|
||
RC2C03B DUAL Tennis (... Dualsystem only?)
|
||
*RP2C04-0001 - Tetris (by Tengen)
|
||
*RP2C04-0003 MMC3+? TKO Boxing
|
||
RC2C05-04 UNROM Top Gun
|
||
RP2C04-0002 DUAL Wrecking Crew (... Dualsystem only?)
|
||
RC2C05-05 ? (this PPU is used by which game ???) (does it exist?)
|
||
RP2C03B ? (this PPU is used by Playchoice 10; not by VS System)
|
||
RP2C03G ? (this PPU is used by which game ???) (does it exist?)
|
||
Note: The "*" marked entries are third-party games that do support different
|
||
PPUs (typically selected via DIP switch 6-8, the PPUs listed in the above table
|
||
are used when all DIP switches are OFF).
|
||
|
||
VS System Mappers
|
||
Below should be the correct mapper numbers used by VS games. Observe that
|
||
ROM-images do often contain incorrect mapper numbers (probably because there is
|
||
no automatic tool for dumping the VS ROM-Sets) (in worst case, the .NES header
|
||
is even missing the VS-flag).
|
||
- Mapper 99 (standard VS System mapper; games without daughterboard)
|
||
40K+16K Mapper 99 (with some extension to access 40K PRG-ROM)
|
||
DUAL Mapper 99 (Dualsystem, requires two ROM-sets, two CPUs/PPUs etc.)
|
||
DUMMY Mapper 99 (single-player, but requires Dummy PRG-ROM on second CPU)
|
||
MMC1 Mapper 1 (MMC1, or actually some pre-MMC1 74xxx-logic)
|
||
MMC3 Mapper 4 (MMC3, or actually some third-party pre-MMC3 chip)
|
||
MMC3+? Mapper 4 (plus protection chip at 5Exxh or 5xxxh)
|
||
Sunsoft3 Mapper 67 (Sunsoft-3 chip)
|
||
UNROM Mapper 2 (UNROM)
|
||
VRC1 Mapper 75 (Konami VRC1 chip)
|
||
The "Mapper 99" games consist of several 8Kbyte EPROMs (to be mounted directly
|
||
on the mainboard). The other games use special daughterboards (to be mounted
|
||
between CPU/PPU and mainboard).
|
||
The "MMC3" chips are actually some sort of pre-MMC3 28pin Shrink-DIP chips from
|
||
Namco, with part number "108 JAPAN", so correct mapper number would be "Mapper
|
||
206" or so?
|
||
|
||
VS System PPUs
|
||
RC2C03B (standard palette) ;\standard palette
|
||
RC2C03C (standard palette) ;/
|
||
RC2C05-01 (with ID ([2002h] AND xxh)=?) ;\
|
||
RC2C05-02 (with ID ([2002h] AND 3Fh)=3Dh) ; standard palette, but with
|
||
RC2C05-03 (with ID ([2002h] AND 1Fh)=1Ch) ; swapped port 2000h/2001h,
|
||
RC2C05-04 (with ID ([2002h] AND 1Fh)=1Bh) ; and Chip ID in port 2002h
|
||
RC2C05-05 (with ID ([2002h] AND xxh)=?) ;/
|
||
RP2C04-0001 (special palette 1) ;\
|
||
RP2C04-0002 (special palette 2) ; special palettes
|
||
RP2C04-0003 (special palette 3) ;
|
||
RP2C04-0004 (special palette 4) ;/
|
||
For reference, below are some more RGB PPUs (although not used in VS System):
|
||
RP2C03B (standard palette) ;<-- Playchoice 10 ;\standard palette, but not
|
||
RP2C03G (standard palette) ;<-- used where? ;/actually VS System related
|
||
And, RP2C03C and RC2C05-99 do exist (the above obscure RP2C03G and RC2C05-05
|
||
chip names might be actually mistyped names, and might be actually being meant
|
||
to mean RP2C03C and RC2C05-99).
|
||
|
||
Reportedly further VS games:
|
||
Babel no Tou (by Namco, 1986)
|
||
Family Boxing (by Namco/Wood Place, 1987; japanese "TKO Boxing")
|
||
Family Stadium '87 (by Namco, 1987; sequel to RBI Baseball)
|
||
Family Stadium '88 (by Namco, 1988; sequel to RBI Baseball)
|
||
Family Tennis (by Namco, 1987)
|
||
Head to Head Baseball (ever finished/released?, by Nintendo, 1986)
|
||
Lionex (prototype by Sunsoft, 1987)
|
||
Madura no Tsubasa (prototype by Sunsoft, 1987)
|
||
Predators (prototype by Williams, 1984)
|
||
Pro Yakyuu Family Stadium (by Namco, 1986; Japan version of RBI Baseball)
|
||
Quest of Ki (by Namco/Game Studio, 1988)
|
||
Super Chinese (by Namco/Culture Brain, 1988)
|
||
Toukaidou 53tsugi (prototype by Sunsoft, 1985)
|
||
Trojan (by Capcom, 1987)
|
||
Urban Champion (1984)
|
||
Volleyball (1986)
|
||
Walkure no Bouken (by Namco, 1986)
|
||
Wild Gunman (1984, light gun game)
|
||
and maybe Kung-Fu, Football, etc.
|
||
|
||
VS System PPUs and Palettes
|
||
---------------------------
|
||
|
||
PPU Name Tables
|
||
The VS System seems to be fitted with 4K VRAM. If that is true, and if there's
|
||
no way to disable that, then VS games are probably always running in
|
||
Four-Screen mode. Ie. ignore any different mirroring settings in .NES file
|
||
header, and ignore any Name Table mode selections via VRC1/MMC1/MMC3/Sunsoft3
|
||
mappers.
|
||
|
||
PPU ID Codes
|
||
There are some PPUs with swapped control port addresses, and IDs in lower 5bit
|
||
of the PPU status port.
|
||
RC2C05-01 (with ID ([2002h] AND xxh)=?) ;\
|
||
RC2C05-02 (with ID ([2002h] AND 3Fh)=3Dh) ; standard palette, but with
|
||
RC2C05-03 (with ID ([2002h] AND 1Fh)=1Ch) ; swapped port 2000h/2001h,
|
||
RC2C05-04 (with ID ([2002h] AND 1Fh)=1Bh) ; and Chip ID in port 2002h
|
||
RC2C05-05 (with ID ([2002h] AND xxh)=?) ;/
|
||
Unknown: RC2C05-05 does it really exist, which game is using it, what's its ID?
|
||
Unknown: RC2C05-01 what ID does it have (if any) (game doesn't check it)?
|
||
Unknown: RC2C05-03 game wants a 6bit ID, does that PPU support the "Sprite
|
||
Lost" flag, if yes, why/how is it set in the ID check? Maybe always initially
|
||
set on Reset, or always occuring shortly after reset (in case OBJ y-coordinates
|
||
are initially all same)?
|
||
|
||
PPU Palettes
|
||
The "Standard" Palette does resemble the NES palette. The other four palettes
|
||
do have these colors rearranged, and have some additional colors.
|
||
All five VS palettes are much more colorful than the "pastelized" NES palette
|
||
(roughly same as on a NES when setting the TV Set to MIN Brightness & MAX
|
||
Color).
|
||
The PPU's Color Emphasis Bits are also different as on NES PPUs: On a VS-PPU,
|
||
they are forcing the selected color(s) to max brightness. For example, when
|
||
setting all three Emphasis Bits, the whole screen will become white (on a NES,
|
||
the normal picture would be kept displayed at reduced brightness).
|
||
|
||
Below palette tables are showing 3:3:3 bit RGB values (eg. 700=Red, 070=Green,
|
||
007=Blue).
|
||
|
||
RP2C04-0001, Special Palette 1
|
||
755,637,700,447,044,120,222,704,777,333,750,503,403,660,320,777
|
||
357,653,310,360,467,657,764,027,760,276,000,200,666,444,707,014
|
||
003,567,757,070,077,022,053,507,000,420,747,510,407,006,740,000
|
||
000,140,555,031,572,326,770,630,020,036,040,111,773,737,430,473
|
||
|
||
RP2C04-0002, Special Palette 2
|
||
000,750,430,572,473,737,044,567,700,407,773,747,777,637,467,040
|
||
020,357,510,666,053,360,200,447,222,707,003,276,657,320,000,326
|
||
403,764,740,757,036,310,555,006,507,760,333,120,027,000,660,777
|
||
653,111,070,630,022,014,704,140,000,077,420,770,755,503,031,444
|
||
|
||
RP2C04-0003, Special Palette 3
|
||
507,737,473,555,040,777,567,120,014,000,764,320,704,666,653,467
|
||
447,044,503,027,140,430,630,053,333,326,000,006,700,510,747,755
|
||
637,020,003,770,111,750,740,777,360,403,357,707,036,444,000,310
|
||
077,200,572,757,420,070,660,222,031,000,657,773,407,276,760,022
|
||
|
||
RP2C04-0004, Special Palette 4
|
||
430,326,044,660,000,755,014,630,555,310,070,003,764,770,040,572
|
||
737,200,027,747,000,222,510,740,653,053,447,140,403,000,473,357
|
||
503,031,420,006,407,507,333,704,022,666,036,020,111,773,444,707
|
||
757,777,320,700,760,276,777,467,000,750,637,567,360,657,077,120
|
||
|
||
All other VS System PPUs reportedly use this (or similar?) Standard Palette
|
||
333,014,006,326,403,503,510,420,320,120,031,040,022,000,000,000
|
||
555,036,027,407,507,704,700,630,430,140,040,053,044,000,000,000
|
||
777,357,447,637,707,737,740,750,660,360,070,276,077,000,000,000
|
||
777,567,657,757,747,755,764,772,773,572,473,276,467,000,000,000
|
||
In the "standard" RGB palettes, color 0Dh is all black, which means that TWO of
|
||
the composite NES gray-shades are missing on RGB PPUs. Note/caution: There is
|
||
an "improved" RGB palette with THREE extra gray-shades (111,222,444) in the
|
||
internet: that palette was invented/intended to make an open source emulator
|
||
look "better" than real hardware - that "improvement" was adopted by many other
|
||
emulators (probably without even being aware of the unreal grays).
|
||
|
||
French "RGB" (home-use NES consoles, not arcade)
|
||
France is using SECAM as television standard, frame rate is 50Hz (like PAL),
|
||
but color encoding is different. The other big video standard in france appears
|
||
to be to have TV Sets fitted with RGB input.
|
||
Like many other manufacturers, Nintendo didn't produce SECAM PPUs. Instead they
|
||
have used a PAL to RGB converter attached to a standard PAL PPU. That pseudo
|
||
"RGB" output is thus having same artifacts as composite PAL pictures.
|
||
|
||
VS System Protections
|
||
---------------------
|
||
|
||
Unprotected Games
|
||
VS Games are consisting of sets of EPROMs without any special hardware (apart
|
||
from custom cabinet front plates), the are no CIC lockout chips. That (and the
|
||
relative high price of the games) made it quite inviting to upgrade the
|
||
cabinets with illegal copies of newer games, or with unlicensed third-party
|
||
games.
|
||
|
||
Nintendo Protections
|
||
To prevent piracy & unlicensed games, Nintendo has made a bunch of different
|
||
PPUs: PPUs with different palettes, and PPUs with different Port
|
||
2000h/2001h/2002h.
|
||
|
||
Third-Party Protections
|
||
Thirty-Party games can be often DIP-switched to work with different palettes
|
||
(thus bypassing Nintendo's protection). Instead, some thirty-party games do
|
||
require some special "ID chip" mapped at 5xxxh or 5Exxh, and refuse to boot if
|
||
the thing doesn't respond with expected values (see below for details).
|
||
|
||
Daughterboards
|
||
These are mainly used to access more memory. But, to some level they do also
|
||
act as protection, since one needs to buy the boards. Some boards can be
|
||
DIP-switched to work with different games with ROM capacites though.
|
||
|
||
Raid on Bungeling Bay
|
||
This game consists of seven 8Kbyte EPROMs. Six PRG/CHR EPROMs for first CPU,
|
||
and one PRG EPROM for second CPU (without any CHR ROM here). This extra EPROM
|
||
isn't doing anything useful (no sound/video output, and coprocessor-like
|
||
maths), it's just doing a short handshake with the other CPU, and then it hangs
|
||
in an endless loop.
|
||
The purpose is unknown; it may be some crude protection (won't work if the
|
||
extra EPROM doesn't say "I am here"). Or maybe the game supports DUAL mode (and
|
||
in UNI mode, requires the second CPU to say "I am NOT here").
|
||
Basically, the game needs a response IRQ from other CPU (with don't care
|
||
response at 67E0h-67FFh), and additionally DIP 5 must be ON.
|
||
|
||
TKO Boxing Protection (Namco)
|
||
Protection unit is contained in a 28pin chip with part number "126 JAPAN".
|
||
[5E00h].Read ;-reset data stream (returns unknown/dummy value)
|
||
[5E01h].Read ;-return data stream (returns FFh,BFh,B7h,etc.)
|
||
TKO Boxing contains pre-computed 32 values in ROM:
|
||
FF,BF,B7,97,97,17,57,4F,6F,6B,EB,A9,B1,90,94,14 ;1st..16th read
|
||
56,4E,6F,6B,EB,A9,B1,90,D4,5C,3E,26,87,83,13,51 ;17th..32th read
|
||
That is, the initial value (FFh on first read) is XORed by following values:
|
||
40,08,20,00,80 ;XORed after 1st..5th read
|
||
40,18,20,04,80 ;XORed after 6th..10th read
|
||
42,18,21,04,80 ;XORed after 11th..15th read
|
||
42,18,21,04,80 ;etc.
|
||
42,18,21,44,88
|
||
62,18,A1,04,90
|
||
42
|
||
The exact way how that pattern is generated (and how it continues after 32
|
||
reads) is unknown. Note: The way how TKO Boxing is programmed, it CAN only
|
||
verify the first 31 values, and actually DOES only verify first 7 values
|
||
(unless there are further checks hidden "deeper" in the game).
|
||
|
||
Atari RBI Baseball Protection (Namco)
|
||
Protection unit is contained in a 28pin chip with part number "127 JAPAN".
|
||
[5E00h].Read ;-reset data stream (returns unknown/dummy value)
|
||
[5E01h].Read ;-return data stream (returns whatever...)
|
||
RBI Baseball verifies only two values: B4h on 5th read, and 6Fh on 10th read.
|
||
This is different as in TKO Boxing (which would return 97h and 6Bh).
|
||
|
||
Super Xevious Protection (Namco)
|
||
Uses whatever protection chip (unknown part number).
|
||
The game is doing the following check upon Reset:
|
||
Write: [5098h]=38h, [5132h]=9Eh, [5263h]=22h, [5300h]=90h
|
||
Verify: [54FFh]=05h, [5678h]=01h, [578Fh]=89h, [5567h]=37h
|
||
Write: [5056h]=44h, [51C8h]=72h, [526Ah]=9Ah, [5300h]=FEh
|
||
Verify: [54FFh]=05h, [5678h]=00h, [578Fh]=D1h, [5567h]=3Eh
|
||
That can be faked by returning following values upon [5400h..57FFh] reads:
|
||
05h, 01h, 89h, 37h, 05h, 00h, D1h, 3Eh
|
||
Unknown how the hardware works in reality; it looks like four 8bit latches, and
|
||
scrambled data, possibly by XORing data & address lines.
|
||
|
||
Controllers
|
||
Some VS games do reportedly some controller buttons exchanged with each other,
|
||
so they can be played only when buying a special controller front panels or so.
|
||
Unknown which games and which buttons that applies to.
|
||
|
||
Nintendo Playchoice 10
|
||
----------------------
|
||
|
||
The Nintendo Playchoice 10 (PC10) arcade cabinets can contain up 10 NES games
|
||
(on special cartridges). Aside from the NES-compatible hardware, the thing
|
||
contains a Z80 CPU and a custom video circuit for handling game selection,
|
||
coin/credits, game title/instructions display and bookkeeping.
|
||
|
||
--> PC10 Memory Map and I/O Ports
|
||
--> PC10 Video Circuit
|
||
--> PC10 Title/Instructions (INST ROM)
|
||
--> PC10 NES-Side
|
||
--> PC10 Games and Cartridge PCBs
|
||
--> PC10 Cabinet and BIOS Versions
|
||
--> PC10 Pin-Outs
|
||
--> Z80 CPU Specifications
|
||
|
||
PC10 Memory Map and I/O Ports
|
||
-----------------------------
|
||
|
||
Z80 Memory Map
|
||
0000h-7FFFh 32K BIOS ROM Area (usually 16K chip, mirrored within 32K area)
|
||
8000h-87FFh 2K Work RAM
|
||
8800h-8BFFh 1K Lower 1K of Battery RAM
|
||
8C00h-8FFFh 1K Upper 1K of Battery RAM (when disabled: mirror of Lower 1K)
|
||
9000h-97FFh 2K Video RAM (write only, and disabled during video output)
|
||
9800h-BFFFh 10K Unused (open bus)
|
||
C000h-DFFFh 8K Cartridge BIOS (resides on each game cartridge)
|
||
E000h-FFFFh 8K Memory-mapped PROM I/O Ports
|
||
|
||
Z80 I/O Map - READ (by IN opcodes)
|
||
00h Button/Status
|
||
bit 0: Channel select button (aka Button 1) (0=Released, 1=Pressed)
|
||
bit 1: Enter button (aka Button 2) (0=Released, 1=Pressed)
|
||
bit 2: Dual-Monitor with Reset button (0=Released, 1=Pressed)
|
||
Single-Monitor with Reset button (0=Pressed, 1=Released)
|
||
Single-Monitor without Reset button (Always 0=No Reset Button)
|
||
(Presence of the single monitor reset button works as so:
|
||
The button may not be held down during power-up (obviously).
|
||
The freeplay mode DIP-switch setting and R99 shunt-lead removal
|
||
are accidentally causing the button-detection to be skipped.
|
||
Bugfix: change the two jumps to address 0378h to address 036Bh)
|
||
bit 3: Vblank NMI Occurred on NES Side (0=Yes, 1=No)
|
||
bit 4: <zero> unknown... is USED ! "R99 0 ohm Shunt Lead to GND" ?
|
||
(allow to insert more coins for PRIME TIME ...?)
|
||
bit 5: Coin 2 button (0=None, 1=Coin Insterted)
|
||
bit 6: Service button (0=Released, 1=Pressed)
|
||
bit 7: Coin 1 button (0=None, 1=Coin Insterted)
|
||
01h DIP-switch 1, Bits 0-7 (A..H) (0=Off, 1=On)
|
||
bit 0..5: (A..F) Coinage (credits per left/right coin slot)
|
||
bit 6: (G) Sound enable for Attraction/Demo mode (0=Off, 1=On)
|
||
bit 7: (H) Automatic Selftest upon Power-Up (0=Off, 1=On)
|
||
02h DIP-switch 2, Bits 0-7 (I..P) (0=Off, 1=On)
|
||
bit 0..5: (I..N) Timer Speed (credit decrease rate)
|
||
bit 6: (O) Divide all coinage settings by 2 (see A..F)
|
||
bit 7: (P) Freeplay Mode (only when bit0..6 = zero)
|
||
03h Reading from this address sets Bit3 of read Port 00h back to 1=False
|
||
Port 04h..FFFFh are mirrors of Port 00h..03h.
|
||
|
||
Z80 I/O Map - WRITE (by OUT opcodes) (all write ports are using bit 0 only)
|
||
00h VRAM Access (0=by Z80 CPU, 1=by Video circuit)
|
||
01h Game Controls (0=Disable, 1=Enable)
|
||
02h PPU RP2C03B Display output (0=Disable, 1=Enable)
|
||
03h APU N2A03 Sound output (0=Disable, 1=Enable)
|
||
04h CPU N2A03 Reset (0=Reset, 1=Run)
|
||
05h CPU N2A03 Stop (0=Stop, 1=Run)
|
||
06h Display Output Select (0=Z80/Video circuit, 1=NES/RP2C03B PPU)
|
||
(Only on single monitor version)
|
||
07h Unknown...? is USED ! (even in single-monitor bios!)
|
||
or, 06h,07h = both N/C
|
||
08h Z80 NMI Control (0=Disable, 1=Enable)
|
||
09h Watchdog Control (0=Enable, 1=Disable)
|
||
0Ah PPU RP2C03B Reset (0=Reset PPU, 1=Run PPU)
|
||
0Bh Game Channel Select Bit0 ;\Slot Select (0-9) (0Ah..0Fh=Open Bus)
|
||
0Ch Game Channel Select Bit1 ; affects NES CPU/PPU memory,
|
||
0Dh Game Channel Select Bit2 ; and Z80 INST-ROM and PROM
|
||
0Eh Game Channel Select Bit3 ;/
|
||
0Fh Upper 1K of Battery RAM (0=Disable, 1=Enable)
|
||
Below 4bit Ports in Single-Monitor version only (remaining time display):
|
||
10h 7-Segment LED 4th Digit (LSB) ;\Four 74HC4511 BCD-to-7-segment drivers,
|
||
11h 7-Segment LED 3rd Digit ; and four GL-8E040 7-segment LED displays
|
||
12h 7-Segment LED 2nd Digit ; (bit0-3:00h..09h="0..9", 0Ah..0Fh=Blank)
|
||
13h 7-Segment LED 1st Digit (MSB) ;/
|
||
Mirrors should be as so:
|
||
10h..1Fh Mirrors of Port 00h..0Fh (Dual-Monitor version only)
|
||
14h..1Fh Mirrors of Port 10h..13h (Single-Monitor version only)
|
||
20h..FFFFh Mirrors of Port 00h..1Fh (all versions)
|
||
|
||
Watchdog
|
||
The watchdog is disabled (and its frame counter is reset to zero) when Port 08h
|
||
and/or Port 09h are set to nonzero values; ie. the watchdog is active ONLY
|
||
during periods when NMIs are off (Port 08h=0) and only when the Watchdog is on
|
||
(Port 09h=0). When active, the watchdog resets the Z80 CPU after 8 frames.
|
||
|
||
Z80 Memory Mapped I/O at E000h..FFFFh - Ricoh RP5H01 serial 72bit PROM
|
||
Data Write:
|
||
7-5 Unused
|
||
4 PROM Test Mode (0=Low=6bit Address, 1=High=7bit Address)
|
||
3 PROM Clock (0=Low, 1=High) ;increment address on 1-to-0 transition
|
||
2-1 Unused
|
||
0 PROM Address Reset (0=High=Reset to zero, 1=Low=No Change)
|
||
Data Read and Opcode Fetch:
|
||
7-5 Always set (MSBs of RST Opcode)
|
||
4 PROM Counter Out (0=High=One, 1=Low=Zero) ;PROM Address Bit5 ;\both
|
||
3 PROM Data Out (0=High=One, 1=Low=Zero) ;PROM Data ;/inverted
|
||
2-0 Always set (LSBs of RST Opcode)
|
||
The 72bit PROM contains 9 bytes (8 "normal" bytes, and 1 "test" byte which was
|
||
originally intended for testing purposes, but can be also mis-used to contain
|
||
"normal" data). After resetting the address to zero, the the PROM will be
|
||
(repeatedly) outputting the following bytes (LSB first):
|
||
DATA (when TEST=0): a, b, c, d, e, f, g, h, a, b, c, d, e, f, g, h
|
||
DATA (when TEST=1): a, b, c, d, e, f, g, h, i, i, 00,00,i, i, 00,00
|
||
COUNTER OUT (always): 00,00,00,00,FF,FF,FF,FF,00,00,00,00,FF,FF,FF,FF
|
||
(the PC10 mainboard inverts that signals, so Z80 will see inverse of above)
|
||
In the PC10, the PROM contains a decryption key, used for deciphering the
|
||
INST-ROM content. Most of the decryption is done by code in the INST-ROM (so
|
||
one could completely omit that part in homebrew INST-ROMs). The BIOS accesses
|
||
the PROM in only two places: In the INST-ROM checksum calculation (which thus
|
||
requires whatever stable data coming from the PROM). And, the Z80 NMI handler
|
||
(which checks that CounterOut is High after 32 reads).
|
||
|
||
PC10 Video Circuit
|
||
------------------
|
||
|
||
PC10 VRAM (32x28 character "BG Map")
|
||
VRAM is located at 9000h-97FFh. VRAM is write-only, and can be accessed only
|
||
when video output is disabled via Port OUT[00h], to avoid flickering, this
|
||
should be usually done only during VBlank (ie. in the Z80 NMI handler).
|
||
Each character line occupies 40h bytes (20h words). The words are:
|
||
Bit0-10 Character number (000h..7FFh) (usually only 000h..3FFh installed)
|
||
Bit11-15 Palette number (00h..1Fh)
|
||
The upper 2 lines and lower 2 lines are masked for V-Blank period, so actually
|
||
used VRAM consists of 28 lines at 9080h..977Fh.
|
||
|
||
PC10 Charset (for the Z80 Video Circuit)
|
||
'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",: abcdefghijkl+ ' ;000-03F
|
||
'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",:mnopq?()/=+ ' ;040-07F
|
||
'abcdefghijklABCmEnoHIpqLMNOPrRSTUstuYv!wxyzr' ;080-0BF
|
||
'stuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ,-!'() ' ;0C0-0FF
|
||
'0 1 2 3 4 5 6 7 8 9 TIMEInsertCoin ' ;100-13F
|
||
' Tim NearUp FillUpTimeAnd ' ;140-17F
|
||
'' ;180-1BF
|
||
'' ;1C0-1FF
|
||
'ChannelSelectEnter.ButtonsGameTart ' ;200-23F
|
||
' ' ;240-27F
|
||
' ' ;280-2BF
|
||
' ' ;2C0-2FF
|
||
' ' ;300-33F
|
||
'cntrlTM' ;340-37F
|
||
'' ;380-3BF
|
||
'c1986nintendo ' ;3C0-3FF
|
||
The 400h characters are stored in three 2764 chips (three 8Kx8 EPROMs): IC
|
||
"8P"=CHR0, IC "8M"=CHR1, IC "8K"=CHR2 (each chip containing one color-plane of
|
||
the 8-color characters). Optionally, for 800h characters, the mainboard could
|
||
be fitted with 27128 chips.
|
||
The "" graphics symbols are used by the BIOS (and by instruction pages in
|
||
Excitebike, Mario Bros, and Super Mario Bros). There are no japanese
|
||
characters.
|
||
|
||
PC10 Palette (for the Z80 Video Circuit)
|
||
Below palette table is showing 4:4:4 bit RGB values (all digits are inverted,
|
||
0=Brightest, F=Darkest, eg. 0FF=Red, F0F=Green, FF0=Blue).
|
||
Pal <-------- Color 0..7 ---------> Pal <-------- Color 0..7 --------->
|
||
00: FFF,000,000,000,000,000,000,000 10: FAF,0BF,000,027,00B,FAF,FA9,F08
|
||
01: 94D,FFF,000,00B,024,1FF,AFF,FD8 11: FAF,A5D,303,707,00B,FAF,307,FFF
|
||
02: F9F,03F,FAF,000,000,000,FFF,FFF 12: 000,000,000,000,000,000,000,000
|
||
03: FFF,000,FFF,9FF,06F,0FF,047,F40 13: 000,000,000,000,000,000,000,000
|
||
04: 048,9FF,000,000,000,F95,FFA,FFF 14: 000,048,000,000,000,F9F,72F,FFF
|
||
05: F9F,0FF,F0B,00A,000,000,FFF,FFF 15: 000,000,000,000,000,000,000,000
|
||
06: F9F,88F,0FF,000,000,000,FFF,FFF 16: 000,000,000,000,000,000,000,000
|
||
07: F9F,11F,5FF,000,000,000,FFF,FFF 17: 000,FAF,000,000,000,FCF,039,FFF
|
||
08: 000,000,000,000,000,000,000,000 18: F8F,000,00B,000,000,036,FFF,FFF
|
||
09: 000,000,000,000,000,000,000,000 19: FAB,2CF,F07,029,111,FFF,4F1,F93
|
||
0A: 000,000,000,000,000,000,000,000 1A: 000,000,000,000,000,000,000,000
|
||
0B: 000,000,000,000,000,000,000,000 1B: FAF,000,FF5,FF0,F40,5AF,024,0FF
|
||
0C: 000,000,000,000,000,000,000,000 1C: FAF,0FF,046,6D9,008,FF4,F30,300
|
||
0D: 000,000,000,000,000,000,000,000 1D: FAF,0F9,F7F,838,415,7BE,27D,048
|
||
0E: 000,000,000,000,000,000,000,000 1E: FAF,0FF,000,02F,F4F,5DF,888,766
|
||
0F: 000,000,000,000,000,000,000,000 1F: F9F,007,000,00F,0FF,027,FFF,FFF
|
||
The 100h palette entries are containing 42h different colors. The Palette data
|
||
is stored in three N82S129N chips (three 256x4bit PROMs): IC "6D"=Blue, IC
|
||
"6E"=Green, IC "6F"=Red.
|
||
|
||
PC10 Character Sets - Available Characters per Color
|
||
The PC10's character set ROM contains four character sets, all having
|
||
identically looking characters, but with different color numbers, and with
|
||
different amounts of defined characters:
|
||
Charset0: 0123456789.'!-",:+?()/=ABCDEFGHIJKLMNOPQRSTUVWXYZabc..xyz
|
||
Charset1: 0123456789 '!- , () ABCDEFGHIJKLMNOPQRSTUVWXYZabc..xyz
|
||
Charset2: 0123456789.'!-",:+ ABCDEFGHIJKLMNOPQRSTUVWXYZ
|
||
Charset3: ! ABC E HI LMNOP RSTU Y
|
||
Title strings must use Charset2 (and will be changed to Charset0 for the
|
||
currently selected title).
|
||
Instruction text can have the Charset ROM colors combined with different VRAM
|
||
palette attributes. To match up with the window border, the background color
|
||
should be dark green (as so in palette 10h-11h and also in 1Bh-1Eh). Possible
|
||
Charset vs Palette combinations for Instruction Texts are:
|
||
Palette: 10h 11h 1Bh 1Ch 1Dh 1Eh
|
||
Charset0: White Mint D.Blue Orange2 D.Green White
|
||
Charset1: Orange L.Green Blue Magenta P.Green Orange3
|
||
Charset2: Red M.Green White Red Pink Red
|
||
Charset3: Yellow Yellow - - - -
|
||
Accordingly, there are several restrictions on coloring. For example, Red
|
||
cannot be used with lowercase letters.
|
||
|
||
PC10 Z80 Video Circuit Timings - Dual Monitor Version
|
||
The Z80 Video Circuit is producing roughly NTSC-style timings (the output is
|
||
passed straight to the built-in RGB monitor, so there has been no need to match
|
||
exact television standards).
|
||
Resolution 32x28 tiles of 8x8 pix each (=256x224 pixels)
|
||
Dotclk = 5.040MHz (X2 oscillator, 20.160MHz, divided by 4)
|
||
Dots per line = 327 total dots (256 visible dots, plus 71 h-blank dots)
|
||
Lines per frame = 256 total lines (224 visible lines, plus 32 v-blank lines)
|
||
VBlank at Y=F0h..0Fh (when V5=1, V6=1, V7=1, latched at raising V4)
|
||
Vsync at Y=F8h..FBh (when Vblank=1, V4=1, V3=1, V2=0)
|
||
Hsync when HBlank=1, H1=1, H2=0
|
||
Screen Border Color during H/V-Blanking is Color 0 of Palette 0 (Black)
|
||
Frame Rate = 60.20642202Hz = 5.040MHz / 256 Lines / 327 Dots
|
||
Z80 NMI (if enabled) is generated on begin of Z80 Circuit's Vblank (Y=F0h)
|
||
The Z80 Video Circuit's frame rate is NOT synchronized with the NES PPU.
|
||
|
||
PC10 Z80 Video Circuit Timings - Single Monitor Version
|
||
Not much known here. There's no schematic for the Single Monitor version.
|
||
According to a component list, the X2 oscillator for the Z80 video circuit is
|
||
21.47727MHz (same as the X3 oscillator for the NES). Accordingly, one may
|
||
assume that dots/line and lines/frame are also matched to NES timings (else the
|
||
display would shake when switching between Z80 picture and NES picture).
|
||
|
||
LED Character Set (74HC4511 BCD-driver with yellow-green GL-8E040 display)
|
||
The Single-Monitor version is having a 4-Digit LED display for displaying the
|
||
remaining time during Game (and also in Menu). The LED Digits 00h..09h are as
|
||
so:
|
||
_ _ _ _ _ _ _
|
||
| | | _| _| |_| |_ |_ | |_| |_|
|
||
|_|. |. |_. _|. |. _|. |_|. |. |_|. |.
|
||
|
||
Digit 06h/09h may vary from chip to chip: existing Playchoice cabinets are
|
||
drawing them as shown above (without upper/lower horizontal line, as specified
|
||
by Toshiba and Philips) (whilst Texas Instruments specifies them with extra
|
||
lines). The "." dot (eighth LED segment) is always off in the Playchoice.
|
||
|
||
PC10 Title/Instructions (INST ROM)
|
||
----------------------------------
|
||
|
||
Hardcoded INST-ROM Addresses
|
||
C000h 16bit ptr to "Data" for 40h-byte Area (passed on stack to C0FFh)
|
||
C001h 8bit value (initial chksum value)
|
||
C0FEh 16bit ptr to rst 38h handler (not used by BIOS) overlaps below C0FFh!
|
||
C0FFh code: rst 00h handler when I<>00h (get_40h_byte_area_function)
|
||
C3C3h code: Opcode E9h (JP HL)
|
||
C784h 16bit ptr to rst 30h handler (not used by BIOS)
|
||
C9BEh code: wait_1_frame function
|
||
XXX the BIOS NMI handler does occassionally remap a different slot
|
||
while the mainprogram is executing the C9BEh function,
|
||
so, the C9BEh stuff must be identical (or very similar)
|
||
in all INST-ROMs
|
||
C9C9h code: Opcode C9h (RET)
|
||
D000h homebrew title string (used by the gamehacker's homebrew BIOS)
|
||
D0FEh 16bit ptr to rst 28h handler (not used by BIOS) overlaps below D0FFh!
|
||
D0FFh code: rst 10h handler (not used by BIOS, used only by INST ROM)
|
||
D3D3h 16bit ptr to rst 20h handler (not used by BIOS)
|
||
D784h 16bit ptr to rst 18h handler (RET P, LD HL,[80E3], LD [HL],00, RET)
|
||
DFFFh 8bit value (can be used as final chksum adjustment byte)
|
||
|
||
40h-byte Area (aka HDR) (retrieved via C0FFh)
|
||
00h 1 GameID (must be unique number for Bookkeeping) (or 00h=Empty Slot)
|
||
01h 2 16bit ptr to 16bit ptr to Token code (demo_duration_function)
|
||
03h 2 16bit ptr to 16bit ptr to Z80 code (draw_instruction_function)
|
||
05h 1 Decryption Offset (to be subtracted from bytes at [05h..1Ch])
|
||
06h 16h Unknown/Unused (eleven words in range C000h..FFFFh or so?)
|
||
1Ch 1 Opcode E9h (JP HL)
|
||
1Dh 3 Zerofilled (overwritten by leading Slot number for Title string)
|
||
20h 18h Title (18h bytes) (space, title, space, dotted-line, player symbols)
|
||
38h 8 Zerofilled (overwritten by variables)
|
||
|
||
Title (18h bytes) (space, title, space, dotted-line, player symbols)
|
||
Must consist of following characters:
|
||
00h..2Bh 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",:
|
||
3Ch +
|
||
3Eh Dotted line
|
||
3Fh Space
|
||
3Dh,F9h Lightgun Symbol
|
||
FBh..FEh Two Player Symbol ("@/@@")
|
||
Last 5 bytes of title should be:
|
||
3E,3F,3F,3F,3F Normal single-player game (eg. 1942, Castlevania, Metroid)
|
||
3E,FB,FC,FD,FE Two-player game (eg. Balloon, Contra)
|
||
3D,F9,3F,3F,3F Lightgun game (eg. Hogan)
|
||
|
||
Instructions (aka "How-to-Play" screens)
|
||
Instructions are displayed in a 30x22 character window (originated at 90C2h in
|
||
VRAM), existing games are containing 1-3 pages of text.
|
||
The text is displayed by repeatedly calling functions in INST ROM during Vblank
|
||
(that functions should display only one text line at a time; to avoid
|
||
flickering that would occur when exceeding vblank time).
|
||
The initial function call goes to [HDR[03h]], aside from drawing text, that
|
||
function may manipulate the call address at [DE-1] (so further calls would go
|
||
to different addresses), and some sort of general purpose index at [DE-2]
|
||
(bit0-6 are initially 01h, and must be kept nonzero, and can be otherwise used
|
||
for general purpose such like drawing yloc, commercial games use it as
|
||
decryption offset) (bit7 should be set at the end of a page, causing the BIOS
|
||
to wait for Enter button).
|
||
|
||
Token Interpreter (for defining the Demo Duration)
|
||
The demo duration is, for some strange reason, defined by tokens. The token
|
||
program pointer consists of a 16bit base plus 8bit index. The token entrypoint
|
||
is Base=[HDR[01h]] with Index=00h. The token interpreter is very simple: It can
|
||
wait... and wait... and wait, and not much more.
|
||
Token Param(s) Function
|
||
00h..0Fh - sleep_1_frame
|
||
10h..1Fh - mark_finished (to be followed by token F0h)
|
||
20h..2Fh Index,BaseLsb,BaseMsb jump
|
||
30h..3Fh Index,BaseLsb,BaseMsb jump_if_user_is_not_interested
|
||
40h..4Fh Index,BaseLsb,BaseMsb jump_if_user_is_interested
|
||
50h..7Fh NNh (max 0Fh else bugs) sleep_n_seconds (aka 64-frame units)
|
||
80h..8Fh NNh sleep_n_frames
|
||
80h..8Fh 02h jump_if_single_monitor
|
||
90h..FFh - terminate (to be preceeded by token 10h)
|
||
The "jump_if_single_monitor" acts as normal on Dual-Monitor BIOS (sleeps 2
|
||
frames), but has a special jump function on Single-Monitor BIOS (jumps to
|
||
Base=Base-0008h, Index=00h).
|
||
User is "interested" means that the user has manually entered the instructions
|
||
mode; that "interest" should be usually handled by executing additional sleep
|
||
tokens to increase the demo duration.
|
||
|
||
Checksum
|
||
The INST-ROM checksum must be C9h. The checksum is calculated by adding/xoring
|
||
8192 bytes from INST-ROM with 8192 PROM reads (for details, see the BIOS code
|
||
near the "compare A,C9h" opcode).
|
||
|
||
Tools
|
||
The a22i assembler (in no$nes debugger's utility menu) contains some .pc10
|
||
directives for creating INST ROMs. See the magicnes.zip package on no$nes
|
||
webpage for sample source code. The INST ROMs will work without decryption PROM
|
||
(they will only require a minimalistic circuit that drags the two decryption
|
||
signals to HIGH upon /CHANNEL_SELECT).
|
||
|
||
PC10 NES-Side
|
||
-------------
|
||
|
||
The PC10 cartridges are usually containing PRG-ROM and CHR-ROM on EPROMs
|
||
(though, despite of the EPROM-storage, they are usually byte-identical to
|
||
normal NES ROM-cartridge versions). Nonetheless, there are a few things to
|
||
recurse when making PC10 games (and eventually customize NES games
|
||
accordingly):
|
||
|
||
NES PPU Palette
|
||
The PC10 uses a RGB palette, the colors are similar to NES Composite colors,
|
||
but not 100% same: PC10 colors are more colorful than the pastelized NES
|
||
colors. Pastel-cyan and two grayshades are completely missing. And, some colors
|
||
are having wrong intensities, so fade-in/fade-out effects programmed for the
|
||
NES can produce ugly flickering on the PC10. The color emphasis bits are also
|
||
working differently as on NES. The PC10 palette is same as the "standard" VS
|
||
System palette, for details see:
|
||
--> VS System PPUs and Palettes
|
||
|
||
NES NMI Disable
|
||
The PC10 BIOS is watching the NES NMI signal. If the NES disables NMIs for a
|
||
longer period (around 255 frames), then it'll treat the game to have locked up,
|
||
and will terminate the game. If that happens more than twice, then it will
|
||
additionally remove the game from the menu's cartridge list.
|
||
|
||
NES Controller Disable
|
||
The PC10 can disable the NES controllers in demo mode. For some reason, it
|
||
doesn't disable the serial shift-register outputs, but rather only the
|
||
Select/Start parallel inputs (and lightgun trigger). Accordingly, to prevent
|
||
the game being played in demo mode, starting the game should work ONLY via
|
||
Start button (ie. not via Button A/B).
|
||
|
||
NES Controller Connection
|
||
The PC10 has two "joypads" and one "zapper", unlike as on NES, it isn't
|
||
possible to disconnect them, so the game must work with that hardware connected
|
||
(which should be usually no problem).
|
||
Whereas, the lightgun seems to be an optional add-on, not installed in all
|
||
cabinets (especially not in tabletop cabinets).
|
||
The Start/Select buttons are mapped to the Joypad 1 input. The Joypad 2 input
|
||
doesn't have any such buttons (similar as japanese Famicom joypads).
|
||
|
||
NES Pause / Timings
|
||
It seems to be possible to "pause" the NES CPU. Unknown if this is actually
|
||
done during game-execution... if so, pausing/unpausing may get the CPU offsync
|
||
with the PPU, which might confuse & crash a few NES games. Initial CPU Reset
|
||
time vs PPU Reset time may be also different as on normal NES.
|
||
And, reportedly, the PC10 RGB-PPU timing isn't exactly same as NES NTSC-PPU
|
||
timing (reportedly something to do with missing dots on some NTSC scanlines or
|
||
so).
|
||
|
||
NES IRQs
|
||
On older PC10 mainboards, the /IRQ pin is wired as output (rather than as
|
||
input), making it incompatible with games that do use IRQs. The mainboards can
|
||
be upgraded (with two wires) to support IRQs. The upgrade may be found on many
|
||
mainboards as it's required for PCH1-01-ROM-G game cards.
|
||
|
||
Communicating between NES and Z80 CPUs
|
||
There is no intended CPU-to-CPU communication support. However, with some
|
||
trickery, it should be possible. On the Z80 side, one could place custom code
|
||
in the C9BEh function (which is called once every mainloop cycle). For
|
||
NES-to-Z80 transfers one could enable/disable NES NMIs to transfer 1bit per
|
||
frame. For Z80-to-NES transfers one could eventually issue specially timed CPU
|
||
or PPU Reset pulses.
|
||
|
||
PC10 Games and Cartridge PCBs
|
||
-----------------------------
|
||
|
||
PC10 Cartridge PCB Versions
|
||
PCH1-01-ROM Mapper 0 (NROM)
|
||
PCH1-01-ROM-A Mapper 3 (CNROM - VROM/8K)
|
||
PCH1-01-ROM-B Mapper 2 (UNROM - PRG/16K)
|
||
PCH1-01-ROM-C Mapper 87 (Jaleco/Konami 16K VROM - VROM/8K)
|
||
PCH1-01-ROM-D Mapper 1 (MMC1 with VRAM)
|
||
PCH1-01-ROM-E Mapper 9 (MMC2) (...plus battery ??)
|
||
PCH1-01-ROM-F Mapper 1 (MMC1 with VROM)
|
||
PCH1-01-ROM-G Mapper 4 (MMC3 xxx)
|
||
PCH1-01-ROM-H Mapper 119 (MMC3 TQROM)
|
||
PCH1-01-ROM-I Mapper 7 (AOROM - PRG/32K, Name Table Select)
|
||
PCH1-01-ROM-J N/A ?
|
||
PCH1-01-ROM-K Mapper 1 (MMC1 with VRAM... plus battery ??)
|
||
|
||
Known/released PC10 Games
|
||
PCH1-02-ROM 1942 (1986/1985) Capcom
|
||
PCH1-01-ROM Balloon Fight (1985/1986) Nintendo
|
||
PCH1-01-ROM Baseball (1985/1984) Nintendo
|
||
PCH1-02-ROM-F Baseball Stars (1989/1986) SNK
|
||
PCH1-01-ROM-I Captain Skyhawk (1990/1989) Milton Bradley
|
||
PCH1-02-ROM-B Castlevania (1987) Konami
|
||
PCH1-02-ROM-F Chip 'n Dale Rescue Rangers (1990) Capcom
|
||
PCH1-02-ROM-B Contra (1988) Konami
|
||
PCH1-01-ROM-F Double Dragon (1988) Technos
|
||
PCH1-02-ROM-B Double Dribble (1987) Konami
|
||
PCH1-02-ROM-F Dr. Mario (1990) Nintendo
|
||
PCH1-01-ROM Duck Hunt (1985) Nintendo
|
||
PCH1-01-ROM Excitebike (1985) Nintendo
|
||
PCH1-01-ROM-F Fester's Quest (1989) Sunsoft
|
||
PCH1-01-ROM-G Gauntlet (1985) Atari/Tengen
|
||
PCH1-01-ROM Golf (1985) Nintendo
|
||
PCH1-01-ROM-C Goonies, The (1986) Konami
|
||
PCH1-01-ROM-A Gradius (1986) Konami (said to exist in two PRG-ROM versions)
|
||
PCH1-01-ROM Hogan's Alley (1985) Nintendo
|
||
PCH1-02-ROM Kung Fu (1985) Irem
|
||
CUSTOM Magic Floor (2012) nocash (homebrew)
|
||
PCH1-01-ROM Mario Bros. (1984/1986) Nintendo
|
||
PCH1-01-ROM-K Mario's Open Golf (1991) Nintendo
|
||
PCH1-04-ROM-G Mega Man 3 (1990) Capcom
|
||
PCH1-01-ROM-D Metroid (1986) Nintendo
|
||
PCH1-01-ROM-E Mike Tyson's Punch-Out!! (1987) Nintendo
|
||
PCH1-01-ROM-F Ninja Gaiden (1989) Tecmo
|
||
PCH1-03-ROM-G Ninja Gaiden II: The Dark Sword of Chaos (1990) Tecmo
|
||
PCH1-03-ROM-G Ninja Gaiden III: The Ancient Ship of Doom (1991) Tecmo
|
||
PCH1-02-ROM-G Nintendo World Cup (Soccer) (1990) Technos
|
||
PCH1-01-ROM-H Pinbot (1990/1988) Rare
|
||
PCH1-02-ROM-G Power Blade (1991) Taito
|
||
PCH1-02-ROM-B Pro Wrestling (1987/1986) Nintendo
|
||
PCH1-02-ROM-D Rad Racer (1987) Square
|
||
PCH1-02-ROM-G Rad Racer II (1990) Square
|
||
PCH1-01-ROM-F R.C. Pro-Am (1988/1987) Rare
|
||
PCH1-02-ROM-G Rockin' Kats (1991) Atlus
|
||
PCH1-01-ROM-B Rush'n Attack (1987) Konami
|
||
PCH1-01-ROM-B Rygar (1987) Tecmo
|
||
PCH1-01-ROM-I Solar Jetman: Hunt for the Golden War(p)ship (1990) Rare
|
||
PCH1-02-ROM-G Super C (1990) Konami
|
||
PCH1-02-ROM Super Mario Bros. (1985) Nintendo
|
||
PCH1-01-ROM-G Super Mario Bros. 2 (1988) Nintendo
|
||
PCH1-01-ROM-G Super Mario Bros. 3 (1990) Nintendo
|
||
PCH1-01-ROM-F Tecmo Bowl (1989) Tecmo Inc.
|
||
PCH1-01-ROM-F Teenage Mutant Ninja Turtles (1989) Konami
|
||
PCH1-03-ROM-G Teenage Mutant Ninja Turtles II: The Arcade Game (1990) Konami
|
||
PCH1-01-ROM Tennis (1985) Nintendo
|
||
PCH1-01-ROM-A Track & Field (1987) Konami
|
||
PCH1-01-ROM-B Trojan (1987/1986) Capcom
|
||
PCH1-01-ROM Volleyball (1987/1986) Nintendo
|
||
PCH1-01-ROM Wild Gunman (1985) Nintendo
|
||
PCH1-02-ROM-F Yo! Noid (1990) Capcom
|
||
As seen above, release dates are somewhat unclear; dates before 1986 are
|
||
apparently referring to the original NES version, not the PC10 release date.
|
||
|
||
Mystical PC10 Games
|
||
(unseen) Goonies II, The (19xx) Konami
|
||
(unseen) RBI Baseball (1987) Atari/Tengen
|
||
(unseen) Shatterhand (1991) Jaleco
|
||
These titles have been somewhere announced, and might have been actually
|
||
released, but so far no collectors ever seem to have ever found these
|
||
cartridges.
|
||
|
||
PC10 Cabinet and BIOS Versions
|
||
------------------------------
|
||
|
||
Dual-Monitor Upright Cabinets
|
||
The upper monitor (for Z80 menu, instructions, and remaining time/credit
|
||
display) is usually smaller than the lower one (NES game picture). There seems
|
||
to be also a variant with two big monitors. Front panel is having 5 control
|
||
buttons.
|
||
|
||
Single-Monitor Cabinets
|
||
The BIOS can switch the monitor to display either the Z80 or NES picture. The
|
||
remaining credit/time is displayed via 4-digit 7-segment LED displays. Front
|
||
panel can have 4 or 5 control buttons. Switching the BIOS to the correct front
|
||
panel type seems to rely on inversion of the reset button signal, and seems to
|
||
work properly only on certain dip-switch settings.
|
||
|
||
Single-Monitor Upright Cabinets
|
||
These are usually upgraded VS System cabinets with a PC10 mainboard (either
|
||
original VS System cabinets, or even older cabinets that have been formerly
|
||
upgraded to become a VS System). The cabinets are having VS System style front
|
||
panels with only four buttons (named 1-4) instead of the normal five PC10
|
||
buttons (Channel Select, Enter, Reset, Start, Game Select).
|
||
|
||
Single-Monitor Countertop/Sitdown Cabinets
|
||
The Playchoice "countertop" version (a white box to be placed on a bar counter
|
||
or table) is a native PC10 cabinet (with 5 control buttons). The "red tent"
|
||
version (a red tent-shaped console with two legs) is an upgraded VS Dual System
|
||
sitdown version (with 4 control buttons).
|
||
|
||
Official BIOSes (IC "8T")
|
||
PCH1-C.8T Dual-Monitor Version (CRC32=D52FA07Ah) (16Kbytes)
|
||
PCK1-C.8T Single-Monitor Version (CRC32=503EE8B1h) (16Kbytes)
|
||
There aren't any further known versions/revisions.
|
||
0BE8CEB4
|
||
|
||
|
||
Homebrew BIOSes
|
||
Oliver Achten's BIOS v0.1 (2002) (CRC32=FB96DE76h) (8Kbytes)
|
||
gamehacker's BIOS v1.0 (CRC32=18B4E0B5h) (16Kbytes)
|
||
gamehacker's BIOS v1.1 (CRC32=80BD20EFh) (16Kbytes)
|
||
The homebrew BIOSes are allowing to play NES games without PROMs. They are
|
||
suffering some restrictions:
|
||
Oliver's BIOS doesn't have any support for Titles/Instructions (neither for
|
||
original nor homebrew games). The BIOS can be DIP-Switched to Single/Dual
|
||
Monitor mode. Unknown if coin inputs are supported.
|
||
Gamehacker's BIOSes are supporting Titles (from original games and homebrew
|
||
games; for the latter, the title can be stored in custom INST ROM format, or in
|
||
SRAM; which probably only lasts for some days/weeks?). Instructions aren't
|
||
supported (neither for original nor homebrew games). Unknown if this BIOS
|
||
supports both Single and Dual Monitor versions. The BIOS doesn't support coin
|
||
inputs (freeplay mode only)
|
||
|
||
PC10 Pin-Outs
|
||
-------------
|
||
|
||
PC10 Cartridge Slot (3x32 pins per slot; 10 slots)
|
||
A1 - B1 PROM.RESET C1 Z80./INST.ROM.SEL
|
||
A2 - B2 PROM.CLOCK C2 Z80.DD7
|
||
A3 - B3 PROM.TEST C3 Z80.DD6
|
||
A4 - B4 Z80.AD7 C4 Z80.DD5
|
||
A5 - B5 Z80.AD6 C5 Z80.DD4
|
||
A6 - B6 Z80.AD5 C6 Z80.DD3
|
||
A7 Z80.AD11 B7 Z80.AD4 C7 Z80.DD2
|
||
A8 Z80.AD10 B8 Z80.AD3 C8 Z80.DD1
|
||
A9 Z80.AD9 B9 Z80.AD2 C9 Z80.DD0
|
||
A10 Z80.AD8 B10 Z80.AD1 C10 Z80.AD12
|
||
A11 PROM.ADDR5 B11 Z80.AD0 C11 Z80./MREQ.RD
|
||
A12 PROM.DATA B12 PPU./PA13 C12 PPU./VRAMCS
|
||
A13 PPU.PA8 B13 PPU.PD7 C13 PPU.VRAMA10
|
||
A14 PPU.PA9 B14 PPU.PD6 C14 PPU.PA7
|
||
A15 PPU.PA10 B15 PPU.PD5 C15 PPU.PA6
|
||
A16 PPU.PA11 B16 PPU.PD4 C16 PPU.PA5
|
||
A17 PPU.PA12 B17 PPU.PD3 C17 PPU.PA4
|
||
A18 PPU.PA13 B18 PPU.PD2 C18 PPU.PA3
|
||
A19 PPU./WE B19 PPU.PD1 C19 PPU.PA2
|
||
A20 PPU./RD B20 PPU.PD0 C20 PPU.PA1
|
||
A21 NES.PHI2 B21 NES./ROM.SEL C21 PPU.PA0
|
||
A22 NES.A8 B22 NES.R/W C22 NES./IRQ (see note)
|
||
A23 NES.A9 B23 NES.D7 C23 NES.A0
|
||
A24 NES.A10 B24 NES.D6 C24 NES.A1
|
||
A25 NES.A11 B25 NES.D5 C25 NES.A2
|
||
A26 NES.A12 B26 NES.D4 C26 NES.A3
|
||
A27 NES.A13 B27 NES.D3 C27 NES.A4
|
||
A28 NES.A14 B28 NES.D2 C28 NES.A5
|
||
A29 /CH1..10 B29 NES.D1 C29 NES.A6
|
||
A30 SOUND B30 NES.D0 C30 NES.A7
|
||
A31 VCC B31 VCC C31 VCC
|
||
A32 GND B32 GND C32 GND
|
||
Note: The NES./IRQ appears to be somehow bugged on older mainboards
|
||
(PCH1-01-CPU and PCH1-02-CPU), Nintendo seems to have released a document that
|
||
describes how to upgrade that mainboards (for PCH1-01-ROM-G game card
|
||
compatibilty). The document says to disconnect pin 11 and 12 of IC "4L", and to
|
||
rewire that pins to whatever locations on the mainboard (not quite clear what
|
||
signals they shall be wired to exactly) (the bug as such seems to be that IC
|
||
"4L" is passing /IRQ as output, rather than as input) (so, maybe, the bugfix
|
||
just means to say to swap the two pins?).
|
||
|
||
Wiring of 74LS367 on PC10 pro wrestling cart
|
||
.----._.----.
|
||
/chsel 1| /G1 Vcc |16 VCC
|
||
(Conn) Chr A13 2| 1A1 /G2 |15 /chsel
|
||
+5 pullup 3| 1Y1 2A1 |14 CHR /A13 (PC10 Connector)
|
||
(Conn) PRG /CE 4| 1A2 2Y1 |13 CIRAM /CE (PC10 Connector)
|
||
+5 pullup 5| 1Y2 2A2 |12 /CSel INST ROM (PC10 Conn)
|
||
(Brd) CIRAM A10 6| 1A3 2Y2 |11 Pin 20 U4
|
||
(Conn)CIRAM A10 7| 1Y3 2A3 |10 N/C
|
||
GND 8| GND 2Y3 | 9 N/C
|
||
'-----------'
|
||
|
||
PC10 "P1" Connector (called "P2" in schematic)
|
||
1 /MRED (Main Screen / NES Picture)
|
||
2 /MGRN
|
||
3 /MBLUE
|
||
4 MVGND
|
||
5 /SRED (Sub Screen / Z80 Picture)
|
||
6 /SGRN
|
||
7 /SBLU
|
||
8 SVGND
|
||
9 /SSYNC
|
||
10 /MSYNC
|
||
11 GND
|
||
12 GND
|
||
13 GND
|
||
14 GND
|
||
15 +5V
|
||
16 +5V
|
||
17 +5V
|
||
18 +5V
|
||
19 ?
|
||
20 ? as 19
|
||
21 ?
|
||
22 ? as 21
|
||
23 +24V
|
||
24 Service
|
||
25 ? ;schematic: Counter 2
|
||
26 Counter1
|
||
27 ?
|
||
28 ?
|
||
29 ?
|
||
30 ?
|
||
31 ? via jumper to 26 ;schematic: Coin 2
|
||
32 Coin1
|
||
33 2.B Button
|
||
34 2.A Button
|
||
35 ? to GND
|
||
36 2.Right
|
||
37 ? to GND
|
||
38 2.Left
|
||
39 ? to GND
|
||
40 2.Up
|
||
41 ? to GND
|
||
42 2.Down
|
||
43 ? to GND
|
||
44 GameSelect
|
||
45 ? to GND
|
||
46 ?
|
||
47 ? NC
|
||
48 Reset
|
||
49 ? NC
|
||
50 Start
|
||
51 SSound (shortcut with MSound)
|
||
52 MSound (shortcut with SSound)
|
||
53 ?
|
||
54 GND (Sound)
|
||
55 GND
|
||
56 GND
|
||
|
||
PC10 "P2-to-P1" Connector (called "P1" in schematic)
|
||
1 1.Right
|
||
2 1.Left
|
||
3 1.Down
|
||
4 1.Up
|
||
5 GND
|
||
6 ? to 4016h.Bit3
|
||
7 1.B Button
|
||
8 1.A Button
|
||
9 GND
|
||
10 ? to 4016h.Bit4 (INP0.D4)
|
||
11 CH.Select
|
||
12 Enter
|
||
13 GND
|
||
14 GND
|
||
15 ?
|
||
16 GND
|
||
17 GunTrigger
|
||
18 GunHit
|
||
19 +5V
|
||
20 +5V
|
||
|
||
PC10 Single-Monitor version Connectors?
|
||
P2 (36 pin)
|
||
Parts Side | Solder Side
|
||
GND | A/19 | 1 | GND
|
||
LED00-DD3 | B/20 | 2 | 2P Right
|
||
LED01-DD2 | C/21 | 3 | 2P Left
|
||
LED02-DD1 | D/22 | 4 | 2P Up
|
||
LED03-DD0 | E/23 | 5 | 2P Down
|
||
+5V | F/24 | 6 | 2P ButtonA
|
||
+5V | H/25 | 7 | 2P ButtonB
|
||
LED04-AD4 | J/26 | 8 | Button1/Channel Select
|
||
LED05-AD1 | K/27 | 9 | Button3/Game Select
|
||
LED06-AD0 | L/28 | 10| Button2/Channel Enter
|
||
LED07-/IOWR | M/29 | 11| Button4/Game Start
|
||
| N/30 | 12| 1P Right
|
||
| P/31 | 13| 1P Left
|
||
+5V | R/32 | 14| 1P Up
|
||
| S/33 | 15| 1P Down
|
||
| T/34 | 16| 1P ButtonA
|
||
ResetButton(if any?) | U/35 | 17| 1P ButtonB
|
||
GND | V/36 | 18| GND
|
||
|
||
P1 (44pin)
|
||
Parts Side | Solder Side
|
||
----------------------------+-------------------------------
|
||
GND | A/23 | 1 | GND
|
||
GND | B/24 | 2 | GND
|
||
+5V | C/25 | 3 | +5V
|
||
+5V | D/26 | 4 | +5V
|
||
+12V | E/27 | 5 | +12V
|
||
| F/28 | 6 |
|
||
| H/29 | 7 | Coin Switch #1
|
||
| J/30 | 8 | Coin Switch #2 (if any?)
|
||
| K/31 | 9 | Video Red (inv)
|
||
| L/32 | 10| Video Green (inv)
|
||
GND | M/33 | 11| GND
|
||
| N/34 | 12| Video Blue (inv)
|
||
| P/35 | 13| Video Sync
|
||
| R/36 | 14|
|
||
| S/37 | 15|
|
||
-5V (or +12V?) | T/38 | 16| -5V (or +12V?)
|
||
(?) | U/39 | 17| (?) (or COUNTER?)
|
||
| V/40 | 18|
|
||
| W/41 | 19| (?) (or SERVICE Button?)
|
||
| X/42 | 20| Audio (no amp)
|
||
GND | Y/43 | 21| GND
|
||
GND | Z/44 | 22| GND
|
||
------------------------------------------------------
|
||
Note: Connect Video Ground and Audio Ground to GND
|
||
Video color signals need to be inverted for regular Jamma
|
||
Audio signal needs to be amplified for regular Jamma
|
||
|
||
Z80 CPU Specifications
|
||
----------------------
|
||
|
||
--> Z80 Register Set
|
||
--> Z80 Flags
|
||
--> Z80 Instruction Format
|
||
--> Z80 Load Commands
|
||
--> Z80 Arithmetic/Logical Commands
|
||
--> Z80 Rotate/Shift and Singlebit Operations
|
||
--> Z80 Jumpcommands & Interrupts
|
||
--> Z80 I/O Commands
|
||
--> Z80 Interrupts
|
||
--> Z80 Meaningless and Duplicated Opcodes
|
||
--> Z80 Garbage in Flag Register
|
||
--> Z80 Compatibility
|
||
--> Z80 Pin-Outs
|
||
--> Z80 Local Usage
|
||
|
||
Z80 Register Set
|
||
----------------
|
||
|
||
Register Summary
|
||
16bit Hi Lo Name/Function
|
||
---------------------------------------
|
||
AF A - Accumulator & Flags
|
||
BC B C BC
|
||
DE D E DE
|
||
HL H L HL
|
||
AF' - - Second AF
|
||
BC' - - Second BC
|
||
DE' - - Second DE
|
||
HL' - - Second HL
|
||
IX IXH IXL Index register 1
|
||
IY IYH IYL Index register 2
|
||
SP - - Stack Pointer
|
||
PC - - Program Counter/Pointer
|
||
- I R Interrupt & Refresh
|
||
|
||
Normal 8bit and 16bit Registers
|
||
The Accumulator (A) is the allround register for 8bit operations. Registers B,
|
||
C, D, E, H, L are normal 8bit registers, which can be also accessed as 16bit
|
||
register pairs BC, DE, HL.
|
||
The HL register pair is used as allround register for 16bit operations. B and
|
||
BC are sometimes used as counters. DE is used as DEstination pointer in block
|
||
transfer commands.
|
||
|
||
Second Register Set
|
||
The Z80 includes a second register set (AF',BC',DE',HL') these registers cannot
|
||
be accessed directly, but can be exchanged with the normal registers by using
|
||
the EX AF,AF and EXX instructions.
|
||
|
||
Refresh Register
|
||
The lower 7 bits of the Refresh Register (R) are incremented with every
|
||
instruction. Instructions with at least one prefix-byte (CB,DD,ED,FD, or
|
||
DDCB,FDCB) will increment the register twice. Bit 7 can be used by programmer
|
||
to store data. Permanent writing to this register will suppress memory refresh
|
||
signals, causing Dynamic RAM to lose data.
|
||
|
||
Interrupt Register
|
||
The Interrupt Register (I) is used in interrupt mode 2 only (see command "im
|
||
2"). In other modes it can be used as simple 8bit data register.
|
||
|
||
IX and IY Registers
|
||
IX and IY are able to manage almost all the things that HL is able to do. When
|
||
used as memory pointers they are additionally including a signed index byte
|
||
(IX+d). The disadvantage is that the opcodes occupy more memory bytes, and that
|
||
they are less fast than HL-instructions.
|
||
|
||
Undocumented 8bit Registers
|
||
IXH, IXL, IYH, IYL are undocumented 8bit registers which can be used to access
|
||
high and low bytes of the IX and IY registers (much like H and L for HL). Even
|
||
though these registers do not officially exist, they seem to be available in
|
||
all Z80 CPUs, and are quite commonly used by various software.
|
||
|
||
Z80 Flags
|
||
---------
|
||
|
||
Flag Summary
|
||
The Flags are located in the lower eight bits of the AF register pair.
|
||
Bit Name Set Clr Expl.
|
||
0 C C NC Carry Flag
|
||
1 N - - Add/Sub-Flag (BCD)
|
||
2 P/V PE PO Parity/Overflow-Flag
|
||
3 - - - Undocumented
|
||
4 H - - Half-Carry Flag (BCD)
|
||
5 - - - Undocumented
|
||
6 Z Z NZ Zero-Flag
|
||
7 S M P Sign-Flag
|
||
|
||
Carry Flag (C)
|
||
This flag signalizes if the result of an arithmetic operation exceeded the
|
||
maximum range of 8 or 16 bits, ie. the flag is set if the result was less than
|
||
Zero, or greater than 255 (8bit) or 65535 (16bit). After rotate/shift
|
||
operations the bit that has been 'shifted out' is stored in the carry flag.
|
||
|
||
Zero Flag (Z)
|
||
Signalizes if the result of an operation has been zero (Z) or not zero (NZ).
|
||
Note that the flag is set (1) if the result was zero (0).
|
||
|
||
Sign Flag (S)
|
||
Signalizes if the result of an operation is negative (M) or positive (P), the
|
||
sign flag is just a copy of the most significant bit of the result.
|
||
|
||
Parity/Overflow Flag (P/V)
|
||
This flag is used as Parity Flag, or as Overflow Flag, or for other purposes,
|
||
depending on the instruction.
|
||
Parity: Bit7 XOR Bit6 XOR Bit5 ... XOR Bit0 XOR 1.
|
||
8bit Overflow: Indicates if the result was greater/less than +127/-128.
|
||
HL Overflow: Indicates if the result was greater/less than +32767/-32768.
|
||
After LD A,I or LD A,R: Contains current state of IFF2.
|
||
After LDI,LDD,CPI,CPD,CPIR,CPDR: Set if BC<>0 at end of operation.
|
||
|
||
BCD Flags (H,N)
|
||
These bits are solely supposed to be used by the DAA instruction. The N flag
|
||
signalizes if the previous operation has be an addition or substraction. The H
|
||
flag indicates if the lower 4 bits exceeded the range from 0-0Fh. (For 16bit
|
||
instructions: H indicates if the lower 12 bits exceeded the range from
|
||
0-0FFFh.)
|
||
After adding/subtracting two 8bit BCD values (0-99h) the DAA instruction can be
|
||
used to convert the hexadecimal result in the A register (0-FFh) back to BCD
|
||
format (0-99h). Note that DAA also requires the carry flag to be set correctly,
|
||
and thus should not be used after INC A or DEC A.
|
||
|
||
Undocumented Flags (Bit 3,5)
|
||
The content of these undocumented bits is filled by garbage by all instructions
|
||
that affect one or more of the normal flags (for more info read the chapter
|
||
Garbage in Flag Register), the only way to read out these flags would be to
|
||
copy the flags register onto the stack by using the PUSH AF instruction.
|
||
However, the existence of these bits makes the AF register a full 16bit
|
||
register, so that for example the code sequence PUSH DE, POP AF, PUSH AF, POP
|
||
HL would set HL=DE with all 16bits intact.
|
||
|
||
Z80 Instruction Format
|
||
----------------------
|
||
|
||
Commands and Parameters
|
||
Each instruction consists of a command, and optionally one or two parameters.
|
||
Usually the leftmost parameter is modified by the operation when two parameters
|
||
are specified.
|
||
|
||
Parameter Placeholders
|
||
The following placeholders are used in the following chapters:
|
||
r 8bit register A,B,C,D,E,H,L
|
||
rr 16bit register BC, DE, HL/IX/IY, AF/SP (as described)
|
||
i 8bit register A,B,C,D,E,IXH/IYH,IXL/IYL
|
||
ii 16bit register IX,IY
|
||
n 8bit immediate 00-FFh (unless described else)
|
||
nn 16bit immediate 0000-FFFFh
|
||
d 8bit signed offset -128..+127
|
||
f flag condition nz,z,nc,c AND/OR po,pe,p,m (as described)
|
||
(..) 16bit pointer to byte/word in memory
|
||
|
||
Opcode Bytes
|
||
Each command (including parameters) consists of 1-4 bytes. The respective bytes
|
||
are described in the following chapters. In some cases the register number or
|
||
other parameters are encoded into some bits of the opcode, in that case the
|
||
opcode is specified as "xx". Opcode prefix bytes "DD" (IX) and "FD" (IY) are
|
||
abbreviated as "pD".
|
||
|
||
Clock Cycles
|
||
The clock cycle values in the following chapters specify the execution time of
|
||
the instruction. For example, an 8-cycle instruction would take 2 microseconds
|
||
on a CPU which is operated at 4MHz (8/4 ms). For conditional instructions two
|
||
values are specified, for example, 17;10 means 17 cycles if condition true, and
|
||
10 cycles if false.
|
||
Note that in case that WAIT signals are sent to the CPU by the hardware then
|
||
the execution may take longer.
|
||
|
||
Affected Flags
|
||
The instruction tables below are including a six character wide field for the
|
||
six flags: Sign, Zero, Halfcarry, Parity/Overflow, N-Flag, and Carry (in that
|
||
order). The meaning of the separate characters is:
|
||
s Indicates Signed result
|
||
z Indicates Zero
|
||
h Indicates Halfcarry
|
||
o Indicates Overflow
|
||
p Indicates Parity
|
||
c Indicates Carry
|
||
- Flag is not affected
|
||
0 Flag is cleared
|
||
1 Flag is set
|
||
x Flag is destroyed (unspecified)
|
||
i State of IFF2
|
||
e Indicates BC<>0 for LDX(R) and CPX(R), or B=0 for INX(R) and OUTX(R)
|
||
|
||
Z80 Load Commands
|
||
-----------------
|
||
|
||
8bit Load Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
ld r,r xx 4 ------ r=r
|
||
ld i,i pD xx 8 ------ i=i
|
||
ld r,n xx nn 7 ------ r=n
|
||
ld i,n pD xx nn 11 ------ i=n
|
||
ld r,(HL) xx 7 ------ r=(HL)
|
||
ld r,(ii+d) pD xx dd 19 ------ r=(ii+d)
|
||
ld (HL),r 7x 7 ------ (HL)=r
|
||
ld (ii+d),r pD 7x dd 19 ------
|
||
ld (HL),n 36 nn 10 ------
|
||
ld (ii+d),n pD 36 dd nn 19 ------
|
||
ld A,(BC) 0A 7 ------
|
||
ld A,(DE) 1A 7 ------
|
||
ld A,(nn) 3A nn nn 13 ------
|
||
ld (BC),A 02 7 ------
|
||
ld (DE),A 12 7 ------
|
||
ld (nn),A 32 nn nn 13 ------
|
||
ld A,I ED 57 9 sz0i0- A=I ;Interrupt Register
|
||
ld A,R ED 5F 9 sz0i0- A=R ;Refresh Register
|
||
ld I,A ED 47 9 ------
|
||
ld R,A ED 4F 9 ------
|
||
|
||
16bit Load Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
ld rr,nn x1 nn nn 10 ------ rr=nn ;rr may be BC,DE,HL or SP
|
||
ld ii,nn pD 21 nn nn 13 ------ ii=nn
|
||
ld HL,(nn) 2A nn nn 16 ------ HL=(nn)
|
||
ld ii,(nn) pD 2A nn nn 20 ------ ii=(nn)
|
||
ld rr,(nn) ED xB nn nn 20 ------ rr=(nn) ;rr may be BC,DE,HL or SP
|
||
ld (nn),HL 22 nn nn 16 ------ (nn)=HL
|
||
ld (nn),ii pD 22 nn nn 20 ------ (nn)=ii
|
||
ld (nn),rr ED x3 nn nn 20 ------ (nn)=rr ;rr may be BC,DE,HL or SP
|
||
ld SP,HL F9 6 ------ SP=HL
|
||
ld SP,ii pD F9 10 ------ SP=ii
|
||
push rr x5 11 ------ SP=SP-2, (SP)=rr ;rr may be BC,DE,HL,AF
|
||
push ii pD E5 15 ------ SP=SP-2, (SP)=ii
|
||
pop rr x1 10 (-AF-) rr=(SP), SP=SP+2 ;rr may be BC,DE,HL,AF
|
||
pop ii pD E1 14 ------ ii=(SP), SP=SP+2
|
||
ex DE,HL EB 4 ------ exchange DE <--> HL
|
||
ex AF,AF 08 4 xxxxxx exchange AF <--> AF'
|
||
exx D9 4 ------ exchange BC,DE,HL <--> BC',DE',HL'
|
||
ex (SP),HL E3 19 ------ exchange (SP) <--> HL
|
||
ex (SP),ii pD E3 23 ------ exchange (SP) <--> ii
|
||
|
||
Blocktransfer
|
||
Instruction Opcode Cycles Flags Notes
|
||
ldi ED A0 16 --0e0- (DE)=(HL), HL=HL+1, DE=DE+1, BC=BC-1
|
||
ldd ED A8 16 --0e0- (DE)=(HL), HL=HL-1, DE=DE-1, BC=BC-1
|
||
ldir ED B0 bc*21-5 --0?0- ldi-repeat until BC=0
|
||
lddr ED B8 bc*21-5 --0?0- ldd-repeat until BC=0
|
||
|
||
Z80 Arithmetic/Logical Commands
|
||
-------------------------------
|
||
|
||
8bit Arithmetic/Logical Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
daa 27 4 szxp-x decimal adjust akku
|
||
cpl 2F 4 --1-1- A = A xor FF
|
||
neg ED 44 8 szho1c A = 00-A
|
||
<arit> r xx 4 szhonc see below
|
||
<arit> i pD xx 8 szhonc see below, UNDOCUMENTED
|
||
<arit> n xx nn 7 szhonc see below
|
||
<arit> (HL) xx 7 szhonc see below
|
||
<arit> (ii+d) pD xx dd 19 szhonc see below
|
||
<cnt> r xx 4 szhon- see below
|
||
<cnt> i pD xx 8 szhon- see below, UNDOCUMENTED
|
||
<cnt> (HL) xx 11 szhon- see below
|
||
<cnt> (ii+d) pD xx dd 23 szhon- see below
|
||
<logi> r xx 4 szhp00 see below
|
||
<logi> i pD xx 8 szhp00 see below, UNDOCUMENTED
|
||
<logi> n xx nn 7 szhp00 see below
|
||
<logi> (HL) xx 7 szhp00 see below
|
||
<logi> (ii+d) pD xx dd 19 szhp00 see below
|
||
Arithmetic <arit> commands:
|
||
add A,op see above 4-19 szho0c A=A+op
|
||
adc A,op see above 4-19 szho0c A=A+op+cy
|
||
sub op see above 4-19 szho1c A=A-op
|
||
sbc A,op see above 4-19 szho1c A=A-op-cy
|
||
cp op see above 4-19 szho1c compare, ie. VOID=A-op
|
||
Increment/Decrement <cnt> commands:
|
||
inc op see above 4-23 szho0- op=op+1
|
||
dec op see above 4-23 szho1- op=op-1
|
||
Logical <logi> commands:
|
||
and op see above 4-19 sz1p00 A=A & op
|
||
xor op see above 4-19 sz0p00 A=A XOR op
|
||
or op see above 4-19 sz0p00 A=A | op
|
||
|
||
16bit Arithmetic Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
add HL,rr x9 11 --h-0c HL = HL+rr ;rr may be BC,DE,HL,SP
|
||
add ii,rr pD x9 15 --h-0c ii = ii+rr ;rr may be BC,DE,ii,SP (!)
|
||
adc HL,rr ED xA 15 szho0c HL = HL+rr+cy ;rr may be BC,DE,HL,SP
|
||
sbc HL,rr ED x2 15 szho1c HL = HL-rr-cy ;rr may be BC,DE,HL,SP
|
||
inc rr x3 6 ------ rr = rr+1 ;rr may be BC,DE,HL,SP
|
||
inc ii pD 23 10 ------ ii = ii+1
|
||
dec rr xB 6 ------ rr = rr-1 ;rr may be BC,DE,HL,SP
|
||
dec ii pD 2B 10 ------ ii = ii-1
|
||
|
||
Searchcommands
|
||
Instruction Opcode Cycles Flags Notes
|
||
cpi ED A1 16 szhe1- compare A-(HL), HL=HL+1, DE=DE+1, BC=BC-1
|
||
cpd ED A9 16 szhe1- compare A-(HL), HL=HL-1, DE=DE-1, BC=BC-1
|
||
cpir ED B1 x*21-5 szhe1- cpi-repeat until BC=0 or compare fits
|
||
cpdr ED B9 x*21-5 szhe1- cpd-repeat until BC=0 or compare fits
|
||
|
||
Z80 Rotate/Shift and Singlebit Operations
|
||
-----------------------------------------
|
||
|
||
Rotate and Shift Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
rlca 07 4 --0-0c rotate akku left
|
||
rla 17 4 --0-0c rotate akku left through carry
|
||
rrca 0F 4 --0-0c rotate akku right
|
||
rra 1F 4 --0-0c rotate akku right through carry
|
||
rld ED 6F 18 sz0p0- rotate left low digit of A through (HL)
|
||
rrd ED 67 18 sz0p0- rotate right low digit of A through (HL)
|
||
<cmd> r CB xx 8 sz0p0c see below
|
||
<cmd> (HL) CB xx 15 sz0p0c see below
|
||
<cmd> (ii+d) pD CB dd xx 23 sz0p0c see below
|
||
<cmd> r,(ii+d) pD CB dd xx 23 sz0p0c see below, UNDOCUMENTED modify and load
|
||
Whereas <cmd> may be:
|
||
rlc rotate left
|
||
rl rotate left through carry
|
||
rrc rotate right
|
||
rr rotate right through carry
|
||
sla shift left arithmetic (b0=0)
|
||
sll UNDOCUMENTED shift left (b0=1)
|
||
sra shift right arithmetic (b7=b7)
|
||
srl shift right logical (b7=0)
|
||
|
||
Singlebit Operations
|
||
Instruction Opcode Cycles Flags Notes
|
||
bit n,r CB xx 8 xz1x0- test bit n ;n=0..7
|
||
bit n,(HL) CB xx 12 xz1x0-
|
||
bit n,(ii+d) pD CB dd xx 20 xz1x0-
|
||
set n,r CB xx 8 ------ set bit n ;n=0..7
|
||
set n,(HL) CB xx 15 ------
|
||
set n,(ii+d) pD CB dd xx 23 ------
|
||
set r,n,(ii+d) pD CB dd xx 23 ------ UNDOCUMENTED set n,(ii+d) and ld r,(ii+d)
|
||
res n,r CB xx 8 ------ reset bit n ;n=0..7
|
||
res n,(HL) CB xx 15 ------
|
||
res n,(ii+d) pD CB dd xx 23 ------
|
||
res r,n,(ii+d) pD CB dd xx 23 ------ UNDOCUMENTED res n,(ii+d) and ld r,(ii+d)
|
||
ccf 3F 4 --h-0c h=cy, cy=cy xor 1
|
||
scf 37 4 --0-01 cy=1
|
||
|
||
Z80 Jumpcommands & Interrupts
|
||
-----------------------------
|
||
|
||
General Jump Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
jp nn C3 nn nn 10 ------ jump to nn, ie. PC=nn
|
||
jp HL E9 4 ------ jump to HL, ie. PC=HL
|
||
jp ii pD E9 8 ------ jump to ii, ie. PC=ii
|
||
jp f,nn xx nn nn 10;10 ------ jump to nn if nz,z,nc,c,po,pe,p,m
|
||
jr nn 18 dd 12 ------ relative jump to nn, ie. PC=PC+d
|
||
jr f,nn xx dd 12;7 ------ relative jump to nn if nz,z,nc,c
|
||
djnz nn 10 dd 13;8 ------ B=B-1 and relative jump to nn if B<>0
|
||
call nn CD nn nn 17 ------ call nn ie. SP=SP-2, (SP)=PC, PC=nn
|
||
call f,nn xx nn nn 17;10 ------ call nn if nz,z,nc,c,po,pe,p,m
|
||
ret C9 10 ------ pop PC ie. PC=(SP), SP=SP+2
|
||
ret f xx 11;5 ------ pop PC if nz,z,nc,c,po,pe,p,m
|
||
rst n xx 11 ------ call n ;n=00,08,10,18,20,28,30,38
|
||
nop 00 4 ------ no operation
|
||
|
||
Interrupt Related Commands
|
||
Instruction Opcode Cycles Flags Notes
|
||
di F3 4 ------ IFF1=0, IFF2=0 ;disable interrupts
|
||
ei FB 4 ------ IFF1=1, IFF2=1 ;enable interrupts
|
||
im 0 ED 46 8 ------ read opcode from databus on interrupt
|
||
im 1 ED 56 8 ------ execute call 0038h on interrupt
|
||
im 2 ED 5E 8 ------ execute call (i*100h+databus) on int.
|
||
halt 76 N*4 ------ repeat until interrupt occurs
|
||
reti ED 4D 14 ------ pop PC, IFF1=IFF2, ACK (ret from INT)
|
||
retn ED 45 14 ------ pop PC, IFF1=IFF2 (ret from NMI)
|
||
</INT=LOW,IM=0,IFF1=1> 1+var ------ IFF1=0,IFF2=0, exec opcode from databus
|
||
</INT=LOW,IM=1,IFF1=1> 12 ------ IFF1=0,IFF2=0, CALL 0038h
|
||
</INT=LOW,IM=2,IFF1=1> 18 ------ IFF1=0,IFF2=0, CALL [I*100h+databus]
|
||
</NMI=falling_edge> ? ------ IFF1=0, CALL 0066h
|
||
|
||
Z80 I/O Commands
|
||
----------------
|
||
|
||
Instruction Opcode Cycles Flags Notes
|
||
in A,(n) DB nn 11 ------ A=PORT(A*100h+n)
|
||
in r,(C) ED xx 12 sz0p0- r=PORT(BC)
|
||
in (C) ED 70 12 sz0p0- **undoc/illegal** VOID=PORT(BC)
|
||
out (n),A D3 nn 11 ------ PORT(A*100h+n)=A
|
||
out (C),r ED xx 12 ------ PORT(BC)=r
|
||
out (C),0 ED 71 12 ------ **undoc/illegal** PORT(BC)=00
|
||
ini ED A2 16 xexxxx MEM(HL)=PORT(BC), HL=HL+1, B=B-1
|
||
ind ED AA 16 xexxxx MEM(HL)=PORT(BC), HL=HL-1, B=B-1
|
||
outi ED A3 16 xexxxx B=B-1, PORT(BC)=MEM(HL), HL=HL+1
|
||
outd ED AB 16 xexxxx B=B-1, PORT(BC)=MEM(HL), HL=HL-1
|
||
inir ED B2 b*21-5 x1xxxx same than ini, repeat until b=0
|
||
indr ED BA b*21-5 x1xxxx same than ind, repeat until b=0
|
||
otir ED B3 b*21-5 x1xxxx same than outi, repeat until b=0
|
||
otdr ED BB b*21-5 x1xxxx same than outd, repeat until b=0
|
||
|
||
Z80 Interrupts
|
||
--------------
|
||
|
||
Interrupt Flip-Flop (IFF1,IFF2)
|
||
The IFF1 flag is used to enable/disable INTs (maskable interrupts).
|
||
In a raw INT-based system, IFF2 is always having the same state than IFF1.
|
||
However, in a NMI-based system the IFF2 flag is used to backup the recent IFF1
|
||
state prior to NMI execution, and may be used to restore IFF1 upon NMI
|
||
completion by RETN opcode.
|
||
Beside for the above 'backup' function, IFF2 itself is having no effect.
|
||
Neither IFF1 nor IFF2 affect NMIs which are always enabled.
|
||
The following opcodes/events are modifying IFF1 and/or IFF2:
|
||
EI IFF1=1, IFF2=1
|
||
DI IFF1=0, IFF2=0
|
||
<INT> IFF1=0, IFF2=0
|
||
<NMI> IFF1=0
|
||
RETI IFF1=IFF2
|
||
RETN IFF1=IFF2
|
||
When using the EI instruction, the new IFF state isn't applied until the next
|
||
instruction has completed (this ensures that an interrupt handler which is
|
||
using the sequence "EI, RET" may return to the main program before the next
|
||
interrupt is executed).
|
||
Interrupts can be disabled by the DI instruction (IFF=0), and are additionally
|
||
automatically each time when an interrupt is executed.
|
||
|
||
Interrupt Execution
|
||
An interrupt is executed when an interrupt is requested by the hardware, and
|
||
IFF is set. Whenever both conditions are true, the interrupt is executed after
|
||
the completion of the current opcode.
|
||
Note that repeated block commands (such like LDIR) can be interrupted also, the
|
||
interrupt return address on the stack then points to the interrupted opcode, so
|
||
that the instruction may continue as normal once the interrupt handler returns.
|
||
|
||
Interrupt Modes (IM 0,1,2)
|
||
The Z80 supports three interrupt modes which can be selected by IM 0, IM 1, and
|
||
IM 2 instructions. The table below describes the respective operation and
|
||
execution time in each mode.
|
||
Mode Cycles Refresh Operation
|
||
0 1+var 0+var IFF1=0,IFF2=0, read and execute opcode from databus
|
||
1 12 1 IFF1=0,IFF2=0, CALL 0038h
|
||
2 18 1 IFF1=0,IFF2=0, CALL [I*100h+databus]
|
||
Mode 0 requires an opcode to be output to the databus by external hardware, in
|
||
case that no byte is output, and provided that the 'empty' databus is free of
|
||
garbage, then the CPU might tend to read a value of FFh (opcode RST 38h, 11
|
||
cycles, 1 refresh) - the clock cycles (11+1), refresh cycles (1), and executed
|
||
operation are then fully identical as in Mode 1.
|
||
Mode 1 interrupts always perform a CALL 0038h operation. The downside is that
|
||
many systems may have ROM located at this address, making it impossible to hook
|
||
the interrupt handler directly.
|
||
|
||
Mode 2 calls to a 16bit address which is read from a table in memory, the table
|
||
pointer is calculated from the "I" register (initialized by LD I,A instruction)
|
||
multiplied by 100h, plus an index byte which is read from the databus. The
|
||
following trick may be used to gain stable results in Mode 2 even if no index
|
||
byte is supplied on the databus: For example, set I=40h the origin of the table
|
||
will be then at 4000h in memory. Now fill the entire area from 4000h to 4100h
|
||
(101h bytes, including 4100h) by the value 41h. The CPU will then perform a
|
||
CALL 4141h upon interrupt execution - regardless of whether the randomized
|
||
index byte is an even or odd number.
|
||
|
||
Non-Maskable Interrupts (NMIs)
|
||
Unlike INTs, NMIs cannot be disabled by the CPU, ie. DI and EI instructions and
|
||
the state of IFF1 and IFF2 do not have effect on NMIs. The NMI handler address
|
||
is fixed at 0066h, regardless of the interrupt mode (IM). Upon NMI execution,
|
||
IFF1 is cleared (disabeling maskable INTs - NMIs remain enabled, which may
|
||
result in nested execution if the handler does not return before next NMI is
|
||
requested). IFF2 remains unchanged, thus containing the most recent state of
|
||
IFF1, which may be used to restore IFF1 if the NMI handler returns by RETN
|
||
instruction.
|
||
Execution time for NMIs is unknown (?).
|
||
|
||
RETN (return from NMI and restore IFF1)
|
||
Intended to return from NMI and to restore the old IFF1 state (assuming the old
|
||
state was IFF1/IFF2 both set or both cleared).
|
||
|
||
RETI (return from INT with external acknowledge)
|
||
Intended to return from INT and to notify peripherals about completion of the
|
||
INT handler, the Z80 itself doesn't send any such acknowledge signal (instead,
|
||
peripherals like Z80-PIO or Z80-SIO must decode the databus during /M1 cycles,
|
||
and identify the opcode sequence EDh,4Fh as RETI). Aside from such external
|
||
handling, internally, RETI is exactly same as RETN, and, like RETN it does set
|
||
IFF1=IFF2 (though in case of RETI this is a dirt effect without practical use;
|
||
within INT handlers IFF1 and IFF2 are always both zero, or when EI was used
|
||
both set). Recommended methods to return from INT are: EI+RETI (when needing
|
||
the external acknowledge), or EI+RET (faster).
|
||
|
||
Z80 Meaningless and Duplicated Opcodes
|
||
--------------------------------------
|
||
|
||
Mirrored Instructions
|
||
NEG (ED44) is mirrored to ED4C,54,5C,64,6C,74,7C.
|
||
RETN (ED45) is mirrored to ED55,65,75.
|
||
RETI (ED4D) is mirrored to ED5D,6D,7D.
|
||
|
||
Mirrored IM Instructions
|
||
IM 0,X,1,2 (ED46,4E,56,5E) are mirrored to ED66,6E,76,7E.
|
||
Whereas IM X is an undocumented mirrored instruction itself which appears to be
|
||
identical to either IM 0 or IM 1 instruction (?).
|
||
|
||
Duplicated LD HL Instructions
|
||
LD (nn),HL (opcode 22NNNN) is mirrored to ED63NNNN.
|
||
LD HL,(nn) (opcode 2ANNNN) is mirrored to ED6BNNNN.
|
||
Unlike the other instructions in this chapter, these two opcodes are officially
|
||
documented. The clock/refresh cycles for the mirrored instructions are then
|
||
20/2 instead of 16/1 as for the native 8080 instructions.
|
||
|
||
Mirrored BIT N,(ii+d) Instructions
|
||
Unlike as for RES and SET, the BIT instruction does not support a third
|
||
operand, ie. DD or FD prefixes cannot be used on a BIT N,r instruction in order
|
||
to produce a BIT r,N,(ii+d) instruction. When attempting this, the 'r' operand
|
||
is ignored, and the resulting instruction is identical to BIT N,(ii+d).
|
||
Except that, not tested yet, maybe undocumented flags are then read from 'r'
|
||
instead of from ii+d(?).
|
||
|
||
Non-Functional Opcodes
|
||
The following opcodes behave much like the NOP instruction.
|
||
ED00-3F, ED77, ED7F, ED80-9F, EDA4-A7, EDAC-AF, EDB4-B7, EDBC-BF, EDC0-FF.
|
||
The execution time for these opcodes is 8 clock cycles, 2 refresh cycles.
|
||
Note that some of these opcodes appear to be used for additional instructions
|
||
by the R800 CPU in newer turbo R (MSX) models.
|
||
|
||
Ignored DD and FD Prefixes
|
||
In some cases, DD-prefixes (IX) and FD-prefixes (IY) may be ignored by the CPU.
|
||
This happens when using one (or more) of the above prefixes prior to
|
||
instructions that already contain an ED, DD, or FD prefix, or prior to any
|
||
instructions that do not support IX, IY, IXL, IXH, IYL, IYH operands. In such
|
||
cases, 4 clock cycles and 1 refresh cycle are counted for each ignored prefix
|
||
byte.
|
||
|
||
Z80 Garbage in Flag Register
|
||
----------------------------
|
||
|
||
Nocash Z80-flags description
|
||
This chapter describes the undocumented Z80 flags (bit 3 and 5 of the Flags
|
||
Register), these flags are affected by ALL instructions that modify one or more
|
||
of the normal flags - all OTHER instructions do NOT affect the undocumented
|
||
flags.
|
||
|
||
For some instructions, the content of some flags has been officially documented
|
||
as 'destroyed', indicating that the flags contain garbage, the exact garbage
|
||
calculation for these instructions will be described here also.
|
||
|
||
All information below just for curiosity. Keep in mind that Z80 compatible CPUs
|
||
(or emulators) may not supply identical results, so that it wouldn't be a good
|
||
idea to use these flags in any programs (not that they could be very useful
|
||
anyways).
|
||
|
||
Normal Behaviour for Undocumented Flags
|
||
In most cases, undocumented flags are copied from the Bit 3 and Bit 5 of the
|
||
result byte. That is "A AND 28h" for:
|
||
RLD; CPL; RLCA; RLA; LD A,I; ADD OP; ADC OP; XOR OP; AND OP;
|
||
RRD; NEG; RRCA; RRA; LD A,R; SUB OP; SBC OP; OR OP ; DAA.
|
||
When other operands than A may be modified, "OP AND 28h" for:
|
||
RLC OP; RL OP; SLA OP; SLL OP; INC OP; IN OP,(C);
|
||
RRC OP; RR OP; SRA OP; SRL OP; DEC OP
|
||
For 16bit instructions flags are calculated as "RR AND 2800h":
|
||
ADD RR,XX; ADC RR,XX; SBC RR,XX.
|
||
|
||
Slightly Special Undocumented Flags
|
||
For 'CP OP' flags are calculated as "OP AND 28h", that is the unmodified
|
||
operand, and NOT the internally calculated result of the comparision.
|
||
For 'SCF' and 'CCF' flags are calculated as "(A OR F) AND 28h", ie. the flags
|
||
remain set if they have been previously set.
|
||
For 'BIT N,R' flags are calculated as "OP AND 28h", additionally the P-Flag is
|
||
set to the same value than the Z-Flag (ie. the Parity of "OP AND MASK"), and
|
||
the S-flag is set to "OP AND MASK AND 80h".
|
||
|
||
Fatal MEMPTR Undocumented Flags
|
||
For 'BIT N,(HL)' the P- and S-flags are set as for BIT N,R, but the
|
||
undocumented flags are calculated as "MEMPTR AND 2800h", for more info about
|
||
MEMPTR read on below.
|
||
The same applies to 'BIT N,(ii+d)', but the result is less unpredictable
|
||
because the instruction sets MEMPTR=ii+d, so that undocumented flags are
|
||
"<ii+d> AND 2800h".
|
||
|
||
Memory Block Command Undocumented Flags
|
||
For LDI, LDD, LDIR, LDDR, undocumented flags are "((A+DATA) AND 08h) +
|
||
((A+DATA) AND 02h)*10h".
|
||
For CPI, CPD, CPIR, CPDR, undocumented flags are "((A-DATA-FLG_H) AND 08h) +
|
||
((A-DATA-FLG_H) AND 02h)*10h", whereas the CPU first calculates A-DATA, and
|
||
then internally subtracts the resulting H-flag from the result.
|
||
|
||
Chaotic I/O Block Command Flags
|
||
The INI, IND, INIR, INDR, OUTI, OUTD, OTIR, OTDR instructions are doing a lot
|
||
of obscure things, to simplify the description a placeholder called DUMMY is
|
||
used in the formulas.
|
||
DUMMY = "REG_C+DATA+1" ;for INI/INIR
|
||
DUMMY = "REG_C+DATA-1" ;for IND/INDR
|
||
DUMMY = "REG_L+DATA" ;for OUTI,OUTD,OTIR,OTDR
|
||
FLG_C = Carry of above "DUMMY" calculation
|
||
FLG_H = Carry of above "DUMMY" calculation (same as FLG_C)
|
||
FLG_N = Sign of "DATA"
|
||
FLG_P = Parity of "REG_B XOR (DUMMY AND 07h)"
|
||
FLG_S = Sign of "REG_B"
|
||
UNDOC = Bit3,5 of "REG_B AND 28h"
|
||
The above registers L and B are meant to contain the new values which are
|
||
already incremented/decremented by the instruction.
|
||
Note that the official docs mis-described the N-Flag as set, and the C-Flag as
|
||
not affected.
|
||
|
||
DAA Flags
|
||
Addition (if N was 0):
|
||
FLG_H = (OLD_A AND 0Fh) > 09h
|
||
FLG_C = Carry of result
|
||
Subtraction (if N was 1):
|
||
FLG_H = (NEW_A AND 0Fh) > 09h
|
||
FLG_C = OLD_CARRY OR (OLD_A>99h)
|
||
For both addition and subtraction, N remains unmodified, and S, Z, P contain
|
||
"Sign", Zero, and Parity of result (A). Undocumented flags are set to (A AND
|
||
28h) as normal.
|
||
|
||
Mis-documented Flags
|
||
For all XOR/OR: H=N=C=0, and for all AND: H=1, N=C=0, unlike described else in
|
||
Z80 docs. Also note C,N flag description bug for I/O block commands (see
|
||
above).
|
||
|
||
Internal MEMPTR Register
|
||
This is an internal Z80 register, modified by some instructions, and usually
|
||
completely hidden to the user, except that Bit 11 and Bit 13 can be read out at
|
||
a later time by BIT N,(HL) instructions.
|
||
The following list specifies the resulting content of the MEMPTR register
|
||
caused by the respective instructions.
|
||
Content Instruction
|
||
A*100h LD (xx),A ;xx=BC,DE,nn
|
||
xx+1 LD A,(xx) ;xx=BC,DE,nn
|
||
nn+1 LD (nn),rr; LD rr,(nn) ;rr=BC,DE,HL,IX,IY
|
||
rr EX (SP),rr ;rr=HL,IX,IY (MEMPTR=new value of rr)
|
||
rr+1 ADD/ADC/SBC rr,xx ;rr=HL,IX,IY (MEMPTR=old value of rr+1)
|
||
HL+1 RLD and RRD
|
||
dest JP nn; CALL nn; JR nn ;dest=nn
|
||
dest JP f,nn; CALL f,nn ;regardless of condition true/false
|
||
dest RET; RETI; RETN ;dest=value read from (sp)
|
||
dest RET f; JR f,nn; DJNZ nn ;only if condition=true
|
||
00XX RST n
|
||
adr+1 IN A,(n) ;adr=A*100h+n, memptr=A*100h+n+1
|
||
bc+1 IN r,(BC); OUT (BC),r ;adr=bc
|
||
ii+d All instructions with operand (ii+d)
|
||
Also the following might or might not affect MEMPTR, not tested yet:
|
||
OUT (N),A and block commands LDXX, CPXX, INXX, OUTXX
|
||
and probably interrupts in IM 0, 1, 2
|
||
All other commands do not affect the MEMPTR register - this includes all
|
||
instructions with operand (HL), all PUSH and POP instructions, not executed
|
||
conditionals JR f,d, DJNZ d, RET f (ie. with condition=false), and the JP
|
||
HL/IX/IY jump instructions.
|
||
|
||
Z80 Compatibility
|
||
-----------------
|
||
|
||
The Z80 CPU is (almost) fully backwards compatible to older 8080 and 8085 CPUs.
|
||
|
||
Instruction Format
|
||
The Z80 syntax simplifies the chaotic 8080/8085 syntax. For example, Z80 uses
|
||
the command "LD" for all load instructions, 8080/8085 used various different
|
||
commands depending on whether the operands are 8bit registers, 16bit registers,
|
||
memory pointers, and/or an immediates. However, these changes apply to the
|
||
source code only - the generated binary code is identical for both CPUs.
|
||
|
||
Parity/Overflow Flag
|
||
The Z80 CPU uses Bit 2 of the flag register as Overflow flag for arithmetic
|
||
instructions, and as Parity flag for other instructions. 8080/8085 CPUs are
|
||
always using this bit as Parity flag for both arithmetic and non-arithmetic
|
||
instructions.
|
||
|
||
Z80 Specific Instructions
|
||
The following instructions are available for Z80 CPUs only, but not for older
|
||
8080/8085 CPUs:
|
||
All CB-prefixed opcodes (most Shift/Rotate, all BIT/SET/RES commands).
|
||
All ED-prefixed opcodes (various instructions, and all block commands).
|
||
All DD/FD-prefixed opcodes (registers IX and IY).
|
||
As well as DJNZ nn; JR nn; JR f,nn; EX AF,AF; and EXX.
|
||
|
||
8085 Specific Instructions
|
||
The 8085 instruction set includes two specific opcodes in addition to the 8080
|
||
instruction set, used to control 8085-specifc interrupts and SID and SOD
|
||
input/output signals. These opcodes, RIM (20h) and SIM (30h), are not supported
|
||
by Z80/8080 CPUs.
|
||
|
||
Z80 vs Z80A
|
||
Both Z80 and Z80A are including the same instruction set, the only difference
|
||
is the supported clock frequency (Z80 = max 2.5MHz, Z80A = max 4MHz).
|
||
|
||
NEC-780 vs Zilog-Z80
|
||
These CPUs are apparently fully compatible to each other, including for
|
||
undocumented flags and undocumented opcodes.
|
||
|
||
Z80 Pin-Outs
|
||
------------
|
||
|
||
_____ _____
|
||
| |_| |
|
||
A11 |1 40| A10
|
||
A12 |2 39| A9
|
||
A13 |3 38| A8
|
||
A14 |4 37| A7
|
||
A15 |5 36| A6
|
||
CLK |6 35| A5
|
||
D4 |7 34| A4
|
||
D3 |8 33| A3
|
||
D5 |9 32| A2
|
||
D6 |10 Z80 31| A1
|
||
VCC |11 CPU 30| A0
|
||
D2 |12 29| GND
|
||
D7 |13 28| /RFSH
|
||
D0 |14 27| /M1
|
||
D1 |15 26| /RST
|
||
/INT |16 25| /BUSRQ
|
||
/NMI |17 24| /WAIT
|
||
/HALT |18 23| /BUSAK
|
||
/MREQ |19 22| /WR
|
||
/IORQ |20 21| /RD
|
||
|_____________|
|
||
|
||
|
||
Z80 Local Usage
|
||
---------------
|
||
|
||
Playchoice 10 (Z80)
|
||
Clocked at 4.000MHz.
|
||
NMIs are triggered on Vblank start (of the Z80 video circuit).
|
||
Normal interrupts are not used. There is no DRAM (no Refresh used).
|
||
There is memory mapped I/O at E000h..FFFFh. Writes to that area are done by LD
|
||
[RR],R and LD [RR],NN and PUSH RR opcodes. Reads from that area are done by BIT
|
||
N,[HL], XOR A,[HL], and JP HL opcodes (JP HL is executing a RST NN opcode in
|
||
the memory mapped I/O area).
|
||
|
||
FamicomBox
|
||
----------
|
||
|
||
Nintendo FamicomBox (SSS-CDS) aka Sharp FamicomStation.
|
||
|
||
Info from Kevin Horton.
|
||
|
||
--> FamicomBox Memory and I/O Maps
|
||
--> FamicomBox I/O Ports
|
||
--> FamicomBox Misc
|
||
--> FamicomBox Cartridges
|
||
--> FamicomBox ROM Header (at FFE0h)
|
||
--> FamicomBox Pinouts
|
||
|
||
FamicomBox Memory and I/O Maps
|
||
------------------------------
|
||
|
||
Overall Memory Map
|
||
0000h-1FFFh 8K RAM (with write-protect feature, see port 5002h.W)
|
||
2000h-3FFFh PPU Registers
|
||
4000h-4FFFh CPU/APU RP2A03E Registers
|
||
5000h-5FFFh FamicomBox Registers
|
||
6000h-7FFFh 8K RAM (temporary storage, used for TEST mode only)
|
||
8000h-FFFFh Cartridge space
|
||
|
||
RAM Usage
|
||
0000h..07FFh Standard NES Work RAM (variables for MENU and GAME)
|
||
0800h..08FFh FamicomBox Variables
|
||
0900h..09FFh FamicomBox Slot Counters (Total & per-game counters)
|
||
0A00h..0A18h FamicomBox Variables
|
||
0A19h..0DFFh FamicomBox Unused
|
||
0E00h..0FFFh FamicomBox Slot Directory (Game Titles with Chksum and Status)
|
||
1000h..1FFFh FamicomBox Program Code (relocated from Menu ROM)
|
||
6000h..7FFFh Unknown purpose (temporary storage, used for TEST mode only)
|
||
Memory at 0800h..1FFFh is write-protected during Game execution (as far as
|
||
known, it isn't battery-backed, but the Famibox doesn't have a power-switch, so
|
||
the RAM is permanently powered; unless one unplugs the power supply).
|
||
Unknown if 6000h..7FFFh is also mapped during Game execution - if so, it may
|
||
clash with (or replace and act as?) SRAM used by Game cartridges?
|
||
|
||
I/O Map (Output)
|
||
4016h.W - Joypad Strobe
|
||
5000h.W - Exception Trap Enable Bits (reset to 00h on power-up only)
|
||
5001h.W - Coin Chip Params & CATV Outputs (reset to 00h on power-up only)
|
||
5002h.W - Slot LED and RAM protect register (reset to 00h when CPU is reset)
|
||
5003h.W - Exception Trap Attraction Timer
|
||
5004h.W - Slot ROM Cart control register (reset to 00h when CPU is reset)
|
||
5005h.W - Misc Control (reset to 00h on power-up only)
|
||
5006h.W - Test Connector DB-25 Outputs (not reset, uninitialzed at power-up)
|
||
5007h.W - Expansion 50-pin Edge Connector, 8bit Output
|
||
|
||
I/O Map (Input)
|
||
4016h.R - Watchdog Reload, and Joypad 1
|
||
4017h.R - Watchdog Reload, and Joypad 2, and Zapper
|
||
5000h.R - Exception Trap Flags
|
||
5001h.R - Not used
|
||
5002h.R - Dip Switch Register
|
||
5003h.R - Keyswitch Position & Coin Chip Status
|
||
5004h.R - Test Connector DB-25 Inputs
|
||
5005h.R - Expansion 50-pin Edge Connector, 8bit Input 1
|
||
5006h.R - Expansion 50-pin Edge Connector, 8bit Input 2
|
||
5007h.R - Misc Status
|
||
|
||
FamicomBox I/O Ports
|
||
--------------------
|
||
|
||
5000h.W - Exception Trap Enable Bits (reset to 00h on power-up only)
|
||
0 6.82Hz interrupt source (0=Enable, 1=Disable)
|
||
1 Attraction Timer (0=Disable, 1=Enable)
|
||
2 Controller reads (0=Disable, 1=Enable)
|
||
3 Keyswitch rotation (0=Disable, 1=Enable)
|
||
4 Coin insertion (and/or EXPIRED?) (0=Disable, 1=Enable)
|
||
5 Reset Button (0=Disable, 1=Enable)
|
||
6 Not used (Watchdog is always Enabled)
|
||
7 CATV connector Pin 1 detection (0=Disable, 1=Enable)
|
||
|
||
5000h.R - Exception Trap Flags
|
||
0 6.82Hz interrupt source hit (0=Trapped, 1=Normal)
|
||
1 Attraction Timer Expired (0=Trapped, 1=Normal)
|
||
2 Controller(s) were read (and PRESSED?) (0=Trapped, 1=Normal)
|
||
3 Keyswitch was rotated (0=Trapped, 1=Normal)
|
||
4 Coin was inserted (and/or EXPIRED?) (0=Trapped, 1=Normal)
|
||
5 Reset Button was pressed (0=Trapped, 1=Normal)
|
||
6 Watchdog Timer Expired (after 17.5s) (0=Trapped, 1=Normal)
|
||
7 CATV connector Pin 1 went high/open (0=Trapped, 1=Normal)
|
||
When 5000h.R is read, this register is reset, and the exception trap controller
|
||
is reset.
|
||
There seems to be a 9th exception flag in 5007h.R.Bit0. If the NINE flags are
|
||
all ones, then the reset can be considered to be caused by a "PROTECT IC" (aka
|
||
CIC, presumably) (see menu error 0Fh at 9067h).
|
||
When one of the above exceptions occurs, the CPU is reset. The menu code then
|
||
reads to see which of the sources caused the reset, and acts accordingly.
|
||
|
||
5003h.W - Exception Trap Attraction Timer
|
||
0-7 Counter value (decremented at 6.8274Hz) (255=max=37 seconds)
|
||
When the timer wraps from 00h to FFh it triggers an exception, if it is
|
||
enabled. (See 5000h.W and 5000h.R)
|
||
This timer is used for the "attract" mode. It lets the game run for several
|
||
seconds before it brings the menu back.
|
||
|
||
5001h.W - Coin Chip Params & CATV Outputs (reset to 00h on power-up only)
|
||
0 Coin Chip pin 1 (1=Ten Minutes per Coin)
|
||
1 Coin Chip pin 2 (1=Twenty Minutes per Coin)
|
||
2 Coin Chip pin 3 (should be always 0, except in test mode)
|
||
3 Coin Chip pin 4 (should be always 0, except in test mode)
|
||
4 Coin Chip pin 12 (should be always 0, except in test mode)
|
||
5 Coin Chip pin 14 (1=Apply Minutes?)
|
||
6 CATV Connector pin 7 (0=Free-Menu/Demo, 1=Play-and-Pay; unless TV Mode?)
|
||
7 CATV Connector pin 8 (0=High=Okay, 1=Low=Joypad/Zapper-Disconnect-Alert)
|
||
|
||
5002h.W - Slot LED and RAM protect register (reset to 00h when CPU is reset)
|
||
0-3 LED Select (00h=None, 01h..0Fh=Cartridge Slot LED 1..15)
|
||
4-6 RAM Write Enable (0=None, 1=0-07FFh, 2=0-0FFFh, 3=0-17FFh, 4-7=0-1FFFh)
|
||
7 LED Flash (3.414Hz) (high=flash, low=steady)
|
||
BIT7: err... 1=high, 0=low or what? err... flash=blinking? and steady... means
|
||
always on? err... what LED(s)... the currently selected cart-led? power-led?
|
||
|
||
5004h.W - Slot ROM Cart control register (reset to 00h when CPU is reset)
|
||
0-3 Cart Number select (00h=Menu, 01h..0Fh=Game Cart1-15)
|
||
4-5 Cart Row select (00h=Menu, 01h=Cart1-5, 02h=Cart6-10, 03h=Cart11-15)
|
||
6 Lock (0=No change, 1=Disable Port 500xh or so; until Reset)
|
||
7 NC
|
||
Proper cart selection requires setting up BOTH the desired cart number
|
||
(00h-0Fh), AND the proper row.
|
||
|
||
5005h.W - Misc Control (reset to 00h on power-up only)
|
||
0 Latching Relay (1=Flip to position A) (coil on pins 1 & 10)
|
||
1 Coin Chip pin ? ;err... which pin? (0=Operate, 1=Config/Reset?)
|
||
2 Zapper GND (0=Disable/Low-Z; for 5007h.R connect-check, 1=Enable/GND)
|
||
3 enable 40% input of modulator (0=Disable, 1=Enable)
|
||
4 NC
|
||
5 maps to 5007h.R.Bit7 (warmboot flag or so?) (and to 50-pin ??)
|
||
6 Joypad Enable (0=Enable, 1=Disable)
|
||
7 Joypad Swap (0=Swap, 1=Normal) swapping only swaps D0 and CLK
|
||
err... what is this register having to do with "CATV"...? maybe the relay?
|
||
|
||
5007h.R - Misc Status
|
||
0 TV type selection (0=TV, 1=Game) ;or... trap flag bit8... CIC, 1=trap?
|
||
1 Keyswitch turned (0=No, 1=in middle of two positions)
|
||
2 Zapper GND (0=Enabled or Disabled+Disconnected, 1=Disabled+Connected)
|
||
3 Expansion 50-pin Edge Connector, Pin 21 (inverted)
|
||
4 CATV Connector pin 8 (0=Low, 1=High) (see also: 5001h.W.Bit7)
|
||
5 Relay Position (0=Position A, 1=Position B) (For CATV 0=Force Demo Only)
|
||
6 Expansion 50-pin Edge Connector, Pin 22 (inverted)
|
||
7 5005h.W.Bit5 (inverted) ;coldboot/warmboot flag?
|
||
7 err, and/or Expansion 50-pin Edge Connector, Pin 23
|
||
|
||
5002h.R - Dip Switch Register
|
||
0 DIP SW 1 Self Test (0=Off=Normal, 1=On=Do continuous selftest)
|
||
1 DIP SW 2 Coin timeout period (0=Off=10 minutes, 1=On=20 minutes)
|
||
2 DIP SW 3 Not used (0=Off, 1=On)
|
||
3 DIP SW 4 Famicombox menu time (0=Off=7 seconds, 1=On=12 seconds)
|
||
4 DIP SW 5 Attract time, bit0 ;\(0..3 = 12,17,23,7 seconds)
|
||
5 DIP SW 6 Attract time, bit1 ;/
|
||
6 DIP SW 7 Mode, bit0 ;\(0=KEY MODE, 1=CATV MODE, 2=COIN MODE, 3=FREEPLAY)
|
||
7 DIP SW 8 Mode, bit1 ;/
|
||
N/A DIP SW 9 Feep Disable (On=Mute the Coin feep)
|
||
N/A DIP SW 10 Controller 2 D3,D4 (Off=Disable, On=Enable) (Zapper pins)
|
||
Attract time: How long each game plays while in attract mode before switching
|
||
to the next.
|
||
|
||
5003h.R - Keyswitch Position & Coin Chip Status
|
||
0 Key Position 0 (0=No, 1=Yes) (??? from left) ;-(demo mode?)
|
||
1 Key Position 1 (0=No, 1=Yes) (??? from left) ;\SELECT GAME (play modes)
|
||
2 Key Position 2 (0=No, 1=Yes) (??? from left) ;/
|
||
3 Key Position 3 (0=No, 1=Yes) (??? from left) ;-SELF CHECK and GAME CHECK
|
||
4 Key Position 4 (0=No, 1=Yes) (??? from left) ;-Lockup ???
|
||
5 Key Position 6 (0=No, 1=Yes) (1st from left) ;-GAME TITLE & COUNT
|
||
6 Coin Chip Pin 9 (0=Empty/Expired, 1="Money system enabled")
|
||
7 Coin Chip Pin 10 (not used by existing software) (MAYBE expired-trap?)
|
||
Note: There are Black visitor keys, and red master keys. The visitor keys can
|
||
be probably turned to only 2 positions.
|
||
The naming for the key positions is very confusing. Obvious names would be "Nth
|
||
from Left" or "Bit0-5" (which may not be numbered straightly). Other naming
|
||
schemes include "ON-OFF" (on front panel, without markings on the other four
|
||
positions), "1 2 3 4 5 6" (used in the Menu cartridge), "0 1 2 3 4 6" (used by
|
||
kevtris, mabe pin-numbers, with 5=GND), and "1-OFF-ON-2-3" (seen on a japanese
|
||
webpage).
|
||
|
||
5001h.R - Not used
|
||
0-7 Not used (open bus)
|
||
|
||
5004h.R - Test Connector DB-25 Inputs
|
||
0-7 Input R0..R7 (DB-25 pins 2,15,3,16,4,17,5,18) (inverted; 0=High, 1=Low)
|
||
|
||
5006h.W - Test Connector DB-25 Outputs (not reset, uninitialzed at power-up)
|
||
0-7 Output W0..W7 (DB-25 pins 6,15,7,16,8,17,9,18)
|
||
|
||
5005h.R - Expansion 50-pin Edge Connector, 8bit Input 1
|
||
0-7 Input from CPU Databus; with 5005h.Read signal on Expansion Port pin 28
|
||
|
||
5006h.R - Expansion 50-pin Edge Connector, 8bit Input 2
|
||
0-7 Input from CPU Databus; with 5006h.Read signal on Expansion Port pin 27
|
||
|
||
5007h.W - Expansion 50-pin Edge Connector, 8bit Output
|
||
0-7 Output to CPU Databus; with 5007h.Write signal on Expansion Port pin 26
|
||
|
||
4016h.W - Joypad Strobe
|
||
0 DB-15 pin 12 and Joypad 1/2 Strobe pin 3
|
||
1 DB-15 pin 11
|
||
2 DB-15 pin 10
|
||
3-7 Not used
|
||
|
||
4016h.R - Watchdog Reload, and Joypad 1
|
||
0 Joypad 1 D0 pin 4 ;Joypad 1 (or joypad 2 when swapped)
|
||
1 DB-15 pin 14
|
||
2 Expansion 50-pin Edge Connector, Pin 44 (would be Microphone in Famicom)
|
||
3 Joypad 1 D3 pin 6
|
||
4 Joypad 1 D4 pin 7
|
||
5 Expansion 50-pin Edge Connector, Pin 19
|
||
6 Expansion 50-pin Edge Connector, Pin 45
|
||
7 Expansion 50-pin Edge Connector, Pin 20
|
||
Reading 4016h or 4017h resets the 4bit Watchdog timer (this must be done at
|
||
least every 17.5 seconds; ie. every fifteen 0.853Hz steps).
|
||
|
||
4017h.R - Watchdog Reload, and Joypad 2 and Zapper
|
||
0 DB-15 pin 8 and Joypad 2 D0 pin 4 ;Joypad 2 (or joypad 1 when swapped)
|
||
1 DB-15 pin 7
|
||
2 DB-15 pin 6
|
||
3 DB-15 pin 5 and Joypad 2 D3 pin 6 ;Zapper Light ;\when DIP10=Off:
|
||
4 DB-15 pin 4 and Joypad 2 D4 pin 7 ;Zapper Trigger ;/only DB-15 pins
|
||
5 Expansion 50-pin Edge Connector, Pin 17
|
||
6 Expansion 50-pin Edge Connector, Pin 43
|
||
7 Expansion 50-pin Edge Connector, Pin 18
|
||
Reading 4016h or 4017h resets the 4bit Watchdog timer (this must be done at
|
||
least every 17.5 seconds; ie. every fifteen 0.853Hz steps).
|
||
|
||
FamicomBox Misc
|
||
---------------
|
||
|
||
Counter chain
|
||
21.47727MHz/3/2000h = 873.91Hz (feep tone, when coin inserted)
|
||
21.47727MHz/3/100000h = 6.827Hz (clock for 8bit attraction timer)
|
||
21.47727MHz/3/200000h = 3.414Hz (LED flash)
|
||
21.47727MHz/3/800000h = 0.853Hz (clock for 4bit watchdog timer)
|
||
|
||
Watchdog timer
|
||
A 4 bit binary up counter is used. It is clocked at 0.85Hz. When a controller
|
||
is read (either one), this timer is reset. When the count wraps from 0Fh to
|
||
00h, an exception is generated. (see 5000R and 5000W)
|
||
|
||
Audio chain
|
||
The audio chain is kinda interesting. The audio passes from the two pins on the
|
||
CPU, through two hex inverter audio amplifiers, and then the outputs of these
|
||
go to the 50-pin expansion connector, and then through two more hex inverter
|
||
amplifiers. The outputs of those two amps is combined with external audio
|
||
(again from the 50-pin expansion connector) and the coin beep, which is finally
|
||
fed to the DB-15, DB-25, and the modulator and audio jack.
|
||
The beep is made whenever coin is inserted.
|
||
|
||
Lockout
|
||
The 3198 lockout chip in the famicombox carts is kinda odd. The resistor
|
||
network connects 4 lines from the expansion pins (on the cart) to 4 pins on the
|
||
lockout chip.
|
||
Unlike the regular lockout chips, the 3198 is designed to work in a network of
|
||
up to 16 lockout chips. Each of the 15 cart slots on the front + the menu board
|
||
has a unique mapping of the 4 lines; pulled high or low depending on which slot
|
||
it is in.
|
||
The master lockout chip on the main board has its 4 address lines connected to
|
||
a latch which is written to by the CPU to select 1 of the 16 slaves on the
|
||
various carts. The slave lockout chip matching the desired chip sent out by the
|
||
master responds, while the other up to 15 chips do not.
|
||
This is how the system addresses each cart's lockout chip to see if a cart
|
||
exists at that address.
|
||
|
||
FamicomBox Cartridges
|
||
---------------------
|
||
|
||
Software Requirements
|
||
For whatever reason, most or all game cartridges are containing PRG-ROM and
|
||
CHR-ROM stored on EPROMs rather than ROMs. The FamicomBox EPROMs are usually
|
||
(maybe always) containing exactly the same data as normal Famicom ROMs, without
|
||
any FamicomBox specific modifications.
|
||
However, as far as known, the Watchdog feature is active even in Game-mode, so
|
||
games MUST read the controller ports (either 4016h or 4017h) at least every
|
||
17.5 seconds; that might be a problem with a few games (with excessive intros
|
||
without controller input).
|
||
And, the games MUST contain a "header" with valid Checksums and Title (see
|
||
below). The only exception are older games (that were produced before the
|
||
FamicomBox was released; ie. before 1986/1987), for such games, the FamicomBox
|
||
menu cartridge contains a database with about 150 known checksums & titles.
|
||
--> FamicomBox ROM Header (at FFE0h)
|
||
|
||
Hardware Restrictions
|
||
According to Kevin Horton, FamicomBox games cannot use IRQs, and can contain
|
||
memory and I/O ports in the 8000h-FFFFh area only (though unknown what exactly
|
||
is causing that restrictions) (in case of the SRAM area at 6000h-7FFFh: unknown
|
||
if the games are allowed to use the internal SRAM on the FamicomBox mainboard;
|
||
instead of battery-backed SRAM used in retail game cartridges).
|
||
|
||
FamicomBox ROM Header (at FFE0h)
|
||
--------------------------------
|
||
|
||
Some cartridges include header information in the last 20h bytes of PRG-ROM (or
|
||
at the end of EVERY 16K PRG-ROM bank, eg. in "Derby Stallion - Zenkoku Han
|
||
(J)"). The header was inventend around 1987 for use by the FamicomBox, but it's
|
||
also present in around 30% of the existing normal retail cartridges.
|
||
|
||
Summary
|
||
FFE0h 16 Title in ASCII, max 16 chars (right-justified, at FFExh..FFEFh)
|
||
FFF0h 2 PRG-ROM Checksum (big-endian) (ALL bytes, or only last 16Kbytes)
|
||
FFF2h 2 CHR-ROM Checksum (big-endian) (ALL bytes, 0000h if no CHR-ROM)
|
||
FFF4h 1 Unknown/Unused Cartridge Size (MSB=PRG-ROM, LSB=CHR-ROM/RAM) (or so)
|
||
FFF5h 1 Mapper Type (implies Checksum Type), and bit7=Name Table Mirroring
|
||
FFF6h 1 Unknown/Unused (00h=NoTitle?, 01h=Normal, 02h=Mapper4?)
|
||
FFF7h 1 Length of Title minus 1 (typically 02h..0Fh) (or often 10h=Corrupt)
|
||
FFF8h 1 Maker Code (same as for Gameboy and SNES) (01h=Nintendo, etc.)
|
||
FFF9h 1 Header Checksum (00h minus all bytes at [FFF2h..FFF8h])
|
||
FFFAh 2 CPU NMI Vector
|
||
FFFCh 2 CPU RESET Vector
|
||
FFFEh 2 CPU IRQ/BRK Vector
|
||
|
||
PRG-ROM Checksum
|
||
This is the sum of either ALL or SOME bytes of PRG-ROM added together, minus
|
||
the checksum bytes at [FFF0h,FFF1h). The FamicomBox DOES verify this value, and
|
||
works only if the checksum is correctly matched to the mapper type in
|
||
[FFF5h].Bit0-6:
|
||
00h NROM PRG=8K,16K,32K
|
||
01h CNROM PRG=8K,16K,32K
|
||
02h UNROM PRG=128K (fixed size) (8 banks of 16K) chksum per whole 128K
|
||
03h GNROM? PRG=128K (fixed size) (4 banks of 32K) chksum per 32K bank
|
||
04h MMC's PRG=16K chksum per (any) mappable 16K bank(s) at C000h-FFFFh
|
||
05h..7Fh Invalid
|
||
For NROM/CNROM, the FamicomBox is autodetecting PRG-ROM sizes of 8K, 16K, and
|
||
32K and computes the checksum across that region (if the PRG-ROM is smaller,
|
||
then the checksum is including mirror(s) in the 8K region).
|
||
For UNROM, the FamicomBox assumes a fixed size of 128K (aka 8 banks of 16K),
|
||
and computes ONE checksum across the whole 128K area (if the actual ROM should
|
||
be bigger/smaller, then it must be clipped/mirrored to 128K size).
|
||
For GNROM, the FamicomBox assumes a fixed size of 128K (aka 4 banks of 32K),
|
||
and computes FOUR checksums across the separate 32K areas; so the ROM must have
|
||
FOUR headers with FOUR different checksums.
|
||
For MMC's, the FamicomBox simply computes a checksum on the 16K area at
|
||
C000h-FFFFh without trying to perform any bankswitching. If that 16K area is
|
||
mappable, then all 16K blocks must contain separate headers with separate
|
||
checksums (unless maybe if the cartridge contains reset logic that does ensure
|
||
a specific initial bank number to be mapped during checksumming).
|
||
|
||
CHR-ROM Checksum
|
||
This is simply the sum of ALL bytes in CHR-ROM added together (or 0000h if
|
||
there's is no CHR-ROM). The FamicomBox doesn't verify this value, and thus
|
||
doesn't require any mapper specific checksumming mechanisms for CHR-ROM.
|
||
|
||
Bad Headers
|
||
The "FamicomBox" headers found in retail cartridges are often incomplete or
|
||
corrupted. For example, some carts have the title centered or left-justified
|
||
(rather than right-justified within the 16-byte region). Many carts have
|
||
16-byte title length defined as 10h (rather than 0Fh). Some have checksums in
|
||
little-endian (instead of big-endian), or completely missing or incorrect
|
||
checksums.
|
||
Unknown if the headers are also used by other consoles (such like maybe the M82
|
||
demonstration unit).
|
||
|
||
FamicomBox Pinouts
|
||
------------------
|
||
|
||
72-Pin Cartridge Slots (16 slots: for menu cart and 15 game carts)
|
||
Mostly same as 72-pin NES cartridges, see:
|
||
--> Cartridge Pin-Outs
|
||
Pin 16-19 are the 4bit SlotID; for use by the FamicomBox CIC chip (on NES
|
||
carts, these pins are unused "expansion" pins).
|
||
|
||
26pin Front Panel connector (from Mainboard to Front Panel)
|
||
1 - +5V
|
||
2 - +5V
|
||
3 - Front LED anode (cathode is grounded) (green LED "indicating TV/game")
|
||
4 - TV/Game Button (5V on other end, connected to pin 6)
|
||
5 - RESET Button (Low=Pressed) (used to return to Menu)
|
||
6 - +5V
|
||
7 - Coin Connector Pin 3 and connects to LED (err... what LED??)
|
||
8 - Coin Connector Pin 1 and TEST Button (Low=Add credit)
|
||
9 - Controller Pin 1 on Port 3: (5007h.R.Bit2, 5005h.W.Bit2, Zapper GND)
|
||
10 - Controller Pin 4 on Port 1: (4016h.R.Bit0, Joypad 1 Data) ;\can be
|
||
11 - Controller Pin 4 on Port 2: (4017h.R.Bit0, Joypad 2 Data) ;/swapped
|
||
12 - Controller Pin 2 on Port 1: (4016h.Read, Joypad 1 Clock) ;\can be
|
||
13 - Controller Pin 2 on Port 2-3: (4017h.Read, Joypad 2 Clock) ;/swapped
|
||
14 - Controller Pin 3 on Port 1-2: (4016h.W.Bit0, Joypad 1/2 Strobe, OUT0)
|
||
15 - Controller Pin 7 on Port 2-3: (4017h.R.Bit4, Zapper Trigger) ;\only when
|
||
16 - Controller Pin 6 on Port 2-3: (4017h.R.Bit3, Zapper Light) ;/DIP10=On
|
||
17 - Controller Pin 6 on Port 1: (4016h.R.Bit3)
|
||
18 - Controller Pin 7 on Port 1: (4016h.R.Bit4)
|
||
19 - Keyswitch position 0 (Low=Selected) (5003h.R.Bit0)
|
||
20 - Keyswitch position 1 (Low=Selected) (5003h.R.Bit1)
|
||
21 - Keyswitch position 2 (Low=Selected) (5003h.R.Bit2)
|
||
22 - Keyswitch position 3 (Low=Selected) (5003h.R.Bit3)
|
||
23 - Keyswitch position 4 (Low=Selected) (5003h.R.Bit4)
|
||
24 - Keyswitch position 6 (Low=Selected) (5003h.R.Bit5)
|
||
25 - GND
|
||
26 - GND
|
||
|
||
3pin Coin Mechanics connector (from Front Panel to External Coin Unit)
|
||
1 - (pin8 of front panel PCB) (Low=Add credit) (also wired to TEST button)
|
||
2 - GND
|
||
3 - (pin7 of front panel PCB) "connects to LED" err.. what LED, what for?
|
||
|
||
7pin Controller Ports (3 pieces; for 2 Joypads and 1 Zapper)
|
||
Pin Purpose Port 1 (Joy1) Port 2 (Joy2) Port 3 (Zapper)
|
||
1 - Ground GND GND 5005h.W.Bit2/5007h.R.Bit2
|
||
2 - Joypad Clock 4016h.R 4017h.R 4017h.R .---------.
|
||
3 - Joypad Strobe 4016h.W.Bit0 4016h.W.Bit0 NC | 4 3 2 1 |
|
||
4 - Joypad Data 4016h.R.Bit0 4017h.R.Bit0 NC | 7 6 5 /
|
||
5 - Supply +5V +5V +5V '-------'
|
||
6 - Zapper Light 4016h.R.Bit3 4017h.R.Bit3/DIP10 4017h.R.Bit3/DIP10
|
||
7 - Zapper Button 4016h.R.Bit4 4017h.R.Bit4/DIP10 4017h.R.Bit4/DIP10
|
||
|
||
DB-15 on the back of unit (marked "15P expand"):
|
||
1 - GND 9 - 4017h.R enable
|
||
2 - audio output 10 - 4016h.W.2
|
||
3 - /IRQ 11 - 4016h.W.1
|
||
4 - 4017h.R.4 12 - 4016h.W.0
|
||
5 - 4017h.R.3 13 - 4016h.R.1
|
||
6 - 4017h.R.2 14 - 4016h.R enable
|
||
7 - 4017h.R.1 15 - +5V
|
||
8 - 4017h.R.0
|
||
Note: The pinout is the same as the Famicom's DB-15.
|
||
|
||
Test Connector DB-25 on the back of the unit (marked "25P expand"):
|
||
1 - +5V 14 - /IRQ
|
||
2 - 5004h.R.0 15 - 5004h.R.1
|
||
3 - 5004h.R.2 16 - 5004h.R.3
|
||
4 - 5004h.R.4 17 - 5004h.R.5
|
||
5 - 5004h.R.6 18 - 5004h.R.7
|
||
6 - 5006h.W.0 19 - 5006h.W.1
|
||
7 - 5006h.W.2 20 - 5006h.W.3
|
||
8 - 5006h.W.4 21 - 5006h.W.5
|
||
9 - 5006h.W.6 22 - 5006h.W.7
|
||
10 - GND 23 - GND
|
||
11 - GND 24 - M2
|
||
12 - GND 25 - GND
|
||
13 - GND
|
||
Could be used as general-purpose I/O port. Some of the Menu's selftest
|
||
functions expect the DB-25 to be strapped to the DB-15 via an external
|
||
test-adaptor (and the /IRQ pin strapped to a CATV pin?).
|
||
|
||
8pin Screw Terminal Block (marked "CATV INTERFACE")
|
||
1 - 5000h.RW.Bit7 Exception Trap (usually strapped to GND, ie. CATV pin4)
|
||
2 - Unknown
|
||
3 - Unknown
|
||
4 - GND
|
||
5 - +5V
|
||
6 - Unknown
|
||
7 - 5001h.W.Bit6 ;Play-and-Pay (unless TV mode?)
|
||
8 - 5001h.W.Bit7 and 5007h.R.Bit4 ;Joypad/Zapper-Disconnect-Alert
|
||
|
||
Expansion 50-pin Edge Connector (behind a small door on the back left side)
|
||
1 - +5V 26 - 5007h.W enable
|
||
2 - +5V 27 - 5006h.R enable
|
||
3 - +5V 28 - 5005h.R enable
|
||
4 - M2 29 - +5V
|
||
5 - Audio Input 30 - +5V
|
||
6 - +5V 31 - +5V
|
||
7 - PRG A6 32 - PRG A7
|
||
8 - PRG A4 33 - PRG A5
|
||
9 - PRG A2 34 - PRG A3
|
||
10 - PRG A0 35 - PRG A1
|
||
11 - PRG D1 36 - PRG D0
|
||
12 - PRG D3 37 - PRG D2
|
||
13 - PRG D5 38 - PRG D4
|
||
14 - PRG D7 39 - PRG D6
|
||
15 - PRG R/W 40 - /(5000h-5FFFh)
|
||
16 - pin #1 audio 41 - /IRQ
|
||
17 - 4017h.R.5 42 - pin #2 audio
|
||
18 - 4017h.R.7 43 - 4017h.R.6
|
||
19 - 4016h.R.5 44 - 4016h.R.2 (microphone)
|
||
20 - 4016h.R.7 45 - 4016h.R.6
|
||
21 - 5007h.R.3 46 - GND
|
||
22 - 5007h.R.6 47 - GND
|
||
23 - 5007h.R.7 (+5005h.W.5 ?) 48 - GND
|
||
24 - GND 49 - GND
|
||
25 - GND 50 - GND
|
||
|
||
3198 - 16pin Lockout Chip (CIC) (17 pieces; 1 on mainboard, 16 in carts)
|
||
Lockout chip with additional 4bit SlotID (unlike normal NES lockout chips).
|
||
--> Cartridge Cicurity Chip (CIC) (Lockout Chip)
|
||
|
||
3199 - 16pin Coin Timer/Coin Chip (1 piece; on mainboard)
|
||
This is probably the same type of 4bit CPU which is used in CICs.
|
||
1 P00 5001h.W.Bit0 (unknown purpose)
|
||
2 P01 5001h.W.Bit1 (unknown purpose)
|
||
3 P02 5001h.W.Bit2 (unknown purpose)
|
||
4 P03 5001h.W.Bit3 (unknown purpose)
|
||
5 CL2 whatever MHz clock (or maybe NC)
|
||
6 CL1 whatever MHz clock (this one needed)
|
||
7 RES whatever type of reset (maybe I/O controlled?)
|
||
8 GND Supply GND
|
||
9 P10 5003h.R.Bit6 (reportedly "Money system enabled")
|
||
10 P11 5003h.R.Bit7 (unknown purpose)
|
||
11 P12 (unknown purpose)
|
||
12 P13 5001h.W.Bit4 (unknown purpose)
|
||
13 P20 (unknown purpose)
|
||
14 P21 5001h.W.Bit5 (unknown purpose)
|
||
15 P22 (unknown purpose)
|
||
16 VCC Supply VCC
|
||
Note: Reportedly, 5005h.W.Bit1 also connects to whatever 3199 pin. Moreover,
|
||
the 3199 chip should connect to "a LED", sound feep, 40% video dimming, and
|
||
coin-insert signal.
|
||
|
||
Modulator 7pin connector (connection from Mainboard to Modulator)
|
||
Audio - Mono audio from amplifier+external+coin feep
|
||
Video - Comes from the usual transistor circuit on the PPU
|
||
B+ - Supply 5V
|
||
B+SW - Switch (Low=Switches the game in, High=Lets TV signal pass through)
|
||
GND - Supply Ground
|
||
40% - Dimming (undermodulates video by 40%) (Low=Dim, High=Normal)
|
||
? - Unknown (there are seven wires, not only six)
|
||
The 40% input is weird. When the time is about to expire on the coin mechanism,
|
||
it feeps and flashes the screen by using this 40% input. The LED on the coin
|
||
mech also flashes in time with the feeping.
|
||
|
||
Modems
|
||
------
|
||
|
||
Japanese Famicom Modems
|
||
There are at least 4 different Famicom modems:
|
||
Famicom Network System HVC-050
|
||
Famicom Network System FCNS-A
|
||
Famicom Network System Dataship 1200 (Nintendo)
|
||
TV-NET MC-1200B
|
||
All of them do connect to cartridge slot and telephone line (that seems to
|
||
include the TV-NET thing - it appears to be a regular modem; not a video text
|
||
decoder).
|
||
All four modems seem to include some kind of "cartridge" slot, whereas the
|
||
"cartridges" seem to be very flat plastic cards; they are almost looking a bit
|
||
too flat to contain any ROM, SRAM or FLASH memory; so, possibly they are only
|
||
containing some sort of ID codes for selecting specific online services;
|
||
encoded in whatever form... possibly magnets, notches, reflectors (?)
|
||
Specifically for use with the modems, there have been some numeric keypads, in
|
||
form of extended joypads, and some in form of (non-wireless) TV-style remote
|
||
controls:
|
||
--> Controllers - Keypads
|
||
Other than that, there isn't anything known about these modems. Unknown if and
|
||
how far they are compatible with each other. There don't seem to be any dumps
|
||
of the modem BIOSes.
|
||
There seems to be no external storage, so any downloaded content is probably
|
||
lost when switching off the modem - unless it contains some kind of internal
|
||
storage. As far as known, the modems have been used for reading news online,
|
||
and for JRA-PAT horse-betting. So far, for that purposes, it may not have
|
||
used/required any storage, except possibly for storing details like user names.
|
||
|
||
US Baton Teleplay Modem
|
||
An unreleased NES modem that did exist only in prototype form. Unlike the
|
||
japanese modems, it has been intended to support multiplayer games.
|
||
|
||
US Minnesota State Lottery Modem (Control Data Corporation) (1991)
|
||
Another unreleased NES modem, intended for online gambling.
|
||
|
||
Unpredictable Things
|
||
--------------------
|
||
|
||
Reading Garbage from unused PPU Bits
|
||
Semi-stable garbage is returned for 8bit write-only PPU registers (2000h,
|
||
2001h, 2003h, 2005h, 2006h), for lower 5bits of the PPU status register (Port
|
||
2002h), and for upper 2bit of palette values (Port 2007h at PPU address
|
||
3F00h-3FFFh). That garbage value is:
|
||
1) The 8bit-value most recently written to any PPU port (2000h-2007h).
|
||
2) The 8bit-value most recently read from 2004h or 2007h,
|
||
3) The 3bit-value most recently read from 2002h (lower 5bit unchanged).
|
||
4) Zero if none of the above has "updated" the garbage for longer period.
|
||
|
||
Reading from Palette Memory
|
||
Palette entries are 6bit values, when reading from palette memory, the upper
|
||
two bits are garbage (see above). In monochrome mode (Port 2001h/Bit0=1) the
|
||
returned lower 4bit are zero. Also, palette reads appear a bit unstable, and
|
||
occasionally return incorrect values (at least on my PAL NES console).
|
||
|
||
Reading from empty Expansion / SRAM area at 4100h-7FFFh
|
||
Returns the most recently fetched data byte. That is: The third opcode byte
|
||
(direct 16bit addressing), or the second zero-page byte (indirect addressing).
|
||
In either case, the returned value is the MSB of 16bit BASE address, regardless
|
||
of any index value which may wrap the MSB to the next page. For example:
|
||
[4510h]=45h and [44FFh+11h]=44h are receiving different values, even though
|
||
both are reading from the same memory address.
|
||
|
||
Reading from empty Expansion / APU area at 4000h-40FFh
|
||
Empty bits and bytes are: Write-only APU Ports 4000h-4014h, unused expansion
|
||
addresses 4018h-40FFh, and unused bits in APU/Joypad Ports: 4015h/Bit5,
|
||
4016h/Bit7-5 (NES) or Bit7-3 (Famicom), and 4017h/Bit7-5. Normally returned
|
||
garbage is 40h (base MSB, as described for 4100h-7FFFh), unless when indexing
|
||
causes a page-wrap (from 3Fxxh+yyh to 40zzh), in that case several
|
||
"unpredictable" things are happening:
|
||
The CPU adds the index to the address LSB, and reads from that address (3Fzzh)
|
||
by mistake, in a second cycle the CPU adds the carry-out to the address MSB,
|
||
and tries to read from the correct address (40zzh). The hardware doesn't output
|
||
data for 40zzh, so that the CPU receives the most recently fetched data byte,
|
||
which has been [3Fzzh], which is a mirror of PPU register [200zh]. To the
|
||
worst, most PPU registers are either write-only, or cannot be read during
|
||
rendering, see PPU Garbage above.
|
||
Cleverly used, this allows to detect the number of unused bits in 4016h, and to
|
||
separate between NES or Famicom hardware.
|
||
|
||
CPU 65XX Microprocessor
|
||
-----------------------
|
||
|
||
Overview
|
||
--> CPU Registers and Flags
|
||
--> CPU Memory Addressing
|
||
|
||
Instruction Set
|
||
--> CPU Memory and Register Transfers
|
||
--> CPU Arithmetic/Logical Operations
|
||
--> CPU Rotate and Shift Instructions
|
||
--> CPU Jump and Control Instructions
|
||
--> CPU Illegal Opcodes
|
||
|
||
Other Info
|
||
--> CPU Assembler Directives/Syntax
|
||
--> CPU Glitches
|
||
--> CPU The 65XX Family
|
||
--> CPU Local Usage
|
||
|
||
CPU Registers and Flags
|
||
-----------------------
|
||
|
||
The 65XX CPUs are equipped with not more than three 8bit general purpose
|
||
registers (A, X, Y). However, the limited number of registers (and complete
|
||
lack of 16bit registers other than PC) is parts of covered by comfortable
|
||
memory operations, especially page 0 of memory (address 0000h-00FFh) may be
|
||
used for relative fast and complicated operations, in so far one might say that
|
||
the CPU has about 256 8bit 'registers' (or 128 16bit 'registers') in memory.
|
||
For details see Memory Addressing chapter.
|
||
|
||
Registers
|
||
Bits Name Expl.
|
||
8 A Accumulator
|
||
8 X Index Register X
|
||
8 Y Index Register Y
|
||
16 PC Program Counter
|
||
8 S Stack Pointer (see below)
|
||
8 P Processor Status Register (see below)
|
||
|
||
Stack Pointer
|
||
The stack pointer is addressing 256 bytes in page 1 of memory, ie. values
|
||
00h-FFh will address memory at 0100h-01FFh. As for most other CPUs, the stack
|
||
pointer is decrementing when storing data. However, in the 65XX world, it
|
||
points to the first FREE byte on stack, so, when initializing stack to top set
|
||
S=(1)FFh (rather than S=(2)00h).
|
||
|
||
Processor Status Register (Flags)
|
||
Bit Name Expl.
|
||
0 C Carry (0=No Carry, 1=Carry)
|
||
1 Z Zero (0=Nonzero, 1=Zero)
|
||
2 I IRQ Disable (0=IRQ Enable, 1=IRQ Disable)
|
||
3 D Decimal Mode (0=Normal, 1=BCD Mode for ADC/SBC opcodes)
|
||
4 B Break Flag (0=IRQ/NMI, 1=RESET or BRK/PHP opcode)
|
||
5 - Not used (Always 1)
|
||
6 V Overflow (0=No Overflow, 1=Overflow)
|
||
7 N Negative/Sign (0=Positive, 1=Negative)
|
||
|
||
Carry Flag (C)
|
||
Caution: When used for subtractions (SBC and CMP), the carry flag is having
|
||
opposite meaning as for normal 80x86 and Z80 CPUs, ie. it is SET when
|
||
above-or-equal. For all other instructions (ADC, ASL, LSR, ROL, ROR) it works
|
||
as normal, whereas ROL/ROR are rotating <through> carry (ie. much like 80x86
|
||
RCL/RCR and not like ROL/ROR).
|
||
|
||
Zero Flag (Z), Negative/Sign Flag (N), Overflow Flag (V)
|
||
Works just as everywhere, Z it is set when result (or destination register, in
|
||
case of some 'move' instructions) is zero, N is set when signed (ie. same as
|
||
Bit 7 of result/destination). V is set when an addition/subtraction exceeded
|
||
the maximum range for signed numbers (-128..+127).
|
||
|
||
IRQ Disable Flag (I)
|
||
Disables IRQs when set. NMIs (non maskable interrupts) and BRK instructions
|
||
cannot be disabled.
|
||
|
||
Decimal Mode Flag (D)
|
||
Packed BCD mode (range 00h..99h) for ADC and SBC opcodes.
|
||
|
||
Break Flag (B)
|
||
The Break flag is intended to separate between IRQ and BRK which are both using
|
||
the same vector, [FFFEh]. The flag cannot be accessed directly, but there are 4
|
||
situations which are writing the P register to stack, which are then allowing
|
||
the examine the B-bit in the pushed value: The BRK and PHP opcodes always write
|
||
"1" into the bit, IRQ/NMI execution always write "0".
|
||
|
||
CPU Memory Addressing
|
||
---------------------
|
||
|
||
Opcode Addressing Modes
|
||
Name Native Nocash
|
||
Implied - A,X,Y,S,P
|
||
Immediate #nn nn
|
||
Zero Page nn [nn]
|
||
Zero Page,X nn,X [nn+X]
|
||
Zero Page,Y nn,Y [nn+Y]
|
||
Absolute nnnn [nnnn]
|
||
Absolute,X nnnn,X [nnnn+X]
|
||
Absolute,Y nnnn,Y [nnnn+Y]
|
||
(Indirect,X) (nn,X) [[nn+X]]
|
||
(Indirect),Y (nn),Y [[nn]+Y]
|
||
|
||
Zero Page - [nn] [nn+X] [nn+Y]
|
||
Uses an 8bit parameter (one byte) to address the first 256 of memory at
|
||
0000h..00FFh. This limited range is used even for "nn+X" and "nn+Y", ie.
|
||
"C0h+60h" will access 0020h (not 0120h).
|
||
|
||
Absolute - [nnnn] [nnnn+X] [nnnn+Y]
|
||
Uses a 16bit parameter (two bytes) to address the whole 64K of memory at
|
||
0000h..FFFFh. Because of the additional parameter bytes, this is a bit slower
|
||
than Zero Page accesses.
|
||
|
||
Indirect - [[nn+X]] [[nn]+Y]
|
||
Uses an 8bit parameter that points to a 16bit parameter in page zero.
|
||
Even though the CPU doesn't support 16bit registers (except for the program
|
||
counter), this (double-)indirect addressing mode allows to use variable 16bit
|
||
pointers.
|
||
|
||
On-Chip Bi-directional I/O port
|
||
Addresses (00)00h and (00)01h are occupied by an I/O port which is built-in
|
||
into 6510, 8500, 7501, 8501 CPUs (eg. used in C64 and C16), be sure not to use
|
||
the addresses as normal memory. For description read chapter about I/O ports.
|
||
|
||
Caution
|
||
Because of the identical format, assemblers will be more or less unable to
|
||
separate between [XXh+r] and [00XXh+r], the assembler will most likely produce
|
||
[XXh+r] when address is already known to be located in page 0, and [00XXh+r] in
|
||
case of forward references.
|
||
Beside for different opcode size/time, [XXh+r] will always access page 0 memory
|
||
(even when XXh+r>FFh), while [00XXh+r] may direct to memory in page 0 or 1, to
|
||
avoid unpredictable results be sure not to use (00)XXh+r>FFh if possible.
|
||
|
||
CPU Memory and Register Transfers
|
||
---------------------------------
|
||
|
||
Register/Immeditate to Register Transfer
|
||
Opcode Flags Clk Native Nocash Expl.
|
||
A8 nz---- 2 TAY MOV Y,A ;Y=A
|
||
AA nz---- 2 TAX MOV X,A ;X=A
|
||
BA nz---- 2 TSX MOV X,S ;X=S
|
||
98 nz---- 2 TYA MOV A,Y ;A=Y
|
||
8A nz---- 2 TXA MOV A,X ;A=X
|
||
9A ------ 2 TXS MOV S,X ;S=X
|
||
A9 nn nz---- 2 LDA #nn MOV A,nn ;A=nn
|
||
A2 nn nz---- 2 LDX #nn MOV X,nn ;X=nn
|
||
A0 nn nz---- 2 LDY #nn MOV Y,nn ;Y=nn
|
||
|
||
Load Register from Memory
|
||
A5 nn nz---- 3 LDA nn MOV A,[nn] ;A=[nn]
|
||
B5 nn nz---- 4 LDA nn,X MOV A,[nn+X] ;A=[nn+X]
|
||
AD nn nn nz---- 4 LDA nnnn MOV A,[nnnn] ;A=[nnnn]
|
||
BD nn nn nz---- 4* LDA nnnn,X MOV A,[nnnn+X] ;A=[nnnn+X]
|
||
B9 nn nn nz---- 4* LDA nnnn,Y MOV A,[nnnn+Y] ;A=[nnnn+Y]
|
||
A1 nn nz---- 6 LDA (nn,X) MOV A,[[nn+X]] ;A=[WORD[nn+X]]
|
||
B1 nn nz---- 5* LDA (nn),Y MOV A,[[nn]+Y] ;A=[WORD[nn]+Y]
|
||
A6 nn nz---- 3 LDX nn MOV X,[nn] ;X=[nn]
|
||
B6 nn nz---- 4 LDX nn,Y MOV X,[nn+Y] ;X=[nn+Y]
|
||
AE nn nn nz---- 4 LDX nnnn MOV X,[nnnn] ;X=[nnnn]
|
||
BE nn nn nz---- 4* LDX nnnn,Y MOV X,[nnnn+Y] ;X=[nnnn+Y]
|
||
A4 nn nz---- 3 LDY nn MOV Y,[nn] ;Y=[nn]
|
||
B4 nn nz---- 4 LDY nn,X MOV Y,[nn+X] ;Y=[nn+X]
|
||
AC nn nn nz---- 4 LDY nnnn MOV Y,[nnnn] ;Y=[nnnn]
|
||
BC nn nn nz---- 4* LDY nnnn,X MOV Y,[nnnn+X] ;Y=[nnnn+X]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
|
||
Store Register in Memory
|
||
85 nn ------ 3 STA nn MOV [nn],A ;[nn]=A
|
||
95 nn ------ 4 STA nn,X MOV [nn+X],A ;[nn+X]=A
|
||
8D nn nn ------ 4 STA nnnn MOV [nnnn],A ;[nnnn]=A
|
||
9D nn nn ------ 5 STA nnnn,X MOV [nnnn+X],A ;[nnnn+X]=A
|
||
99 nn nn ------ 5 STA nnnn,Y MOV [nnnn+Y],A ;[nnnn+Y]=A
|
||
81 nn ------ 6 STA (nn,X) MOV [[nn+x]],A ;[WORD[nn+x]]=A
|
||
91 nn ------ 6 STA (nn),Y MOV [[nn]+y],A ;[WORD[nn]+y]=A
|
||
86 nn ------ 3 STX nn MOV [nn],X ;[nn]=X
|
||
96 nn ------ 4 STX nn,Y MOV [nn+Y],X ;[nn+Y]=X
|
||
8E nn nn ------ 4 STX nnnn MOV [nnnn],X ;[nnnn]=X
|
||
84 nn ------ 3 STY nn MOV [nn],Y ;[nn]=Y
|
||
94 nn ------ 4 STY nn,X MOV [nn+X],Y ;[nn+X]=Y
|
||
8C nn nn ------ 4 STY nnnn MOV [nnnn],Y ;[nnnn]=Y
|
||
|
||
Push/Pull
|
||
48 ------ 3 PHA PUSH A ;[S]=A, S=S-1
|
||
08 ------ 3 PHP PUSH P ;[S]=P, S=S-1 (flags)
|
||
68 nz---- 4 PLA POP A ;S=S+1, A=[S]
|
||
28 nzcidv 4 PLP POP P ;S=S+1, P=[S] (flags)
|
||
Notes: PLA sets Z and N according to content of A. The B-flag and unused flags
|
||
cannot be changed by PLP, these flags are always written as "1" by PHP.
|
||
|
||
CPU Arithmetic/Logical Operations
|
||
---------------------------------
|
||
|
||
Add memory to accumulator with carry
|
||
69 nn nzc--v 2 ADC #nn ADC A,nn ;A=A+C+nn
|
||
65 nn nzc--v 3 ADC nn ADC A,[nn] ;A=A+C+[nn]
|
||
75 nn nzc--v 4 ADC nn,X ADC A,[nn+X] ;A=A+C+[nn+X]
|
||
6D nn nn nzc--v 4 ADC nnnn ADC A,[nnnn] ;A=A+C+[nnnn]
|
||
7D nn nn nzc--v 4* ADC nnnn,X ADC A,[nnnn+X] ;A=A+C+[nnnn+X]
|
||
79 nn nn nzc--v 4* ADC nnnn,Y ADC A,[nnnn+Y] ;A=A+C+[nnnn+Y]
|
||
61 nn nzc--v 6 ADC (nn,X) ADC A,[[nn+X]] ;A=A+C+[word[nn+X]]
|
||
71 nn nzc--v 5* ADC (nn),Y ADC A,[[nn]+Y] ;A=A+C+[word[nn]+Y]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
|
||
Subtract memory from accumulator with borrow
|
||
E9 nn nzc--v 2 SBC #nn SBC A,nn ;A=A+C-1-nn
|
||
E5 nn nzc--v 3 SBC nn SBC A,[nn] ;A=A+C-1-[nn]
|
||
F5 nn nzc--v 4 SBC nn,X SBC A,[nn+X] ;A=A+C-1-[nn+X]
|
||
ED nn nn nzc--v 4 SBC nnnn SBC A,[nnnn] ;A=A+C-1-[nnnn]
|
||
FD nn nn nzc--v 4* SBC nnnn,X SBC A,[nnnn+X] ;A=A+C-1-[nnnn+X]
|
||
F9 nn nn nzc--v 4* SBC nnnn,Y SBC A,[nnnn+Y] ;A=A+C-1-[nnnn+Y]
|
||
E1 nn nzc--v 6 SBC (nn,X) SBC A,[[nn+X]] ;A=A+C-1-[word[nn+X]]
|
||
F1 nn nzc--v 5* SBC (nn),Y SBC A,[[nn]+Y] ;A=A+C-1-[word[nn]+Y]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
Note: Compared with normal 80x86 and Z80 CPUs, incoming and resulting Carry
|
||
Flag are reversed.
|
||
|
||
Logical AND memory with accumulator
|
||
29 nn nz---- 2 AND #nn AND A,nn ;A=A AND nn
|
||
25 nn nz---- 3 AND nn AND A,[nn] ;A=A AND [nn]
|
||
35 nn nz---- 4 AND nn,X AND A,[nn+X] ;A=A AND [nn+X]
|
||
2D nn nn nz---- 4 AND nnnn AND A,[nnnn] ;A=A AND [nnnn]
|
||
3D nn nn nz---- 4* AND nnnn,X AND A,[nnnn+X] ;A=A AND [nnnn+X]
|
||
39 nn nn nz---- 4* AND nnnn,Y AND A,[nnnn+Y] ;A=A AND [nnnn+Y]
|
||
21 nn nz---- 6 AND (nn,X) AND A,[[nn+X]] ;A=A AND [word[nn+X]]
|
||
31 nn nz---- 5* AND (nn),Y AND A,[[nn]+Y] ;A=A AND [word[nn]+Y]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
|
||
Exclusive-OR memory with accumulator
|
||
49 nn nz---- 2 EOR #nn XOR A,nn ;A=A XOR nn
|
||
45 nn nz---- 3 EOR nn XOR A,[nn] ;A=A XOR [nn]
|
||
55 nn nz---- 4 EOR nn,X XOR A,[nn+X] ;A=A XOR [nn+X]
|
||
4D nn nn nz---- 4 EOR nnnn XOR A,[nnnn] ;A=A XOR [nnnn]
|
||
5D nn nn nz---- 4* EOR nnnn,X XOR A,[nnnn+X] ;A=A XOR [nnnn+X]
|
||
59 nn nn nz---- 4* EOR nnnn,Y XOR A,[nnnn+Y] ;A=A XOR [nnnn+Y]
|
||
41 nn nz---- 6 EOR (nn,X) XOR A,[[nn+X]] ;A=A XOR [word[nn+X]]
|
||
51 nn nz---- 5* EOR (nn),Y XOR A,[[nn]+Y] ;A=A XOR [word[nn]+Y]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
|
||
Logical OR memory with accumulator
|
||
09 nn nz---- 2 ORA #nn OR A,nn ;A=A OR nn
|
||
05 nn nz---- 3 ORA nn OR A,[nn] ;A=A OR [nn]
|
||
15 nn nz---- 4 ORA nn,X OR A,[nn+X] ;A=A OR [nn+X]
|
||
0D nn nn nz---- 4 ORA nnnn OR A,[nnnn] ;A=A OR [nnnn]
|
||
1D nn nn nz---- 4* ORA nnnn,X OR A,[nnnn+X] ;A=A OR [nnnn+X]
|
||
19 nn nn nz---- 4* ORA nnnn,Y OR A,[nnnn+Y] ;A=A OR [nnnn+Y]
|
||
01 nn nz---- 6 ORA (nn,X) OR A,[[nn+X]] ;A=A OR [word[nn+X]]
|
||
11 nn nz---- 5* ORA (nn),Y OR A,[[nn]+Y] ;A=A OR [word[nn]+Y]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
|
||
Compare
|
||
C9 nn nzc--- 2 CMP #nn CMP A,nn ;A-nn
|
||
C5 nn nzc--- 3 CMP nn CMP A,[nn] ;A-[nn]
|
||
D5 nn nzc--- 4 CMP nn,X CMP A,[nn+X] ;A-[nn+X]
|
||
CD nn nn nzc--- 4 CMP nnnn CMP A,[nnnn] ;A-[nnnn]
|
||
DD nn nn nzc--- 4* CMP nnnn,X CMP A,[nnnn+X] ;A-[nnnn+X]
|
||
D9 nn nn nzc--- 4* CMP nnnn,Y CMP A,[nnnn+Y] ;A-[nnnn+Y]
|
||
C1 nn nzc--- 6 CMP (nn,X) CMP A,[[nn+X]] ;A-[word[nn+X]]
|
||
D1 nn nzc--- 5* CMP (nn),Y CMP A,[[nn]+Y] ;A-[word[nn]+Y]
|
||
E0 nn nzc--- 2 CPX #nn CMP X,nn ;X-nn
|
||
E4 nn nzc--- 3 CPX nn CMP X,[nn] ;X-[nn]
|
||
EC nn nn nzc--- 4 CPX nnnn CMP X,[nnnn] ;X-[nnnn]
|
||
C0 nn nzc--- 2 CPY #nn CMP Y,nn ;Y-nn
|
||
C4 nn nzc--- 3 CPY nn CMP Y,[nn] ;Y-[nn]
|
||
CC nn nn nzc--- 4 CPY nnnn CMP Y,[nnnn] ;Y-[nnnn]
|
||
* Add one cycle if indexing crosses a page boundary.
|
||
Note: Compared with normal 80x86 and Z80 CPUs, resulting Carry Flag is
|
||
reversed.
|
||
|
||
Bit Test
|
||
24 nn xz---x 3 BIT nn TEST A,[nn] ;test and set flags
|
||
2C nn nn xz---x 4 BIT nnnn TEST A,[nnnn] ;test and set flags
|
||
Flags are set as so: Z=((A AND [addr])=00h), N=[addr].Bit7, V=[addr].Bit6. Note
|
||
that N and V are affected only by [addr] (not by A).
|
||
|
||
Increment by one
|
||
E6 nn nz---- 5 INC nn INC [nn] ;[nn]=[nn]+1
|
||
F6 nn nz---- 6 INC nn,X INC [nn+X] ;[nn+X]=[nn+X]+1
|
||
EE nn nn nz---- 6 INC nnnn INC [nnnn] ;[nnnn]=[nnnn]+1
|
||
FE nn nn nz---- 7 INC nnnn,X INC [nnnn+X] ;[nnnn+X]=[nnnn+X]+1
|
||
E8 nz---- 2 INX INC X ;X=X+1
|
||
C8 nz---- 2 INY INC Y ;Y=Y+1
|
||
|
||
Decrement by one
|
||
C6 nn nz---- 5 DEC nn DEC [nn] ;[nn]=[nn]-1
|
||
D6 nn nz---- 6 DEC nn,X DEC [nn+X] ;[nn+X]=[nn+X]-1
|
||
CE nn nn nz---- 6 DEC nnnn DEC [nnnn] ;[nnnn]=[nnnn]-1
|
||
DE nn nn nz---- 7 DEC nnnn,X DEC [nnnn+X] ;[nnnn+X]=[nnnn+X]-1
|
||
CA nz---- 2 DEX DEC X ;X=X-1
|
||
88 nz---- 2 DEY DEC Y ;Y=Y-1
|
||
|
||
CPU Rotate and Shift Instructions
|
||
---------------------------------
|
||
|
||
Shift Left Logical/Arithmetic
|
||
0A nzc--- 2 ASL A SHL A ;SHL A
|
||
06 nn nzc--- 5 ASL nn SHL [nn] ;SHL [nn]
|
||
16 nn nzc--- 6 ASL nn,X SHL [nn+X] ;SHL [nn+X]
|
||
0E nn nn nzc--- 6 ASL nnnn SHL [nnnn] ;SHL [nnnn]
|
||
1E nn nn nzc--- 7 ASL nnnn,X SHL [nnnn+X] ;SHL [nnnn+X]
|
||
|
||
Shift Right Logical
|
||
4A 0zc--- 2 LSR A SHR A ;SHR A
|
||
46 nn 0zc--- 5 LSR nn SHR [nn] ;SHR [nn]
|
||
56 nn 0zc--- 6 LSR nn,X SHR [nn+X] ;SHR [nn+X]
|
||
4E nn nn 0zc--- 6 LSR nnnn SHR [nnnn] ;SHR [nnnn]
|
||
5E nn nn 0zc--- 7 LSR nnnn,X SHR [nnnn+X] ;SHR [nnnn+X]
|
||
|
||
Rotate Left through Carry
|
||
2A nzc--- 2 ROL A RCL A ;RCL A
|
||
26 nn nzc--- 5 ROL nn RCL [nn] ;RCL [nn]
|
||
36 nn nzc--- 6 ROL nn,X RCL [nn+X] ;RCL [nn+X]
|
||
2E nn nn nzc--- 6 ROL nnnn RCL [nnnn] ;RCL [nnnn]
|
||
3E nn nn nzc--- 7 ROL nnnn,X RCL [nnnn+X] ;RCL [nnnn+X]
|
||
|
||
Rotate Right through Carry
|
||
6A nzc--- 2 ROR A RCR A ;RCR A
|
||
66 nn nzc--- 5 ROR nn RCR [nn] ;RCR [nn]
|
||
76 nn nzc--- 6 ROR nn,X RCR [nn+X] ;RCR [nn+X]
|
||
6E nn nn nzc--- 6 ROR nnnn RCR [nnnn] ;RCR [nnnn]
|
||
7E nn nn nzc--- 7 ROR nnnn,X RCR [nnnn+X] ;RCR [nnnn+X]
|
||
|
||
Notes:
|
||
ROR instruction is available on MCS650X microprocessors after June, 1976.
|
||
ROL and ROR rotate an 8bit value through carry (rotates 9bits in total).
|
||
|
||
CPU Jump and Control Instructions
|
||
---------------------------------
|
||
|
||
Normal Jumps & Subroutine Calls/Returns
|
||
4C nn nn ------ 3 JMP nnnn JMP nnnn ;PC=nnnn
|
||
6C nn nn ------ 5 JMP (nnnn) JMP [nnnn] ;PC=WORD[nnnn]
|
||
20 nn nn ------ 6 JSR nnnn CALL nnnn ;[S]=PC+2,PC=nnnn
|
||
40 nzcidv 6 RTI RETI ;(from BRK/IRQ/NMI) ;P=[S], PC=[S]
|
||
60 ------ 6 RTS RET ;(from CALL) ;PC=[S]+1
|
||
Note: RTI cannot modify the B-Flag or the unused flag.
|
||
Glitch: For JMP [nnnn] the operand word cannot cross page boundaries, ie. JMP
|
||
[03FFh] would fetch the MSB from [0300h] instead of [0400h]. Very simple
|
||
workaround would be to place a ALIGN 2 before the data word.
|
||
|
||
Conditional Branches (conditional jump to PC=PC+/-dd)
|
||
10 dd ------ 2** BPL nnn JNS nnn ;N=0 plus/positive
|
||
30 dd ------ 2** BMI nnn JS nnn ;N=1 minus/negative/signed
|
||
50 dd ------ 2** BVC nnn JNO nnn ;V=0 no overflow
|
||
70 dd ------ 2** BVS nnn JO nnn ;V=1 overflow
|
||
90 dd ------ 2** BCC/BLT nnn JNC/JB nnn ;C=0 less/below/no carry
|
||
B0 dd ------ 2** BCS/BGE nnn JC/JAE nnn ;C=1 above/greater/equal/carry
|
||
D0 dd ------ 2** BNE/BZC nnn JNZ/JNE nnn ;Z=0 not zero/not equal
|
||
F0 dd ------ 2** BEQ/BZS nnn JZ/JE nnn ;Z=1 zero/equal
|
||
** The execution time is 2 cycles if the condition is false (no branch
|
||
executed). Otherwise, 3 cycles if the destination is in the same memory page,
|
||
or 4 cycles if it crosses a page boundary (see below for exact info).
|
||
Note: After subtractions (SBC or CMP) carry=set indicates above-or-equal,
|
||
unlike as for 80x86 and Z80 CPUs.
|
||
|
||
Interrupts, Exceptions, Breakpoints
|
||
00 ---1-- 7 BRK Force Break B=1,[S]=PC+1,[S]=P,I=1,PC=[FFFE]
|
||
-- ---1-- 7 /IRQ Interrupt B=0,[S]=PC, [S]=P,I=1,PC=[FFFE]
|
||
-- ---1-- 7 /NMI NMI B=0,[S]=PC, [S]=P,I=1,PC=[FFFA]
|
||
-- ---1-- T+6? /RESET Reset B=1,S=S-3, I=1,PC=[FFFC]
|
||
Notes: IRQs can be disabled by setting the I-flag. BRK command, /NMI signal,
|
||
and /RESET signal cannot be masked by setting I.
|
||
BRK/IRQ/NMI first change the B-flag, then write P to stack, and then set the
|
||
I-flag, the D-flag is NOT changed and should be cleared by software.
|
||
The same vector is shared for BRK and IRQ, software can separate between BRK
|
||
and IRQ by examining the pushed B-flag only.
|
||
The RTI opcode can be used to return from BRK/IRQ/NMI, note that using the
|
||
return address from BRK skips one dummy/parameter byte following after the BRK
|
||
opcode.
|
||
Software or hardware must take care to acknowledge or reset /IRQ or /NMI
|
||
signals after processing it.
|
||
IRQs are executed whenever "/IRQ=LOW AND I=0".
|
||
NMIs are executed whenever "/NMI changes from HIGH to LOW".
|
||
If /IRQ is kept LOW then same (old) interrupt is executed again as soon as
|
||
setting I=0. If /NMI is kept LOW then no further NMIs can be executed.
|
||
|
||
CPU Control
|
||
18 --0--- 2 CLC CLC ;Clear carry flag C=0
|
||
58 ---0-- 2 CLI EI ;Clear interrupt disable bit I=0
|
||
D8 ----0- 2 CLD CLD ;Clear decimal mode D=0
|
||
B8 -----0 2 CLV CLV ;Clear overflow flag V=0
|
||
38 --1--- 2 SEC STC ;Set carry flag C=1
|
||
78 ---1-- 2 SEI DI ;Set interrupt disable bit I=1
|
||
F8 ----1- 2 SED STD ;Set decimal mode D=1
|
||
|
||
No Operation
|
||
EA ------ 2 NOP NOP ;No operation
|
||
|
||
Conditional Branch Page Crossing
|
||
The branch opcode with parameter takes up two bytes, causing the PC to get
|
||
incremented twice (PC=PC+2), without any extra boundary cycle. The signed
|
||
parameter is then added to the PC (PC+disp), the extra clock cycle occurs if
|
||
the addition crosses a page boundary (next or previous 100h-page).
|
||
|
||
CPU Illegal Opcodes
|
||
-------------------
|
||
|
||
SAX and LAX
|
||
87 nn ------ 3 SAX nn STA+STX [nn]=A AND X
|
||
97 nn ------ 4 SAX nn,Y STA+STX [nn+Y]=A AND X
|
||
8F nn nn ------ 4 SAX nnnn STA+STX [nnnn]=A AND X
|
||
83 nn ------ 6 SAX (nn,X) STA+STX [WORD[nn+X]]=A AND X
|
||
A7 nn nz---- 3 LAX nn LDA+LDX A,X=[nn]
|
||
B7 nn nz---- 4 LAX nn,Y LDA+LDX A,X=[nn+Y]
|
||
AF nn nn nz---- 4 LAX nnnn LDA+LDX A,X=[nnnn]
|
||
A3 nn nz---- 6 LAX (nn,X) LDA+LDX A,X=[WORD[nn+X]]
|
||
B3 nn nz---- 5* LAX (nn),Y LDA+LDX A,X=[WORD[nn]+Y]
|
||
For SAX, both A and X are output to databus, LOW-bits are stronger than
|
||
HIGH-bits, resulting in a "forceful" AND operation.
|
||
For LAX, the same value is written to both A and X.
|
||
|
||
Combined ALU-Opcodes
|
||
Opcode high-bits, flags, commands:
|
||
00+yy nzc--- SLO op ASL+ORA op=op SHL 1 // A=A OR op
|
||
20+yy nzc--- RLA op ROL+AND op=op RCL 1 // A=A AND op
|
||
40+yy nzc--- SRE op LSR+EOR op=op SHR 1 // A=A XOR op
|
||
60+yy nzc--v RRA op ROR+ADC op=op RCR 1 // A=A+op+cy
|
||
C0+yy nzc--- DCP op DEC+CMP op=op-1 // A-op
|
||
E0+yy nzc--v ISC op INC+SBC op=op+1 // A=A-op-(1-cy)
|
||
Opcode low-bits, clock cycles, operands:
|
||
07+xx nn 5 nn [nn]
|
||
17+xx nn 6 nn,X [nn+X]
|
||
03+xx nn 8 (nn,X) [WORD[nn+X]]
|
||
13+xx nn 8 (nn),Y [WORD[nn]+Y]
|
||
0F+xx nn nn 6 nnnn [nnnn]
|
||
1F+xx nn nn 7 nnnn,X [nnnn+X]
|
||
1B+xx nn nn 7 nnnn,Y [nnnn+Y]
|
||
|
||
Other Illegal Opcodes
|
||
0B nn nzc--- 2 ANC #nn AND+ASL A=A AND nn, C=N ;bit7 to carry
|
||
2B nn nzc--- 2 ANC #nn AND+ROL A=A AND nn, C=N ;same as above
|
||
4B nn nzc--- 2 ALR #nn AND+LSR A=(A AND nn) SHR 1
|
||
6B nn nzc--v 2 ARR #nn AND+ROR A=(A AND nn), V=Overflow(A+A),
|
||
A=A/2+C*80h, C=A.Bit6
|
||
CB nn nzc--- 2 AXS #nn CMP+DEX X=(X AND A)-nn
|
||
EB nn nzc--v 2 SBC #nn SBC+NOP A=A-nn cy?
|
||
BB nn nn nz---- 4* LAS nnnn,Y LDA+TSX A,X,S = [nnnn+Y] AND S
|
||
|
||
NUL/NOP and KIL/JAM/HLT
|
||
xx ------ 2 NOP (xx=1A,3A,5A,7A,DA,FA)
|
||
xx nn ------ 2 NOP #nn (xx=80,82,89,C2,E2)
|
||
xx nn ------ 3 NOP nn (xx=04,44,64)
|
||
xx nn ------ 4 NOP nn,X (xx=14,34,54,74,D4,F4)
|
||
xx nn nn ------ 4 NOP nnnn (xx=0C)
|
||
xx nn nn ------ 4* NOP nnnn,X (xx=1C,3C,5C,7C,DC,FC)
|
||
xx ------ - KIL (xx=02,12,22,32,42,52,62,72,92,B2,D2,F2)
|
||
NOP doesn't change any registers or flags, the operand (if any) is fetched,
|
||
which may be useful for delays, patches, or for read-sensitive I/O ports. KIL
|
||
halts the CPU, the data bus will be set to #$FF, KIL can be suspended by /RESET
|
||
signal (not sure if also by /IRQ or /NMI ???).
|
||
|
||
Unstable Illegal Opcodes
|
||
8B nn nz---- 2 XAA #nn ((2)) TXA+AND A=X AND nn
|
||
AB nn nz---- 2 LAX #nn ((2)) LDA+TAX A,X=nn
|
||
BF nn nn nz---- 4* LAX nnnn,X LDA+LDX A,X=[nnnn+X]
|
||
93 nn ------ 6 AHX (nn),Y ((1)) [WORD[nn]+Y] = A AND X AND H
|
||
9F nn nn ------ 5 AHX nnnn,Y ((1)) [nnnn+Y] = A AND X AND H
|
||
9C nn nn ------ 5 SHY nnnn,X ((1)) [nnnn+X] = Y AND H
|
||
9E nn nn ------ 5 SHX nnnn,Y ((1)) [nnnn+Y] = X AND H
|
||
9B nn nn ------ 5 TAS nnnn,Y ((1)) STA+TXS S=A AND X // [nnnn+Y]=S AND H
|
||
note to XAA: DO NOT USE!!! Highly unstable!!!
|
||
note to LAX: DO NOT USE!!! On my C128, this opcode is stable, but on my C64-II
|
||
it loses bits so that the operation looks like this: ORA #? AND #{imm} TAX.
|
||
note to AXS: performs CMP and DEX at the same time, so that the MINUS sets
|
||
the flag like CMP, not SBC.
|
||
Combinations of STA/STX/STY:
|
||
AHX {adr} = stores A&X&H into {adr}
|
||
SHX {adr} = stores X&H into {adr}
|
||
SHY {adr} = stores Y&H into {adr}
|
||
note: sometimes the &H drops off. Also page boundary crossing will not work as
|
||
expected (the bank where the value is stored may be equal to the value stored).
|
||
["H" probably meant to be the MSB aka Highbyte of the 16bit memory address?]
|
||
|
||
CPU Assembler Directives/Syntax
|
||
-------------------------------
|
||
|
||
Below are some common 65XX assembler directives, and the corresponding
|
||
expressions in 80XX-style language.
|
||
|
||
65XX-style 80XX-style Expl.
|
||
.native .nocash select native or nocash syntax
|
||
*=$c100 org 0c100h sets the assumed origin in memory
|
||
*=*+8 org $+8 increments origin, does NOT produce data
|
||
label label: sets a label equal to the current address
|
||
label=$dc00 label equ 0dc00h assigns a value or address to label
|
||
.by $00 db 00h defines a (list of) byte(s) in memory
|
||
.byt $00 defb 00h same as .by and db
|
||
.wd $0000 dw 0000h defines a (list of) word(s) in memory
|
||
.end end indicates end of source code file
|
||
|nn [|nn] force 16bit "00NN" instead 8bit "NN"
|
||
#<nnnn nnnn AND 0FFh isolate lower 8bits of 16bit value
|
||
#>nnnn nnnn DIV 100h isolate upper 8bits of 16bit value
|
||
N/A (?) fast label ensure relative jump without page crossing
|
||
N/A (?) slow label ensure relative jump with page crossing
|
||
|
||
Special Directives
|
||
.65xx Select 6502 Instruction Set
|
||
.nes Create NES ROM-Image with .NES extension
|
||
.c64_prg Create C64 file with .PRG extension/stub/fixed entry
|
||
.c64_p00 Create C64 file with .P00 extension/stub/fixed entry/header
|
||
.vic20_prg Create VIC20/C64 file with .PRG extension/stub/relocated entry
|
||
end entry End of Source, the parameter specifies the entrypoint
|
||
The C64 files contain Basic Stub "10 SYS<entry>" with default ORG 80Eh.
|
||
|
||
VIC20 Stub
|
||
The VIC20 Stub is "10 SYSPEEK(44)*256+<entry>" with default ORG 1218h, this
|
||
relocates the entryoint relative to the LOAD address (for C64: 818h, for VIC20:
|
||
1018h (Unexpanded), 0418h (3K Expanded), 1218h (8K and more Expansion). It does
|
||
NOT relocate absolute addresses in the program, if the program wishes to run at
|
||
a specific memory location, then it must de-relocate itself from the LOAD
|
||
address to the desired address.
|
||
|
||
CPU Glitches
|
||
------------
|
||
|
||
Dummy Read Cycles at Page-Wraps
|
||
Dummy reads occur when reads from [nnnn+X] or [nnnn+Y] or [WORD[nn]+Y] are
|
||
crossing page boundaries, this applies only to raw read-opcodes, not for write
|
||
or read-and-modify opcodes (ie. only for opcodes that include an extra clock
|
||
cycle on page boundaries, such as LDA, CMP, etc.)
|
||
For above reads, the CPU adds the index register to the lower 8bits of the
|
||
16bit memory address, and does then read from the resulting memory address, if
|
||
the addition caused a carry-out, then an extra clock cycle is used to increment
|
||
the upper 8bits of the address, and to read from the correct memory location.
|
||
For example, a read from [1280h+X] with X=C0h produces a dummy read from
|
||
[1240h], followed by the actual read from [1340h].
|
||
Dummy reads cause no problems with normal ROM or RAM, but may cause problems
|
||
with read-sensitive I/O ports (eg. IRQ flags that are automatically cleared
|
||
after reading, or data-registers that are automatically incrementing associated
|
||
memory pointers, etc.)
|
||
|
||
Dummy Write Cycles in Read-Modify-Opcodes
|
||
Dummy writes occur in all read-modify opcodes, ie. all INC, DEC, Shift, Rotate
|
||
opcodes with memory operands. The opcodes consist of three memory accesses:
|
||
read original value, write dummy value, write result value.
|
||
Dummy writes cause no problems with normal RAM, but may cause problems (or may
|
||
be useful) with write-sensitive I/O ports (eg. IRQ flags that are cleared by
|
||
writing certain values, or data-registers that are automatically incrementing
|
||
associated memory pointers, etc.)
|
||
On the C64 and C16, the written dummy value appears to be equal to the original
|
||
value, a couple of programs are using this to acknowledge IRQs.
|
||
On the NES, the dummy value appears to be equal to the result value, though
|
||
more or less unstable ANDed with a random number. Presumably 00h is output
|
||
during the first half of the write cycle, and the result only during the second
|
||
half, not leaving enough time to raise all bits from LOW to high. Also, dummy
|
||
writes to [2007h] aren't always recognized (ie. the VRAM address register isn't
|
||
always incremented twice), presumably because the PPU isn't fast enough to
|
||
realize two write-signals immediately after each other, that maybe because it
|
||
is attempting to synchronize CPU bus writes with the PPU bus.
|
||
|
||
CPU The 65XX Family
|
||
-------------------
|
||
|
||
Different versions of the 6502:
|
||
|
||
All of these processors are the same concerning the software-side:
|
||
6501 Some sort of 6502 prototype
|
||
6502 Used in the CBM floppies and some other 8 bit computers.
|
||
6507 Used in Atari 2600, 28pins (only 13 address lines, no /IRQ, no /NMI).
|
||
6510 Used in C64, with built-in 6bit I/O port.
|
||
7501 Used in C16,C116,Plus/4, with built-in 7bit I/O Port, without /NMI pin.
|
||
8500 Used in C64-II, with different pin-outs.
|
||
8501 Same as 7501
|
||
8502 Used in C128s.
|
||
|
||
Some processors of the family which are not 100% compatible:
|
||
65C02 Extension of the 6502
|
||
65SC02 Small version of the 65C02 which lost a few opcodes again.
|
||
65CE02 Extension of the 65C02, used in the C65.
|
||
65816 Extended 6502 with new opcodes and 16 bit operation modes.
|
||
2A03 Nintendo NES/Famicom, modified 6502 with built-in sound controller.
|
||
|
||
|
||
CPU Local Usage
|
||
---------------
|
||
|
||
CPU
|
||
The NES uses a customized NMOS 6502 CPU, engineered and produced by Ricoh. It's
|
||
primary customization adds audio. Audio registers are mapped internal to the
|
||
CPU; all waveform generation is done internal to the CPU as well.
|
||
The NES's 6502 does not contain support for decimal mode. Both the CLD and SED
|
||
opcodes function normally, but the 'd' bit of P is unused in both ADC and SBC.
|
||
It is common practice for games to CLD prior to code execution, as the status
|
||
of 'd' is unknown on power-on and on reset.
|
||
NMIs may be generated by PPU each VBlank.
|
||
IRQs may be generated by APU and by external hardware.
|
||
The CPU does include undocumented opcodes, just like normal 6502 CPUs.
|
||
The NTSC NES runs at 1.7897725MHz, and 1.662607MHz for PAL. Which is pretty
|
||
fast for a 6502 compatible CPU, for example C64 used only 1MHz, and Atari 2600
|
||
only 1.2MHz.
|
||
|
||
Hardware Pin-Outs
|
||
-----------------
|
||
|
||
Pin-Outs
|
||
--> Cartridge Pin-Outs
|
||
--> Cartridge Shell Dimensions
|
||
--> Controllers - Pin-Outs
|
||
--> Chipset Pin-Outs
|
||
--> NES Expansion Port
|
||
|
||
Upgrading
|
||
--> Nocash SRAM Circuit
|
||
|
||
Chipset Pin-Outs
|
||
----------------
|
||
|
||
2A03 Pin-Outs & Signal Description (CPU and APU)
|
||
Pin Name Dir Expl.
|
||
1 ROUT Out Sound channel 1+2 output
|
||
2 COUT Out Sound channel 3+4+5 output
|
||
3 /RES In Resets several internal 2A03 registers, and the 6502.
|
||
4-19 A0-15 Out Address Bus
|
||
20 GND - Supply Ground
|
||
21-28 D7-0 I/O Data Bus
|
||
29 CLK In Master clock input (236,250/11 MHz), clocks an internal
|
||
divide-by-12 counter.
|
||
30 ? In Normally grounded in NES/FC consoles, this pin has unknown
|
||
functionality. Might be an input controlling something,
|
||
since the pin does draw a little current. Or might be
|
||
simply some kind of shielding for the CLK signal?
|
||
31 PHI2 Out Divide-by-12 result of the CLK signal (1.79 MHz).
|
||
The internal 6502 along with function generating hardware,
|
||
is clocked off this frequency, and is available externally
|
||
here so that it can be used as a data bus enable signal
|
||
(when at logic level 1) for external 6502 address decoder
|
||
logic. The signal has a 62.5% duty cycle.
|
||
32 /IRQ In Interrupt Request (Low)
|
||
33 /NMI In Non-Maskable Interrupt (on High-to-Low Transition)
|
||
34 R/W Out Direction of 6502's data bus (0=Write/Out, 1=Read/In)
|
||
35 /JOY2 Out Low if A0-A15=4017h, R/W=0, PHI2=1
|
||
36 /JOY1 Out Low if A0-A15=4016h, R/W=0, PHI2=1
|
||
37-39 J2-0 Out Bit2-0 of internal register 4016h (Bit0 = Joystick strobe)
|
||
40 VCC - Supply +5VDC
|
||
On Playchoice 10, Pin 30 is called "/SPECIAL" (seems to be related to pausing
|
||
the CPU). On VS System, Pin 30 is called "NC" and is wired to GND.
|
||
|
||
2C02 Pin-Outs & Signal Descriptions (PPU)
|
||
Pin Dir Name Expl
|
||
1 In CPU R/W Direction when /CS=LOW
|
||
2-9 I/O CPU D0-D7 Data when /CS=LOW
|
||
10-12 In CPU A2-A0 Register Select when /CS=LOW
|
||
13 In CPU /CS CPU read/write to/from PPU Registers
|
||
14-17 I/O EXT0-EXT3 External Master/Slave Video signal (not used)
|
||
18 In CLK 21.47727MHz NTSC, 26.601712MHz PAL
|
||
19 Out /VBL NMI VBlank, LOW max 20 scanlines or until acknowledged
|
||
20 In VEE GND Supply Ground
|
||
21 Out VOUT Composite Video output
|
||
22 In /SYNC EXT External Master /VBL for use by slave (not used) (*)
|
||
23,24 Out PPU /W,/R Video memory Write/Read requests
|
||
25-30 Out PPU A13-A8 Video memory MSB-address lines
|
||
31-38 I/O PPU AD7-AD0 Video memory LSB-address and data lines
|
||
39 Out PPU ALE Address Latch Enable, HIGH when A0-A7 output at AD0-AD7
|
||
40 In VCC +5VDC Supply
|
||
(*) On Famicom consoles, /SYNC EXT is always tied to logical one. On the NES
|
||
however, this pin is tied in with the 2A03's reset input, and as a result, the
|
||
picture is always disabled while the reset switch is held in on an NES.
|
||
On RGB PPUS (both Playchoice 10 and VS System ones), Pin 14-17,21,22 are
|
||
R,G,B,GND,/SYNC,/RST.
|
||
|
||
NES Expansion Port
|
||
------------------
|
||
|
||
NES Expansion Port, 48-pins, (at bottom of console, rarely used)
|
||
Pin Dir Expl.
|
||
1,48,2,47 Out VCC,VCC,GND,GND (Supply +5VDC and Ground)
|
||
23 Out VDD voltage from external power supply (usually +10VDC)
|
||
3 In AIN (Audio Input)
|
||
21,22,23,24 Out VOUT, AOUT (Video and Audio Outputs)
|
||
4,14,25-32 I/O CPU /NMI,/IRQ,D7,D6,D5,D4,D3,D2,D1,D0
|
||
5,24 Out CPU A15, CIC 4MHz
|
||
6-10,38-42 I/O Cart Pin 51-55,20-16
|
||
43,44,45 Out OUT0, OUT1, OUT2 (Port 4016h Bit0-2 Outputs)
|
||
34 and 37 Out PORT0-CLK (both pins) (CPU Read from Port 4016h)
|
||
11 and 17 Out PORT1-CLK (both pins) (CPU Read from Port 4017h)
|
||
35,12,33,13,36 In PORT0-0,1,2,3,4 (Port 4016h Bit0-3 Inverted Inputs)
|
||
19,20,15,16,18 In PORT1-0,1,2,3,4 (Port 4017h Bit0-3 Inverted Inputs)
|
||
46 - Unused
|
||
|
||
Nocash SRAM Circuit
|
||
-------------------
|
||
|
||
Step 1 - Basic Connection, NROM support (32K+8K), Horizontal Mirroring
|
||
________ ________ ________
|
||
VCC ---------|A13-A19 | VCC ------tmp-|A15-A18 | VCC -----tmp-|A13-A18 |
|
||
CPU A0-A12 --|A0-A12 | CPU A0-A14 ---|A0-A14 | PPU A0-A12 --|A0-A12 |
|
||
CPU D0-D7 ---|D0-D7 | CPU D0-D7 ----|D0-D7 | PPU D0-D7 ---|D0-D7 |
|
||
CPU /PRG ----|/CS | CPU /PRG -----|/CS | PPU A13 -tmp-|/CS |
|
||
LPT /LF -tmp-|/OE BIOS| LPT /SEL -----|/OE WRAM| PPU /R ------|/OE VRAM|
|
||
|________| CPU R/W ------|/WE | PPU /W ------|/WE |
|
||
___ |________| |________|
|
||
VCC -|___|- CPU /RESET
|
||
CIC /RESET --cut-- CPU /RESET FLOPPY 5VDC ------- VCC (supply)
|
||
CIC /RESET --|<|-- CPU /RESET LPT GND ------- GND
|
||
LPT /INIT --|<|-- CPU /RESET PPU /A13 --tmp-- NES /VCS
|
||
LPT /STROBE --|<|-- CPU /NMI PPU A10 --tmp-- NES VA10
|
||
CIC MODE --cut-- VCC (lockout) LPT BUSY ------- CPU OUT2
|
||
CIC MODE ------- GND (no lockout) LPT D7 ------- EXP PORT0-1
|
||
|
||
At this stage, the console won't work if an external cartridge is inserted.
|
||
|
||
Step 2 - Horizontal or Vertical Mirroring Control
|
||
____ ____
|
||
LPT D0 ----|OR \__|AND |_______ NES VA10 (out) PPU A10 --undo-- NES VA10
|
||
PPU A10 ---|____/ |7411|
|
||
LPT D1 ----|OR \__| |__tmp__ VCC (third AND-input, used in Step 3)
|
||
PPU A11 ---|____/ |____|
|
||
|
||
Step 3 - Internal Circuit Disable (Required for Internal Circuit only)
|
||
____ ____ ___
|
||
CPU /PRG --|OR \__ SLOT /PRG LPT /LF --|AND \__ CART VCC -|___|- LPT /LF
|
||
/CART -----|____/ LPT /SEL -|____/ VCC -|___|- LPT /SEL
|
||
PPU /R ----|OR \__ SLOT /R CART -----|NAND\__ /CART VCC -|___|- LPT D0
|
||
/CART -----|____/ CART -----|____/ VCC -|___|- LPT D1
|
||
CART ------|OR \__ VRAM /CS CPU A14 --|AND \__ SLOT A14
|
||
PPU A13 ---|____/ CART -----|____/ NES /VCS --cut-- SLOT /VCS
|
||
/CART -----|OR \__ AND (Step 2) NES VA10 --cut-- SLOT VA10
|
||
SLOT VA10 -|____/ CPU A14 --cut-- SLOT A14
|
||
CART ------|OR \__ ____ CPU /PRG --cut-- SLOT /PRG
|
||
PPU /A13 --|____/ |AND \__ NES /VCS PPU /R --cut-- SLOT /R
|
||
SLOT /VCS -|OR \__|____/ VCC --undo-- AND (Step 2)
|
||
/CART -----|____/ PPU A13 -undo- VRAM /CS PPU /A13 --undo- NES /VCS
|
||
|
||
Also allows to disable the internal circuit so that external cartridges can be
|
||
used when LPT cable is disconnected (or when LPT signals are all HIGH).
|
||
|
||
Step 4 - UNROM (N*16K+8K) and CNROM (32K+N*8K) Bank Switching
|
||
__________ __________ ____
|
||
LPT /LF ----|/CLKEN1 | LPT LF -----|/CLKEN1 | WRAM A14 --|____|-- VCC
|
||
CPU R/W ----|/CLKEN2 | CPU R/W ----|/CLKEN2 | WRAM A15 --|____|-- VCC
|
||
CPU /PRG ---|CLK | CPU /PRG ---|CLK | WRAM A16 --|____|-- VCC
|
||
CPU D0..3 --|D0..3 | CPU D0..3 --|D0..3 | LPT /LF ---|NAND\_ LPT LF
|
||
GND --------|/OE1 | CPU A14 ----|/OE1 | LPT /LF ---|____/
|
||
GND --------|/OE2 74173| GND --------|/OE2 74173| LPT /SEL --|NAND\_ BIOS
|
||
GND --------|RST CNROM| GND --------|RST UNROM| LPT LF ----|____/ /OE
|
||
VRAM A13-16-|Q0..3 | WRAM A14-16-|Q0..2 | WRAM A15-A16 --undo-- VCC
|
||
|__________| |__________| VRAM A13-A16 --undo-- VCC
|
||
LPT /LF --undo-- BIOS /OE WRAM A14 --undo-- CPU A14
|
||
|
||
Step 5 - Optional 8bit high-speed upload connection
|
||
____ ____ __________
|
||
CPU A13 --|AND | CPU /PRG -|AND | ____ CPU D0-7--|Q0-7 D0-7|--LPT D0-7
|
||
CPU A14 --|7411| CPU R/W --|7411| VCC-|NAND\__________|/OE1 /OE2|--LPT /SEL
|
||
CPU PHI2 -|____|-----------|____|-----|____/ 74541 |__________|
|
||
|
||
The 1bit PORT0-1 connection is no longer used (may be disconnected if desired).
|
||
|
||
Compatibility Notes
|
||
WRAM and VRAM are not write-protected, and may get overwritten by accidental
|
||
writes to ROM/VROM area, that applies also for writes to bank selection ports
|
||
(no problem for cartridges that handle bus-conflicts, it will simply replace
|
||
the value in RAM by the (same) written value). In NROM mode, bank selection
|
||
ports are not protected against accidental ROM-area writes.
|
||
|
||
Soldering Notes
|
||
To reduce the amount of wires, the WRAM/VRAM chips can be stacked on top of the
|
||
internal 2K SRAMs with 1:1 connection for most pins, also the BIOS EPROM socket
|
||
can be stacked on the WRAM chip.
|
||
Optionally, the circuit could be connected externally to the cartridge slot
|
||
(with /RESET and /NMI connected to unused cartridge/expansion port pins), the
|
||
/CART and CART signals would be not required, Step 3 could be left out.
|
||
|
||
Parts List
|
||
2 SRAM WRAM/VRAM, min 32K/8K, recommended 128K/32K, max 128K/128K
|
||
1 EPROM BIOS, 27C64 or similar, min 8K
|
||
2 74LS32 quad 2-input OR gates
|
||
1 74LS08 quad 2-input AND gates
|
||
1 74LS00 quad 2-input NAND gates
|
||
1 74LS11 triple 3-input AND gates
|
||
2 74LS173 4-bit 3-state flip-flops
|
||
1 74LS541 8-bit 3-state buffer/line driver
|
||
8 10K pull-up resitors
|
||
3 1N4148 diodes for /RESET and /NMI
|
||
Plus, eprom socket, optionally also sockets for all other chips, 100nF
|
||
capacitors for power supply of all chips, centronics printer cable, centronics
|
||
socket, wire, board, solder, eprom burner, etc.
|
||
|
||
BIOS ROM-Image
|
||
0000 85 04 48 8A 48 A9 19 8D FA FF A9 04 8D FB FF A2
|
||
0010 08 E0 00 D0 FC 68 AA 68 60 A9 00 06 04 69 03 8D
|
||
0020 16 40 CA 40 8A 48 A9 3B 8D FA FF A9 04 8D FB FF
|
||
0030 A2 08 E0 00 D0 FC 68 AA A5 04 60 24 0D 30 09 AD
|
||
0040 16 40 4A 4A 26 04 CA 40 AD 00 60 85 04 A2 00 40
|
||
0050 20 24 04 A2 7E A0 04 24 0D 30 04 A2 8D A0 04 8E
|
||
0060 FA FF 8C FB FF 8D FF FF A9 00 8D 01 20 8D 06 20
|
||
0070 8D 06 20 A2 00 A0 20 A9 01 85 04 4C 7B 04 AD 00
|
||
0080 60 8D 07 20 CA D0 FE 88 D0 FE 4C 1C 06 AD 16 40
|
||
0090 4A 4A 26 04 90 FE A5 04 8D 07 20 A9 01 85 04 CA
|
||
00A0 D0 FE 88 D0 FE 4C 1C 06 20 24 04 A2 DC A0 04 24
|
||
00B0 0D 30 04 A2 EE A0 04 8E FA FF 8C FB FF 8D FF FF
|
||
00C0 A0 BF A2 FF C9 FF D0 04 A0 FF A2 F9 8C FC 04 8C
|
||
00D0 E2 04 E8 A0 40 A9 01 85 04 4C D9 04 AD 00 60 CA
|
||
00E0 9D 00 FF D0 FE CE E2 04 88 D0 FE 4C 1C 06 AD 16
|
||
00F0 40 4A 4A 26 04 90 FE A5 04 CA 9D 00 FF A9 01 85
|
||
0100 04 E0 00 D0 FE CE FC 04 88 D0 FE 4C 1C 06 A2 00
|
||
0110 20 24 04 95 05 E8 E0 08 D0 F6 A2 00 B5 05 9D FA
|
||
0120 FF E8 E0 06 D0 F6 A1 05 81 05 4C 2A 05 A2 55 A0
|
||
0130 AA 8E FE FF 8C FF FF EC FE FF D0 F5 CC FF FF D0
|
||
0140 F0 8C FE FF 8E FF FF CC FE FF D0 E5 EC FF FF D0
|
||
0150 E0 60 A2 00 BD 61 05 20 00 04 E8 BD 61 05 D0 F4
|
||
0160 60 4E 4F 24 4E 45 53 20 42 49 4F 53 20 56 31 2E
|
||
0170 30 00 A9 00 85 0D 20 87 05 A9 80 85 0D 20 87 05
|
||
0180 F0 04 A9 00 85 0D 60 A2 00 A0 2B 20 24 04 DD A1
|
||
0190 05 F0 02 A0 2D E8 E0 08 D0 F1 98 20 00 04 C9 2B
|
||
01A0 60 00 FF 55 AA 0F F0 3C C3 A9 57 20 00 04 A2 FF
|
||
01B0 8D FF FF E8 8E 00 80 8E FF BF EC FF FF F0 06 E0
|
||
01C0 1F D0 F0 A2 01 E8 8A 20 00 04 60 A9 56 20 00 04
|
||
01D0 A2 40 A0 56 A9 00 8D 01 20 CA 8E FF FF 8D 06 20
|
||
01E0 8D 06 20 8C 07 20 8E 07 20 D0 EE A2 00 8E FF FF
|
||
01F0 8D 06 20 8D 06 20 CD 07 20 CC 07 20 D0 0A EC 07
|
||
0200 20 D0 05 E8 E0 40 D0 E5 8A 20 00 04 60 20 2D 05
|
||
0210 20 52 05 20 72 05 20 A9 05 20 CB 05 A9 52 20 00
|
||
0220 04 20 24 04 C9 57 D0 03 4C A8 04 C9 56 D0 03 4C
|
||
0230 50 04 C9 46 D0 03 4C 0E 05 4C 39 06 A2 00 BD 00
|
||
0240 E0 9D 00 04 BD 00 E1 9D 00 05 BD 00 E2 9D 00 06
|
||
0250 BD 00 E3 9D 00 07 E8 D0 E5 60 78 D8 A9 00 8D 00
|
||
0260 20 AD 02 20 A2 FF 9A 20 3C E2 4C 0D 06 FF FF FF
|
||
0270 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
|
||
.... FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
|
||
1FF0 FF FF FF FF FF FF FF FF FF FF 00 00 5A E2 00 00
|
||
To be copied to the highest memory location, ie. E000h-FFFFh for a 64K EPROM.
|
||
|
||
About Everynes
|
||
--------------
|
||
|
||
Everynes
|
||
Everything about NES and Famicom.
|
||
Nocash Technical Specifications written 2004 by Martin Korth.
|
||
Everynes Text and Html and Debugger versions and updates available at:
|
||
http://problemkaputt.de/nes.htm
|
||
I've originally written Everynes when collecting and sorting-out relevant info
|
||
for making the no$nes emulator/debugger. I've included a copy of the resulting
|
||
document in the debuggers help text, and also released raw txt/htm versions,
|
||
which may be eventually of some use to NES/Famicom programmers.
|
||
|
||
Help welcome
|
||
Please let me know if you come across anything that is incomplete, incorrect,
|
||
or unclear. A couple of details (marked by question marks) are definetly
|
||
unclear to me - additional info would be very welcome!
|
||
My email address hides in no$nes.exe about box (for anti-spam reasons).
|
||
|
||
Thanks & Credits
|
||
Most of the Everynes document is based on information from many other documents
|
||
found at nesdev.parodius.com - hoping that nobody gets angry about picking info
|
||
from his/her docs - I'd like to send many thanks to the authors of that great
|
||
documents, and to all people whom have contributed information to those docs,
|
||
complete list as far as known to me - many thangs to:
|
||
|
||
(Feedback)
|
||
Thanks to Joe Lennox, and #nesdev on EFnet for Everynes corrections.
|
||
|
||
MAPPERS.NFO
|
||
Comprehensive NES Mapper Document v0.80 by \Firebug\
|
||
Thanks to FanWen, Y0SHi, D, Jim Geffre, Goroh, Paul Robson, Mark Knibbs.
|
||
|
||
2A03TECH.TXT
|
||
2A03 technical reference by Brad Taylor
|
||
Thanks to Matthew Conte, Kentaro Ishihara, Goroh, Memblers, FluBBa, Izumi,
|
||
Chibi-Tech, Quietust, SnowBro, Bananmos, Kevin Horton, and many others for
|
||
their time and help on and off the NESdev mailing list, and the Membled
|
||
Messageboards.
|
||
|
||
2C02TECH.TXT
|
||
NTSC 2C02 technical reference by Brad Taylor
|
||
Thanks to the NES community. http://nesdev.parodius.com.
|
||
Special thanks to Neal Tew for scrolling information.
|
||
|
||
FDSTECH.TXT
|
||
Famicom Disk System Technical Reference by Brad Taylor. Special thanks to Nori,
|
||
Goroh, Ki, Sgt. Bowhack and "D".
|
||
|
||
NESTECH2.TXT
|
||
Nintendo Entertainment System Documentation, Version: 2.00
|
||
Alex Krasivsky
|
||
Andrew Davie
|
||
Avatar Z
|
||
Barubary
|
||
Bluefoot
|
||
CiXeL
|
||
Chi-Wen Yang
|
||
Chris Hickman
|
||
D
|
||
Dan Boris
|
||
David de Regt
|
||
Donald Moore
|
||
Fredrik Olsson
|
||
Icer Addis
|
||
Jon Merkel
|
||
Kevin Horton
|
||
Loopy
|
||
Marat Fayzullin
|
||
Mark Knibbs
|
||
Martin Nielsen
|
||
Matt Conte
|
||
Matthew Richey
|
||
Memblers
|
||
MiKael Iushin
|
||
Mike Perry
|
||
Morgan Johansson
|
||
Neill Corlett
|
||
Pat Mccomack
|
||
Patrik Alexandersson
|
||
Paul Robson
|
||
Ryan Auge
|
||
Stumble
|
||
Tennessee Carmel-Veilleux
|
||
Thomas Steen
|
||
Tony Young
|
||
Vince Indriolo
|
||
\FireBug\
|
||
|
||
FFPA.TXT
|
||
Famicom Four-Player Adapters Technical Document by Richard Hoelscher
|
||
|
||
NES4PLAY.TXT
|
||
NES 4player-adapter documentation by Fredrik Olsson
|
||
Special thanks to:
|
||
Juan Antonio Gomez Galvarez
|
||
Yoshi
|
||
Marat Fayzulin
|
||
Morgan Johansson
|
||
|
||
Pin-Outs
|
||
drk421
|
||
Siudym'2001
|
||
|
||
6205BUGS.TXT
|
||
Ivo van Poorten
|
||
|
||
NLOCKOUT.TXT
|
||
by Mark (Knipps?)
|
||
|
||
VSDOC.TXT
|
||
VS Unisystem information version 1.0, by Fx3
|
||
|
||
PC10DOC.TXT
|
||
Nintendo Playchoice 10 Hardware Description by Oliver Achten
|
||
|
||
NESGG.TXT
|
||
NES Game Genie Code Format DOC v0.71 by Benzene of Digital Emutations
|
||
Special thanks to Sardu, Opcode, Deuce, DrSplat, KingPin
|
||
|
||
NESFQ.HTM
|
||
NES Tech FAQ by Chris Covell
|
||
|
||
NES.HTM
|
||
Nintendo Entertainment System Architecture by Marat Fayzullin
|
||
Pascal Felber Patrick Lesaard Tink
|
||
Goroh Pan of Anthrox Bas Vijfwinkel
|
||
Kawasedo Paul Robson
|
||
Marcel de Kogel Serge Skorobogatov
|
||
Alex Krasivsky John Stiles
|
||
|
||
KEYBOARD.TXT
|
||
Reverse Engineering the Keyboard of Family Computer
|
||
by goroh, english translation by Ki
|
||
|
||
LIGHTGUN.TXT
|
||
Family Computer Gun
|
||
by goroh, english translation by Ki
|
||
|
||
POWERPAD.TXT
|
||
Power Pad information Version: 1.2 (03/12/00) by Tennessee Carmel-Veilleux
|
||
Thanks to Jeremy D. Chadwick, Kevin Horton
|
||
|
||
CPU
|
||
Project64, Graham
|
||
|
||
The weird and wonderful CIC
|
||
Segher's rev-engineered instruction set for the CIC CPU.
|
||
|
||
Index
|
||
-----
|
||
|
||
--> Contents
|
||
--> No$nes Controls
|
||
--> XED Editor
|
||
--> XED About
|
||
--> XED Hotkeys
|
||
--> XED Assembler/Debugger Interface
|
||
--> XED Commandline based standalone version
|
||
--> No$nes Emulation Files
|
||
--> Tech Data
|
||
--> Memory Maps
|
||
--> I/O Map
|
||
--> Picture Processing Unit (PPU)
|
||
--> PPU Reset
|
||
--> PPU Control and Status Registers
|
||
--> PPU SPR-RAM Access Registers
|
||
--> PPU VRAM Access Registers
|
||
--> PPU Scrolling
|
||
--> PPU Tile Memory
|
||
--> PPU Background
|
||
--> PPU Sprites
|
||
--> PPU Palettes
|
||
--> PPU Dimensions & Timings
|
||
--> PPU 2C02 Timings
|
||
--> 3D Glasses
|
||
--> Audio Processing Unit (APU)
|
||
--> APU Channel 1-4 Register 0 (Volume/Decay)
|
||
--> APU Channel 1-4 Register 1 (Sweep)
|
||
--> APU Channel 1-4 Register 2 (Frequency)
|
||
--> APU Channel 1-4 Register 3 (Length)
|
||
--> APU Channel 5 - DMC Sound
|
||
--> APU Control and Status Registers
|
||
--> APU 4-bit DAC
|
||
--> APU Various
|
||
--> APU DMC-DMA Glitch
|
||
--> APU External Sound Channels
|
||
--> Controllers
|
||
--> Controllers - I/O Ports
|
||
--> Controllers - Pin-Outs
|
||
--> Controllers - Summary of Controller Types
|
||
--> Controllers - Summary of Controller Signals
|
||
--> Controllers - Detection
|
||
--> Controllers - Joypads
|
||
--> Controllers - Four-Player Adaptors
|
||
--> Controllers - Lightguns (Zapper)
|
||
--> Controllers - Paddles
|
||
--> Controllers - Push Buttons
|
||
--> Controllers - Typewriter Keyboards
|
||
--> Controllers - Piano Keyboards
|
||
--> Controllers - Piano - Miracle Piano Controller Port
|
||
--> Controllers - Piano - Miracle Piano MIDI Commands
|
||
--> Controllers - Piano - Miracle Piano Instruments
|
||
--> Controllers - Piano - Miracle Pinouts and Component List
|
||
--> Controllers - Keypads
|
||
--> Controllers - Mats
|
||
--> Controllers - Inflatable Controllers
|
||
--> Controllers - RacerMate Bicycle Training System
|
||
--> Controllers - Tablets
|
||
--> Controllers - Trackball and Mouse
|
||
--> Controllers - Power Glove
|
||
--> Controllers - Power Glove Transmission Protocol (RX/TX)
|
||
--> Controllers - Power Glove TX Packets (Configuration Opcodes)
|
||
--> Controllers - Power Glove RX Packets (Position/Sensor Data)
|
||
--> Controllers - Power Glove Games and Compatibilty Modes
|
||
--> Controllers - Power Glove Drawings
|
||
--> Controllers - Power Glove Pinouts
|
||
--> Controllers - UForce
|
||
--> Controllers - UForce I/O
|
||
--> Controllers - UForce Drawings
|
||
--> Controllers - UForce Games and Game Switches
|
||
--> Controllers - Barcode Readers
|
||
--> Controllers - Barcode Battler (barcode reader)
|
||
--> Controllers - Barcode Battler Transmission I/O
|
||
--> Controllers - Barcode Battler Drawings
|
||
--> Controllers - Barcode Formats
|
||
--> Controllers - Pachinko
|
||
--> Controllers - Microphones
|
||
--> Controllers - Reset Button
|
||
--> Controllers - Arcade Machines
|
||
--> Storage Data Recorder
|
||
--> Storage Turbo File
|
||
--> Storage Battle Box
|
||
--> Storage Battle Box I/O Access
|
||
--> Storage Battle Box Filesystem
|
||
--> Hori Game Repeater
|
||
--> Headphones
|
||
--> R.O.B. (Robotic Operating Buddy)
|
||
--> R.O.B. Technical Drawings
|
||
--> Cartridges and Mappers
|
||
--> Cartridge Overview
|
||
--> Cartridge ROM-Image File Formats
|
||
--> Cartridge IRQ Counters
|
||
--> Cartridge Bus Conflicts
|
||
--> Cartridge Cicurity Chip (CIC) (Lockout Chip)
|
||
--> Cartridge CIC Pseudo Code
|
||
--> Cartridge CIC Instruction Set
|
||
--> Cartridge CIC Notes
|
||
--> Cartridge CIC Versions
|
||
--> Cartridge CIC Pinouts
|
||
--> Cartridge CIC Tengen Clone
|
||
--> Cartridge Cheat Devices
|
||
--> Cartridge Pin-Outs
|
||
--> Cartridge Shell Dimensions
|
||
--> Mapper 0: NROM - No Mapper (or unknown mapper)
|
||
--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT
|
||
--> Mapper 2: UNROM - PRG/16K
|
||
--> Mapper 3: CNROM - VROM/8K
|
||
--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ
|
||
--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc.
|
||
--> Mapper 5: MMC5 - I/O Map
|
||
--> Mapper 5: MMC5 - CPU Memory Control
|
||
--> Mapper 5: MMC5 - Video Name Table
|
||
--> Mapper 5: MMC5 - Video Pattern Table
|
||
--> Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit
|
||
--> Mapper 5: MMC5 - Video EXRAM
|
||
--> Mapper 5: MMC5 - Sound Control
|
||
--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches
|
||
--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ
|
||
--> Mapper 7: AOROM - PRG/32K, Name Table Select
|
||
--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ
|
||
--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH
|
||
--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH
|
||
--> Mapper 11: Color Dreams - PRG/32K, VROM/8K
|
||
--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ
|
||
--> Mapper 13: CPROM - 16K VRAM
|
||
--> Mapper 15: X-in-1 - PRG/32K/16K, NT
|
||
--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM
|
||
--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT
|
||
--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND
|
||
--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND
|
||
--> Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT
|
||
--> Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ)
|
||
--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 21-26,73,75,85: Konami VRC Mappers
|
||
--> Mapper 28: Action 53 homebrew X-in-1
|
||
--> Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT
|
||
--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ
|
||
--> Mapper 34: Nina-1 - PRG/32K, VROM/4K
|
||
--> Mapper 40: FDS-Port - Lost Levels
|
||
--> Mapper 41: Caltron 6-in-1
|
||
--> Mapper 42: FDS-Port - Mario Baby
|
||
--> Mapper 43: X-in-1
|
||
--> Mapper 44: 7-in-1 MMC3 Port A001h
|
||
--> Mapper 45: X-in-1 MMC3 Port 6000hx4
|
||
--> Mapper 46: 15-in-1 Color Dreams
|
||
--> Mapper 47: 2-in-1 MMC3 Port 6000h
|
||
--> Mapper 48: Taito TC190V
|
||
--> Mapper 49: 4-in-1 MMC3 Port 6xxxh
|
||
--> Mapper 50: FDS-Port - Alt. Levels
|
||
--> Mapper 51: 11-in-1
|
||
--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM
|
||
--> Mapper 56: Pirate SMB3
|
||
--> Mapper 57: 6-in-1
|
||
--> Mapper 58: X-in-1
|
||
--> Mapper 61: 20-in-1
|
||
--> Mapper 62: X-in-1
|
||
--> Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ
|
||
--> Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ
|
||
--> Mapper 66: GNROM - PRG/32K, VROM/8K
|
||
--> Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ
|
||
--> Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM
|
||
--> Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ
|
||
--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT
|
||
--> Mapper 71: Camerica - PRG/16K
|
||
--> Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K
|
||
--> Mapper 73: Konami VRC3 - PRG/16K, IRQ
|
||
--> Mapper 74: Whatever MMC3-style
|
||
--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT
|
||
--> Mapper 76: Namco 109 - PRG/8K, VROM/2K
|
||
--> Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K
|
||
--> Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K
|
||
--> Mapper 79: AVE Nina-3 - VROM/8K
|
||
--> Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT
|
||
--> Mapper 81: AVE Nina-6
|
||
--> Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K
|
||
--> Mapper 83: Cony
|
||
--> Mapper 84: Whatever
|
||
--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND
|
||
--> Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K
|
||
--> Mapper 87: Jaleco/Konami 16K VROM - VROM/8K
|
||
--> Mapper 88: Namco 118
|
||
--> Mapper 89: Sunsoft Early - PRG/16K, VROM/8K
|
||
--> Mapper 90: Pirate MMC5-style
|
||
--> Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ
|
||
--> Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K
|
||
--> Mapper 93: 74161/32 - PRG/16K
|
||
--> Mapper 94: 74161/32 - PRG/16K
|
||
--> Mapper 95: Namcot MMC3-Style
|
||
--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH
|
||
--> Mapper 97: Irem - PRG HI
|
||
--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K)
|
||
--> Mapper 100: Whatever
|
||
--> Mapper 105: X-in-1 MMC1
|
||
--> Mapper 112: Asder - PRG/8K, VROM/2K/1K
|
||
--> Mapper 113: Sachen/Hacker/Nina
|
||
--> Mapper 114: Super Games
|
||
--> Mapper 115: MMC3 Cart Saint
|
||
--> Mapper 116: Whatever
|
||
--> Mapper 117: Future
|
||
--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ
|
||
--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ
|
||
--> Mapper 122: Whatever
|
||
--> Mapper 133: Sachen
|
||
--> Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards
|
||
--> Mapper 152: Whatever
|
||
--> Mapper 160: Same as Mapper 90
|
||
--> Mapper 161: Same as Mapper 1
|
||
--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ
|
||
--> Mapper 180: Nihon Bussan - PRG HI
|
||
--> Mapper 182: Same as Mapper 114
|
||
--> Mapper 184: Sunsoft - VROM/4K
|
||
--> Mapper 185: VROM-disable
|
||
--> Mapper 188: UNROM-reversed
|
||
--> Mapper 189: MMC3 Variant
|
||
--> Mapper 218: Nocash Single-Chip
|
||
--> Mapper 222: Dragon Ninja
|
||
--> Mapper 225: X-in-1
|
||
--> Mapper 226: X-in-1
|
||
--> Mapper 227: X-in-1
|
||
--> Mapper 228: X-in-1 Homebrewn
|
||
--> Mapper 229: 31-in-1
|
||
--> Mapper 230: X-in-1 plus Contra
|
||
--> Mapper 231: 20-in-1
|
||
--> Mapper 232: 4-in-1 Quattro Camerica
|
||
--> Mapper 233: X-in-1 plus Reset
|
||
--> Mapper 234: Maxi-15
|
||
--> Mapper 240: C&E/Supertone - PRG/32K, VROM/8K
|
||
--> Mapper 241: X-in-1 Education
|
||
--> Mapper 242: Waixing - PRG/32K, NT
|
||
--> Mapper 243: Sachen Poker - PRG/32K, VROM/8K
|
||
--> Mapper 244: C&E - PRG/32K, VROM/8K
|
||
--> Mapper 246: C&E - PRG/8K, VROM/2K, SRAM
|
||
--> Mapper 255: X-in-1 - (Same as Mapper 225)
|
||
--> Famicom Disk System (FDS)
|
||
--> FDS Memory and I/O Maps
|
||
--> FDS I/O Ports - Timer
|
||
--> FDS I/O Ports - Disk
|
||
--> FDS I/O Ports - Sound
|
||
--> FDS BIOS Disk Format
|
||
--> FDS BIOS Disk Functions
|
||
--> FDS BIOS Disk Errors
|
||
--> FDS BIOS Data Areas in WRAM
|
||
--> FDS Disk Drive Operation
|
||
--> VS System
|
||
--> VS System Controllers
|
||
--> VS System Games
|
||
--> VS System PPUs and Palettes
|
||
--> VS System Protections
|
||
--> Nintendo Playchoice 10
|
||
--> PC10 Memory Map and I/O Ports
|
||
--> PC10 Video Circuit
|
||
--> PC10 Title/Instructions (INST ROM)
|
||
--> PC10 NES-Side
|
||
--> PC10 Games and Cartridge PCBs
|
||
--> PC10 Cabinet and BIOS Versions
|
||
--> PC10 Pin-Outs
|
||
--> Z80 CPU Specifications
|
||
--> Z80 Register Set
|
||
--> Z80 Flags
|
||
--> Z80 Instruction Format
|
||
--> Z80 Load Commands
|
||
--> Z80 Arithmetic/Logical Commands
|
||
--> Z80 Rotate/Shift and Singlebit Operations
|
||
--> Z80 Jumpcommands & Interrupts
|
||
--> Z80 I/O Commands
|
||
--> Z80 Interrupts
|
||
--> Z80 Meaningless and Duplicated Opcodes
|
||
--> Z80 Garbage in Flag Register
|
||
--> Z80 Compatibility
|
||
--> Z80 Pin-Outs
|
||
--> Z80 Local Usage
|
||
--> FamicomBox
|
||
--> FamicomBox Memory and I/O Maps
|
||
--> FamicomBox I/O Ports
|
||
--> FamicomBox Misc
|
||
--> FamicomBox Cartridges
|
||
--> FamicomBox ROM Header (at FFE0h)
|
||
--> FamicomBox Pinouts
|
||
--> Modems
|
||
--> Unpredictable Things
|
||
--> CPU 65XX Microprocessor
|
||
--> CPU Registers and Flags
|
||
--> CPU Memory Addressing
|
||
--> CPU Memory and Register Transfers
|
||
--> CPU Arithmetic/Logical Operations
|
||
--> CPU Rotate and Shift Instructions
|
||
--> CPU Jump and Control Instructions
|
||
--> CPU Illegal Opcodes
|
||
--> CPU Assembler Directives/Syntax
|
||
--> CPU Glitches
|
||
--> CPU The 65XX Family
|
||
--> CPU Local Usage
|
||
--> Hardware Pin-Outs
|
||
--> Chipset Pin-Outs
|
||
--> NES Expansion Port
|
||
--> Nocash SRAM Circuit
|
||
--> About Everynes
|