diff --git a/retro-core/components/nofrendo/docs/everynes.txt b/retro-core/components/nofrendo/docs/everynes.txt new file mode 100644 index 000000000..8729c590e --- /dev/null +++ b/retro-core/components/nofrendo/docs/everynes.txt @@ -0,0 +1,13980 @@ +Everynes - Nocash NES Specs +--------------------------- + +Contents +-------- + +No$nes Emulator / Debugger +--> No$nes Controls +--> No$nes Emulation Files + +Everynes NES Hardware Specifications +--> Tech Data +--> Memory Maps +--> I/O Map +--> Picture Processing Unit (PPU) +--> Audio Processing Unit (APU) +--> Controllers +--> Cartridges and Mappers +--> Famicom Disk System (FDS) +--> VS System +--> Nintendo Playchoice 10 +--> FamicomBox +--> Modems +--> Hardware Pin-Outs +--> CPU 65XX Microprocessor +--> About Everynes + +No$nes Controls +--------------- + +General Joypad Controls +Keyboard controls for up to four players can be defined in setup. Buttons of +USB Gamepads & Joysticks & the like can be also changed per player. + +Special Controls + F1..F5 Enable/Disable Sound Channel 1-5 + F9 Enable/Disable Showing Screen Splits as dotted line + NUM * Hard Reset + NUM / Soft Reset + NUM - Switch to Debug Mode + NUM + Disable Realtime Delays and use 10% frameskip (while held down) + BS Disable Realtime Delays (same as above, for notebook keyboards) + +Famicom Disk System (FDS) + INS Flip Disk (some games ignore fast flips; hold down for some seconds) + +VS Unisystem (Arcade Cabinet) + INS Credit Left Coin Slot + HOME Credit Right Coin Slot + PGUP Credit Service Button + 1..4 Button 1..4 (aliases for NES Start/Select buttons) + 0 DIP-Switch Window + +Playchoice 10 (Arcade Cabinet) + INS Credit Coin Slot 1 + HOME Credit Coin Slot 2 (works only if enabled via DIP switches) + PGUP Service Button (add credit) (during reset: bookkeeping) + DEL Reset Button (if any) + END Enter Button (also works via Num-Enter) + PGDN Channel Select Button + 0 DIP-Switch Window + Mouse Zapper (Lightgun Move/Trigger) + +FamicomBox + INS XXX Insert Coin + HOME RESET Button + PGUP XXX GAME/TV Button + 123456 1st..6th Keyswitch Position (from left) [=INTENDED, see Note] + 0 DIP-Switch Window + Mouse Zapper (Lightgun Move/Trigger) +Note: The ordering of the keyswitch positions from left-to-right is still +unknown; currently keys 1..6 are simply mapped to keyswitch bit0..5. +Multi-cart loading isn't emulated yet, so you'll only see the menu & self-test +feature, without any games. + +Famicom Keyboard + BS/DEL DEL + HOME CLR + TAB ESC + END STOP + L-ALT GRPH + R-ALT KANA + +Party Tap Push Buttons + 123456 Buttons for Player 1-6 + +Konami Hyper Shot Push Buttons + Joypad Button A --> "RUN"-Button (or, used as "Shoot-Right" in Hyper Sports) + Joypad Button B --> "JUMP"-Button (or, used as "Shoot-Left" in Hyper Sports) +The games do replace joypad data by button data; no$nes somewhat undoes that +replacement. + +Lightguns (NES Zapper, Famicom Beam Gun, VS Zapper, Bandai Hyper Shot Gun) + Mouse Move + Left Mouse Button Trigger + +Paddle (NES and both Famicom versions) + Mouse (left/right) Move + Left Mouse Button Button + +Oeka Kids Tablet + Mouse Move & Touch + Left Mouse Button Click + +Mouse / Trackball + Mouse (move) Move + Left/Right Button Left/Right Button (A/B Button on Trackball) + Middle Button or ESC Return mouse to operating system + +Power Glove + Gamepad Analog X/Y/Z/R Position X/Y/Z and Wrist Rotation + Gamepad Button 1..4 Thumb/Index/Middle/Ring Finger Flex + Gamepad Digital POV Keypad DPAD + Keyboard 0..9 Keypad 0..9 + Keyboard Buttons/DPAD Keypad A,B,Start,Select,DPAD + XXX Keypad Prog,Center,Enter + +UForce + Page Down Top-most sensor ;\for push-button + NUM-/ NUM-* Upper Left/Right sensors in upper field ; style usage (with + NUM-8 NUM-9 Lower Left/Right sensors in upper field ; sensor=min/max) + NUM-5 Upper Left sensor in lower field ; (eg. Nuclear Rat, + NUM-2 NUM-3 Lower Left/Right sensors in lower field ; and Rock on Air) + Page Up Bottom-most sensor ;/ + Gamepad Analog X Top-most sensor ;\for analog usage + Gamepad Analog Y Bottom-most sensor, or, ; (eg. Hose'em Down + Gamepad Analog Y Lower-Left sensor in lower field ;/and Rock on Air) +Plus Start/Select as configured in joypad setup. Analog mode is activate when +moving the analog gamepad (and will then override the corresponding keyboard +keys). Analog input emulation is matched to the existing "UForce Power Games" +cartridge (and may mismatch with other/homebrew UForce games). + +Top-Rider Bike + Gamepad Analog X Steering Handles Left/Right + Gamepad Analog Y Forward=GearLo, Back=GearHi + Gamepad Analog Z Forward=Accelerate Slow/Fast, Back=Accelerate Turbo + Gamepad Button 1,2,3,4 Brake,Wheelie,Start,Select + +Pachinko + Digital Joypad/Keyboard Pachinko Joypad Buttons + Analog Joypad Forward Pachinko Analog Dial + +Barcode Reader (Barcode Batter and Datach) + INS-Key Paste numeric ASCII string from clipboard and Send barcode + DEL-Key Manually Clear input buffer (without sending) + Keypad 0..9 Manually Key-in Barcode digits + Keypad Dot Manually Confirm input and Send (or re-send) barcode +Note: For the Barcode Battler, only EAN-13 is implemented (since it's unknown +how/if it supports shorter UPC-A, UPC-E, or EAN-8 barcodes). For Datach, +EAN-13, UPC-A, EAN-8 are supported (however, the Datach software seems to +support a further non-standard unknown barcode format, which isn't emulated). + +Capcom Mahjong Controller + A..N Drop Card A..N (or N=Draw new card) + Space Same as N + F1..F7 Function Keys (Select, Start, and five "japanese" keys) + Tab/LeftCtrl Same as F1 (Select) + Enter Same as F2 (Enter) + +Piano Keyboard + 12345... 1st Octave (12 keys) (only last 7 keys used on Doremikko) + QWERT... 2nd Octave (12 keys) (all keys used) + ASDFG... 3rd Octave (12 keys) (all keys used) + ZXCVB... 4th Octave (10 keys) (only first 5 keys used on Doremikko) + Rshift/Ctrl 4th Octave (last 2) (Miracle only) + NUM-Dot 5th Octave (1 key) (Miracle only) + NUM-0..7 Control Buttons 0..7 (Miracle only) + Left Shift Sustain Foot Pedal (Miracle only) +Note: The miracle sound isn't emulated (as far as known there aren't any dumps +of it's BIOS and SOUND-ROM existing yet). The FDS sound for Doremikko isn't +emulated yet (when I last checked, there seems to have been little known about +FDS sound hardware). + +Mats (Power Pad/Family Trainer/Tap-tap Mat) + QWER --> Upper row (Side B) RTYU --> Upper Row (Side A, or Tap-tap Mat) + ASDF --> Middle row (Side B) FGHJ --> Middle Row (Side A, or Tap-tap Mat) + ZXCV --> Lower row (Side B) VBNM --> Lower Row (Side A, or Tap-tap Mat) +Safety Note: Put the keyboard on the floor if you are using feet or hammer. + +Exciting Boxing Bag + Num-7,8,9 Left Hook, N/A ,Right Hook + Num-4,5,6 Left Jabb, Straight ,Right Jabb + Num-1,2,3 Left Push, Body ,Right Push + +RacerMate Bicycle Trainer + Gamepad Analog X Pulse + Gamepad Analog Y Speed + Gamepad Analog Z Watts + F1 or Enter Button F1 (START) + F2 Button F2 (DISPLAY) + F3 Button F3 (SET) + F4 or End Button RESET + PGUP or Up Button Plus (UP) + PGDN or Down Button Minus (DOWN) + +XED Editor +---------- + +--> XED About +--> XED Hotkeys +--> XED Assembler/Debugger Interface +--> XED Commandline based standalone version + +XED About +--------- + +About XED +XED is a text editor, the executable is fast and small, and it includes +comfortable editing functions. It is both intended for standard .TXT files (or +any other ASCII files, such like .ASM for assembler source code). Also, the +line-wrapping support (.XED files) can be used for authoring stories, +specifications, etc. Most of the features are much the same as for other text +editors, some special functions are pointed out below: + +Block Selection +XED supports good old quality block mechanisms, allowing to copy/move the +selection directly to cursor position by Ctrl+K,C/V hotkeys (without needing to +use paste). For data exchange with other programs or text files, the block can +be directly written to (or loaded from) file by Ctrl+K,R/W. And, mainstream +copy/cut/paste functions are supported as well, by Ctrl+Ins, Shift+Del, +Shift+Ins. +Note: The block remains selected even when typing text, and it won't get +deleted when touching Del-key. + +Condensed Display Mode +Condensed mode is activated by "F6,C" key combination. In this mode, only lines +beginning with colon ":", or (for assembler source code files) with +semicolon-colon ";:", for example: + :Chapter IV + ;:---Sound Engine--- +Normal block functions can be used in this mode to Move, Copy, or Delete whole +'chapter(s)'. Cursor keys can be used to move the cursor to a specific chapter. +Pushing Enter or Escape terminates condensed mode. + +Column Block Mode +Column mode is activated by "Ctrl+K,N" key combination. In this mode, the block +selection appears as a rectangular area, allowing to deal with tables & columns +in text files by using copy/delete, indent/unindent block functions. +Typing "Ctrl+K,N" again will return to normal block mode (in which any lines +between begin/end of the block will be selected at full length). + +Blank Space +Unlike most other editors, XED allows to move the cursor to any screen +location, including at horizontal positions after the end of the current line. +Entering space characters at such locations advances the cursor position, but +does not actually store space characters in the file. +When typing text, spaces are automatically inserted between line-end and cursor +position. Respectively, ending spaces are automatically deleted (eg. assume +that the line contains "Hello !", deleting "!" will also remove the space +character, internally). +That is of course all happening behind your back, you won't have to care about +it - but you can be sure that there'll be no hidden spaces filling up disk +space. + +Tabulation Marks / TAB-Key +The TAB Key advances the cursor to the next higher tabulation location (usually +in steps of eight columns, counted from leftmost screen border), and the +appropriate number of spaces is inserted into the file if necessary. +In overwrite mode (de-/activated by INS Key), the TAB Key simply advances the +cursor without actually inserting spaces (and without overwriting existing text +by spaces). + +Tabulation Marks / CHR(9) +When enabled in setup (default), TAB marks are automatically expanded into +appropriate number of spaces (ie. towards next "8-column" position) when +loading a file. +The file is normally saved by using raw SPC characters, without any TABs. +Optionally, it can be saved by using "best-fill" SPCs and TABs (disabled by +default), that feature may conflict with third party tools (assemblers, +compilers, etc). In order to reduce the risk of such problems, best-fill is +suppressed in quoted lines (by using ' or " or <> quotation marks, eg. db +'Hello !'). + +Line Wrapping +Line wrapping is enabled/disabled by "F5+W" key combination. Wrapping is +automatically enabled when loading a file with extension ".XED". +In the file, wrapped lines are using CR characters as soft linebreaks, +paragraphs are terminated by normal CR,LF characters. +Note: It'd be recommended to convert .XED files into 'standard' formats such +like .TXT or .HTM before releasing them, but preferably NOT into disliked +bloated file formats such like .PDF or .DOC. + +Word Processing +Aside from the above line-wrapping support, no other 'word processing' features +are included, the program provides normal 'type writer' functions, not more, +not less. In particular, any overload such like bold or colored text, big and +small fonts, bitmaps and different fonts are disliked. + +XED Hotkeys +----------- + +XED recognizes both CP/M Wordstar hotkeys (also used by Borland PC compilers), +and Norton editor hotkeys (NU.EXE). The "Ctrl+X,Y" style hotkeys are wordstar +based, particulary including good block functions. The F4,X and Alt/Ctrl+X type +hotkeys are norton based, particulary very useful for forwards/backwards +searching. + +Standard Cursor Keys + Up Move line up + Down Move line down + Left Move character left + Right Move character right + Pgup Scroll page up / to top of screen + Pgdn Scroll page down / to bottom of screen + Ctrl+Pgup Go to start of file (or Ctrl+Home) + Ctrl+Pgdn Go to end of file (or Ctrl+End) + Home Go to start of line + End Go to end of line + Ctrl+Left Move word left + Ctrl+Right Move word right + Ins Toggle Insert/Overwrite mode + Del Delete char below cursor + Backspace Delete char left of cursor + Tab Move to next tabulation mark + Enter New line/paragraph end + Esc Quit (or Alt+X, F3+Q, Ctrl+K+D, Ctrl+K+Q, Ctrl+K+X) +Note: Pgup/Pgdn are moving the cursor to top/bottom of screen, page scrolling +takes place only if the cursor was already at that location. + +Editor Keys + Ctrl+Y Delete line (or Alt+K) + Alt+L Delete to line end (or Ctrl+Q,Y) + Alt+V Caseflip to line end + Ctrl+V Caseflip from line beginning + +Norton Search/Replace Functions + Alt+F Norton - search/replace, forwards + Ctrl+F Norton - search/replace, backwards + Alt+C Norton - continue search/replace, forwards + Ctrl+C Norton - continue search/replace, backwards +Search: Type "Alt/Ctrl+F, String, Enter". +Search+replace: "Type Alt/Ctrl+F, String1, Alt+F, String2, Enter". +Non-case sensitive: Terminate by Escape instead of Enter. + +Wordstar Search/Replace Functions + Ctrl+Q,F Wordstar - search + Ctrl+Q,A Wordstar - replace + Ctrl+L Wordstar - continue search/replace +Search options: B=Backwards, G=Global, N=No query, +U=non-casesensitive, W=whole words only, n=n times. + +Disk Commands + F3,E Save+exit + F3,S Save (or Ctrl+K,S) + F3,N Edit new file + F3,A Append a file +See also: Block commands (read/write block). + +Block Selection + Shift+Cursor Select block begin..end + Ctrl+K,B Set block begin (or F4,S) + Ctrl+K,K Set block end (or F4,S) + Ctrl+K,H Remove/hide block markers (or F4,R) + F4,L Mark line including ending CRLF (or Ctrl+K,L) + F4,E Mark line excluding ending CRLF + Ctrl+K,T Mark word + Ctrl+K,N Toggle normal/column blocktype + +Clipboard Commands + Shift+Ins Paste from Clipboard + Shift+Del Cut to Clipboard + Ctrl+Ins Copy to Clipboard + Ctrl+Del Delete Block + +Block Commands + Ctrl+K,C Copy block (or F4,C) + Ctrl+K,V Move block (or F4,M) + Ctrl+K,Y Delete block (or F4,D) + Ctrl+K,P Print block (or F7,B) + Ctrl+Q,B Find block begin (or F4,F) + Ctrl+Q,K Find block end (or F4,F) + Ctrl+K,R Read block from disk towards cursor location + Ctrl+K,W Write block to disk + Ctrl+K,U Unindent block (delete one space at begin of each line) + Ctrl+K,I Indent block (insert one space at begin of each line) + F5,F Format block (with actual x-wrap size) (or ;Ctrl+B) + F8,A Add values within column-block + +Setup Commands + F11 Setup menu (or F8,S) + F5,S Save editor configuration + F5,L Set line len for word wrap (or Ctrl+O,R) + F5,W Wordwrap on/off (or Ctrl+O,W) (*) + F5,I Auto indent on/off (or Ctrl+O,I) + F5,T Set tab display spacing +(*) Wrapped lines will be terminated by CR, paragraphs by CRLF. + +Other + F1 Help + F2 Status (displays info about file & currently selected block) + F8,M Make best fill tabs + F8,T Translate all tabs to spaces + SrcLock Freeze cursor when typing text ("useful" for backwards writing) + Ctrl+O,C Center current line + Ctrl+K,# Set marker (#=0..9) + Ctrl+Q,# Move to marker (#=0..9) + Ctrl+Q,P Move to previous pos + F6,C Condensed display mode on/off (*) + Ctrl+G Go to line nnnn (or F6,G) (or commandline switch /l:nnnn) +(*) only lines starting with ':' or ';:' will be displayed. cursor and block +commands can be used (e.g. to copy a text-sequence by just marking it's +headline) + +Hex-Edit Keys (Binary Files) +This mode is activated by /b commandline switch, allowing to view and modify +binary files. Aside from normal cursor keys, the following hotkeys are used: + Tab Toggle between HEX and ASC mode (or Shift+Left/Right) + Ctrl+Arrow Step left/right one full byte (instead one single HEX digit) + Ctrl+G Goto hex-address + Ctrl+K,S Save file (as usually) + +Printer Commands + F7,P Print file + F7,B Print block (or Ctrl+K,P) + F7,E Eject page + F7,S Set page size +More printer options can be found in setup. Printing was working well (at least +with my own printer) in older XED versions, but it is probably badly bugged (at +least untested) for years now. + +XED Assembler/Debugger Interface +-------------------------------- + +Nocash Debuggers +The XED editor provides simple but very useful interaction with the various +nocash debuggers/emulators (no$gba, no$gmb, no$cpc, no$msx, no$c64, no$2k6, +no$zx, no$nes, no$sns, no$x51). +The editor can be launched from inside of the debugger (by Alt+E hotkey, by +retaining the recently edited line number when re-launching the editor). +And, when editing assembler source code files, F9-key can used to launch the +assembler from inside of XED. That is, the file is saved to disk, the A22i +assembler is started (built-in in all debuggers), and, in case of successful +assembly, the program is loaded & started in the emulator. Otherwise, the +assembler displays a list of errors, and the editor is moved directly to the +source code line number in which the first error has occured. + +16bit DOS debuggers +The XED editor is included built-in in all nocash windows debuggers, and in the +no$gba 32bit DOS version only. +For use with other nocash 16bit DOS debuggers the XED editor must be downloaded +separately at http://problemkaputt.de/xed.htm, and must be installed in a +directory which is included in your PATH statement. + +XED Commandline based standalone version +---------------------------------------- + +Standalone 16bit DOS version +This version is written in turbo pascal, nevertheless fast enough to work on +computer with less than 10MHz. It uses 16bit 8086 code, and works with all +80x86 compatible CPUs, including very old XTs. +The downside is that it is restricted to Conventional DOS Memory, so that the +maximum filesize is 640K (actually less, because the program and operating +system need to use some of that memory). + +Using the 32bit debugger-built-in version as 32bit standalone editor +I haven't yet compiled a 32bit standalone version, however, any of the no$xxx +32bit debuggers can be used for that purpose. By commandline input: + no$xxx /x Edit text file in standalone mode + no$xxx /b Edit binary file in standalone hexedit mode + +Standalone Commandline Syntax +Syntax: XED [/l:] | /? + Filename, optionally d:\path\name.ext + /? Displays commandline help + /l: Moves to line number nnn after loading +The filename does not require to include an extension, the program +automatically loads the first existing file with any of following extensions +appended: XED, ASM, ASC, INC, BAT, TXT, HTM, DOC, A22, PAS. + +Standalone DOS Return Value +XED returns a three-byte return value after closing the program. This data is +used when calling XED as external editor from inside of nocash DOS debuggers, +but it might be also useful for other purposes. +Because normal DOS return values are limited to 8bits only, the three bytes are +written into video RAM at rightmost three character locations in first line: + VSEG:77*2 Exit code (00h=Exit normal, F9h=Exit by F9-key) + VSEG:78*2 Line number (Lower 8bits, 1..65536 in total) + VSEG:79*2 Line number (Upper 8bits) +The color attribute for these characters is set to zero (invisible, black on +black). Use INT 10h/AH=0Fh to determine the current video mode (AL AND 7Fh), if +it is monochrome (07h) then use VSEG=B000h, otherwise VSEG=B800h. + + +No$nes Emulation Files +---------------------- + +SLOT Folder +Default location for Game ROM-Images is "SLOT" folder (in same directory as +"no$nes.exe"). +ZIPped ROM-Images can be loaded if PKUNZIP.EXE is installed (ie. it must be +somewhere in your "PATH") (if you don't know what that means, put it into a +folder like C:\WINDOWS\COMMAND or so). + +BIOS Folder +The "BIOS" folder (in same directory as "no$nes.exe") should contain following +files: + DISKSYS.ROM 8Kbytes Famicom Disk System (FDS) BIOS + PC10BIOS.ROM 16Kbytes Playchoice 10 (PC10) BIOS (IC "8T") + PC10CHAR.ROM 24Kbytes Playchoice 10 (PC10) Charset (ICs "8P+8M+8K") + +Playchoice 10 Games +PC10 games require the BIOS files (see above), and completely dumped ROMs. As +of 2012, most or all existing PC10 dumps are incomplete: They contain only the +NES PRG/CHR-ROMs, and the Z80 INST-ROM, but do miss the Z80 PROM (which is +absolutely required to use/decrypt the INST-ROMs). A tool for adding the +missing PROM data to existing ROM-images can be found here: +http://problemkaputt.de/pc10make.zip + +Tech Data +--------- + +Overall Specs +CPU 2A03 - customized 6502 CPU - audio - does not contain support for decimal +The NTSC NES runs at 1.7897725MHz, and 1.662607MHz for PAL. + +NMIs may be generated by PPU each VBlank. +IRQs may be generated by APU and by external hardware. +Internal Memory: 2K WRAM, 2K VRAM, 256 Bytes SPR-RAM, and Palette/Registers + +The cartridge connector also passes audio in and out of the cartridge, to allow +for external sound chips to be mixed in with the Famicom audio. + +Original Famicom (Family Computer) (1983) (Japan) +60-pin cartridge slot, with external sound-input, without lockout chip. +Two joypads directly attached to console, Joypad 1 with Start/Select buttons, +Joypad 2 with microphone, but without Start/Select. 15pin Expansion port for +further controllers. Video RF-Output only. +"During its first year, people found the Famicom to be unreliable, with +programming errors and freezing rampant. Yamauchi recalled all sold Famicom +systems, and put the Famicom out of production until the errors were fixed. The +Famicom was re-released with a new motherboard." + +Original NES (Nintendo Entertainment System) (1985) (US, Europe, Australia) +Same as Famicom, but with slightly different pin-outs on cartridge slot, and +controllers/expansion ports: Front-loading 72-pin cartridge slot, without +external sound-input on cartridge slot, without microphone on joypads, with +lockout chip. + +Newer Famicom, AV Famicom (1993-1995) +60-pin cartridge slot, with external sound-input, without lockout chip. +Includes NES-style joystick connectors, plus the original 15pin Famicom +Expansion port. Doesn't have microphone. Video AV-Output only. + +Newer NES (1993-1995) +Top-loading 72-pin cartridge slot, without external sound-input, without +lockout chip. Poorer video signal than old NES. Video WHAT?-output only. + +VS Unisystem +Arcade Machine. Coin-detect inputs, eight Dip-switches, different palette. + +Play Choice 10 +Arcade Machine with 10 cartridge slots. Uses Z80 as second CPU. + +Memory Maps +----------- + +Internal Memory: 2K WRAM, 2K VRAM, 256 Bytes SPR-RAM, and Palette/Registers + +CPU Memory Map (16bit buswidth, 0-FFFFh) + 0000h-07FFh Internal 2K Work RAM (mirrored to 800h-1FFFh) + 2000h-2007h Internal PPU Registers (mirrored to 2008h-3FFFh) + 4000h-4017h Internal APU Registers + 4018h-5FFFh Cartridge Expansion Area almost 8K + 6000h-7FFFh Cartridge SRAM Area 8K + 8000h-FFFFh Cartridge PRG-ROM Area 32K +CPU Reset vector located at [FFFC], even smaller carts must have memory at that +location. Larger carts may use whatever external mappers to access more than +the usual 32K. + +PPU Memory Map (14bit buswidth, 0-3FFFh) + 0000h-0FFFh Pattern Table 0 (4K) (256 Tiles) + 1000h-1FFFh Pattern Table 1 (4K) (256 Tiles) + 2000h-23FFh Name Table 0 and Attribute Table 0 (1K) (32x30 BG Map) + 2400h-27FFh Name Table 1 and Attribute Table 1 (1K) (32x30 BG Map) + 2800h-2BFFh Name Table 2 and Attribute Table 2 (1K) (32x30 BG Map) + 2C00h-2FFFh Name Table 3 and Attribute Table 3 (1K) (32x30 BG Map) + 3000h-3EFFh Mirror of 2000h-2EFFh + 3F00h-3F1Fh Background and Sprite Palettes (25 entries used) + 3F20h-3FFFh Mirrors of 3F00h-3F1Fh +Note: The NES contains only 2K built-in VRAM, which can be used for whatever +purpose (for example, as two Name Tables, or as one Name Table plus 64 Tiles). +Palette Memory is built-in as well. Any additional VRAM (or, more regulary, +VROM) is located in the cartridge, which may also contain mapping hardware to +access more than 12K of video memory. + +SPR-RAM Memory Map (8bit buswidth, 0-FFh) + 00-FF Sprite Attributes (256 bytes, for 64 sprites / 4 bytes each) +Sprite RAM is directly built-in in the PPU chip. SPR-RAM is not connected to +CPU or PPU bus, and can be accessed via I/O Ports only. + +I/O Map +------- + +I/O Map + 2000h - PPU Control Register 1 (W) + 2001h - PPU Control Register 2 (W) + 2002h - PPU Status Register (R) + 2003h - SPR-RAM Address Register (W) + 2004h - SPR-RAM Data Register (RW) + 2005h - PPU Background Scrolling Offset (W2) + 2006h - VRAM Address Register (W2) + 2007h - VRAM Read/Write Data Register (RW) + 4000h - APU Channel 1 (Rectangle) Volume/Decay (W) + 4001h - APU Channel 1 (Rectangle) Sweep (W) + 4002h - APU Channel 1 (Rectangle) Frequency (W) + 4003h - APU Channel 1 (Rectangle) Length (W) + 4004h - APU Channel 2 (Rectangle) Volume/Decay (W) + 4005h - APU Channel 2 (Rectangle) Sweep (W) + 4006h - APU Channel 2 (Rectangle) Frequency (W) + 4007h - APU Channel 2 (Rectangle) Length (W) + 4008h - APU Channel 3 (Triangle) Linear Counter (W) + 4009h - APU Channel 3 (Triangle) N/A (-) + 400Ah - APU Channel 3 (Triangle) Frequency (W) + 400Bh - APU Channel 3 (Triangle) Length (W) + 400Ch - APU Channel 4 (Noise) Volume/Decay (W) + 400Dh - APU Channel 4 (Noise) N/A (-) + 400Eh - APU Channel 4 (Noise) Frequency (W) + 400Fh - APU Channel 4 (Noise) Length (W) + 4010h - APU Channel 5 (DMC) Play mode and DMA frequency (W) + 4011h - APU Channel 5 (DMC) Delta counter load register (W) + 4012h - APU Channel 5 (DMC) Address load register (W) + 4013h - APU Channel 5 (DMC) Length register (W) + 4014h - SPR-RAM DMA Register (W) + 4015h - DMC/IRQ/length counter status/channel enable register (RW) + 4016h - Joypad #1 (RW) + 4017h - Joypad #2/APU SOFTCLK (RW) +Additionally, external hardware may contain further ports: + 4020h - VS Unisystem Coin Acknowledge + 4020h-40FFh - Famicom Disk System (FDS) + 4100h-FFFFh - Various addresses used by various cartridge mappers + +Picture Processing Unit (PPU) +----------------------------- + +--> PPU Reset +--> PPU Control and Status Registers +--> PPU SPR-RAM Access Registers +--> PPU VRAM Access Registers +--> PPU Scrolling +--> PPU Tile Memory +--> PPU Background +--> PPU Sprites +--> PPU Palettes +--> PPU Dimensions & Timings + +Based on "Nintendo Entertainment System Documentation" Version 2.00 by Jeremy +Chadwick aka Y0SHi aka JDC. Which was itself based on "Nintendo Entertainment +System Architecture" by Marat Fayzullin. + +--> 3D Glasses + +PPU Reset +--------- + +Registers +Some registers are reset to zero upon reset; namely NMIs are disabled. Other +registers are kept unchanged (or contain semi-stable initial values on +Power-Up). + +Locked Registers +During first frame after Reset, Ports 2000h, 2001h, 2005h, and 2006h are +reportedly write-protected. And, Port 2007h is read-protected (always returns +00h, even if all VRAM at 0000h..3FFFh is FFh-filled, and even if the 2007h +prefetch latch was pre-loaded with a nonzero value before reset; the origin of +the 00h is unknown, it might be an open-bus value). +The read/write protection is released when: + NTSC: At END of First Vblank (261 scanlines after reset) + PAL: At END of First Vblank (311 scanlines after reset) + +PPU Control and Status Registers +-------------------------------- + +2000h - PPU Control Register 1 (W) + Bit7 Execute NMI on VBlank (0=Disabled, 1=Enabled) + Bit6 PPU Master/Slave Selection (0=Master, 1=Slave) (Not used in NES) + Bit5 Sprite Size (0=8x8, 1=8x16) + Bit4 Pattern Table Address Background (0=VRAM 0000h, 1=VRAM 1000h) + Bit3 Pattern Table Address 8x8 Sprites (0=VRAM 0000h, 1=VRAM 1000h) + Bit2 Port 2007h VRAM Address Increment (0=Increment by 1, 1=Increment by 32) + Bit1-0 Name Table Scroll Address (0-3=VRAM 2000h,2400h,2800h,2C00h) + (That is, Bit0=Horizontal Scroll by 256, Bit1=Vertical Scroll by 240) + +2001h - PPU Control Register 2 (W) + Bit7-5 Color Emphasis (0=Normal, 1-7=Emphasis) (see Palettes chapter) + Bit4 Sprite Visibility (0=Not displayed, 1=Displayed) + Bit3 Background Visibility (0=Not displayed, 1=Displayed) + Bit2 Sprite Clipping (0=Hide in left 8-pixel column, 1=No clipping) + Bit1 Background Clipping (0=Hide in left 8-pixel column, 1=No clipping) + Bit0 Monochrome Mode (0=Color, 1=Monochrome) (see Palettes chapter) +If both sprites and BG are disabled (Bit 3,4=0) then video output is disabled, +and VRAM can be accessed at any time (instead of during VBlank only). However, +SPR-RAM does no longer receive refresh cycles, and its content will gradually +degrade when the display is disabled. + +2002h - PPU Status Register (R) + Bit7 VBlank Flag (1=VBlank) + Bit6 Sprite 0 Hit (1=Background-to-Sprite0 collision) + Bit5 Lost Sprites (1=More than 8 sprites in 1 scanline) + Bit4-0 Not used (Undefined garbage) +Reading resets the 1st/2nd-write flipflop (used by Port 2005h and 2006h). +Reading resets Bit7, can be used to acknowledge NMIs, Bit7 is also +automatically reset at the end of VBlank, so manual acknowledge is normally not +required (unless one wants to free the NMI signal for external NMI inputs) (and +unless one wants to disable/reenable NMIs during NMI handling, in that case +Bit7 MUST be acknowledge before reenabling NMIs, else NMI would be executed +another time). + +Status Notes +VBlank flag is set in each frame, even if the display is fully disabled, and +even if NMIs are disabled. Hit flag may become set only if both BG and OBJ are +enabled. Lost Sprites flag may become set only if video is enabled (ie. BG or +OBJ must be on). For info about the "Not used" status bits, and some other PPU +bits see: +--> Unpredictable Things + +VS System +Some VS System PPUs have Port 2000h/2001h swapped, and do have a Chip ID in +LSBs of 2002h. For details, see +--> VS System + +PPU SPR-RAM Access Registers +---------------------------- + +2003h - SPR-RAM Address Register (W) + D7-D0: 8bit address in SPR-RAM (00h-FFh) +Specifies the destination address in Sprite RAM for use with Port 2004h (Single +byte write), and Port 4014h (256 bytes DMA transfer). +This register is internally used during rendering (and typically contains 00h +at the begin of the VBlank period). + +2004h - SPR-RAM Data Register (Read/Write) + D7-D0: 8bit data written to SPR-RAM. +Read/write data to/from selected address in Sprite RAM. +The Port 2003h address is auto-incremented by 1 after each to 2004h. +The address is NOT auto-incremented after from 2004h. +Caution: Single byte access via 2004h is somewhat working, but DMA via 4014h is +more robust. + +4014h - Sprite DMA Register (W) +Transfers 256 bytes from CPU Memory area into SPR-RAM. The transfer takes 512 +CPU clock cycles, two cycles per byte, the transfer starts about immediately +after writing to 4014h: The CPU either fetches the first byte of the next +instruction, and then begins DMA, or fetches and executes the next instruction, +and then begins DMA. The CPU is halted during transfer. + Bit7-0 Upper 8bit of source address (Source=N*100h) (Lower bits are zero) +Data is written to Port 2004h. The destination address in SPR-RAM is thus +[2003h], which should be normally initialized to zero - unless one wants to +"rotate" the target area, which may be useful when implementing more than eight +(flickering) sprites per scanline. + +Notes +SPR-RAM should be accessed during VBlank only, preferably by issuing Sprite DMA +at begin of Vblank. +SPR-RAM is dynamic memory, refreshed during rendering, it does no longer +receive refresh cycles (and will lose its content quickly within about a frame) +when the display is disabled (by clearing both Bit3+Bit4 in Port 2001h). +PAL issues another refresh somewhere mid-vblank even when display disabled? +NTSC doesn't do so and tends to forget data more easily - using DMA to rewrite +sprite memory on vblank is somewhat forcefully fixing that issue. + +Port 2003h/2004h are internally used during rendering. The unlicensed game +Micro Machines is reading 2004h to determine the currently rendered line, +however, that doesn't work with all PPU revisions and PPU clones. + +PPU VRAM Access Registers +------------------------- + +Registers used to Read and Write VRAM data, and for Background Scrolling. +The CPU can Read/Write VRAM during VBlank only - because the PPU permanently +accesses VRAM during rendering (even in HBlank phases), and because the PPU +uses the VRAM Address register as scratch pointer. Respectively, the address in +Port 2006h is destroyed after rendering, and must be re-initialized before +using Port 2007h. + +1st/2nd Write +Below Port 2005h and 2006h require two 8bit writes to receive a 16bit +parameter, the current state (1st or 2nd write) is memorized in a single +flipflop, which is shared for BOTH Port 2005h and 2006h. The flipflop is reset +when reading from PPU Status Register Port 2002h (the next write will be then +treated as 1st write) (and of course it is also reset after any 2nd write). + +2005h - PPU Background Scrolling Offset (W2) +Defines the coordinates of the upper-left background pixel, together with PPU +Control Register 1, Port 2000h, Bits 0-1). + Port 2005h-1st write: Horizontal Scroll Origin (X*1) (0-255) + Port 2005h-2nd write: Vertical Scroll Origin (Y*1) (0-239) + Port 2000h-Bit0: Horizontal Name Table Origin (X*256) + Port 2000h-Bit1: Vertical Name Table Origin (Y*240) +Caution: The above scroll reload settings are overwritten by writes to Port +2006h. See PPU Scrolling chapter for more info. + +2006h - VRAM Address Register (W2) +Used to specify the 14bit VRAM Address for use with Port 2007h. + Port 2006h-1st write: VRAM Address Pointer MSB (6bit) + Port 2006h-2nd write: VRAM Address Pointer LSB (8bit) +Caution: Writes to Port 2006h are overwriting scroll reload bits (in Port 2005h +and Bit0-1 of Port 2000h). And, the PPU uses the Port 2006h register internally +during rendering, when the display is enabled one should thus reinitialize Port +2006h at begin of VBlank before accessing VRAM via Port 2007h. + +2007h - VRAM Read/Write Data Register (RW) +The PPU will auto-increment the VRAM address (selected via Port 2006h) after +each read/write from/to Port 2007h by 1 or 32 (depending on Bit2 of $2000). + Bit7-0 8bit data read/written from/to VRAM +Caution: Reading from VRAM 0000h-3EFFh loads the desired value into a latch, +and returns the OLD content of the latch to the CPU. After changing the address +one should thus always issue a dummy read to flush the old content. However, +reading from Palette memory VRAM 3F00h-3FFFh, or writing to VRAM 0000-3FFFh +does directly access the desired address. +Note: Some (maybe all) RGB PPUs (as used in Famicom Titler) do not allow to +read palette memory (instead, they appear to mirror 3Fxxh to 2Fxxh). + +Caution +The APU (if DMC sound is used) can conflict with joypad reads! For details, +see: +--> APU DMC-DMA Glitch + +PPU Scrolling +------------- + +The PPU allows to scroll the background pixelwise horizontally and vertically. +The total scroll-able area is 512x480 pixels (though the full size can be +usedwith external memory only, see Name Tables chapter), of which circa 256x240 +pixels are displayed (see visible screen resolution). + +Vertical offsets 240-255 (aka Tile Rows 30-31) will cause garbage Tile numbers +to be fetched from the Attribute Table (instead of from Name Table), after line +255 it will wrap to line 0, but without producing a carry-out to the Name Table +Address. + +Scroll Pointer and Reload Registers +Scrolling relies on a Pointer register (Port 2006h), and on a Reload register +(Port 2005h, and Bit0-1 of Port 2000h). The Pointer is automatically +incremented by the hardware during rendering, and points to the currently drawn +tile row, the same pointer register is also used by software to access VRAM +during VBlank or when the display is disabled. The Reload value defines the +horizontal and vertical origin of upper-left pixel, the reload value is +automatically loaded into the Pointer at the end of the vblank period (vertical +reload bits), and at the begin of each scanline (horizontal reload bits). The +relation between Pointer and Reload bits is: + VRAM-Pointer Scroll-Reload + A8 2006h/1st-Bit0 <--> Y*64 2005h/2nd-Bit6 + A9 2006h/1st-Bit1 <--> Y*128 2005h/2nd-Bit7 + A10 2006h/1st-Bit2 <--> X*256 2000h-Bit0 + A11 2006h/1st-Bit3 <--> Y*240 2000h-Bit1 + A12 2006h/1st-Bit4 <--> Y*1 2005h/2nd-Bit0 + A13 2006h/1st-Bit5 <--> Y*2 2005h/2nd-Bit1 + - 2006h/1st-Bit6 <--> Y*4 2005h/2nd-Bit2 + - 2006h/1st-Bit7 <--> - - + A0 2006h/2nd-Bit0 <--> X*8 2005h/1st-Bit3 + A1 2006h/2nd-Bit1 <--> X*16 2005h/1st-Bit4 + A2 2006h/2nd-Bit2 <--> X*32 2005h/1st-Bit5 + A3 2006h/2nd-Bit3 <--> X*64 2005h/1st-Bit6 + A4 2006h/2nd-Bit4 <--> X*128 2005h/1st-Bit7 + A5 2006h/2nd-Bit5 <--> Y*8 2005h/2nd-Bit3 + A6 2006h/2nd-Bit6 <--> Y*16 2005h/2nd-Bit4 + A7 2006h/2nd-Bit7 <--> Y*32 2005h/2nd-Bit5 + - - <--> X*1 2005h/1st-Bit0 + - - <--> X*2 2005h/1st-Bit1 + - - <--> X*4 2005h/1st-Bit2 + +Port 2006h-1st Write (VRAM Pointer MSB) +As one might (not) have expected, this does NOT change the VRAM Pointer, +instead, the written value is stored in the corresponding Reload bits (Port +2005h/2000h settings), the VRAM pointer is left unchanged for now. + +Port 2006h-2nd Write (VRAM Pointer LSB) +The written value is stored in the VRAM Pointer LSB Bits (and maybe also in the +corresponding Reload bits ?). And, the VRAM Pointer MSB is now loaded from the +corresponding Reload bits (ie. the value from the previous Port 2006h-1st Write +is applied now). + +Port 2005h-1st Write (Horizontal Scroll Origin, X*1, 0-255) +Port 2005h-2nd Write (Vertical Scroll Origin, Y*1, 0-239) +Port 2000h-Bit0 (Horizontal Name Table Origin, X*256) +Port 2000h-Bit1 (Vertical Name Table Origin, Y*240) +Writing to these registers changes the Reload value bits only, the VRAM Pointer +is left unchanged (except for indirect changes at times when the Reload value +is loaded into the Pointer during rendering). + +Full-screen and Mid-frame Scrolling +Simple full-screen scrolling can be implemented by initializing the Reload +value via Ports 2005h and 2000h. Many games change the scroll settings +mid-frame to split the screen into a scrolled and non-scrolled area: The +Horizontal bits can be changed by re-writing the Reload value via Ports 2005h +and 2000h, the vertical bits by re-writing the Pointer value via Port 2006h. +Changing both horizontal and vertical bits is possible by mixed writes to Port +2005h and 2006h, for example: + [2006h.1st]=(X/256)*4 + (Y/240)*8 + [2005h.2nd]=((Y MOD 240) AND C7h) + [2005h.1st]=(X AND 07h) + [2006h.2nd]=(X AND F8h)/8 + ((Y MOD 240) AND 38h)*4 +Notes: In that example, most bits are updated twice, once via 2006h and once +via 2005h, above shows only the relevant bits, the other bits would be don't +care (eg. writing unmasked values to 2005h would be faster, and wouldn't change +the functionality). The 1st/2nd-write-flipflop is toggled on each of the four +writes, so that above does change 2005h-2nd-write, and +2005h-1st-write. + +Pointer Increment/Reload during Rendering +During rendering, A4-A0 is incremented per tile, with carry-out to A10, at end +of HBlank A4-A0 and A10 are reset to the Reload value. "A14-A12" are used as +LSBs of Tile Data address, these bits are incremented per scanline, with +carry-out to tile row A9-A5, the tile row wraps from 29 to 0 with carry-out to +A11. +Note: Initializing the tile row to 30 or 31 will display garbage tiles (fetched +from Attribute table area), in that case the row wraps from 31 to 0, but +without carry-out to A11. + +PPU Tile Memory +--------------- + +PPU 0000h-0FFFh - Pattern Table 0 (4K) (256 Tiles) +PPU 1000h-1FFFh - Pattern Table 1 (4K) (256 Tiles) + +Pattern Table Format +Each pattern table contains 256 tiles. When using both pattern table 0 and 1, +up to 512 tiles can be used for Background and Sprites. +Each tile consists of a 8x8 pixel bitmap with 2bit depth (4 colors). Each tile +occopies 16 bytes, the first 8 bytes contain color bit 0 for each pixel, the +next 8 bytes color bit 1. Each byte defines a row of 8 pixels (MSB left). + +Pattern Table Memory +The console does NOT include built-in Pattern Table Memory. Instead, Pattern +tables are located in the cartridge, usually in a separate ROM chip, or (less +often) in a SRAM chip. Cartridges with more than 8K Pattern memory may contain +whatever mapping mechanisms to map the memory into the PPU 8K Pattern Memory +area. +There are some special mappers that do automatically change the CHR banks +during rendering (allowing to access more than 8K in one frame): +--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc. +--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH +--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH +--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH +Cartridges with CHR-RAM (instead CHR-ROM) usually have 8K RAM, but there also a +few with 16K, 32K or 64K RAM: +--> Mapper 13: CPROM - 16K VRAM +--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH +--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ + +PPU Background +-------------- + +PPU 2000h-23FFh - Name Table 0 and Attribute Table 0 (1K) +PPU 2400h-27FFh - Name Table 1 and Attribute Table 1 (1K) +PPU 2800h-2BFFh - Name Table 2 and Attribute Table 2 (1K) +PPU 2C00h-2FFFh - Name Table 3 and Attribute Table 3 (1K) +PPU 3000h-3EFFh - Mirror of 2000h-2EFFh + +Name Table Format +Each Name Table occupies 3C0h bytes, containing 8bit tile numbers for 32x30 +tiles (256x240 pixels). The tiles are fetched from Pattern Table 0 or 1 +(depending on Bit 4 in PPU Control Register 1). Note that NTSC displays may be +unable to display the whole 256x240 pixels, basically the relevant portion of +screen output should be in the 32x28 tiles (256x224 pixels) see PPU +Dimensions and Timings chapter for more info. + +Attribute Table Format +Each Name Table is directly followed by an Attribute Table of 40h bytes, +containing 2bit background palette numbers for each 16x16 pixel field. Each +byte in the Attribute table defines palette numbers for a 32x32 pixel area: + Bit0-1 Palette Number for upperleft 16x16 pixels of the 32x32 area + Bit2-3 Palette Number for upperright 16x16 pixels of the 32x32 area + Bit4-5 Palette Number for lowerleft 16x16 pixels of the 32x32 area + Bit6-7 Palette Number for lowerright 16x16 pixels of the 32x32 area +Note: Attributes for each 8x1 pixel row are fetched from cartridge bus. The +MMC5 Mapper with EXRAM allows to use different palettes for each 8x8 pixel +tile, instead of sharing one palette for above 16x16 areas. + +Background Scrolling +Scrolling origin is defined by the Name Table selection in Bit0-1 of $2000, and +by offsets in $2005, of which Horizontal offsets may range in 0-255, vertical +offsets in 0-239; values above 239 are considered negative (eg. 248 is -8). The +picture wraps to the next Name Table when drawing exceeds the boundaries of the +current Name Table... + +Multiple Name Tables +The NES has the capability of addressing up to four Name Tables (NT0-3), +allowing to define backgrounds of up to 512x480 pixels, arranged as such: + Square Horizontal Scroll Vertical Scroll + NT0 NT1 NT0 left/right NT1 NT0 above/below NT2 + NT2 NT3 NT2 left/right NT3 NT1 above/below NT3 +However, the NES includes only 2K VRAM, so that not more than two Name Tables +can be used (unless the cartridge includes external Name Table memory). + +Name Table Mapping/Mirroring +The NES outputs the desired Name Table number (NT0-3) to the cartridge, which +may then respond by selecting one of the two internal 1K RAM blocks (BLK0-1), +or by presenting an external RAM/ROM block (eg. BLK2-3). Examples: + _Name Table____________NT0___NT1___NT2___NT3___Purpose______________ + Horizontal Mirroring BLK0 BLK0 BLK1 BLK1 Vertical Scrolling + Vertical Mirroring BLK0 BLK1 BLK0 BLK1 Horizontal Scrolling + Four-screen BLK0 BLK1 BLK2 BLK3 Four-Way Scrolling +When using only the internal blocks, the cartridge may use a simple hardwired +connection between two pins to select horizontal or vertical mirroring. Also, +the cartridge may contain whatever circuits to map Single-Screen or CHR-ROM to +whatever addresses dependently or independently of the selected NT number. + +Background Clipping +The PPU allows to mask the left 8 pixels of BG, allowing to use horizontal +scrolling with only one Name Table, the 16pix-width palette attribute isn't +fully clipped though. Also, BG could be vertically clipped by software, which +would require accurate timing though. Aside from that, it'd be no problem to +implement four-way scrolling by using only one name table. + +PPU Sprites +----------- + +SPR-RAM 00-FF - Sprite Attributes (256 bytes, for 64 sprites / 4 bytes each) + +The PPU supports 64 sprites, which can be either 8x8 or 8x16 pixels in size, +only 8 sprites can be displayed per scanline. The sprite Tile bitmaps are kept +within the Pattern Table region of VRAM (which is also used for BG Tiles). + +Sprite-RAM is built-in in the PPU-chip, and can be accessed via I/O ports only +(it is not part of the PPU or CPU memory area). Each four bytes in SPR-RAM +define attributes for one sprite, bytes 0-3 for sprite 0, up to bytes FCh-FFh +for sprite 63. + +SPR-RAM Byte 0 - Y Coordinate Minus 1 + Vertical Position-1 (FFh,00h..EEh=Scanline 0..239, EFh..FEh=Not displayed) +The sprites can be moved bottom-offscreen, but cannot be moved top-offscreen. + +SPR-RAM Byte 1 - Tile Number +In 8x8 pixel mode (PPU Control Register 1, Bit5=0): + Bit7-0 Specifies 8bit tile number + And, Pattern Table selected by Bit 3 in PPU Control Register 1 +In 8x16 pixel mode (PPU Control Register 1, Bit5=1): + Bit7-1 Upper 7bit of tile number (N=0-127 uses Tiles N*2 and N*2+1) + Bit0 Pattern Table Address (0=VRAM 0000h, 1=VRAM 1000h) + +SPR-RAM Byte 2 - Attributes + 7 Vertical Flip (0=Normal, 1=Mirror) + 6 Horizontal Flip (0=Normal, 1=Mirror) + 5 Background Priority (0=Sprite in front of BG, 1=Sprite Behind BG) + 4-2 Not used (Always zero when reading from SPR-RAM) + 1-0 Sprite Palette (0-3=Sprite Palette 0-3) + +SPR-RAM Byte 3 - X Coordinate + Horizontal Position (00h..FFh) +Sprites can be moved right-offscreen, and clipping via Port 2001h also allows +to move sprites somewhat left-offscreen. + +Sprite Priorites +If two or more non-transparent sprite-pixels overlap, then only the sprite with +highest priority is processed. If the sprites background priority bit is set to +"Behind BG", then it will be hidden behind any non-transparent background +pixels. + Sprite 0 = highest priority + Sprite 63 = lowest priority +Mind that the PPU processes ONLY the sprite with highest priority, eg. if a +non-transparent pixel of sprite 5 hides "Behind BG", then sprite 6-63 won't be +displayed (even if they are "In Front of BG"). + +Sprite 0 Hit Flag (Collision Check between BG and Sprite 0) +The Hit Flag, Bit 6 of register 2002h, gets set when the cathode ray beam +passes a non-transparent Sprite 0 pixel which is overlapping a non-transparent +BG pixel (regardless the sprites BG priority). +The Hit Flag is automatically reset at the end of the VBlank period, it cannot +be set or reset by software, that means one can detect only one Hit per frame. +Aside from a normal collision detection, the Hit Flag is also useful to detect +when the cathode ray beam has reached a specific screen location, eg. to split +the picture into a scrolled and non-scrolled section. + +Color 1 or color 2 are (NOT) non-nontransparent (?) + +PPU Palettes +------------ + +PPU 3F00h-3F1Fh - Background and Sprite Palettes + +Palette Memory (25 entries used) + 3F00h Background Color (Color 0) + 3F01h-3F03h Background Palette 0 (Color 1-3) + 3F05h-3F07h Background Palette 1 (Color 1-3) + 3F09h-3F0Bh Background Palette 2 (Color 1-3) + 3F0Dh-3F0Fh Background Palette 3 (Color 1-3) + 3F11h-3F13h Sprite Palette 0 (Color 1-3) + 3F15h-3F17h Sprite Palette 1 (Color 1-3) + 3F19h-3F1Bh Sprite Palette 2 (Color 1-3) + 3F1Dh-3F1Fh Sprite Palette 3 (Color 1-3) + +Palette Gaps, Mirrors, and Unused Entries + 3F04h,3F08h,3F0Ch - Three general purpose 6bit data registers. + 3F10h,3F14h,3F18h,3F1Ch - Mirrors of 3F00h,3F04h,3F08h,3F0Ch. + 3F20h-3FFFh - Mirrors of 3F00h-3F1Fh. + +Palette Entries + Bit7-6 Not used (contains garbage when reading palette memory) + Bit5-4 Luminance (Grayscale) (0-3) + Bit3-0 Chrominance (Color) (0-F) + +The Color values are based on the NTSC color-wheel (even on PAL consoles): + |__0__|__1___2___3___4___5___6___7___8___9___A___B___C_|_D__|__E___F__| + |White|..Blue..Magenta..Red......Yellow...Green....Blue|Gray| Black | +Color and Grayscale (0-3) can be combined as such: + Luminance__0Xh_______1Xh__________2Xh_________3Xh___________________ + Color 0: Med Gray, Light Gray, White, White + Color 1-C: (Dark), (Normal), (Brighter), (Brightest/Pastelized) + Color D: Reserved, Black, Dark Gray, Lighter Gray + Color E-F: Black, Black, Black, Black +Some black/white colors are duplictated, one should normally use 0Eh or 0Fh as +black. Of the two Light Grays, 3Dh is slightly brighter than 10h. The Reserved +color is Blacker-than-black, producing a very low voltage, which some monitors +may or may not treat to be a sync signal rather than a color. + +Monochrome Television Set (nine different grayshades) +On mono TV sets, Colors 0 and D-F can be used for Black/Gray/White colors as +usually, and Colors 1-C are all displayed as grayshades: 01h-0Ch=Black, +11h-1Ch=Med/Dark Gray, 21h-2Ch=Med/Light Gray, 31h-3Ch=Bright Gray. Intensity +ramp example: 0Eh, 2Dh, 11h, 00h, 21h, 01h, 3Dh, 31h, 30h. Also, the Color +Emphasis bits are somewhat affecting the luminance output, even on mono +television sets. + +Monochrome Bit (three different grayshades) +When Port 2001h/Bit0 is set: The lower 4bits of all palette entries are treated +to be zero; this affects both memory reads and video output. +For memory reads, the 6bit values are ANDed with 30h when trying to read +palette data via Port 2007h. +For video output, only 3 colors can be displayed: Gray, Light Gray, and White. +All other colors cannot be used (even Black and Dark Gray are disabled). The +Color Emphasis bits can be still used (eg. to change above 3 gray-shades into 3 +pastelized green-shades). + +Color Emphasis Bits +Port 2001h/Bit7-5 allow to adjust the palette, eg. with setting 001b the whole +picture becomes more green. + 000b Normal + 001b Green + 010b Brown + 100b Blue +To play by the rules, one should reportedly not set more than one of the +emphasis bits at once, setting two or more bits may shortcut something inside +the PPU, though it doesn't seem to damage the chip. + +Border Color and Clipping Colors +The screen border is black, regardless of any palette settings. +The Color 0 setting is displayed when the BG is disabled, when the whole +display is disabled, and when the left BG row is clipped. + +RGB-Palettes (VS System, Play Choice 10, Famicom Titler) +These systems are using PPUs with RGB output. The PPUs are having a MUCH more +colorful palette than the pastelized NES palette; this "feature" may be seen as +a hardware glitch, or as an improvement. +Some of the VS System's PPUs are additionally having "scrambled" colors +(rearranged color numbers, so games will have wrong colors when not buying the +correct PPU; intended to prevent piracy and unlicensed games). For details, see +--> VS System + +PPU Cartridge Bus Note +When software accesses palette RAM via Port 2006h/2007h, the palette address +(PPU 3Fxxh) is output to the PPU address bus (usually a mirror of PPU 2Fxxh), +but the /WR signal isn't activated on palette writes (so VRAM remains +unchanged), however, the /RD signal is activated on palette reads, and the +addressed VRAM data is latched (ie. if the [2006h] gets changed to a +non-palette address, then the latched value will be returned on the next read +from 2007h). + +PPU Dimensions & Timings +------------------------ + +Below are timings for Nintendo's NTSC and PAL consoles, and for the Dendy (a +russian Famicom clone with PAL output and Famicom-like NTSC-style timings). + +Clock Speeds + Type NTSC PAL Dendy + Master Clock (X1) 21.47727MHz 26.6017125MHz Like PAL + Color Clock 3.579545MHz=X1/6 4.43361875MHz=X1/6 Like PAL + Dot Clock 5.3693175MHz=X1/4 5.3203425MHz=X1/5 Like PAL + CPU Clock 1.7897725MHz=X1/12 1.66260703MHz=X1/16 1.773448MHz=X1/15 + Frame Rate 60.09914261Hz 50.00697891Hz Like PAL +Note: Above NTSC values are rounded. The exact NTSC Color Clock should be +315/88MHz. + +Vertical Timings (in scanlines) + NTSC PAL Dendy + ? 1 ? Pre-Render Time + 240? 239 240? Rendering Time + 1 1 51? Post-Render Time + 20 70 20? Vblank + 1 1 1? Post-Blank Time + ---- ---- ---- ------- + 262 312 312? Total number of Scanlines + +Horizontal Timings (in dots) + NTSC PAL Dendy + 25x 252 25x Rendering Time + xx 89 xx Hblank + ---- ---- ---- ------- + 341 341 341? Total number of dots per scanline +In each second frame, NTSC does output a short scanline with only 340 dots, +this happens only if BG and/or OBJ are enabled. + +CPU vs PPU Timings + Type NTSC PAL Dendy + Dots per CPU Clk 3.0 (12/4) 3.2 (16/5) 3.0 (15/5) + CPU Clks per Scanline 113.6666 106.5625 + CPU Clks per One Frame 29780.66 33247.5 + CPU Clks per Other Frame 29780.33 33247.5 + CPU Clks per Two Frames 59561.0 66495.0 + +Modulator vs PPU Timings + Type NTSC PAL Dendy + Dots per Color Clk 1.5 (6/4) 1.2 (6/5) 1.2 (6/5) + Color Clks per Scanline 227.3333 284.1666 + Color Clks per One Frame 59561.33 88660.0 + Color Clks per Other Frame 59560.66 88660.0 + Color Clks per Two Frames 119122.0 177320.0 + +Visible Screen Resolution +The logical screen resolution processed by the PPU is 256x240 pixels. However +the visible screen resolution is somewhat smaller, due to improper blanking +periods, and eventually due to exceeding the physical dimensions of (NTSC) +displays. +On PAL hardware, the upper 1 scanline, the left 2 pixels, and the right 2 +pixels are invisible (displayed as black border). On NTSC hardware, the upper 8 +scanlines, and the lower 8 scanlines are reportedly often invisible (224 lines +visible), eventually some NTSC screens are hiding only the upper 3 scanlines +(237 lines visible). +To be compatible with all types of displays, output valid 256x240 pixels, but +have the relevant information in the 240x224 pixels (30x28 tiles) +only. + +Synchronizing Software with the Cathode Ray Beam +The PPU sets the VBlank flag in PPU Status Register (and optionally produces an +NMI) once per frame. It doesn't support scanline interrupts, or a current +scanline number register, which is making it a bit difficult to access PPU +registers at specific Cathode Ray Beam locations (for example, to split the the +screen into two sections with different colors or scroll offsets). However, a +couple of methods could be used for that purpose: + 1) Delay Loops synchronized with NMI (badly wasting CPU time) or using + meaningful code with fixed non-conditional execution time instead delays. + 2) Producing a "Sprite 0 Hit", or a "More Than 8 Sprites Per Scanline" + situation at specific screen location (which sets corresponding flag in + PPU Status Register, one cannot reset the flag manually, so either works + only once per frame) + 3) Using PCM Sound IRQs as Timer (synchronized with NMI) + 4) Using external Timers (contained in some Cartridge Mappers) +The APU also contains a so-called "Frame" counter - that counter is NOT +physically synchronized with the PPU, and it doesn't even match the exact +number of clock cycles per frame. There's a limited chance that one could +program it to produce an IRQ at a specific screen location (and to +resynchronize it for the next frame). + +More detailed Timing Info +--> PPU 2C02 Timings + +PAL Vblank Start Timing + Line <--Line238--><--Line239--><--Line240--><--Line241--><--Line242--> + /NMI ---------------------------------------__________________________ + Video: PPPPPPPPP-_C-PPPPPPPPP-_C-----------_C-----------_C-----------_C- + +PAL Vblank Middle Timing + Line <--Line268--><--Line269--><--Line270--><--Line271--><--Line272--> + /NMI _________________________________________________________________ + Video: ----------_C-----------____________-____________-____________-_C- + +PAL Vblank End Timing + Line <--Line310--><--Line311--><--Line000--><--Line001--><--Line002--> + /NMI _____________---------------------------------------------------- + Video: ----------_C-----------_C-----------_C-PPPPPPPPP-_C-PPPPPPPPP-_C- + +Whereas +For Video: P=Picture, -=Blank, _=Sync, C=ColorBurst +/NMI is toggled on & off at the begin of the line (after the ending "-_C-" +blanking part of the previous line). +VSYNC is toggled at HSYNC, while active, it changes the "-_C-" part to "-___", +and also changes the next lines "picture" part from "---" to "___". + +PPU 2C02 Timings +---------------- + +PPU base timing - NTSC +the 21.48 MHz signal is divided by 4 to get 5.37 MHz, and is used as the +smallest unit of timing in the PPU. All following references to PPU clock cycle +(abbr. "cc") timing in this document will be in respect to this timing base, +unless otherwise indicated. + - Pixels are rendered at the same rate as the base PPU clock. + In other words, 1 clock cycle= 1 pixel. + - One frame consists of 262 scanlines. + This equals 341*262 PPU cc's per frame (divide by 3 for # of CPU cc's). + - 341 PPU cc's make up the time of a typical scanline (or 341/3 CPU cc's). +All PPU memory access cycles are 2 clocks long, and can be made back-to-back +(typically done during rendering). Here's how the access breaks down: + +At the beginning of the access cycle, PPU address lines 8..13 are updated with +the target address. This data remains here until the next time an access cycle +occurs. + +Miscellanious PPU info + - Reading from $2002 clears the vblank flag (bit 7), and resets the + internal $2005/6 flip-flop. Writes here have no effect. + - $2002.5 and $2002.6 after being set, stay that way for the first 20 + scanlines of the new frame, relative to the VINT. + - Pin /VBL on the 2C02 is the logical NAND between 2002.7 and 2000.7. + +Frame rendering details +The following describes the PPU's status during all 262 scanlines of a frame. +Any scanlines where work is done (like image rendering), consists of the steps +which will be described in the next section. + +0..19: Starting at the instant the VINT flag is pulled down (when a NMI is +generated), 20 scanlines make up the period of time on the PPU which I like to +call the VINT period. During this time, the PPU makes no access to it's +external memory (i.e. name / pattern tables, etc.). + +20: After 20 scanlines worth of time go by (since the VINT flag was set), the +PPU starts to render scanlines. This first scanline is a dummy one; although it +will access it's external memory in the same sequence it would for drawing a +valid scanline, no on-screen pixels are rendered during this time, making the +fetched background data immaterial. Both horizontal *and* vertical scroll +counters are updated (presumably) at cc offset 256 in this scanline. Other than +that, the operation of this scanline is identical to any other. The primary +reason this scanline exists is to start the object render pipeline, since it +takes 256 cc's worth of time to determine which objects are in range or not for +any particular scanline. + +21..260: after rendering 1 dummy scanline, the PPU starts to render the actual +data to be displayed on the screen. This is done for 240 scanlines, of course. + +261: after the very last rendered scanline finishes, the PPU does nothing for 1 +scanline (i.e. the programmer gets screwed out of perfectly good VINT time). +When this scanline finishes, the VINT flag is set, and the process of drawing +lines starts all over again. + +Scanline rendering details +As explained before, external PPU memory can be accessed every 2 cc's. With 341 +cc's per scanline, this gives the PPU enough time to make 170 memory accesses +per scanline (and it uses all of them!). After the 170th fetch, the PPU does +nothing for 1 clock cycle. Remember that a single pixel is rendered every clock +cycle. + +Note that the PPU fetches an attribute table byte for every 8 sequential +horizontal pixels it draws. This essentially limits the PPU's color area (the +area of pixels which are forced to use the same 3-color palette) to only 8 +horizontally sequential pixels. + +Memory fetch phase 1 thru 128 - BG Fetch +Fetches 4x32 bytes; one Name Table entry, one Attribute Table entry, and two +Pattern Table bytes; for 3rd..34th tile in scanline (33th tile may be parts +visible if BG scrolled, 34th is never visible). From the time of the Name Table +fetch, it takes (16-n) clock cycles until the first pixel of the fetched tile +is processed (drawn on screen, unless being covered by a Sprite-pixel, and +eventually setting the Hit Flag) (n=0..7, horizontal scroll offset). +Simultaneously with above BG fetch, the PPU pre-processes SPR-RAM for the NEXT +scanline by searching for Sprite Y-cooridnates that are visible in that +scanline, only the first eight matches will be recursed, if the search finds +additional matching entries then bit5 of $2002 will get set to indicate that +one or more entries have been ignored. + +Memory fetch phase 129 thru 160 - Sprite Fetch +Fetches 4x8 bytes; two dummy Name Table entris, and two Pattern Table bytes; +for 1st..8th sprite in NEXT scanline (fetches dummy patterns if the scanline +contains less than 8 sprites). + +Memory fetch phase 161 thru 168 - BG Fetch +Fetches 4x2 bytes; one Name Table entry, one Attribute Table entry, and two +Pattern Table bytes; for 1st..2nd tile in NEXT scanline. + +Memory fetch phase 169 thru 170 (and a half) - Padding +Fetches 2 bytes; two dummy reads from the Name Table address of the 3rd tile in +next scanline. After that fetches, the PPU rests for one "dead" cycle here (or +the equivelant of 1/2 memory access cycle) before repeating the whole +pixel/scanline rendering process. Scanline 20 is the only scanline that has +variable length, on every odd frame, this scanline is only 340 cycles (the dead +cycle at the end is removed). This is done to cause a shift in the NTSC +colorburst phase. + +3D Glasses +---------- + +Famicom 3D System (Japan) (LCD shutter glasses) +Japanese Famicom games are using fairly expensive LCD shutter glasses, +controlled via the 15pin Controller Expansion Port. Left & Right images are +transferred in separate frames (and the left/right shutters are opened/closed +accordingly). + Write to [4016h].Bit1 (0=Shut Which? Eye, 1=Shut WhichOther? Eye) +The advantage is that the 3D picture is fully colored. The downside is that the +hardware is expensive, and must be purchased separately. Another restriction is +that it requires the old 15pin Famicom connector (or an adapter for newer +Famicom and NES 7pin controller ports). + +Simple 3D Glasses (US and Europe) (red/cyan glasses) +US and European NES games are using much cheaper "passive" 3D glasses with +colored "lens" instead of LCD shutters. Theoretically, this would allow to +transfer the left & right picture in one frame, but that'd require more CPU +load and color depth, so, in practice the games are drawing the left/right +frames separately (similar as in the LCD shutter method). + Right Eye -- Red + Left Eye -- Blue/cyan or so +The advantage is that the hardware is so cheap that it can have been included +with the game for free. Cheapest variant would be "cardboard" glasses, though +there seems to have been also a yellow stylish plastic variant. +The downside of mis-using colors for 3D effects is that the picture will appear +more or less monochrome. + +Pulfrich Effect 3D Glasses (US) (dark/clear glasses) +Another approach is using the Pulfrich effect with dark/clear glasses, this is +some sort psychophysical stuff, related to different signal timings for +bright/dark colors. + Right Eye -- Dark ;\as so for NES Orb-3D + Left Eye -- Clear ;/(that is, opposite as for SNES Jim Power) +The advantage is that it's cheap, and that it can be even used for colored +images (unlike the red/cyan glasses method). The disadvantage is that it does +work only with permanently moving objects. + +Games with support for 3D Glasses + Attack Animal Gakuen (J) (Pony Canyon) + Cosmic Epsilon (J) (Asmik) + Falsion (Konami) + Famicom Grand Prix: 3D Hot Rally (Nintendo) + Highway Star (J) aka Rad Racer (U) (E) (Square) + Tobidase Daisakusen (J) aka 3-D World Runner (U) (Square) + JJ Tobidase Daisakusen Part II (J) (Square) + Orb-3D (U) (Pulfrich Effect) +In most of that games, 3D mode is activated by pressing SELECT button. Game +versions that were released outside of Japan are customized to work with the +red/cyan glasses (or dark/clear glasses for Orb-3D). + +Audio Processing Unit (APU) +--------------------------- + +--> APU Channel 1-4 Register 0 (Volume/Decay) +--> APU Channel 1-4 Register 1 (Sweep) +--> APU Channel 1-4 Register 2 (Frequency) +--> APU Channel 1-4 Register 3 (Length) +--> APU Channel 5 - DMC Sound +--> APU Control and Status Registers +--> APU 4-bit DAC +--> APU Various +--> APU DMC-DMA Glitch +--> APU External Sound Channels +--> Controllers - Microphones + +Based on "2A03 technical reference by Brad Taylor" (1st release, April 2004). + +APU Channel 1-4 Register 0 (Volume/Decay) +----------------------------------------- + +4000h - APU Volume/Decay Channel 1 (Rectangle) +4004h - APU Volume/Decay Channel 2 (Rectangle) +400Ch - APU Volume/Decay Channel 4 (Noise) + 0-3 Volume / Envelope decay rate + When Bit4=1: Volume (0=Silent/None..F=Loud/Max) + When Bit4=0: Envelope decay rate, NTSC=240Hz/(N+1), PAL=192Hz/(N+1) + 4 Envelope decay disable (0=Envelope/Decay, 1=Fixed Volume) + 5 Length counter clock disable / Envelope decay looping enable + When Bit4=1: length counter clock disable + When Bit4=0: envelope decay looping enable + 0: Disable Looping, stay at 0 on end of decay [ \_____ ] + 1: Enable Looping, restart decay at F [ \\\\\\ ] + (Does this still affect Length counter clock disable ?) + 6-7 Duty cycle type (unused on noise channel) + 0 [--______________] 12.5% Whereas, + 1 [----____________] 25.0% [_] = LOW (zero) (0) + 2 [--------________] 50.0% [-] = HIGH (volume/decay) (0..F) + 3 [------------____] 75.0% Noise randomly outputs LOW or HIGH +The Duty Cycle counter is reset when the length counter of the same channel is +written to (via 4003h/4007h). + +Initial Decay Volume: +Only a write out to 4003h/4007h/400Fh will reset the current envelope decay +counter to a known state (to 0Fh=max) for the appropriate channel's envelope +decay hardware. Otherwise, the envelope decay counter is always counting down +(by 1) at the frequency currently contained in the volume / envelope decay rate +bits (even when envelope decays are disabled by setting bit 4), except when the +envelope decay counter contains a value of 0, and envelope decay looping (bit +5) is disabled (0). + +4008h - APU Linear Counter Channel 3 (Triangle) + 0-6 linear counter load register + 7 length counter clock disable / linear counter start +Linear counter incremented-or-decremented? at NTSC=240Hz, PAL=192Hz, same +purpose, but higher resolution than length counter, so Triangle channel is +ALWAYS using either linear-counter or length-counter, and cannot be used with +both counters disabled? + +The Triangle channel does not have a variable volume, nor variable duty cycle. +Instead, it produces the following fixed 32-step output level stream: + 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F,F,E,D,C,B,A,9,8,7,6,5,4,3,2,1,0 +On 2A03 reset, the stream starts at 0. The stream will be halted (at the +current position) whenever the Triangle channel's length or linear counter +contains a count of 0, and will continue at whatever old position when it is +restarted. + +APU Channel 1-4 Register 1 (Sweep) +---------------------------------- + +4001h - APU Sweep Channel 1 (Rectangle) +4005h - APU Sweep Channel 2 (Rectangle) + 0-2 Sweep right shift amount (S=0..7) + 3 Sweep Direction (0=[+]Increase, 1=[-]Decrease) + 4-6 Sweep update rate (N=0..7), NTSC=120Hz/(N+1), PAL=96Hz/(N+1) + 7 Sweep enable (0=Disable, 1=Enable) +At specified Update Rate, the 11bit Wavelength will be modified as such: + Wavelength = Wavelength +/- (Wavelength SHR S) + (For Channel 1 Decrease only: minus an additional 1) + (Ie. in Decrease mode: Channel 1 uses NOT, Channel 2 uses NEG) +Wavelength register will be updated only if all 3 of these conditions are met: + Bit 7 is set (sweeping enabled) + The shift value (which is S in the formula) does not equal to 0 + The channel's length counter contains a non-zero value +Sweep end: The channel gets silenced, and sweep clock is halted, when: + 1) current 11bit wavelength value is less than 008h + 2) new 11bit wavelength would become greater than 7FFh +Note that these conditions pertain regardless of any sweep refresh rate values, +or if sweeping is enabled/disabled (via Bit7). + +4009h - APU N/A Channel 3 (Triangle) +400Dh - APU N/A Channel 4 (Noise) + 0-7 Unused (No Sweep support for these channels) + +APU Channel 1-4 Register 2 (Frequency) +-------------------------------------- + +4002h - APU Frequency Channel 1 (Rectangle) +4006h - APU Frequency Channel 2 (Rectangle) +400Ah - APU Frequency Channel 3 (Triangle) + 0-7 Lower 8 bits of wavelength (upper 3 bits in Register 3) +F = CPUCLK/(N+1)/16 for Rectangle channels +F = CPUCLK/(N+1)/32 for Triangle channel +CPUCLK is 1.789773MHz (NTSC), or 1.662607MHz (PAL). + +400Eh - APU Frequency Channel 4 (Noise) + 0-3 Noise frequency, F=1.79MHz/2/(N+1) + Value 0..F corresponds to following 11bit clock cycle value: + N=002,004,008,010,020,030,040,050,065,07F,0BE,0FE,17D,1FC,3F9,7F2 + 4-6 Unused + 7 Random number type generation (0=32767 bits, 1=93 bits) +XXX conflicting info suggests these frequency values: + NTSC: 004,008,010,020,040,060,080,0A0,0CA,0FE,17C,1FC,2FA,3F8,7F2,FE4 + PAL: 004,008,00E,01E,03C,058,076,094,0BC,0EC,162,1D8,2C4,3B0,762,EC2 + (XXX but, this won't match the "/2/(N+1)" part of the above formula) +The random number generator consists of a 15bit shift register. The MSB (Bit14) +is output/inverted (1=Low/Zero, 0=High/Decay/Volume). At the specified +frequency, Bit14 is XORed with Bit13 (32767-bit mode) or with Bit8 (93-bit +mode), the register is then shifted to the left, with the result of the XOR +operation shifted-in to Bit0. + +On 2A03 reset, this shift register is loaded with a value of 1. +Not sure if it is reset when switching from 32767-bit mode to 93-bit mode? If +it isn't reset then 93-bit mode will act unstable: produce different 93-bit +patterns, or even a 31-bit pattern, depending on old shift register content. + +APU Channel 1-4 Register 3 (Length) +----------------------------------- + +4003h - APU Length Channel 1 (Rectangle) +4007h - APU Length Channel 2 (Rectangle) +400Bh - APU Length Channel 3 (Triangle) +400Fh - APU Length Channel 4 (Noise) +Writing to the length registers restarts the length (obviously), and also +restarts the duty cycle (channel 1,2 only), and restarts the decay volume +(channel 1,2,4 only). + 0-2 Upper 3 bits of wavelength (unused on noise channel) + 3-7 Length counter load register (5bit value, see below) +The above 5bit value is translated to the actual 7bit counter value as such: + Bit3=0 and Bit7=0 (Dividers matched for use with PAL/50Hz) + Bit6-4 (0..7 = 05h,0Ah,14h,28h,50h,1Eh,07h,0Dh) + Bit3=0 and Bit7=1 (Dividers matched for use with NTSC/60Hz) + Bit6-4 (0..7 = 06h,0Ch,18h,30h,60h,24h,08h,10h) + Bit3=1 (General Fixed Dividers) + Bit7-4 (0..F = 7Fh,01h..0Fh) +The 7bit counter value is decremented once per frame (PAL=48Hz, or NTSC=60Hz) +the counter and sound output are stopped when reaching a value of zero. The +counter can be paused (and restarted at current location) by Length Counter +Clock Disabled bit in Register 0. + +APU Channel 5 - DMC Sound +------------------------- + +4010h - DMC Play mode and DMA frequency + 7 IRQ Enable, when Length=0 AND Loop=Disabled (0=Disable, 1=Enable) + DMC IRQs can be acknowledged by writing 0 to Bit7 of 4010h, or + by writing any value to 4015h + 6 Loop when reaching Length=0 (0=Stop, 1=Loop) + In looped mode, the sample block is restarted by reloading the + DMA Start Address and Length values, IRQs are not generated. + 5-4 Appear to be unused + 3-0 DMC frequency (00h..0Fh, see below) +For frequency 00h..0Fh, the number of cycles/samplebyte are: + NTSC: D60,BE0,AA0,A00,8F0,7F0,710,6B0,5F0,500,470,400,350,2A8,240,1B0 + PAL: XXX +For frequency 00h..0Fh, the number of cycles/samplebit are: + NTSC: 1AC,17C,154,140,11E,0FE,0E2,0D6,0BE,0A0,08E,080,06A,054,048,036 + PAL: 18E,162,13C,12A,114,0EC,0D2,0C6,0B0,094,084,076,062,04E,042,032 + +4011h - DMC Delta counter load register + 7 Appears to be unused + 6-1 MSBs of 7bit DAC (6bit "Delta Counter") + 0 LSB of 7bit DAC +Used to initialize the Delta Counter (for DMC usage), or to output 7bit data +directly (for PCM usage). Another use of this register has been to somewhat +control the volume of the Triangle & Noise sound channel outputs. Please see +NESSOUND.TXT for more information. + +4012h - DMC address load register +Specifies the DMA Start Address. The Start Address is loaded to the actual DMA +pointer, when the DMC is activated from an inactive state, or when restarting +looped playback. + 7-0 DMA Start Address for DMC (Address = C000h+N*40h) +The DMA pointer is 15 bits in size, and wraps from FFFFh to 8000h (not C000h). + +4013h - DMC length register + 7-0 DMA Length DMC (Length = N*10h+1 Bytes = N*80h+8 Bits) +When it arrives at 0, the DMC will take action(s) based on the 2 MSB of $4010. +This counter will be loaded with the current calculated address value of $4013 +when the DMC is activated from an inactive state. + +Usage as Delta Modulation Channel (DMC) with Direct Memory Access (DMA) +This method uses 1-bit samples, processed at the specified sample-bit-rate, + 1 = Increment Delta counter by 1 (unless result would be greater than 3Fh) + 0 = Decrement Delta counter by 1 (unless result would be less than 0) +Every eight sample-bits, the DMC will halt the CPU for 2 clock cycles to +retrieve the next sample-byte per DMA, each sample byte is processed bit-by-bit +(LSB first). + +Usage as Pulse Code Modulation (PCM) Channel +Alternately, 7bit samples can be written directly to the DAC. +Advantages are that all 7bit can be used (instead only the upper six Delta +bits), and that the DAC can be directly changed from one value to any other +value (which would take up to 64 increment/decrement steps in DMC mode). +Disadvantages are that it requires exact software timings and more CPU load +than the DMA method. +No idea if it is required to "enable" the DMC channel (eg. by outputting a +looped dummy 55h sample byte) in order to use PCM ? + +On 2A03 reset, the DMC's IRQ flag is cleared (disabled), and the [DMC] channel +is disabled. On 2A03 reset, all 7 used bits of $4011 are reset to 0. + +Caution +Using DMC-DMA can conflict with other I/O ports (such like VRAM or joypad +reads)! For details, see: +--> APU DMC-DMA Glitch + +APU Control and Status Registers +-------------------------------- + +4015h - DMC/IRQ/length counter status/channel enable register + 0 Status/Enable rectangle wave channel 1 + 1 Status/Enable rectangle wave channel 2 + 2 Status/Enable triangle wave channel 3 + 3 Status/Enable noise channel 4 + 4 Status/Enable DMC channel 5 + 5 Not used (returns garbage on reading) + 6 Frame IRQ status (active when set) + 7 DMC's IRQ status (active when set) +Reading Bit4-0 returns 0 for a zero count status in the length counter +(channel's sound is disabled), and 1 for a non-zero status. Reading Bit7-6 +returns IRQ status flags. +Writing to Bit4-0: Writing 0 forces to disable the channel, it will get stopped +and become silent (as if its length counter has reached 0), writing 1 +de-activates the forced-stop (without changing the length counter, playback +continues at whatever value have been in the length counter). +Writing to Bit7-5: Unknown. +DMC IRQs are acknowledged by WRITING any value to 4015h. +Frame IRQs are acknowledged by READING from 4015h. + +Note that all 5 writable bits in 4015h will be set to 0 upon 2A03 reset. + +4017h - APU Low frequency timer control (W) +Any write to 4017h resets both the frame counter, and the clock divider. +Sometimes, games will write to this register in order to synchronize the sound +hardware's internal timing, to the sound routine's timing (usually tied into +the NMI code). The frame IRQ frequency is slightly smaller than the PPU's +vertical retrace frequency, so you can see why games would desire this +synchronization. + bit6: Frame IRQ Disable (0=Enable Frame IRQ, 1=Disable Frame IRQ) + bit7: Frame Rate Select (0=NTSC=60Hz=240Hz/4, 1=PAL=48Hz=240Hz/5) + ...XXX... Frame IRQ works ONLY if bit6 and bit7 are BOTH zero! +On 2A03 reset, Bit6-7 will be cleared. That means that Frame IRQs are enabled +by default (though usually not executed since the CPUs IRQ-Disable-Flag is set +on reset). +Frame IRQs are acknowledged by reading from 4015h. + +Frame Counter +Several audio timings are referred to as "Frames" and "PAL" and "NTSC", + ! These timings are NOT physically related to actual PPU VBlank/NMI timings ! +The Audio "Frame" counter can be switched into "PAL" or "NTSC" mode by software +- regardless of whether the game does run on a PAL/NTSC console. Audio-frames +may be (more or less) synchronized with video-frames by chosing PAL/NTSC +audio-mode matching to PAL/NTSC console type respectively. +The frame counter is based on a 240Hz signal which is gained from dividing the +1.78Mhz PHI2 clock edges (2*1.78M edges/second) by 14915. In PAL Mode (4017h +Bit7=1), the 240Hz signal is divided by 1.25 (by simply leaving out each fifth +clock pulse), resulting in a somewhat dirty 192Hz signal. This PAL/NTSC +adjustment mechanism counts through 4 or 5 steps, producing output as such: + 0/NTSC: 4,0,1,2,3,0,1,2,3,0,1,2,3 | 1/PAL: 0,1,2,3,4,0,1,2,3,4,0,1,2,3,4 + 240Hz: __-_-_-_-_-_-_-_-_-_-_-_- | 192Hz: -_-_-_-___-_-_-_-___-_-_-_-__ + 120Hz: ____-___-___-___-___-___- | 96Hz: __-___-_____-___-_____-___-__ + 60Hz: (above somehow div by 2) | 48Hz: (above somehow divided by 2) +Frame Counter is reset on writing to 4017h, and does then restart sequences as +shown above (in NTSC mode starting with a skipped step, whilst directly +starting with a non-skipped step in PAL mode). +Linear counter (triangle) and envelope decay counters (rectangle/noise) are +clocked by 240Hz/192Hz. Frequency sweep (rectangle) clocked by 120Hz/96Hz. +Length counters (all channels) and Frame IRQ clocked by 60Hz/48Hz. + +4014h - SPR-RAM DMA +Sprite RAM DMA Function contained in 2A03 chip. See PPU description. + +4016h - Write +Three bit general purpose output latch contained in 2A03 chip. +Used to strobe joysticks. See Controllers chapter for more info. + +4016h/4017h - Read +The 2A03 chip does not actually contain read-able registers at these addresses, +however, it does output read-request signals for these addresses, which are +used to activate on-board joystick inputs. +See Controllers chapter for more info. + +Note: 4015h is the only R/W register in the 4000h-4017h area, all other +registers in this area are write-only, and do not respond to read cycles +(except for the external read-able 4016h/4017h registers). + +APU 4-bit DAC +------------- + +Channel 1-4 are (each) using a standard 4-bit DAC with 16 steps of output +voltage resolution. On the 2A03, rectangle wave 1 & 2 are mixed together, and +are available via pin 1. Triangle, noise, and DMC are available on pin 2. +Signals are then merged via 20KOhm (pin 1) and 12KOhm (pin2), respectively, +rectangle channels have different output levels than equivalent volume settings +on triangle/noise channels? + +The output waveforms have some linear asymmetry (the desired output voltage +would increase on a linear scale, the actual outputted voltage increases less +and less each step). + +The side effect of this is that the DMC's 7-bit DAC port ($4011) is able to +indirectly control the volume (somewhat) of both triangle & noise channels. +When $4011=0, triangle & noise volume outputs are at maximum. When $4011=7F, +triangle & noise channel outputs operate at only 57% total volume. A few games +actually take advantage of this "volume" feature, and write values to $4011 in +order to regulate the amplitude of the triangle wave channel's output. + +Forced Zero Volume: +When hardware in the channel wants to disable it's sound output (like the +length counter, or sweep unit). + +APU Various +----------- + +After 2A03 reset, the sound channels are unavailable for playback during the +first 2048 CPU clocks. + +The rectangle channel(s) frequency in the range of 54.6 Hz to 12.4 KHz. +The triangle wave channel range of 27.3 Hz to 55.9 KHz. +The random wavelength channel range anywhere from 29.3 Hz to 447 KHz. + +RP2A03E quirk +I have been informed that revisions of the 2A03 before "F" actually lacked +support for the 93-bit looped noise playback mode. While the Famicom's 2A03 +went through 4 revisions (E..H), I think that only one was ever used for the +front loading NES: "G". Other differences between 2A03 revisions are +unknown. Is that Quirk True and Confirmed ? + +APU DMC-DMA Glitch +------------------ + +DMC-DMA can conflict with other I/O ports. If the DMA read occurs at the same +time as a CPU read, then the CPU read is executed TWICE. In case of CPU reads +from read-sensitve I/O ports this can result in "lost" bits and bytes. + 2002h ppu status ;-vblank flag acknowledged (lost flag) + 2007h vram data read ;-vram address incremented twice (one byte skipped) + 4016h joypad1 read ;\two CLKs sent to joypad, causing one shift-register + 4017h joypad2 read ;/step to be skipped + xxxxh other external read-sensitive mapper registers +The bug occurs only on CPU reads (not on CPU writes). And, it occurs only on +NTSC consoles (with RP2A03xx APU/CPU), not on PAL consoles (with RP2A07xx +APU/CPU). + +Workarounds +In case of joypad & vram reads, the workaround would be to read the data +repeatedly, until receiving twice the same values. This should also work for +most other controllers - unless the controller transfers the data only ONCE, or +unless it does internally reset the data after reading. +For ppu status read, it is generally better to set a nmi_flag in the NMI +handler, and to poll that flag in the main program (rather than polling 2002h +directly, which is unstable, even without the DMC glitch). +And, of course, one could disable DMC. Or, sense the collision time (eg. by +examining VRAM reads), and then place critical reads into gaps where DMC isn't +occuring). + +APU External Sound Channels +--------------------------- + +The Famicom 60-pin cartridge slot includes a SND_IN pin, allowing external +sound controllers (as included in some Cartridge Mappers, and in Famicom Disk +System) to produce additional sound channels which are merged with the normal +APU channels: + +--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc. +--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND +--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND +--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 188: UNROM-reversed + +However, the NES 72-pin cartridge slot DOES NOT include a SND_IN pin, even +though it does have more (more or less unused) pins than Famicom. + +And, there are a few devices with external speakers (not routed through NES +SND_IN) - a "beep" function Power Glove, and fully featured synthesizer in the +Miracle: +--> Controllers - Piano Keyboards +--> Controllers - Power Glove + +And, the FamicomBox contains a beep function (when money is inserted); the beep +sound is merged with the APU sound, and then passed to TV-Set. +--> FamicomBox + +Controllers +----------- + +Controller Interface +--> Controllers - I/O Ports +--> Controllers - Pin-Outs +--> Controllers - Summary of Controller Types +--> Controllers - Summary of Controller Signals +--> Controllers - Detection + +Controllers +--> Controllers - Joypads +--> Controllers - Four-Player Adaptors +--> Controllers - Lightguns (Zapper) +--> Controllers - Paddles +--> Controllers - Push Buttons +--> Controllers - Typewriter Keyboards +--> Controllers - Piano Keyboards +--> Controllers - Keypads +--> Controllers - Mats +--> Controllers - Inflatable Controllers +--> Controllers - RacerMate Bicycle Training System +--> Controllers - Tablets +--> Controllers - Trackball and Mouse +--> Controllers - Power Glove +--> Controllers - UForce +--> Controllers - Barcode Readers +--> Controllers - Pachinko +--> Controllers - Microphones +--> Controllers - Reset Button +--> Controllers - Arcade Machines + +Other Devices that connect to Controller I/O Ports +--> 3D Glasses +--> Storage Data Recorder +--> Storage Turbo File +--> Storage Battle Box +--> Hori Game Repeater +--> Headphones + +Another special device (not directly connected to Controller Ports) +--> R.O.B. (Robotic Operating Buddy) + +Controllers - I/O Ports +----------------------- + +Port 4016h-4017h control 3 general purpose outputs (OUT0/1/2), plus 2 clock +outputs (PORT0/1-CLK), and several inputs (number of inputs varies depending on +the console type), all inputs are inverted inside of the console, ie. LOW +arrives as "1" at the CPU. + +4016h - Joypad Output Register (W) + 2-0 OUT2-0 Expansion Port Outputs + 0 OUT0 NES/Famicom: Joypad 1+2 Strobe (for BOTH joypads) + +4016h - Joypad Input Register 0 (R) + Bit Name NES Famicom Purpose + 7-5 N/A Not used (undefined) Not used (undefined) - + 4 PORT0-4 Expansion/Gameport Not used (undefined) Zapper 1 Button + 3 PORT0-3 Expansion/Gameport Not used (undefined) Zapper 1 Light + 2 PORT0-2 Expansion Microphone Input Microphone + 1 PORT0-1 Expansion Expansion Exp. + 0 PORT0-0 Expansion/Gameport Joypad Joypad 1 +Reading from 4016h generates a PORT0-CLK signal (used to clock joypads). + +4017h - Joypad Input Register 1 (R) + Bit Name NES Famicom Purpose + 7-5 N/A Not used (undefined) Not used (undefined) - + 4 PORT1-4 Expansion/Gameport Expansion Zapper 2 Button + 3 PORT1-3 Expansion/Gameport Expansion Zapper 2 Light + 2 PORT1-2 Expansion Expansion Exp. + 1 PORT1-1 Expansion Expansion Exp. + 0 PORT1-0 Expansion/Gameport Expansion/Joypad Joypad 2 +Reading from 4017h generates a PORT1-CLK signal (used to clock joypads). + +4017h - APU Low frequency timer control (W) +Not joypad/expansion related. See APU chapter for more info. + +For info about the "Not used (undefined)" bits, see: +--> Unpredictable Things + +Caution +The APU (if DMC sound is used) can conflict with joypad reads! For details, +see: +--> APU DMC-DMA Glitch + +Controllers - Pin-Outs +---------------------- + +Controller ports - NES (and newer Famicom models) - male, front side + Pin Dir Player 1 Player 2 Expl./Usage .---------. + 1 Out GND GND Ground | 4 3 2 1 | + 2 Out PORT0-CLK PORT1-CLK Joystick Clock (CPU Port Read) | 7 6 5 / + 3 Out OUT0 OUT0 Joystick Serial-Start (Strobe) '-------' + 4 In PORT0-0 PORT1-0 Joystick Serial-Data .---------. + 5 Out +5VDC +5VDC Supply | 4 3 2 1 | + 6 In PORT0-3 PORT1-3 Zapper Light, Paddle Button | 7 6 5 / + 7 In PORT0-4 PORT1-4 Zapper Button, Paddle Position '-------' +All controller inputs are inverted inside of the console, LOW arrives as "1". +Note: Older Famicom consoles do not include controller ports, instead the +joypad cables are directly attached to the console (without plugs/sockets). + +Famicom Expansion Port (standard db15, female, front side) +Included in both older and newer Famicom consoles, not in NES consoles. + 1 Out GND .------------------------. + 2 Out SOUND OUT (headphone adaptors) | 8 7 6 5 4 3 2 1 | + 3 I/O /IRQ \ 15 14 13 12 11 10 9 / + 4 In port1-D4 (zapper button) '--------------------' + 5 In port1-D3 (zapper light) + 6 In port1-D2 (barcode battler) (turbo file data.in) + 7 In port1-D1 (joystick 4 serial input) (paddle ADC serial input) + 8 In port1-D0 (joystick 2 serial input) + 9 Out port1-CLK (joystick 2+4 clock read) + 10 Out OUT2 (turbo file data.clock) (tape output) + 11 Out OUT1 (turbo file reset address) + 12 Out OUT0 (joystick 1+2+3+4 start) (turbo file data.out) + 13 In port0-D1 (joystick 3 serial input) (paddle button) (tape input) + 14 Out port0-CLK (joystick 1+3 clock read) + 15 Out +5V +Used to connect a 3rd and 4th joystick, and various other expansion hardware. +Keep in mind that older Famicom Joypads cannot be disconnected, so the input at +Pin 8 may be disturbed by joypad 2 signals. + +Note: Joypads/PowerPads/etc are normally using standard 4021 parallel-in +serial-out shift registers. + +Controllers - Summary of Controller Types +----------------------------------------- + +NES Controllers + NES Joypad 1/2 + NES Joypad 3/4 + NES Joypad 4-player adaptor Satellite (for joypad 3-4) (wireless) + NES Joypad 4-player adaptor Four-Score (for joypad 3-4) (wired) + NES Lightgun Zapper + NES Arkanoid I Paddle + NES Miracle Piano Keyboard (49 keys) + NES Mat - Power Pad (dance mat) + NES RacerMate Bicycle Training System + NES Power Glove + NES UForce + NES Add-on 3D-Glasses (colored lens, without any electronics) + NES Add-on Robot +Note: Most of the NES controllers do also exist for the Famicom. However, +observe that they are connected differently, and thus need to be accessed +differently at software side. + +Famicom Controllers + Famicom Joypad 1/2 (hardwired to console, pad2 with mic instead start/select) + Famicom Joypad 3/4 (player 3/4, or alternate joypads for player 1/2) + Famicom Joypad 4-player adaptor (for joypad 4, not needed for joypad 3) + Famicom Joypad Add-ons (gimmicks mounted on top of standard joypads) + Famicom Lightgun Beam-Gun + Famicom Lightgun Hyper Shot (extra buttons, not fully compatible trigger) + Famicom Arkanoid I Paddle (with 9bit overflow) + Famicom Arkanoid II Paddle (raw 8bit without overflow) + Famicom Arkanoid II Secondary Paddle (add-on for second player) + Famicom Push Buttons Party Tap (6 players, 1 button/player) + Famicom Push Buttons Hyper Shot (2 players, 2 buttons/player) + Famicom Keyboard (72 keys type-writer keyboard) + Famicom Doremikko Piano Keyboard (36 keys) + Famicom Keypad TV-Net ("remote control" style) (different versions exist) + Famicom Keypad Famicom Network (joypad with numeric keypad) + Famicom Keypad Mahjong Controller (keys "A..M", plus 7 functions keys) + Famicom Mat - Family Trainer (dance mat) + Famicom Mat - Tap-tap Mat (mat with hammer) + Famicom Inflatable Exciting Boxing Bop Bag + Famicom Inflatable Top-Rider Bike + Famicom Tablet Oeka Kids (touchpad) + Famicom Trackball Hori Track (joypad with trackball) + Famicom Power Glove + Famicom Barcode Reader - Barcode Battler (controller port) + Famicom Barcode Reader - Datach (cartridge slot) + Famicom Pachinko - Joypad with pachinko dial + Famicom Microphone - Standard Microphone in japanese Joypad 2 + Famicom Microphone - Bandai Cartridge with "Stage" Microphone & buttons + Famicom Disk System (with Eject Button; aka no-disk sensor) + Famicom Add-on 3D-Glasses (with LCD shutters, connected to controller port) + Famicom Add-on Storage Turbo File + Famicom Add-on Storage Battle Box + Famicom Add-on Storage Data Recorder + Famicom Add-on Robot + +Console Variants with special Controllers + Subor Keyboard (NES-clones with built-in keyboard) + Subor Mouse (NES-clone bundled with mouse) + Sharp Famicom Titler (console with built-in tablet and keypad) + VS System Joysticks (swapped signals; other than normal joypads) + VS System Dip-Switches / Coin-Inputs / Service Button + VS System Lightgun (with serially injected data) + Play Choice 10 + FamicomBox: Dip Switches, Keyswitch, Coin Input, Joypad/Zapper Control + Nintendo M82 - Shop Demo Unit for 12 games (similar to FamicomBox) + +Controllers - Summary of Controller Signals +------------------------------------------- + +==================== Port 4016h.Write ==================== + +OUT-0 (4016h.W.Bit0) + NES/Famicom Strobe Joypads, Paddle, Keyboard, etc. (load Shift-Registers) + NES Miracle Piano Data Out (and Long/Short Strobe) + NES RacerMate Bicycle Trainer - Forwarded to TX1/TX2 on 4016h/4017h.reads + Famicom Battle Box: CLK to EEPROM, and, when set, enable chipselect toggle + Famicom Doremikko Piano: Clock for next row + Famicom Turbo File Data Out + Famicom Oeka Kids Tablet Strobe (inverse of normal joypad strobe) + +OUT-1 (4016h.W.Bit1) + Famicom 3D System (select left/right shutter for 3D Glasses) + Famicom Bandai Hyper Shot Gun: Vibration Feature Enable + Famicom Doremikko Piano: Start transfer (select 1st row) + Famicom Exciting Boxing (row select) + Famicom Keyboard Clock for Nibbles + Famicom Konami Hyper Shot Must be LOW for Player 2 "JUMP"/"RUN" Buttons + Famicom Newer-Paddle-Versions: Manually start next A/D-Conversion? + Famicom Oeka Kids Tablet Clock (manually clocked, unlike joypads) + Famicom Top-Rider Bike - Start some conversion or so? + Famicom Turbo File Reset Address to 0000h + NES Unused (not connected to Controller Port) + VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ) (and map Shared-RAM) + +OUT-2 (4016h.W.Bit2) + Famicom Bandai Hyper Shot Gun: Sound Feature Enable + Famicom Keyboard Tape Data Out + Famicom Konami Hyper Shot Must be LOW for Player 1 "JUMP"/"RUN" Buttons + Famicom Turbo File Data Clock + NES Unused (not connected to Controller Port) + VS Unisystem Mapper 99, Select 8K VROM Bank + +==================== Port 4016h.Read ==================== + +PORT0-0 (4016h.R.Bit0) + Famicom Joypad 1 (always connected) + NES/Famicom Power Glove (per-byte strobe, and data-out after LONG strobe) + NES Hori Track (8bit joypad, 2x4bit trackball, 4bit switches/ID) (unreleased) + NES Joypad 1 (if connected) + NES Miracle Piano Data In + NES Power Glove (data-in) (Mattel) + NES RacerMate Bicycle Trainer - Get RX1 (and forward OUT0 to TX1) (Player 1) + NES Satellite & Four-Score (Joypad 1, Joypad 3, ID_A) + VS Unisystem Joypad 2 (not Joypad 1) + VS Unisystem Lightgun (5th Bit=ID=1, 7th Bit=Light, 8th Bit=Trigger) + +PORT0-1 (4016h.R.Bit1) + Famicom Hori Track (8bit joypad, 2x4bit trackball, 4bit switches/ID) + Famicom Joypad 3 (when 4-player adaptor used) + Famicom Pachinko Controller (8bit Joypad 3 data, followed by 8bit ADC data) + Famicom Paddle 1 Button (1bit) + Famicom Keyboard Tape Data In + NES Unused (not connected to Controller Port) +And, probably: Famicom Power Glove (data-in) (PAX) + +PORT0-2 (4016h.R.Bit2) + Famicom Microphone (built-in in Joypad 2) + NES Unused (not connected to Controller Port) + VS Unisystem Credit Service Button + +PORT0-3 (4016h.R.Bit3) + Famicom Unused (not connected to Controller nor Expansion Port) + NES Second-Zapper Light Sensor + NES Power Pad Bits 2,1,5,9,6,10,11,7 + VS Unisystem Dip Switch 1 + +PORT0-4 (4016h.R.Bit4) + Famicom Unused (not connected to Controller nor Expansion Port) + NES Second-Zapper Trigger Button + NES Power Pad Bits 4,3,12,8, and four "1"-bits + VS Unisystem Dip Switch 2 + +PORT0-5/6 (4016h.R.Bit5/6) + NES/Famicom Unused (not connected to Controller nor Expansion Port) + VS Unisystem Credit Left/Right Coin Slot + +PORT0-7 (4016h.R.Bit7) + NES/Famicom Unused + VS Dualsystem: Master/Slave ID (0=Slave CPU, 1=Master CPU) + +==================== Port 4017h.Read ==================== + +PORT1-0 (4017h.R.Bit0) + Famicom Joypad 2 (always connected) (without Start/Select) + NES Joypad 2 (if connected) + NES Satellite & Four-Score (Joypad 2, Joypad 4, ID_B) + NES RacerMate Bicycle Trainer - Get RX2 (and forward OUT0 to TX2) (Player 2) + Subor Clone: Subor Mouse Data (in conjunction with OUT-0,OUT-1,OUT-2 ?) + VS Unisystem Joypad 1 (not Joypad 2) + +PORT1-1 (4017h.R.Bit1) + Famicom Doremikko Piano: Data fragment for current half-row + Famicom Joypad 4 (when 4-player adaptor used) + Famicom Exciting Boxing (column 1) + Famicom Keyboard Bit0 of 4-bit Nibble + Famicom Konami Hyper Shot Player 1 "RUN" Button + Famicom Mahjong Controller: Data (in conjunction with OUT-0,OUT-1,OUT-2 ?) + Famicom Paddle 1 Position (8bits) + NES Unused (not connected to Controller Port) + +PORT1-2 (4017h.R.Bit2) + Famicom Barcode Battler (20-byte ASCII String at 1200 Baud, 8N1) + Famicom Doremikko Piano: Data fragment for current half-row + Famicom Exciting Boxing (column 2) + Famicom Keyboard Bit1 of 4-bit Nibble + Famicom Konami Hyper Shot Player 1 "JUMP" Button + Famicom Oeka Kids Tablet Ack (confirm Strobe/Clock signals) + Famicom Party Tap (Button 1, Button 4, ID "1"-Bit) + Famicom Turbo File Data In + NES Unused (not connected to Controller Port) + VS Unisystem Dip Switch 3 + +PORT1-3 (4017h.R.Bit3) + Famicom Battle Box: Dta.In (data from EEPROM) + Famicom Doremikko Piano: Data fragment for current half-row + Famicom Exciting Boxing (column 3) + Famicom Keyboard Bit2 of 4-bit Nibble + Famicom Konami Hyper Shot Player 2 "RUN" Button + Famicom Oeka Kids Tablet Data (18bits) + Famicom Paddle 2 Button (1bit) + Famicom Party Tap (Button 2, Button 5, ID "0"-Bit) + Famicom Top-Rider Bike - First 8bit shift-register + NES/Famicom Zapper Light Sensor + NES/Famicom Power Pad Bits 2,1,5,9,6,10,11,7 + NES Paddle Button (1bit) + NES Power Pad Bits 2,1,5,9,6,10,11,7 + VS Unisystem Dip Switch 4 + +PORT1-4 (4017h.R.Bit4) + Famicom Battle Box: Status of Dta.out (can be toggled by [4016h].reads) + Famicom Doremikko Piano: Data fragment for current half-row + Famicom Exciting Boxing (column 4) + Famicom Keyboard Bit3 of 4-bit Nibble + Famicom Konami Hyper Shot Player 2 "JUMP" Button + Famicom Paddle 2 Position (8bits) + Famicom Party Tap (Button 3, Button 6, ID "1"-Bit) + Famicom Top-Rider Bike - Second 8bit shift-register + NES/Famicom Zapper Trigger Button + NES/Famicom Power Pad Bits 4,3,12,8, and four "1"-bits + NES Power Pad Bits 4,3,12,8, and four "1"-bits + NES Paddle Position (8bits) + VS Unisystem Dip Switch 5 + +PORT1-5/6/7 (4017h.R.Bit5/6/7) + NES/Famicom Unused (not connected to Controller nor Expansion Port) + VS Unisystem Dip Switch 6/7/8 + +==================== Other Controller Port Signals ==================== + +PORT0-CLK (4016h.R) and PORT1-CLK (4017h.R) +Automatically clocked when reading 4016h and 4017h accordingly, usually +clocking serial shift registers (joypad, paddle). Other uses are: + Famicom Battle Box: Toggle Dta.out (always), Toggle /CS (when [4016h].W.0=1) + Famicom Doremikko Piano: Clock for 1st/2nd half of current row + FamicomBox: Watchdog Reload + NES RacerMate Bicycle Trainer - Forward OUT0 to TX0/TX1 (by 4016h/4017h.Read) + +/IRQ + Famicom Unused (expansion port /IRQ-pin not used by any known controllers) + NES Unused (not connected to Controller Port) + +SOUND OUT + Famicom Headphones (used by some headphone adaptors) + NES Unused (not connected to Controller Port) + +==================== Controller Signals on Cartridge Slot ==================== + +Controller I/O Ports + 4032h FDS Disk Status Register 1 (Disk Insert/Eject Sensor) + 6000h Bandai Microphone and Buttons ? + 6000h.Bit3 - Bandai Datach - Joint ROM System (Barcode Sensor) + 500xh FamicomBox: Dip Switches, Keyswitch, Coin Input, Joypad/Zapper Control +And, video out: Used by Lightguns and R.O.B. Robot. + +Controllers - Detection +----------------------- + +Opcodes + 88 8C 16 40 A9 08 2D 17 40 C9 08 C8 8C 16 40 ;Battle Box + AD 17 40 4A 4A 29 01 09 06 8D 16 40 ;Turbo File (older games) + AD 17 40 29 04 4A 4A 09 06 8D 16 40 ;Turbo File (newer games) + +Controllers - Joypads +--------------------- + +Joypads (or Joysticks) +Each joypad includes an 8bit shift register, set Port 4016h/Bit0=1 to reload +the button states into the shift registers of both joypads, then reset Port +4016h/Bit0=0 to disable the shift reload (otherwise all further reads would be +stuck to the 1st bit, ie. Button A). Joypad data can be then read from bit 0 of +4016h (joypad 1) and/or bit 0 of 4017h (joypad 2) as serial bitstream of 8bit +length, ordered as follows: + 1st Button A (0=High=Released, 1=Low=Pressed) + 2nd Button B (0=High=Released, 1=Low=Pressed) + 3rd Select (0=High=Released, 1=Low=Pressed) + 4th Start (0=High=Released, 1=Low=Pressed) + 5th Direction Up (0=High=Released, 1=Low=Moved) + 6th Direction Down (0=High=Released, 1=Low=Moved) + 7th Direction Left (0=High=Released, 1=Low=Moved) + 8th Direction Right (0=High=Released, 1=Low=Moved) + 9th and up Unused (all 1=Low) ;(or all 0=High when no joypad connected) +The console automatically sends a clock pulse to the Joypad 1 shift register +after each read from 4016h (and to joypad 2 after read from 4017h). There are +no timing restrictions, joypads can be handled as fast, or as slow, as desired. +Note that older Famicom controllers include Select & Start buttons only on +joypad 1, whilst joypad 2 probably returns unused dummy bits instead (the +values of that dummy bits are unknown, probably 0=High=Released?). + +Joypad Layout + ___________________________________ + | _ | + | _| |_ Nintendo | + | |_ _| SELECT START | + | |_| (==) (==) ( B ) ( A ) | + |___________________________________| + +Jump and Run Games conventionally use A=Jump, B=Fire. + +Third-Party Joypads/Joysticks (NES) +Third-Party NES Joypads/Joysticks can be simply plugged into normal controller +ports. + +Third-Party Joypads/Joysticks (Famicom) +The Famicom comes with two hardwired joypads, making it difficult to use +third-party joypads or joysticks. One simple solution is to mount add-on +hardware (mechanically) on the standard joypads: + Climber Stick NBF-CY (Nichibutsu) (mini-dildo/nipple to be mounted on DPAD) + FamiCoin (colored "coins" to be mounted on DPAD; for better grip or so) + Super Controller (Bandai?)(joystick to be mounted on DPAD of standard joypad) + Ultech 3 Meijin-kun (joystick to be mounted on DPAD+A+B of standard joypad) +Another solution is to connect the devices to the 15pin expansion port (the +15pin connector lacks the joypad 1 signal, so at best, they could be shortcut +with the joypad 2 signal, or wired as joypad 3/4; aside from 3/4-player games, +many 1/2-player games also support that kind of input). Known devices are: + ASCII Stick L5 - one-handed joypad (not joystick) (ASCII) + Joypad with numeric keypad for Famicom Modem (connects to the 15pin port) +Reportedly, following further devices exist (unknown if they are mechanically +attached, or electronically connected to 15pin port, or to 7pin ports of late +Famicoms): + Joystick-7 and Joystick-7 Mk II + Joycard Sanusui SSS (Hudson) (with adapter for headphones) + Reggies's Joystick (with turbofire) + Super Controller II (Bandai) (with LCD screen) + Toyo Stick (Toyo) +Attention: +To support external joypads, single-player games should read joypad 3, and +treat it is alternate input for player 1. Two-player games should also support +joypad 4 (via 4-player adaptor) as alternate input for player 2. + +Crazy Climber Stick +Crazy Climber is played with two regular joypads, but both turned by 90 +degrees. Optionally, "Climber Sticks" can be mounted on the joypads, turning +the thumb-controlled DPADs into thumb-controlled joysticks. + _________ _________ + | _ | Joypad 1 | _ | Joypad 2 + | _| |_ | (Left Hand) | _| |_ | (Right Hand) + | |_ _| | | |_ _| | + | |_| | | |_| | + | | | | + | | SEL | | | + | | | :: MIC | + | | STA | | | + | | | | + | (B) | | (B) | + | (A) | | (A) | + |_________| |_________| + +Controllers - Four-Player Adaptors +---------------------------------- + +NES Four-player devices (Satellite and Four Score) + NES Satellite (wireless) (Nintendo) (1989) + Four-Score (wired) (Nintendo) (1990) +The device is connected to both of the consoles two controller ports, and up to +four controllers can be connected to the device. +The device is accessed much like normal joypads, except that the returned +bitstream consist of 24 bits instead of normal 8 bits: + write "1-then-0" to (4016h) (that only once, for all 24 bits) + read 1st 8 bits: controller 1 (4016h) / controller 2 (4017h) (as normal) + read 2nd 8 bits: controller 3 (4016h) / controller 4 (4017h) (new ports) + read 3rd 8 bits: 0,0,0,1,0,0,0,0 (4016h) / 0,0,1,0,0,0,0,0 (4017h) (ID codes) + further bits: unknown (probably all 0, or all 1) +The ID codes can be used to detect if the 4-player adapter is connected (used +by RC Pro Am 2, not used by Gauntlet II). Otherwise the ID field typically +contains all ones (normal/single controller), or all zeros (no controller +connected at all). +Satellite & Four Score Games + Bomberman II + Danny Sullivan's Indy Heat + Gauntlet II + Greg Norman's Golf Power + Harlem Globetrotters + Kings of the Beach + Magic Johnson's Fast Break + Monster Truck Rally + M.U.L.E. + NES Play Action Football + Nightmare on Elm Street + Nintendo World Cup + Rackets & Rivals + R.C. Pro-Am II + Rock 'n' Ball (?) + Roundball: 2 on 2 Challenge + Smash TV + Spot + Super Jeopardy! + Super Off Road + Super Spike V'Ball + Swords and Serpents + Top Players' Tennis + +Famicom Four-player device (Two extra joypads at Expansion Port) +Older Famicom consoles have 2 "built-in" joypads, additional 2 joypads can be +connected to the expansion port. The procedure for reading Famicom 4-player +data is similar as for 2-player data: As normal, write "1-then-0" to 4016h, +then read 8 times from 4016h, that simultaneously receives data for two pads, +Bit 0 for joypad 1, and additionally Bit 1 for joypad 3. Respectively, Bit 0 +and 1 of 4017h are for pad 2 and 4. +Japanese 3-4 player games: + Downtown Nekketsu Koshinkyoku: Soreyuke Daiundokai + Ike Ike! Nekketsu Hockey Bu: Subette Koronde Dai Ranto + Nekketsu Kakutou Densetsu + Nekketsu Koukou Dodge Ball Bu (in Bean Ball mode of japanese version only) + Nekketsu Street Basket: Ganbare Dunk Heroes + Kunio-kun no Nekketsu Soccer League + U.S. Championship V'Ball + Wit's +Note: For 3-players, joypad 3 can be plugged directly to the Expansion Port +(without needing a 4-player adaptor). +Moreover, many normal 1-2 player games do support joypad 3-4 as alternate +player 1-2 inputs (allowing to use external joysticks/joypads, including such +with autofire functions, instead of the standard famicom joypads). + +Controllers - Lightguns (Zapper) +-------------------------------- + +Zapper (Light Gun) Ports / Connection +Zapper state can be obtained by reading Bit3-4 of Port 4017h and/or 4016h. +Famicom Zapper connected to Famicom Expansion Port (Inputs at 4017h). +NES Zappers connected to 1st and/or 2nd Joypad Port (Inputs at 4016h, 4017h). +Most or all NES games are using 2nd Joypad Port because Famicom uses 4017h. + Bit3 State of the gun sight (0=High=Light detected, 1=Low=None) + Bit4 Trigger (0=High=Released, 1=Low=Pulse) (shoot on 1-to-0 transition) +The trigger mechanics are working as so: + pulled part way: soft "click" sound: 0-to-1 transition (ignored by games) + pulled full way: loud "CLANG" sound: 1-to-0 transition (games do fire) +One exception are Bandai games, which do accidently shoot at 0-to-1 (either +because of misunderstanding the zapper hardware, and/or for compatibility with +Bandai's own Hyper Shot gun). +The light detection flag gets set when sensing light emission from the display, +ie. when the cathode ray beam outputs a bright color (preferably white) at the +location where the gun is pointed to. +Handling the light sensor is usually done as so: + Output a black picture with a white-rectangle at target location + If the gun senses light, then it's a "hit". + (to reduce unnecessary flickering, do that only when trigger is pulled) +To avoid "hits" on other light sources, verify that there is NO light at times +when the screen should be dark (eg. shortly before end of vblank). +When sensing light, the sensor bit does reportedly stay set for 10-25 scanlines +(during hit-checks, one should check the bit around every 5 scanlines). +Note: The NES PPU doesn't have any H/V-latches for lightpen/lightgun +coordinates, so there's little chance to measure the H-position by software. +However, one may measure the vertical position by counting the time between +light and vblank (this would allow handling multiple targets at different +vertical positions within a single frame). +Note: Shooting at offscreen locations is advancing menu cursors in some games +(the games are typically also allowing to do this via joypad-select, so it +isn't stritcly necessary to support offscreen positions in emulators). + +Games compatible with the NES Zapper: + Adventures of Bayou Billy (gun optional) (U) 1989 (E) 1990 Konami + Baby Boomer (unlicensed) (gun optional) (U) 1989 Jim Meuer/Color Dreams + Barker Bill's Trick Shooting (U) 1989 Nintendo + Chiller (unlicensed) (gun optional) (U) (HES) 1986 Exidy + Day Dreamin' Davey (gun optional) (U) 1990 HAL + Duck Hunt (JUE) (PC10) (VS) 1984 Nintendo + Freedom Force (U) (VS) 1988 Sunsoft + Gotcha! The Sport! (U) 1987 LJN + Gumshoe (UE) (VS) 1986 Nintendo + Gun-Nac (U) (J) 1990 Tonkin House/Tokyo Shoseki/Nexoft + Hogan's Alley (JU) (PC10) (VS) 1984 Nintendo + Laser Invasion (U) aka Gun Sight (for LaserScope or Zapper) (J) 1991 Konami + The Lone Ranger (gun optional) 1991 Konami + Mechanized Attack (gun optional) (U) 1991 SNK + Operation Wolf (gun optional) (J) (U) 1989 Taito + Shooting Range (for Hyper Shot or Zapper+Joypad) (U) 1989 Bandai + Space Shadow (for Hyper Shot or Zapper+Joypad) (J) 1989 Bandai + To The Earth (U) 1989 Nintendo + Track & Field II (in one section of the game) (U)(E) 1988/89 Konami + Wild Gunman (U) (PC10) Wairudo Ganman (J) 1984 Nintendo + +NES/Famicom Lightguns + Nintendo Zapper (US) (old gray/dark gray version) (1985) + Nintendo Zapper (US) (new gray/orange version) + Nintendo Beam Gun (Japan) (black/brown revolver) (1985) + Nintendo VS Unisystem Lightgun (orange revolver) (2bit serial transmit) + Bandai Hyper Shot (black machine gun: zapper + joypad-like buttons) (1989) + Hyperkin FC Super Loader Gun (made by Hyperkin, NES/Zapper compatible?) + Konami LaserScope/Gun Sight (headset: headphones + voice-activated zapper) + Nexoft The Dominator: Pro Beam Light Gun (wireless lightgun) +As additional add-on gimmicks, Quickshot has made Sighting Scopes and Deluxe +Sighting Scopes that can be mounted on the Nintendo Zapper. + +Bandai Hyper Shot Gun (for Space Shadow) (1989) +A black machine pistol, working (more or less) like a normal zapper combined +with an additional joypad. + 4016h.R.Bit1 Serial 8bit joypad3-style button data + 4017h.R.Bit3 Light (0=High=Yes, 1=Low=No) + 4017h.R.Bit4 Trigger (0=High=Released, 1=Low=Pressed/Held) (shoot while 1) + 4016h.W.Bit1 Gun Move aka Body Vibration System (0=Off, 1=On) + 4016h.W.Bit2 Sound (0=Off, 1=On) +The serial "joypad3" data is used as so (by Space Shadow): + joypad3 button B --> throw grenade + joypad3 up --> move forward (after defeating enemy) + joypad3 select --> toggle sound/gun-move (in title screen) + joypad3 start --> start/pause +The trigger is a simple push-button without the normal zapper-mechanics, this +allows Space Shadow to support continous fire when the button is held down, but +isn't fully compatible with normal zapper games (which will fire on 1-to-0 +transitions, ie. when the Hyper Shot trigger, rather than pressing +it). +The light sensor may have different sensitivity as normal zappers (Space Shadow +does use white-rectangles, but doesn't output black-background; the +tunnel-backgrounds are fairly dark, but the backgrounds at tunnel-end are very +bright, even including some white pixels; so apparently, the hypershot gun +senses light only when aimed at all-white-pixels areas). +There seems to be some sort of rumble/vibration feature (called "Body Vibration +System" on the gun, and "Gun Move" in Space Shadow). +And, some "Sound" feature (can be enabled/disabled in Space Shadow title +screen), details are unknown; maybe causing the gun to produce sounds when +pulling the trigger, or maybe simply outputting the APU sound/music to a +speaker in the gun? +Note: Bandai's "Hyper Shot" Lightgun is not to be confused with Konami's "Hyper +Shot" Push Buttons. + +VS System Lightguns (for VS Unisystem/Dualsystem arcade machines) +These are resembling the japanese revolver-shaped Beam Guns. The VS Unisystem +can't use the "normal" Zapper I/O lines (because it has DIP-Switches connected +to that ports), and, instead, it's injecting Lightgun data to the 8bit "Joypad" +shift-register: + Port.Bit (VS-Joypad) VS-Zapper + 4016h.5th.Bit (Joy2 Up) Connect OK (0=Alert sound, 1=Connected) + 4016h.7th.Bit (Joy2 Left) Light Sensor (0=No,1=Light ;INVERSE of NES Zapper) + 4016h.8th.Bit (Joy2 Right) Trigger (0-to-1=Fire ;INVERSE of NES Zapper) +The Connect bit is used to generate an Alert sound if people are trying to +steal the gun by cutting the cable. +The gun lacks a transistor that is found in normal Zappers (so the Light sensor +will output opposite voltage). +Also mind that the VS Unisystem uses different palette(s) than NES consoles, so +the PPU color number for White (20h or 30h on NES) may differ from game to +game. + +FamicomBox Zapper +The FamicomBox is using a standard NES-Zapper, but with some extras on the +mainboard: A somewhat bidirectional Supply GND pin on the Zapper connector +(allows to do a zapper connect check), an Disconnect-Alert signal (on a special +"CATV" connector), and a DIP-switch for disabling the Zapper. For details, see: +--> FamicomBox + +Zapper Schematic / Handheld Pistol NES004 + .----------. + | 1|--------------GND VCC -----NES.Pin5 + | Sharp 2|---|<|--------GND (light sensor "43 Pi") GND -----NES.Pin1 + | IR3T07A 3|---[22]--||---GND (cap: 1/50) ___ + | 4|---------||---GND (cap: 3.3/50) VCC GND -o o-NES.Pin7 + | 5|--------------GND | 2SC459 Trigger + | 6|--[390K]------VCC [10K] .------. + | 7|---------||---GND (cap: .001) | | C|------ NES.Pin6 + | 8|----------------------------------+---|B | + | 9|--------------VCC | E|---GND + '----------' VCC--||---GND (cap: 10/16) '------' + +Arcade Gun "062G2 GUN" (for VS and/or PC10 or so) + .----------. + | 1|--------------GND GND ----------- GND, RedPlug.pin1 + | 2|---|<|--------GND (light sensor "43PI") .-- GND, RedPlug.pin2 + | IR3T07 3|--[6R8]--||---GND (C1: 105) '-- ALM, RedPlug.pin3 + | 4|---------||---GND (C2: 335) + | 5|--------------GND + | 6|--[394]-------VCC ___ + | 7|---------||---GND (C3: 102) GND ---o o--- TRG, WhitePlug.pin1 + | 8|------------------------------------------ HIT, WhitePlug.pin2 + | 9|--------------VCC VCC --[101]-- +5V, WhitePlug.pin3 + '----------' GND--||--VCC (C4: 476) GND--||--+5V (C5: 476) + +Note: Aside from the electronics, there's also a lens the gun barrel (not shown +in the schematics). + +Controllers - Paddles +--------------------- + +The Paddle (aka Arkanoid Controller or Vaus Controller) consists of a Push +Button, and a Dial (a potentiometer, which can be turned left/right by about +270 degrees, connected to an A/D-converter and 8bit shift-register), some (or +maybe all) paddles also have a second potentiometer (for calibrating the +dial-range). + +Paddle Games + Arkanoid (J) 1986 (Taito) (bundled with OLD paddle for 15pin Famicom) + Arkanoid (U) 1987 (Taito) (bundled with OLD paddle for 7pin NES) + Arkanoid 2 (J) 1988 (Taito) (with NEW paddle; with connector for 2nd paddle) + Chase H.Q. (J) 1989 (Taito) (compatible with NEW paddle) + +Old Paddles (automatic ADC-start, max 1 paddle) +For Famicom-version (Japan): + 4016h.W.Bit0 Load shift-register (strobe 1-then-0) + 4016h.R.Bit1 Paddle Button (1bit) (0=High=Released, 1=Low=Pressed) + 4017h.R.Bit1 Paddle Position (8bits) (0=High=One, 1=Low=Zero) (MSB first) +For NES-version (US/Europe): + 4016h.W.Bit0 Load shift-register (strobe 1-then-0) + 4017h.R.Bit3 Paddle Button (1bit) (0=High=Released, 1=Low=Pressed) + 4017h.R.Bit4 Paddle Position (8bits) (0=High=One, 1=Low=Zero) (MSB first) +For the Position Values, first of, undo inversion of the ADC value (XOR by +FFh), then handle the result as so: + treat 00h..1Fh as position 100h..11Fh ;\repair 8bit/9bit "overflows" + treat 20h..FEh as position 020h..0FEh ;/ + treat FFh as NOT CONNECTED (although FFh may ALSO occur at position 0FFh) + clip position 020h..11Fh to min/max range 062h..102h ;<-- Arkanoid +Values are small=left, large=right. With old paddles, A/D-conversion seems to +start automatically (unlike as new paddles); unknown how that works (if it's +poorly implemented, read-errors might occur if the ADC value is updated during +shift-register loading). + +New Paddles (different ADC-range, manual ADC-start, max 2 paddles) +For Famicom-version (new paddles were released ONLY in Japan): + 4016h.W.Bit0 Load shift-register (strobe 1-then-0) + 4016h.R.Bit1 Paddle 1 Button (1bit) (0=High=Released, 1=Low=Pressed) + 4017h.R.Bit1 Paddle 1 Position (8bits) (0=High=One, 1=Low=Zero) (MSB first) + 4017h.R.Bit3 Paddle 2 Button (1bit) (0=High=Released, 1=Low=Pressed) + 4017h.R.Bit4 Paddle 2 Position (8bits) (0=High=One, 1=Low=Zero) (MSB first) + 4016h.W.Bit1 Start next A/D-conversion (strobe 1-then-0) +For the Position Values, first of, undo inversion of the ADC value (XOR by +FFh), then handle the result as so: + treat 00h..FFh as position 00h..FFh (no 9bit "overflows" in new paddles) + optionally treat as FFh as NOT CONNECTED (Arkanoid 2/Chase H.Q. don't so) + clip position 00h..FFh to min/max range 4Eh..BAh ;<--Arkanoid 2, TINY-screen + clip position 00h..FFh to min/max range 4Eh..F2h ;<--Arkanoid 2, WIDE-screen + clip position 00h..FFh to min/max range 54h..DBh ;<--Arkanoid 2, PONG-view + clip position 00h..FFh to min/max range 38h..E7h ;<--Chase H.Q. +Note: For reaching the Arkanoid 2 doors at left/right screen sides, the values +received from paddle must EXCEED the 4Eh..F2h min/max range. +Values are small=left, large=right (or, in Arkanoid 2's PONG-view, small=up for +player 1, and small=down for player 2). + +Note +Emulators (or hardware) can auto-detect the Paddle version by sensing OUT1=1. + +Component List (Old Paddle) + IC1 14pin NE556 (dual 555 universal timers) + IC2 16pin NEC D4040BC (12-bit asynchronous binary counter with reset) + IC3 16pin NEC D74HC00C (quad NAND gates) + IC4 14pin NEC D74HC165C (8-bit parallel-in serial-out shift register) + CN 6pin connector (VCC,GND,STB,DTA,CLK,BUTTON) + VR1 paddle-dial potentiometer + VR2 calibration potentiometer + SW1 push-button + plus, 11 capacitors, and 6 resistors + +Controllers - Push Buttons +-------------------------- + +Party Tap (Six Players, one Button per player) (Yonezawa/Partyroom 21) +Set of six controllers, each with one push button. Used by following games: + Casino Derby (J) (19xx) + Gimmi a Break - Shijou Saikyou no Quiz OuKetteisen (J) (TBS/S'PAL) (1991) + Gimmi a Break - Shijou Saikyou no Quiz OuKetteisen 2 (J) (TBS/S'PAL) (1992) + Project Q (J) (Hect/Hector) (1992) + .-----. + .----------------------------------------|1 \ + | .---------------------------------|2 | _ + | | .--------------------------|3 |_________| | 15pin + | | | .-------------------|4 | |_| plug + | | | | .------------|5 | + | | | | | .-----|6 / + .-'-. .-'-. .-'-. .-'-. .-'-. .-'-. '-----' + |(1)| |(2)| |(3)| |(4)| |(5)| |(6)| + '---' '---' '---' '---' '---' '---' +The thing has somehow fragile timings; the different games all have different +delays before/after strobing and between reads. With max delays, it's accessed +somewhat like so: + wait 500 clks ;-lead delay (with strobe=0) + [4016h]=01h, [4016h]=00h, wait 160 clks ;-strobe 1-then-0 with delay + a=[4017h], wait 80 clks, b=[4017h] ;-read 2x3bit with delay + data = (a AND 1Ch)/4 + (b AND 1Ch)*2 ;-merge (Bit0-5 = Button 1-6) +Moreover, at whatever time (apparently somewhere after above 1st/2nd reads), a +detection value can be read: "([4017h.R] AND 1Ch)=14h" + +Konami Hyper Shot (Two Players, two Buttons per player) (Konami) +Set of two controllers, each with two push buttons. Used by following games: + Hyper Olympic (J) Konami (1985) + Hyper Sports (J) Konami (1985) +Accessed as shown below. + 4016h.W.Bit1 Select Player 2 "JUMP"/"RUN" Buttons (0=Low=Yes) ;\usually, set + 4016h.W.Bit2 Select Player 1 "JUMP"/"RUN" Buttons (0=Low=Yes) ;/both to 0 + 4017h.R.Bit1 Player 1 "RUN" Button (0=High=No, 1=Low=Pressed and OUT-2=LOW) + 4017h.R.Bit2 Player 1 "JUMP" Button (0=High=No, 1=Low=Pressed and OUT-2=LOW) + 4017h.R.Bit3 Player 2 "RUN" Button (0=High=No, 1=Low=Pressed and OUT-1=LOW) + 4017h.R.Bit4 Player 2 "JUMP" Button (0=High=No, 1=Low=Pressed and OUT-1=LOW) +Note: For whatever reason, the buttons are wired to OUT-2/OUT-1 (rather than +being wired to GND), this would allow to select/deselect the buttons; in the +existing software both OUT-2 and OUT-1 are always set to LOW. + .--------------------------. .--------------------------. + | imanoK | | imanoK | + | tohSrepyH | | tohSrepyH | + | PMUJ NUR | | PMUJ NUR | + _| ( ) I ( ) | _| ( ) II ( ) | + / | JUMP RUN | / | JUMP RUN | + | | HyperShot | | | HyperShot | + | | Konami | | | Konami | + | '--------------------------' \ '--------------------------' _ + \ '--------------------------------| | 15pin + '-----------------------------------------------------------------|_| plug +The pads don't explicitly have "front/back" sides (and can be turned either way +around); however, for shooting left/right in Hyper Sports they should be turned +this way: JUMP=Left, RUN=Right. +Theoretically, one could as well use normal joypad buttons, however, Konami has +intentionally crippled them to be working ONLY with their Hyper Shot: The games +are actually reading normal joypad data, but are then erasing all joypad bits +(except start/select), and are then replacing them by the Hyper Shot Button +bits. +Note: Konami's "Hyper Shot" Buttons are not to be confused with Bandai's "Hyper +Shot" Lightgun. + +Controllers - Typewriter Keyboards +---------------------------------- + +Keyboard with 72 Keys, and tape read/write port, connected to 15-pin Famicom +Expansion port. Used by Famicom BASIC and Playbox BASIC. Also, the Study and +Game 32-in-1 and Education 18-in-1 cartridges use an identical protocol, but +with different keyboard matrix. + +Keyboard Access Pseudo Code + [4016h]=05h:WAIT(16clks) ;reset (force row 0) + FOR i=0 TO 8 ;loop 9 rows + [4016h]=04h:WAIT(56clks) ;request LSB of NEXT row + Row[i]=(([4017h] SHR 1) AND 0Fh) ;read LSB + [4016h]=06h:WAIT(56clks) ;request MSB of SAME row + Row[i]=(([4017h] SHL 3) AND F0h)+Row[i] ;read MSB + NEXT ;loop next +Column 0-7 are then in Bit0-7 of each row. Bits are 0=Pressed, 1=Released +(unlike for most other NES/Famicom controllers, which are 1=Pressed). +When reading more than 9 rows, the 10th read (row 9) returns garbage data, and +then starts over at row 0. + +Famicom Keyboard Matrix + Row Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7 + 0 F8 RETURN [ ] KANA R-SHFT \(Yen) STOP + 1 F7 @ : ; _ / - ^ + 2 F6 O L K . , P 0 + 3 F5 I U J M N 9 8 + 4 F4 Y G H B V 7 6 + 5 F3 T R D F C 5 4 + 6 F2 W S A X Z E 3 + 7 F1 ESC Q CTRL L-SHFT GRPH 1 2 + 8 CLR UP RIGHT LEFT DOWN SPACE DEL INS + +Famicom Keyboard Layout (HVC-007) + .------------------------------------------------. + | F1 F2 F3 F4 F5 F6 F7 F8 | + | 1 2 3 4 5 6 7 8 9 0 - ^ \ STOP | + | ESC Q W E R T Y U I O P @ [ ENTER CLR INS DEL | + | CTRL A S D F G H J K L ; : ] KANA UP | + | SHIFT Z X C V B N M , . / _ SHIFT LEFT RIGHT | + | GRPH SPACE DOWN | + '------------------------------------------------' + +32-in-1 Study and Game / Education Keyboard Matrix + Row Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7 + 0 4 G F C F2 E 5 V + 1 2 D S END F1 W 3 X + 2 INS BS PGDN RIGHT F8 PGUP ESC HOME + 3 9 I L , F5 O 0 . + 4 ] ENTER UP LEFT F7 [ \ DOWN + 5 Q CAPS Z Pa ESC A 1 CTRL + 6 7 Y K M F4 U 8 J + 7 - ; ' / F6 P = SHIFT + 8 T H N SPACE F3 R 6 B +The 32-in-1 menu also checks Bit4 in Row 9, if that bit is zero then it does +additionally read row 0Ah..0Ch. Aside from the menu, most or all games in the +32-in-1 cartridge don't seem to use that extra rows though. + +32-in-1 Study and Game Keyboard Layout (as shown in Typing School I) + .------------------------------------------------------------. + | ESC F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 Pa. Br Nu Re. | + | ~ 1 2 3 4 5 6 7 8 9 0 - + BS HOME | + | TAB Q W E R T Y U I O P [ ] \ END | + | CAPS A S D F G H J K L ; ' ENTER PGUP | + | SHIFT Z X C V B N M , . / SHIFT UP PGDN | + | ### CTRL ALT ## [ SPACE ] ALT INS DEL LT DN RIGH | + '------------------------------------------------------------' +Above does only show how software in "Typing School I" depicts the keyboard, +unknown how the real hardware looks like... there are some NES-console clones +named GA-M16 and GLK-2016 with built-in keyboard... maybe these clone(s) are +compatible with the 32-in-1 cartridge? + +Keyboard I/O Signals + OUT.0 Keyboard Strobe/Reset (0=Normal, 1=Initialize) + OUT.1 Keyboard Clock (0=LSB, 1=MSB) (1-to-0=Next Row) + OUT.2 Tape Output (Should be 1 when accessing Keyboard) + PORT0-1 Tape Input + PORT1-4..1 Keyboard Input Bit3..0 (either MSB or LSB of current row) +Tape In/Out allow to connect an external tape recorder. +--> Storage Data Recorder + +Subor Keyboard +Details are unknown, maybe same as the Study and Game thing. + +Controllers - Piano Keyboards +----------------------------- + +Doremikko (Three octaves; aka two & two-half octaves) (Konami) +Piano keyboard for the "Doremikko" FDS (Famicom Disk System) game. + _____________________________________________ + | _________________________________________ | + | | U U U | U U | U U U | U U | U U U | U U | | + | | U U U | U U | U U U | U U | U U U | U U | | Keys + | | | | | | | | | | | | | | | | | | | | | | | | + |_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_| + F G A H C D E F G A H C D E F G A H C D E Notes + |-------><------------><------------><----| Octaves + 1..7 8..19 | 20..31 32..36 Key Numbers + | + Middle C + 36 Piano Keys (21 White Keys, 15 Black Keys) (two & two-half octaves) +The 36 keys are read like so: + [4016h]=02h, [4016h]=01h ;-write 2-then-1 + dummy=[4017h], Key1,2=[4017h].Bit1,2 ;-read 0+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key3,4,5,6=[4017h].Bit1,2,3,4, Key7,8=[4017h].Bit1,2 ;-read 4+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key9,10,11,12=[4017h].Bit1,2,3,4, Key13,14=[4017h].Bit1,2 ;-read 4+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key15,16,17,18=[4017h].Bit1,2,3,4, Key19,20=[4017h].Bit1,2 ;-read 4+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key21,22,23,24=[4017h].Bit1,2,3,4, Key25,26=[4017h].Bit1,2 ;-read 4+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key27,28,29,30=[4017h].Bit1,2,3,4, Key31,32=[4017h].Bit1,2 ;-read 4+2 bits + [4016h]=00h, [4016h]=01h ;-write 0-then-1 + Key33,34,35,36=[4017h].Bit1,2,3,4 ;-read 4+0 bits +The used controller signals are working somewhat like so: + OUT-1 start transfer (select 1st row) + OUT-0 clock for next row + CLK clock for 1st/2nd half of current row + PORT1.1-4 data for current row (4bit in 1st half, 2bit in 2nd half) +Unlike the Miracle, the Doremikko Keyboard doesn't contain its own sound +generator. However, since the software was shipped on disk, it may use the FDS +sound hardware: +--> Famicom Disk System (FDS) +The Piano mode (right-most option in main menu) uses normal APU sound as second +voice (when pressing two keys). + +Miracle (Four Octaves, plus next higher C) (The Software Toolworks) +MIDI Synthesizer connected to NES controller Port. Used by only one NES +cartridge: The Miracle Piano Teaching System (1990). Aside from the keyboard, +the Miracle contains its own sound generators and speakers. + .--._________________________________________________________.--. + | |:::::::::::: MIRACLE .. .. .. .. .. ::::::::::::| | + | |:::::::::::: .. .. .. .. .. ::::::::::::| | + | |:::::::::::: # # # # : .. .. .. .. ::::::::::::| | + | |:::::::::::: # # # # : .. .. .. ::::::::::::| | + | |_________________________________________________________| | + | | U U | U U U | U U | U U U | U U | U U U | U U | U U U | | | + | | U U | U U U | U U | U U U | U U | U U U | U U | U U U | | |Keys + | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | + |__|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|__| + C D E F G A H C D E F G A H C D E F G A H C D E F G A H C Notes + <-------------><------------><------------><------------>X Octaves + 36..47 48..59 | 60..71 72..83 84 Key Numbers + | + Middle C + 49 Piano Keys (29 White Keys, 20 Black Keys) (4 octaves, plus next higher C) + 1 Foot Pedal (Sustain) + 8 Push Buttons (Mode/Volume Selection) +The thing can be connected to NES, SNES, and other consoles/computers. +--> Controllers - Piano - Miracle Piano Controller Port +--> Controllers - Piano - Miracle Piano MIDI Commands +--> Controllers - Piano - Miracle Piano Instruments +--> Controllers - Piano - Miracle Pinouts and Component List + +Controllers - Piano - Miracle Piano Controller Port +--------------------------------------------------- + +Miracle Controller Port Transfer +Read Direction (invoked by SHORT Strobe signal) + 1st Data Present Flag (0=High=None, 1=Low=Yes) + 2nd..9th Data Bit7..0 (MSB First, inverted 1=LOW=Zero) + 10th..12th Unknown + 13th..16th Unknown (would be ID Bit3..0 on other SNES controllers) + 17th and up Unknown +Write Direction (invoked by LONG Strobe signal, data output on STROBE line) + 1st..8th Data Bit7..0 (MSB First, 0=LOW=Zero) +Observe that read/write direction depends on length of initial Strobe signal +(so games that are reading joypad with other strobe-lengths might mess up +things). +10th bit and up (including the 4bit Controller ID) might be garbage (depending +on how the 8051 CPU in the keyboard handles the data transfer). However, with +appropriate timings, detecting a Miracle could be done via the "Firmware +version request" MIDI command. +Note: The NES and SNES Miracle software expects the piano keyboard connected to +Port 1, and a normal joypad connected to Port 2. + +miracle_recv_byte + [4016h]=01h ;strobe on + delay (need strobe on for 12 NES clks) ;short delay = READ mode + [4016h]=00h ;strobe off + data_present_flag = [4016h].bit0 ;data present flag (1=LOW=Yes) + for i=7 to 0 + data.bit(i)=NOT [4016h].bit0 ;data bits (MSB first, 1=LOW=Zero) + next i + +miracle_send_byte + [4016h]=01h ;strobe on (start bit) + delay (need strobe on for 66 NES clks) ;long delay = WRITE mode + for i=7 to 0 + [4016h].bit0=data.bit(i) ;data bits (MSB first, 1=HIGH=One) + dummy=[4016h] ;issue short CLK pulse + next i + [4016h]=00h ;strobe off (stop/idle) + delay (21 NES clks... plus overload) ;wait before next byte transfer + +Controllers - Piano - Miracle Piano MIDI Commands +------------------------------------------------- + +The Miracle is always using MIDI messages (no matter if the messages are +transferred through MIDI or RS232 or NES/SNES/Genesis controller cables). Below +lists the supported MIDI messages (including "Undocumented" messages, which are +used by the Miracle's SNES software, although they aren't mentioned in the +Miracle's Owner's Manual). + +MIDI Information Sent FROM/TO The Miracle keyboard + Expl. Dir Hex + Note off (Undocumented) W 8#h,,00h ;same as Note ON with velo=00h + Note on/off command R/W 9#h,, + Main volume level W B0h,07h, + Sustain on/off command R/W B#h,40h, + Local control on/off W B0h,7Ah, + All notes off W B#h,7Bh,00h + Patch change command (*) R ?? C#h, ;TO keyboard = Undocumented + Miracle button action R F0h,00h,00h,42h,01h,01h,,F7h + Unknown (Undocumented) W F0h,00h,00h,42h,01h,02h,,F7h ;??? + Keyboard buffer overflow R F0h,00h,00h,42h,01h,03h,01h,F7h + Midi buffer overflow R F0h,00h,00h,42h,01h,03h,02h,F7h + Firmware version request W F0h,00h,00h,42h,01h,04h,F7h + Miracle firmware version R F0h,00h,00h,42h,01h,05h,,,F7h + Patch split command W F0h,00h,00h,42h,01h,06h,0#h,,,F7h + Unknown (Undocumented) W F0h,00h,00h,42h,01h,07h,F7h ;??? + All LEDs on command W F0h,00h,00h,42h,01h,08h,F7h + LEDs to normal command W F0h,00h,00h,42h,01h,09h,F7h + Reset (Undocumented) W FFh +Direction: R=From keyboard, W=To keyboard +Notes: (*) Patch change FROM Keyboard is sent only in Library mode. + N#h Hex-code with #=channel (#=0 from keyb, #=0..7 to keyb) + Key (FROM Miracle: 24h..54h) (TO Miracle: 18h..54h/55h?) + Velocity (01h..7Fh, or 00h=Off) + Volume (00h=Lowest, 7Fh=Full) + Flag (00h=Off, 7Fh=On) + Instrument (00h..7Fh) for all notes + Instrument (00h..7Fh) for notes 24?/36-59, lower patch number + Instrument (00h..7Fh) for notes 60-83/84?, upper patch number + . Version (from version 1.0 to 99.99) + button on/off (bit0-2:button number, bit3:1=on, bit4-7:zero) +Data from piano is always sent on first channel (#=0). Sending data to piano +can be done on first 8 channels (#=0..7), different instruments can be assigned +to each channel. Although undocumented, the SNES software does initialize 16 +channels (#=0..0Fh), unknown if the hardware does support/ignore those extra +channels (from the instrument table: it sounds as if one could use 16 +single-voice channels or 8 dual-voice channels). + +Controllers - Piano - Miracle Piano Instruments +----------------------------------------------- + +Available Patches (aka Instruments) +The following patches are available through both Library Select Mode and MIDI +control: + 000 Grand Piano 032 Marimba 064 Synth Bells 096 Tube Bells' + 001 Detuned Piano 033 Glockenspiel' 065 Vox 1 097 Frogs/Ducks + 002 FM Piano 034 Kalimba' 066 Vox 2 098 Banjo' + 003 Dyno 035 Tube Bells 067 Vox 3 099 Shakuhachi' + 004 Harpsichord 036 Steel Drums 068 Mod Synth 100 Piano' + 005 Clavinet 037 Log Drums' 069 Pluck Synth 101 Vibraphone' + 006 Organ 038 Strings 1 070 Hard Synth 102 FM Piano' + 007 Pipe Organ 039 Pizzicato 071 Syntar 103 Clock Belis' + 008 Steel Guitar 040 Strings 2 072 Effects 1 * 104 Harpsichord' + 009 12-StringGuitar 041 Violin 1' 073 Effects 2 * 105 Clavinet' + 010 Guitar 042 Trumpet' 074 Percussion 1 * 106 Organ' + 011 Banjo 043 Trumpets 075 Percussion 2 * 107 Pipe Organ' + 012 Mandolin 044 Horn' 076 Percussion 3 * 108 Metal Guitar' + 013 Koto' 045 Horns 077 Sine Organ' 109 Stick' + 014 Jazz Guitar' 046 Trombone' 078 Organ # 110 Guitar' + 015 Clean Guitar' 047 Trombones 079 Pipe Organ # 111 Xylophone' + 016 Chorus Guitar 048 CupMuteTrumpet' 080 Harpsichord # 112 Marimba' + 017 Fuzz Guitar 049 Sfz Brass 1 081 Synth Pad 1 113 Syn Trombone' + 018 Stop Guitar 050 Sfz Brass 2 082 Synth Pad 2 114 Syn Trumpet' + 019 Harp' 051 Saw Synth 083 Synth Pad 3 115 Sfz Brass 1' + 020 Detuned Harp 052 Tuba' 084 Synth Pad 4 116 Sfz Brass 2' + 021 Upright Bass' 053 Harmonica 085 Synth Pad 5 117 Saw Synth' + 022 Slap Bass' 054 Flute' 086 Synth Pad 6 118 Church Bells' + 023 Electric Bass' 055 Pan Flute' 087 Synth Pad 7 119 Marcato' + 024 Moog 056 Calliope 088 Synth Pad 8 120 Marcato + 025 Techno Bass 057 Shakuhachi 089 Synth Pad 9 121 Violin 2' + 026 Digital Waves 058 Clarinet' 090 Synth Pad 10 122 Strings 3 + 027 Fretless Bass' 059 Oboe' 091 Synth Pad 11 123 Synth Bells' + 028 Stick Bass 060 Bassoon' 092 Synth Pad 12 124 Techno Bass' + 029 Vibraphone 061 Sax' 093 Synth Pad 13 125 Mod Synth' + 030 MotorVibraphone 062 Church Bells 094 Synth Pad 14 126 Pluck Synth' + 031 Xylophone 063 Big Bells 095 Synth Pad 15 127 Hard Synth' +Notes: + ' These programs are single voice, which lets The Miracle play up to 16 + notes simultaneously. All other programs are dual voice, which lets it + play up to 8 notes simultaneously. + * 072..076 See below for a list of Effects/Percussion sounds. + # 078..080 To be true to the nature of the sampled instrument, these patches + do not respond to velocity. + +Effects and Percussion Patches +When selecting instruments 072..076 (Effects 1-2 and Percussion 1-3), a number +of different sounds are mapped to each six keyboard keys/notes: + Note Effects 1 Effects 2 Percussion 1 Percussion 2 Percussion 3 + 30-35 Jet Yes (ding) - - Ratchet + 36-4l Gunshot No (buzz) Kick Drum Rim Shot Snap 1 + 42-47 RoboDeath Applause Snare Exotic Snap 2 + 48-53 Whoosh Dogbark Toms Congas Dripdrum 1 + 54-59 Punch Door creak Cymbal Timbale Dripdrum 2 + 60-65 Slap Door slam Closed Hat Cowbell Wet clink + 66-71 Duck Boom Open Hat Bongos Talk Drum + 72-77 Ow! 1 Car skid Ride Whistle Agogo + 78-83 Ow! 2 Goose Shaker Clave Explosion +Note: The piano keys are numbered 36..84 (so notes 30..35 can be used only +through MIDI messages, not via keyboard). + +Controllers - Piano - Miracle Pinouts and Component List +-------------------------------------------------------- + +25pin SUBD connector (J6) + 1 PC/Amiga/Mac RS232 GND (also wired to RTS) + 2 PC/Amiga/Mac RS232 RxD + 3 PC/Amiga/Mac RS232 TxD + 7 NES/SNES/Genesis GND + 10 NES/SNES/Genesis Data + 13 NES/SNES/Genesis Strobe + 14 Sense SENSE0 (0=MIDI Output off, 1=MIDI Output on) + 15 Sense SENSE1 (0=9600 Baud; for RS232, 1=31250 Baud; for MIDI) + 19 NES/SNES/Genesis Clock + all other pins = not connected +For PC/Mac RS232 wire SENSE0=GND, SENSE1=GND + +Miracle NES and SNES Cartridges +According to the ROM Headers: The SNES cartridge contains 512Kbyte Slow/LoROM, +and no SRAM (nor other storage memory). The NES cartridge contains MMC1 mapper, +256Kbyte PRG-ROM, 64Kbyte CHR-ROM, and no SRAM (nor other storage memory). + +Miracle Piano Component List (Main=Mainboard Section, Snd=Sound Engine) + U1 Snd 16pin TDA7053 (stereo amplifier for internal speakers) + U2 Snd 8pin NE5532 (dual operational amplifier) + U3 Snd 16pin LM13700 or LM13600 (unclear in schematic) (dual amplifier) + U4 Snd 14pin LM324 (quad audio amplifier) + U5 Main 3pin LM78L05 (converts +10V to VLED, supply for 16 LEDs) + U6 Main 14pin 74LS164 serial-in, parallel-out (to 8 LEDs) + U7 Main 14pin 74LS164 serial-in, parallel-out (to another 8 LEDs) + U8 Main 5pin LM2931CT (converts +12V to +10V, and supply for Power LED) + U9 Main 3pin LM78L05 (converts +10V to +5REF) + U10 Snd 14pin TL084 (JFET quad operational amplifier) + U11 Snd 40pin J004 (sound chip, D/A converter with ROM address generator) + U12 Snd 32pin S631001-200 (128Kx8, Sound ROM for D/A conversion) + U13 Main 3pin LM78L05 (converts +10V to VCC, supply for CPU and logic) + U14 Main 40pin AS0012 (ASIC) Keyboard Interface Chip (with A/D for velocity) + U15 Main 40pin 8032 (8051-compatible CPU) (with Y1=12MHz) + U16 Snd 40pin AS0013 (ASIC) + U17 Main 28pin 27C256 EPROM 32Kx8 (Firmware for CPU) + U18 Main 28pin 6264 SRAM 8Kx8 (Work RAM for CPU) + U19 Main 16pin LT1081 Driver for RS232 voltages + U20 Main 8pin 6N138 opto-coupler for MIDI IN signal + S1-8 Main 2pin Push Buttons + S9 Main 3pin Power Switch (12V/AC) + J1 Main 3pin 12V AC Input (1 Ampere) + J2 Main 2pin Sustain Pedal Connector (polarity is don't care) + J3 Snd 2pin RCA Jack Right + J4 Snd 2pin RCA Jack Left + J5 Snd 5pin Headphone jack with stereo switch (mutes internal speakers) + J6 Main 25pin DB25 connector (RS232 and SNES/NES/Genesis controller port) + J7 Main 5pin MIDI Out (DIN) + J8 Main 5pin MIDI In (DIN) + JP1 Main 16pin Keyboard socket right connector + JP2 Main 16pin Keyboard socket left connector + JP3 Snd 4pin Internal stereo speakers connector +Note: The official original schematics are released & can be found in internet. + +Controllers - Keypads +--------------------- + +TV-NET (21 Buttons) +The TV-NET controllers are roughly resembling TV remote controls (though using +a cable connection, no wireless IR-transmission). There are several revisions +(with differently labeled buttons): + Television Network Whatever Daiwa no My Trade + .----------------. .----------------. .----------------. + | TV-NET | | JAP | | JAP | + | [JP] [F1] [F2] | | [JP] [JP] [JP] | | [JP] [JP] [JP] | + | [F3] [F4] [F5] | | [JP] [JP] [JP] | | [<|] [|>] [C ] | + | (1) (2) (3) | | (1) (2) (3) | | (1) (2) (3) | + | (4) (5) (6) | | (4) (5) (6) | | (4) (5) (6) | + | (7) (8) (9) | | (7) (8) (9) | | (7) (8) (9) | + | (*) (0) (.) | | (^) (0) (v) | | (*) (0) (.) | + | (<-) (->) | | (<|) (|>) | | (# ) (->) | + | (JAP) | | (JAP) | | ((o)) | + '----------------' '----------------' '----------------' +Numeric keypads for use with TV-NET modems: +--> Modems + +Famicom Network Controller (HVC-051) (23 Buttons) + .------------------------------------------. + | (<) (>) (1) (2) (3) (*) (C) | + | SEL _ STA (JAP) | + | _| |_ (4) (5) (6) (#) (.) | + | |_ _| | + | |_| (7) (8) (9) ( 0 ) (B) (A) | + '------------------------------------------' +Joypad with numeric keypad for use with Famicom Network modems: +--> Modems + +Power Glove Numeric Keypad +The Power Glove does also have some sort of numeric keypad. In normal mode, the +keypad is used to configure the glove (for using it with games without built-in +glove-support). When entering a special glove mode, it's also possible to read +the keypad buttons by software. +--> Controllers - Power Glove + +Jissen Mahjong Controller (Capcom) (21 Buttons) +The top row has 14 buttons (square "A-M" keys, and a round "N" key), these keys +are used to drop one of the 14 cards (or if one has less than 14 cards, then +"N" draws a new card). +The bottom row has 7 buttons (SEL, ST, and some japanese symbols), these are +function keys (Select and Start, and whatever special "japanese" functions). + ...--------... + .-------------------'' CAPCOM ''------------------. + / lt up rt \ + | [A] [B] [C] [D] [E] [F] [G] [H] [I] [J] [K] [L] [M] (N) | + | | + | [F1][F2][F3][F4][F5][F6][F7] | + | lt dn rt | + \ / + '-------------------------------------------------------' +Reading is done as: + [4016h]=5, [4016h]=4, read 8bits from [4017h].Bit1 ;row 0 + [4016h]=3, [4016h]=2, read 8bits from [4017h].Bit1 ;row 1 + [4016h]=7, [4016h]=6, read 8bits from [4017h].Bit1 ;row 2 +The bits returned are: + Read Row 0 Row 1 Row 2 + 1st H (Right) None? None? (Change/Cheat?) ;\ + 2nd G (Up) None? Fn Unknown(EndGame?) ; All buttons: + 3rd F (Left) N (New/Okay) Fn Unknown(Tingeling?) ; 1=Low=Pressed + 4th E M Fn Unknown(Jp?) ; 0=High=Released + 5th D L Fn Unknown(Jp?) ; Unused bits: + 6th C K Fn Unknown(Right/Toggle); ?=What=Unknown + 7th B J F2 Start (Down) ; + 8th A I F1 Select (Left) ;/ + 9th.. Unknown(N/A?) Unknown(N/A?) Unknown(N/A?) ;-Probably padding +Translation for the text on the 5 japanese functions keys is unknown (the +left-most one apparently toggles setup options); Location of the japanese +function keys in the return data is unknown (probably in Row 2, 2nd..6th, +probably ordered as 6th read left-most, through 2nd read right-most). +There are only two known supported games: + Ide Yousuke Meijin no Jissen Mahjong (J) Capcom (1987) + Ide Yousuke Meijin no Jissen Mahjong 2 (J) Capcom (1991) +There are at least three (cosmetic) revisions of the Mahjong controller; mostly +different text/logos in lower-left section. The "II" version has a black case, +additional arrow symbols (LT-UP-RT above F-G-H keys, and LT-DN-RT below +SEL-STA-JP keys) and a blue rectangle around M-key. + +Famicom Titler +A special NES console from Sharp. The thing has built-in Tablet and Keypad. + +Controllers - Mats +------------------ + +Power Pad (Dance Mat) (Bandai/Nintendo) +The Power Pad aka Family Trainer aka Family Fun Fitness is a device made by +Bandai/Nintendo (1987/1988) which serves as an "exercising fun center" for the +whole family. That is, a large (1x1 meters) vinyl mat with 12 touch-sensitive +areas, or actually step-sensitive areas, since it's intended to be put on the +floor. The mat has two sides, with different patterns drawn on each side. +Supported games are: + Athletic World (J) (U) (E) 1986-1988 + Class Track Meet/Running Stadium/Stadium Events (J) (U) (E) 1986-1988 + Aerobics Studio/Dance Aerobics (J) (U) 1987/1989 + Fuuun! Takeshi Shiro 2 (J) 1988 + Jogging Race (J) 1987 + Meiro Daisakusen (J) 1987 + Power Pad Test Program by Tennessee Carmel-Veilleux (PD) (UE) + Rai Rai! Kyonshiizu: Baby Kyonshi no Amida Daiboken (J) 1989 + Short Order / Eggsplode! (U) 1989 + Street Cop/Manhattan Police (J) (U) 1987/1989 + Super Team Games/Daiundoukai (J) (U) 1987/1988 + Totsugeki! Fuuun Takeshi Shiro (J) 1987 + +Tap-tap Mat (igs) (Japan only) +Another mat, this one is smaller than the Power Pad mat, and one is supposed to +hit the fields with a plastic hammer. Used by only one known game: + Super Mogura Tataki!! - Pokkun Moguraa (J) (bundled with mat & hammer) + +NES Version I/O Access (outside Japan) (Bandai/Nintendo Mats) +Connects to 7pin controller port (typically the mat connects to port 2, and a +normal joypad for menu selections to port 1). To read the button states: + Output 1-then-0 to Bit0 of Port 4016h + Read eight times from Port 4017h (or 4016h, when plugged into port 1) +Each read receives two button states in Bit 3 and 4, in following order: + Bit4 4,3,12,8,u,u ,u ,u (0=High=Released, 1=Low=Pressed) (u=Unused always 1) + Bit3 2,1,5 ,9,6,10,11,7 (0=High=Released, 1=Low=Pressed) +Whereas, "1-12" are button numbers as drawn on Side B, or equivalent buttons on +Side A (horizontally mirrored, of course). + +FAMICOM Version I/O Access (Japan) (Bandai/Nintendo Mats and igs Mats) +Connects to 15pin expansion port. Unlike in NES version, the buttons are read +via a simple row/column matrix (without shift-register). The overall I/O access +is same for Nintendo/Bandai-mats and igs-mats: + 4016h.W.Bit0 Select Lower row (9..12) (0=Low=Select, 1=High=No) + 4016h.W.Bit1 Select Middle row (5..8) (0=Low=Select, 1=High=No) + 4016h.W.Bit2 Select Upper row (1..4) (0=Low=Select, 1=High=No) + 4017h.R.Bit1 Read Right-most column (4,8,12) (0=High, 1=Low=Pressed) + 4017h.R.Bit2 Read Right-middle column (3,7,11) (0=High, 1=Low=Pressed) + 4017h.R.Bit3 Read Left-middle column (2,6,10) (0=High, 1=Low=Pressed) + 4017h.R.Bit4 Read Left-most column (1,5,9) (0=High, 1=Low=Pressed) +After selecting a Row one should execute some delay before reading Column data: +For the Nintendo/Bandai-mats this should be a huge 1800 cycle delay. The +igs-mat can be used with shorter 138 cycle delays, but results might be +unstable (the tap-tap game reads all data twice, and retries reading until both +results are same). + +Power Pad Layout (Side A and Side B) +Side A has 2 red fields, 6 blue fields, and 4 hidden fields. +Side B has 12 fields, numbered 1..12, the left fields (1,2,5,6,9,10) are blue, +the other are red. + ____________.-------.____________ ____________.-------.____________ + |POWER PAD '=======' SIDE B| |POWER PAD '=======' SIDE A| + | | | | + | .---. .---. .---. .---. | | .---. .---. | + |-( 1 )-( 2 )-( 3 )-( 4 )-| | ( ) ( ) | + | '---' '---' '---' '---' | | '---' '---' | + |---------------------------------| | | + | .---. .---. .---. .---. | | .---. .---. .---. .---. | + |-( 5 )-( 6 )-( 7 )-( 8 )-| | ( ) ( ) ( ) ( ) | + | '---' '---' '---' '---' | | '---' '---' '---' '---' | + |---------------------------------| | | + | .---. .---. .---. .---. | | .---. .---. | + |-( 9 )-( 10 )-( 11 )-( 12 )-| | ( ) ( ) | + | '---' '---' '---' '---' | | '---' '---' | + |_________________________________| |_________________________________| + _________.-------------._________ + | |// Tap-tap | igs | + | |/ Mat | | + |---------'============='---------| + | .---. .---. .---. .---. | <--- Tap-tap numbering is same as + | (dragn) (BANG!) (croco) (BANG!) | on SIDE A of Power Pad, ie. + | '---' '---' '---' '---' | 4 3 2 1 + | .---. .---. .---. .---. | 8 7 6 5 + | (BANG!) (monky) (BANG!) (chick) | 12 11 10 9 + | '---' '---' '---' '---' | + | .---. .---. .---. .---. | + | (frank) (BANG!) (shark) (BANG!) | + | '---' '---' '---' '---' | + |_________________________________| + +Controllers - Inflatable Controllers +------------------------------------ + +Exciting Boxing Bop Bag (Konami) 1987 +Inflatable boxing bag with 8 sensors, used only by one game (Exciting Boxing). + 4016h.W.Bit1 Row Select (0=Hook/Move or 1=Jabb/Straight/Body) + 4017h.R.Bit1-4 Column Inputs (0=High=Punch, 1=Low=None) +There seems to be a delay required after changing the Row Select bit: The game +seems to read one 4bit column per frame, then toggle the row select bit, and +then read the other 4bit in next frame. + 4017h.R Row0 (OUT1=0) Row1 (OUT1=1) + Bit4 Right Hook (left ear) Straight (breast/chin) + Bit3 Move? (to left screen-edge) Right Jabb (left shoulder) + Bit2 Move? (to right screen-edge) Body (belly) + Bit1 Left Hook Left Jabb (right shoulder) +The location of the 2 move sensors is unknown (not used in Training mode; used +only in VS mode). The average location of the 6 punch-sensors can be seen in +Training mode, as so: + _###_ + /"#####"\ + (ear) Row0.Bit1 --> (| o\ /o |) <-- Row0.Bit4 (ear) (hook) + \ _ / + / \_o_/ \ <---- Row1.Bit4 (breast) (straight) + (shoulder) Row1.Bit1 --> | " | <-- Row1.Bit3 (shoulder) (jabb) + | () () | <---- Row1.Bit4 (belly) (body) + |_/ \_| + |=======| + | /-\ | + |==| |==| <-- inflatable boxer + | | | | + _|__|#|__|_ <-- control box + (___________) <-- inflatable ring + \ \ + \___________\ <-- floor mat +The type of all 8 sensors is unknown, presumably some kind of pressure or shock +sensors. The size of the bag is unknown (looks like around 100..150cm in height +on photos). Unknown how the thing is stabilized; maybe one is intended to sit +on the floor mat... or the ring or mat are meant to be filled with water... or +so? + +Top-Rider Bike (Varie) 1988 +Inflatable motor-bike with handle-bars mounted on the front end. + 4016h.W.Bit1 Start some conversion or so? + 4016h.W.Bit0 Reload shift-registers + 4017h.R.Bit3 8bit shift-register + 4017h.R.Bit4 8bit shift-register +Accessing the bike seems to require special start-bit and some delays: + [4016h]=03h ;start some conversion or so? + wait 60 clks (game tries so, but bugged code waits only 10 clks) + wait some more (whatever overload, additionally to above delay) + [4016h]=01h ;strobe on + wait some clks (strobe on should last for 12 clks) + [4016h]=00h ;strobe off + read 8 times from [4017h].Bit3-4 +The separate bits are: + Read 4017h.R.Bit3 4017h.R.Bit4 + 1st Accel, Bit5 (0=VCC=Zero) Turbo Unknown/unused? (?) + 2nd Accel, Bit4 (0=VCC=Zero) Steer Right, Bit1 (0=VCC=Zero, 1=One) + 3rd Accel, Bit3 (0=VCC=Zero) Steer Left, Bit1 (0=VCC=Zero, 1=One) + 4th Accel, Bit2 (0=VCC=Zero) Steer Right, Bit0 (0=VCC=Zero, 1=One) + 5th Accel, Bit1 (0=VCC=Zero) Fast Steer Left, Bit0 (0=VCC=Zero, 1=One) + 6th Accel, Bit0 (0=VCC=Zero) Slow Hand Brake (0=VCC=No, 1=GND=Pulled) + 7th Start Button (0=VCC=Released) Gear Switch (0=VCC=Lo, 1=GND=Hi) + 8th Select Button (0=VCC=Released) Wheelie (0=VCC=No, 1=GND=What?) +Of the 6bit accelerate value, only a few values are actually used: 01h=Slow, +02h=Fast, 20h=Turbo, and 00h/03h..1Fh/21h..3Fh=Stop; details are unknown, it's +probably not a 6bit analog values, maybe a 7-position switch with 1bit per +position; and no bit for the stop-position)? +The 4bit steering value allows 7 directions (forward, and 3 levels of +left/right each) (settings with both left and right bits nonzero are invalid); +details are unknown, maybe analog input, or a 7-position switch. +The gear switch is a switch (not a push button), and so, remains in the most +recently selected position. +Pulling the Hand Brake obviously pushes a button. Start/Select are on the bases +front panel, but unknown is Start is on left or right side. +Unknown how to trigger the Wheelie function; the picture on the box depicts a +function near ring finger of left hand, maybe there's a button underneath of +the left handle, or maybe it's possible to lift/pull the handles? +The length/height/width of the bike is unknown (judging from the photo on the +box, it seems to be made for small children). There's reportedly some risk to +pop the bike when used by heavy adults, unknown if that's just panic or an +actual problem. + ______ something near ring finger? maybe wheelie-button or so? + | ___ gear switch + | | _________ mimmicked km/h and rpm display + | | | | ____ handbrake + | | v v | + | | .---------------. __ v turn handle-bar + v v | .--. .--. | | |=====O to steer left/right? + ._______ _____| | | | | |__| |/______. + |_______| |__| '--' o '--' o|__|__|.______| <--- turn right handle + ' '|__| :'---------------': ' to accelerate? + # : (S??) (S??) : + : '._____________.' : <------ base with start/select + : : + : : <------ inflatable pillow to sit on + : : + +Controllers - RacerMate Bicycle Training System +----------------------------------------------- + +CompuTrainer by RacerMate. Used only by RacerMate Challenge II. + 4016h.W.Bit0 OUT0 (to be forwarded to TX1/TX2 on 4016h/4017h.reads) + 4016h.R.Bit0 Get RX1 (and forward OUT0 to TX1) (Player 1) + 4017h.R.Bit0 Get RX2 (and forward OUT0 to TX2) (Player 2) (if any) +The transfer rate is generated by an IRQ timer in the cartridge (the timer's +baudrate is unknown; the transfers do require at least 27 IRQs per 60Hz frame, +so the IRQ rate must be at least 1620 Hz or higher). In practice, 1024 clks per +IRQ seems to be too slow (video glitches), 512 clks too fast (1/10 second +counter increases non-linear), so, the IRQ rate is probably something around +768 clks. + +Transfer Packets (per player) (48 TX Bits & 48 RX Bits) + First Frame: + 2 IRQs Leading Pause (TX levels left unchanged) + 1 IRQ Output 1st TX Bit (Start Bit "0") Input nothing + 23 IRQs Output 2nd..24th TX Bit Input 1st..23rd RX Bit + 1 IRQ Output nothing (keep 24th TX bit) Input 24th RX Bit + 0 IRQs Ending pause (IRQs should be disabled until next Vblank NMI) + Second Frame: + 2 IRQs Leading Pause (TX levels left unchanged) + 1 IRQ Output 25th TX Bit (Start Bit "1") Input nothing + 23 IRQs Output 26nd..48th TX Bit Input 25th..47rd RX Bit + 1 IRQ Output nothing (keep 48th TX bit) Input 48th RX Bit + 0 IRQs Ending pause (IRQs should be disabled until next Vblank NMI) +Both the 48bit-RX and 48bit-TX streams are interleaved: + 24 "odd" bits (1st, 3rd, 5th, 7th, ... 47th bits) + 24 "even" bits (2nd, 4th, 6th, 8th, ... 48th bits) + +Odd TX Bits (1st, 3rd, 5th, 7th, ... 47th TX bits) (24bit from NES to Bike) + 1bit Must be "0" (start bit of packet-half transferred in First Frame) + 6bit Unknown (seems to be fixed: 1,1,0,1,0,0) ;(aka 2Ch/4, LSB first) + 5bit Data, Bit0..4 (LSB first) + 1bit Must be "1" (start bit of packet-half transferred in Second Frame) + 7bit Data, Bit5..11 (LSB first) + 4bit Index, Bit0..3 (LSB first) +The Index/Data Pairs are: + Index=1, Grade (signed) + Index=2, Wind (signed) + Index=3, Weight (LBS) + Index=4, Pulse Target Min (BPM+800h) ;\player 1 only + Index=5, Pulse Target Max (BPM+800h) ;/ + Index=5, Zero ;-player 2 only + Index=F, Start Race (Data=001h) +Unknown if there are further ones... eg. to stop/pause/resume race? + +Even RX Bits (2nd, 4th, 6th, 8th, ... 48th RX bits) (24bit from Bike to NES) + 1st EvenRxByte --> Button flags (bit0-5) SpecialStart (bit6) + 2nd EvenRxByte --> 8bit Data Fragment + 3rd EvenRxByte --> 4bit Data Fragment (LSBs), 4bit Index (01h..0Eh) (MSBs) +The 12bit data fragments are stored in an array (with index 01h..0Eh), there +are thus 14x12bit = 168 bits in that array. There are two separate arrays (one +per bike). + XXX content of the array is unknown (presumably speed and such things?) +The Button bits are: + 0 Button RESET (0=High=Released, 1=Low=Pressed) + 1 Button F1 (START/PAUSE/LEAVE) (0=High=Released, 1=Low=Pressed) + 2 Button F3 (SET/SELECT) (0=High=Released, 1=Low=Pressed) + 3 Button + (PLUS/UP) (0=High=Released, 1=Low=Pressed) + 4 Button F2 (DISPLAY) (0=High=Released, 1=Low=Pressed) + 5 Button - (MINUS/DOWN) (0=High=Released, 1=Low=Pressed) + 6 Start of Special Odd RX Bits (?) + 7 Unknown/unused? (?) +The Index/Data Pairs are: + Index=0 Unknown/Ignored + Index=1 Speed 12bit (0..FFFh = 0..81.9 MPH) (ie. 1/50 MPH units) + Index=2 Watts 12bit (0..FFFh = 0..3054 Watts) (roughly 3/4 Watt units) + Index=3 Pulse 8bit (0..FFh = 0..255 BPM) (and MSBs = 4bit Flags) + Index=4..E Unknown/Stored in memory (but seems to have no effect) + Index=F Unknown/Ignored + Unknown if/how/where RPM is transferred. + Speed (MPH) also affects distance (DST). +The 4bit flag-field for the Pulse data is: + Bit8 Blink Heart-Symbol + Bit9 Show "E" + Bit10 Show "LO" ;\when both set: treated as "sensor not connected" + Bit11 Show "HI" ;/(ie. showing "--" instead of the pulse value) + +Even TX Bits (2nd, 4th, 6th, 8th, ... 48th TX bits) (24bit from NES to Bike) +These bits are simply inverse bits that are preceeding the following Odd TX +Bits. Ie. a "0" bit will be transferred as "1-then-0" bit-pair, and "1" bit as +"0-then-1". The receiver (control panel) may use that transitions for +synchronization (eg. in case of baudrate inaccuracies). +In case of the 24th/48th TX bits, this "wraps" to next frame, ie. they are +inverse of the of the start-bit of the next frame. + +Odd RX Bits (1st, 3rd, 5th, 7th, ... 47th RX bits) (24bit from Bike to NES) +These bits can be inverse data bits that are preceeding the normal Even RX Bits +(similar as for TX). +Alternately, the odd RX bits can contain special information (probably an +extension of the original transfer protocol). Presence of that special info is +determined as so: + (EvenRxBytes <> (OddRxBytes XOR FFFFFFh)) AND Parity(1stOddRxByte)=odd +If that condition is true, then the 3 odd bytes are a fragment of a 24-byte +special array; it does thus take 8 packets to transfer the whole array; the +array-start is indicated by bit6 of the "button" byte. + XXX content of the array is unknown ... + XXX the software seems to manage only ONE array (not 2 arrays for 2 bikes) + +Control Panel +The control panel connects to both controller ports, which leaves no room for +connecting joypads or other controllers. So, menu selections are solely +controlled by the 6 buttons on the control panel. The only other inputs are the +rear-wheels rotation speed, and the pulse sensor. + .-------------------------. + | CompuTrainer | + | .---------------------. | + | | LCD | | <--- unknown display type + | | Display | | (maybe 7-segment or so) + | | | | + | '---------------------' |_____ + | Stop Display _ | <--- attach to handle-bars here + | [RESET] [ F2 ] [ + ] _____| + | [ F1 ] [ F3 ] [ - ] | + | Start Set | + | RACERMATE | + | Computer Aided Trainer | + | MODEL 8000? | + '-------------------------' + +Components +Hardware at Bike Side: + Control Panel (LCD display, 6 buttons, wired to flywheel, NES, pulse sensor) + Front Stand (small stand, holds front-wheel in straight-forward direction) + Rear Stand with electronic flywheel (resistance, speed-meter, stand upright) + Power Supply (for flywheel) + Pulse sensor, cables, screws + Bicycle (not included) (can be used with regular "ourdoor" bicycles) +Hardware at NES Side: + NES Connector Box (2x7pin NES connector, 2x3pin 3.5mm sockets; for 2 bikes) + NES Console with CIC disabled (or top-loading NES without CIC) + NES Challenge II cartridge (without CIC, except, old versions had CIC clone) +There are several hardware revisions (including some for newer +computers/consoles). For the NES, there are at least two front-panel variants +(with connectors located in different places), and at least two +rear-stand/fly-wheels (marked CompuTrainer, or CompuTrainer Pro), and, there +are reportedly several EPROM versions: + 3.11.088 05-02-1991 20:41:04 + 5.01.033 02-01-1994 19:28:10 + 5.01.036 05-15-1996 19:47:57 + 6.02.002 05-21-1996 12:22:18 + 9.03.128 (PAL) 03-22-1996 11:57:11 + +The game does also require a special mapper (and a NES with CIC disabled): +--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ + +Controllers - Tablets +--------------------- + +Games + Oeka Kids - Anpanman no Hiragana Daisuki (J) + Oeka Kids - Anpanman to Oekaki Shiyou!! (J) + +Controller Access + 4016h.W.Bit0 Oeka Kids Tablet Strobe (inverse of normal joypad strobe) + 4016h.W.Bit1 Oeka Kids Tablet Clock (manually clocked, unlike joypads) + 4017h.R.Bit2 Oeka Kids Tablet Ack (confirm Strobe/Clock signals) + 4017h.R.Bit3 Oeka Kids Tablet Data (18bits) +To start the transmission & read the 18 databits: + [4016h]=00h, wait for [4017h].Bit2=0 ;\strobe 0-then-1 (start transfer) + [4016h]=01h, wait for [4017h].Bit2=1 ;/ + [4016h]=03h, wait for [4017h].Bit2=0 ;\read databit (repeat 18 times) + databit = [4017h].Bit3 ; (note: the final wait after 18th + [4016h]=01h, wait for [4017h].Bit2=1 ;/bit can/should/must? be ommitted) +The separate databits are: + 1st..8th X-coordinate, MSB first, inverted (0=High=One, 1=Low=Zero) + 9st..16th Y-coordinate, MSB first, inverted (0=High=One, 1=Low=Zero) + 17th Soft-Pressure (Pen touches tablet) (0=High=Yes, 1=Low=No) + 18th Hard-Pressure (Click/Draw) ??????? (0=High=Yes, 1=Low=No) + XXX or is there a "click" button; the gray bar at front? So one must + push that button, and the thing can't sense "hard pressure" at all? +To convert tablet coordinates to 256x240 pixel screen coordinates: + tablet.x = tablet.x XOR FFh ;\undo inversion of databits + tablet.y = tablet.y XOR FFh ;/ + screen.x = tablet.x + (tablet.x/10h) - 08h ;\scale to screen dimensions + screen.y = tablet.y - (tablet.y/10h) + 0Dh ;/ + screen.x = minmax(screen.x,00h..FFh) ;\clip to min/max range + screen.y = minmax(screen.x,00h..EDh) ;/ + (of course, the coordinates are valid only if the pen touches the tablet) +The touch area is divided into eight sections: seven small "holes" at the top +of the tablet, and the main drawing area. Note: The horizontal coordinates of +these "holes" aren't exactly the same as of the corresponding screen buttons. + .----------------------------. + / ( LOGO/TEXT ) (<===pen====) \ + | __ __ __ __ __ __ __ | + | (__)(__)(__) (__)(__)(__) (__) | <-- touch-sensitive holes + | ____________________________ | + | | ' ' ' | | + | | | | <-- touch-sensitive tablet + | |- + + + -| | + / | | \ + | |- + + + -| | + | | | | + | |- + + + -| | + | | | | <-- lower half of case=click button? + | |______.______.______._______| | + \__________________________________/ + +Famicom Titler +A special NES console from Sharp. The thing has built-in Tablet and Keypad. + +Controllers - Trackball and Mouse +--------------------------------- + +Hori Track + Moero Pro Soccer (J) 1988 Jaleco + Operation Wolf (J) (U) 1989 Taito (also supports Zapper lightgun) + Putt Putt Golf (FDS) 1989 Pack-In-Video + US Championship V'Ball (J) 1989 Technos Japan Corp +Hori seems to have planned both NES and Famicom versions of the controller; as +far as known, the NES version wasn't released, but, most of the existing games +(except Putt Putt Golf) do contain both NES and Famicom controller protocol +versions: + Version Input Data from ID Bits Connector Released + Famicom [4016h/4017h].Bit1 0,1 15pin Yes + NES [4016h/4017h].Bit0 1,0 7pin No +Controller Bits: + (to be preceeded by normal joypad like 1-then-0 strobing on OUT-0) + 1st..8th bit --> Same as normal joypad data + 9th..12th bit --> Axis 1, signed 4bit (MSB first, inverted, 1=Low=Zero) + 13th..16th bit --> Axis 2, signed 4bit (MSB first, inverted, 1=Low=Zero) + 17th --> L/R mode switch (0=High=R-Mode, 1=Low=L-Mode) + 18th --> Unknown/unused (probably SPEED LO/HI switch) (=?) + 19th --> ID Bit1 (0=High=Famicom, 1=Low=NES) + 20th --> ID Bit0 (0=High=NES, 1=Low=Famicom) + 21th..24th --> Unknown/unused (read by software, but seems to be unused) + 25th and up --> Unknown/unused (probably whatever padding bits) +Trackball Orientation: + When 17th Bit=1: (L-Mode) (supported by all games) + Axis 1 is to be treated as Y-axis (POSITIVE = DOWN = towards DPAD) + Axis 2 is to be treated as X-axis (POSITIVE = RIGHT = towards START/SELECT) + When 17th Bit=0: (R-Mode) (not supported by Operation Wolf) + Axis 1 is to be treated as X-axis (POSITIVE = LEFT = towards DPAD) + Axis 2 is to be treated as Y-axis (POSITIVE = DOWN = towards START/SELECT) +DPAD orientation is unknown (according to manual, it sounds like UP=Towards +Ball, RIGHT=Towards B-Button) (in software, this should be probably always kept +handled as so, regardless of the L/R switch). + ___________ L-Mode R-Mode ___________ + | ___ |\ __________ __________ /| ___ | + | .' '. | | |\ /| _ | | .' '. | HORI TRACK + | | BALL | | | STA | | | | _| |_ | | | BALL | | + | | | | | // SEL | | | | |_ _| | | | | | HORI ELECTRIC + | '.___.' | | // | | | | |_| | | '.___.' | CO.LTD. + |___________| | A | | | | | |___________| MODEL TRK-7 + | \| .''. | | | | .''. |/ | MADE IN JAPAN + |_____________| | | | | | | | | |_____________| + | _ B '..' | | | | '..' B | Note: + | _| |_ .''. | | | | .''. STA | L/R switch and + | |_ _| | | | | | | | | SEL \\ | SPEED LO/HI + | |_| '..' | | | | '..' A \\ | switch are at + |________________________| | | |________________________| bottom-side + | H O R I T R A C K \ | | / | + |_________________________\| |/_________________________| + +Joyball Note +There's also a roughly similar looking controller called Joyball. However, that +thing is just a regular joystick with "ball-shaped" handle, not a trackball. + +Subor Mouse +The Subor Mouse is bundled with a keyboard-shaped NES clone; the mouse is +supported by only one known cartridge (bundled with the mouse & NES clone): + Educational Computer 2000 (RU) (with mimmicked russian Win95 GUI) +Reading a mouse byte is done as so: + [4016h]=01h + wait 28 clks (14 NOPs) + [4016h]=06h + read 8bits from [4017h].R.Bit0 (MSB first) (bits are NOT inverted!) +Mouse response can be a single-byte (max +/-1 mickey), or 3-byte (max +/-31 +mickeys). The response type & index is indicated in lower 2bit of the bytes. +Single-Byte Packet: + 7 Left Button (1=Pressed) + 6 Right Button (1=Pressed) + 5-4 Step X (0=None, 1=Plus 1/Right, 2=Treated same as 1, 3=Minus 1/Left) + 3-2 Step Y (0=None, 1=Plus 1/Down, 2=Treated same as 1, 3=Minus 1/Up) + 1-0 Must be 0 for single-byte packet +1st-byte of Three-byte Packet: + 7 Left Button (1=Pressed) + 6 Right Button (1=Pressed) + 5 Direction X (0=Plus/Right, 1=Minus/Left) + 4 Unsigned Step X, Bit4 + 3 Direction Y (0=Plus/Down, 1=Minus/Up) + 2 Unsigned Step Y, Bit4 + 1-0 Must be 1 for 1st byte of multi-byte packet +2nd-byte of Three-byte Packet: + 7-6 Unused (maybe copy of buttons) + 5-2 Unsigned Step X, Bit3-0 + 1-0 Must be 2 for 2nd byte of multi-byte packet +3rd-byte of Three-byte Packet: + 7-6 Unused (maybe copy of buttons) + 5-2 Unsigned Step Y, Bit3-0 + 1-0 Must be 3 for 3rd byte of multi-byte packet +Threshold must be implemented by software (as done in Educational Computer +2000): + 00h..0Eh Mickeys ---> Mul 1.0 --> 00h..0Eh Pixels + 0Fh..13h Mickeys ---> Mul 1.5 --> 16h..1Ch Pixels + 14h..18h Mickeys ---> Mul 2.0 --> 28h..30h Pixels + 19h..1Dh Mickeys ---> Mul 2.5 --> 3Eh..48h Pixels + 1Eh..1Fh Mickeys ---> Mul 3.5 --> 69h..6Ch Pixels +Motion counters are reset to zero after reading. Data should be read per NMI +(read at least one byte, and, in case of 3-byte response: read all 3 bytes). +Caution: +The Subor Clone does also contain a keyboard (and joypads), reading the +controllers might somehow interfere. Namely, Subor is doing the keyboard +reading AFTER and ONLY AFTER single-byte-mouse reads (in case of +multi-byte-mouse reads, it's completely omitting keyboard reading in that +frame) (though unknown if that kind of handling is really required). +--> Controllers - Typewriter Keyboards + +Controllers - Power Glove +------------------------- + +--> Controllers - Power Glove Transmission Protocol (RX/TX) +--> Controllers - Power Glove TX Packets (Configuration Opcodes) +--> Controllers - Power Glove RX Packets (Position/Sensor Data) +--> Controllers - Power Glove Games and Compatibilty Modes +--> Controllers - Power Glove Drawings +--> Controllers - Power Glove Pinouts + +Controllers - Power Glove Transmission Protocol (RX/TX) +------------------------------------------------------- + +Transmit (TX) (Configuration) +Transmission mode is entered by outputting a LONG strobe signal: + Set [4016h].W.Bit0=1, then wait around 3330 clks ;-Enter TX Mode +Thereafer, the TX packet can be sent bit-by-bit: + Set [4016h].W.Bit0=Databit ;-Output Data Bit + Do dummy-read from [4016h].R ;-Output Clk Pulse +Bytes are sent MSB first. Insert a small delay between each two bytes: + 1280 clks should be fine; as used by Super Glove Ball ;-Delay between bytes + (the older Bad Street Brawler game used 2304 clks) +For the standard Analog mode with 9-byte response, the transmitted packet +should be usually following 7 bytes: 06h,C1h,08h,00h,02h,FFh,01h. For details +on other TX packets, see: +--> Controllers - Power Glove TX Packets (Configuration Opcodes) +After the transfer, the value of the lastmost databit may be left on the strobe +line; the glove doesn't seem to treat this as new LONG strobe. + +Receive (RX) (Read Sensors/Buttons) +Read one Status Byte per frame (ie. via 60Hz NMI handler), just like normal +joypad reading: + Set [4016h].W.Bit0 to 1-then-0 ;-Strobe + Read 8bits from [4016h].R.Bit0 (MSB first, inverted) ;-Read Byte +This byte indicates if the glove is ready to send a new data packet: + 5Fh (received) aka A0h (when XORing by FFh) --> analog mode, ready + 00h? (received) aka FFh? (when XORing by FFh) --> analog mode, not ready (?) + other (joypad data) --> joypad emulation mode +If the Status Byte indicates Ready, then the next some bytes (usually 9 bytes) +are packet data, these can be read as so: + wait 100 clks ;-Delay between bytes + Set [4016h].W.Bit0 to 1-then-0 ;-Strobe (on each byte) + Read 8bits from [4016h].R.Bit0 (MSB first, inverted) ;-Read Byte + XOR byte by FFh ;-Undo inversion +For details on the packet content, see: +--> Controllers - Power Glove RX Packets (Position/Sensor Data) +After the transfer, a long pause may be required (it seems as if the glove +terminates RX mode via a timeout); best wait until next 60Hz frame before +trying to receive a new packet. +The conversion time isn't constant (for example, flex A/D conversion time seems +to increase when making a tight fist). Normally, status "Ready" should be +received around every 3 frames. Generate a timeout if ready isn't seen after 20 +frames; that might happen if the glove isn't connected, or not initialized (not +in analog mode), or if the user has hit the PROG button. + +Caution +Reading [4016h].R.Bit0 does, of course, work on NES ONLY. Unknown how to read +data from the japanese PAX Power Glove; [4016h].R.Bit1 should be a good guess. + +The existing games expect the glove connected to port 1 (4016h.R), alternately +it should also work in port 2 (4017h.R). When trying to connect two gloves, the +ultrasonic speakers would disturb each other, so only Flex and Buttons would +work. + +Controllers - Power Glove TX Packets (Configuration Opcodes) +------------------------------------------------------------ + +Overall TX Packet Format +The overall transmit packet format is: + 1. Length Byte (total number of following bytes) (used range is 05h..32h) + 2. 16bit Opcode Area (convert analog positions to temporary flags) + 3. 8bit Opcode Area (forward temporary flags to joypad bits; can use logic) + 4. Optional 6 extra bytes (whatever purpose, used only in one program) + +Analog Mode TX Packets +To enter the Analog mode, this should be usually the following 7 bytes: + 06h Length, total number of following bytes + C1h Analog Mode (bit7), one 16bit opcode (bit3-0) + 08h,00h Opcode 0800h (maybe analog request, or maybe just a dummy-opcode) + 02h Two 8bit "opcodes" (in Analog mode, they are "masks", not "opcodes") + FFh,01h Mask Word 01FFh (bit0-8: request 1st..9th response byte) +The 7th..8th response bytes contain unknown/unused values, changing the mask +from 01FFh to 013Fh should omit them (and save around 500 clks per received +packet); the Error Flags (normally in 9th byte) would then appear in 7th byte. +Setting Mask bit9..15 causes the glove to send extra garbage bytes. + +Digital Mode TX Packets +Digital mode would be required only if you want to use the joypad emulation +mode (ie. cripple the 3D analog position data to 2D digital joypad signals). +For details on doing that, read on below: + +======================== 16bit Opcode Area (Part 1) ======================== + +Header Byte for 16bit Opcode Area + 7 Low level mode (0=Digital Joypad Emulation, 1=Analog Low-Level Mode) + 6 Unknown (always 1 in known packets) + 5 Configure glove for use with other games (1=Survive POWER-OFF ?) + 4 Unknown (always 0 in known packets) "prevent re-flash later"? + 3-0 Number of following 16bit commands (used range is 01h..09h) + +16bit Opcodes +The upper 8bit (first byte) are: + 15 Unknown (always 0 in known packets) + 14 Unknown (maybe only-if-NEWLY?) ;-can be used together with bit13-8 + 13 Examine Thumb Finger Flex ;\ + 12 Examine Index Finger Flex ; only one of these + 11 Examine Middle Finger Flex ; bits should be set + 10 Examine Ring Finger Flex ; (usually) + 9 Examine Wrist Rotation Angle ; + 8 Examine X/Y/Z Coordinate ;/ +The lower 8bit (second byte) can have following uses: +For Finger Flex: + 7-4 Unknown (usually 0) (except, can be 1 when checking TWO fingers...?) + 3-2 Wanted flex or so (3 or 2=Want Flex, 0=Want NO Flex) + 1-0 Unwanted flex or so (0 or 2=Want Flex, 3=Want NO Flex) +For Wrist Rotation: + 7-4 Max Angle (00h..0Bh) ;\eg. wanted clock range 3:00 .. 6:00 should be + 3-0 Min Angle (00h..0Bh) ;/defined as Min=3, Max=6; or maybe Max=7, or so +For X/Y/Z Coordinate: + 7-3 Unknown, maybe flag(s) and/or boundary value + 2 Select Direction (0=Right/Up/Back, 1=Left/Down/Forward) + 1-0 Select Parameter (0=X, 1=Y, 2=Z, 3=Fourth Axis??) +The opcodes are computing if the glove is moved in the specified way, and the +result is then stored in a flag array: Input(1..9) = Result of 1st..9th 16bit +opcode (used as "Input" to the 8bit Opcodes in Part 2). + +Unknown/uncommon 16bit opcodes +Some very strange ones: + 1D18 ; right?? ;\these are used in combination with + 0000 ; left ?? ; "normal" left/right opcodes... + 1D18 ; ... ?? ; might be somehow related to near & far + 0000 ; ... ?? ;/transformed to slow/pulsed & fast/normal + (Maybe flex on 3 fingers, with two 2x2bit flex pairs in LSBs if first word, + plus bit8=whatever, plus an extra 2x2bit flex pair somewhere in 2nd word?) +Some other odd ones: + 440C ;\maybe "true if ring is NEWLY bent"? + 440C ;/ + 040C ;-looks like "ring", but is undocumented in manual + 6418 ;-two fingers bent? + 011E ;-looks like hand forward, but is undocumented in manual + +======================== 8bit Opcode Area (Part 2) ======================== + +Header Byte for 8bit Opcode Area + 7 Append EXTRA SIX BYTES after 8bit Opcode Area (0=Normal, 1=Extra) + 6-5 Unknown (always 0 in known packets) + 4-0 Number of following 8bit commands (used range is 01h..18h) + +Boolean Registers used with 8bit Opcodes + flg 1-bit accumulator + CondFlag Conditional Flag (false: skip all but opcode 6nh/7nh or so) + Input(0) General purpose flag (can be used to memorize current "mode") + Input(1..9) Results from 1st..9th 16bit Opcode (see Part 1) + Input(Ah..Dh) Unknown/unused + Input(Eh) Another general purpose flag (used as frame-toggle or so) + Input(Fh) Another general purpose flag (used as frame-toggle or so) + Output(0) Should be BEEP sound (judging from description in manual) + Output(1..8) Joypad Shift Register (R,L,D,U,?,?,B,A) ;?,?=probably STA,SEL + Output(9) Used in Brawler init and in "Joust" program (... LED?) + Output(Ah) Unknown/unused + Output(Bh) Maybe abort opcode execution... or LED control? + Output(Ch..Fh) Unknown/unused + PulseA Pulse generator 1 (mainly used for auto-fire on Button A) + PulseB Pulse generator 2 (mainly used for auto-fire on Button B) +For the first opcode, incoming flg and CondFlag seem to be initially true. +PulseA and PulseB can be also used to pulse DPAD bits, the pulse rate can be +changed and enabled/disabled via numeric keypad. +The Joypad DPAD outputs are reportedly also affecting the Direction LEDs on the +receiver unit. And, the other two LEDs are reportedly also affected by +"autofire", which probably means Joypad A/B buttons, or the PulseA/PulseB +generators. And the 9th LED (on the controller pad): unknown if it's software +controlled, or just a Power LED. + +8bit Opcodes + 0nh Unknown/unused + 1nh flg = Input(n) + 2nh CondFlag = flg, and, thereafter, flg = Input(0..9) ;IF command + 3nh Used... 33h is related to Input(3) and related to CondFlag? + 4nh flg = flg AND Input(n) + 5nh flg = flg OR Input(n) + 6nh Used... somehow related to CondFlag stuff... ;ELSE/ELSEIF? + 7nh Exchange flg <--> Input(n) ;or so? or CondFlag? ;ENDIF? + 8nh Output(n) = flg + 9nh Output(n) = flg AND PulseA + Anh Output(n) = flg AND PulseB + Bnh Input(n) = Input(n) XOR flg ;or so? or Input(n) = (NOT?) flg + Cnh Output(n) = NOT flg + Dnh Unknown/unused + Enh Unknown/unused + Fnh Used... FEh is used, related to Input(n) .. and CondFlag? + +Extra Six +Finally, "PROGRAM E" has EXTRA SIX BYTES after the 8bit opcode area (indicated +in bit7 of the 8bit Area's header). The bytes there are +00h,00h,00h,00h,57h,57h, purpose is unknown. + +Controllers - Power Glove RX Packets (Position/Sensor Data) +----------------------------------------------------------- + +Packet Summary +The standard packets are 9 bytes in size (not counting the preceeding "ready" +byte; and obviously not counting the preceeding/following "not ready" bytes). + 1st byte: Signed X-Coordinate + 2nd byte: Signed Y-Coordinate + 3rd byte: Signed Z-Coordinate + 4th byte: Wrist Rotation Angle (around Z-axis) + 5th byte: Finger Flex Sensors + 6th byte: Control Pad Buttons + 7th byte: Unknown/unused (00h) + 8th byte: Unknown/unused (00h) + 9th byte: Error Flags +Note: It is possible to disable some of the response bytes (via Mask Word in +configuration packet). For example, one may want to disable 7th..8th byte +(since they seem to be useless, and waste around 500 clks RX time); when doing +so, the numbering of the following bytes changes (ie. in that example, Error +Flags in "9th" byte would move to location of "7th" byte). + +1st/2nd/3rd byte: Signed X/Y/Z-Coordinates + 1st byte: X-coordinate (-80h=Left, +7Fh=Right) + 2nd byte: Y-coordinate (-80h=Down, +7Fh=Up) + 3rd byte: Z-coordinate (-80h=Forward, +7Fh=Back) ;Forward=Towards Screen +All coordinates are relative to the "Center" (the location where one has most +recently pushed the Center button). +Warning: There's a software bug in the Super Glove Ball game: When moving the +glove too fast, the sprite jumps to random locations in left screen half, +and/or stays stuck at botton-most screen coordinate. As a workaround, emulators +may limit the distance to max 31 units per packet. + +UNKNOWN if the glove is calibrating itself to biggest/smallest coordinates it +has seen (similar as for the finger flex calibration). +If so, the calibrated range would "grow" each time when moving towards the +boundaries; to avoid that "growing" effect, it may be a good idea to clip +values to -40h..3Fh in software (that, being the "used" range, and values +beyond that range being a "dead" zone) (if the user gets into the dead zone, +nothing bad happens as it's still far to the -80h/+7Fh maximum boundaries where +the growing effect might take place). + +4th byte: Wrist Rotation Angle (around Z-axis) + 7-4 Unused (always 0?) + 3-0 Clockwise rotation in 30 degree steps (00h..0Bh) +Rotation around Z-axis is determined by sensing X and Y coordinates of the two +ultrasonic speakers in relation to each other. Examples for the four major +rotation angles are: + Val Clock-face Degrees Back-side-of-Hand Thumb + 00h 12:00 0' Points up Points left + 03h 3:00 +90' Points right Points up + 06h 6:00 +180' Points down Points right + 09h 9:00 -90' Points left Points down +Mind that there are some body-mechanic restrictions: + In general, forearm can be be turned clockwise from around 0:00 to 6:00 + When using your shoulder you may also go anti-clockwise from 11:00 to 8:00 + When breaking your arm, or maybe doing a salto, you might also get to 7:00 +Note: Rotation around X-axis or Y-axis won't work: The speakers are no longer +aimed at the microphones, so the signals get lost, and the glove cannot compute +position & rotation values. + +5th byte: Finger Flex Sensors + 7-6 Thumb (hard to use) (0..3; 0=Straightest, 3=Most Bent) + 5-4 Index Finger (0..3; 0=Straightest, 3=Most Bent) + 3-2 Middle Finger (0..3; 0=Straightest, 3=Most Bent) + 1-0 Ring Finger (0..3; 0=Straightest, 3=Most Bent) + N/A Little Finger (there is no flex sensor for this finger) +The glove is automatically calibrating itself to the minimum/maximum flex +positions that it has seen; ie. before using it, one should stretch/bend all +fingers a few times. When not doing that, it defaults to return all 3's (ie. +highest flex seen so far). +Note: The flex sensors seem to be somehow fragile; it appears to be more or +less common that only 3 of the 4 sensors are working (unknown what is causing +that problem; maybe they are broken, or maybe just dirty). + +6th byte: Control Pad Buttons + 7-0 Button number of currently pressed button +Button numbers are: + 00h Keypad "0" or Center (glove beeps & centers when pressing Center?) + 01h-09h Keypad "1".."9" + 0Ah Button A + 0Bh Button B + 0Ch DPAD Left ;XXX or Up ? + 0Dh DPAD Up ;XXX or Right ? + 0Eh DPAD Down + 0Fh DPAD Right ;XXX or Left ? + 80h Enter (glove beeps when pressing this button?) + 82h Start + 83h Select + 84h (?) PROG (glove goes into program-mode when pressing this button) + FFh (?) None (no button pressed) +There can be only one button pressed. Priority order is reportedly (starting +with highest priority): + Left,Up,Down,Right, Enter,Start,Select,Center, 0,1,2,3,4,5,6,7,8,9, A,B. +Center and Enter are to-be-avoided as they beep the glove and wreck (?) one +sample or so of data. WHEREAS, "wrecking" sounds unlikely... maybe it does +rather stay not-ready for a while during centering? "0" and "Center" are +returning the same value according to two sources (but both being unaware of +the "ready" status-byte; so maybe they are seeing status=00h=centering/not +ready, rather than seeing button=00h=center). + +7th byte: Unknown/unused +8th byte: Unknown/unused +These two bytes seem to be always 00h. Purpose unknown. + +9th byte: Error Flags + 7-6 Unused (always 0) + 5 Right speaker (on little finger) to Sensor 3 (lower-right mic) (1=Okay) + 4 Right speaker (on little finger) to Sensor 2 (upper-right mic) (1=Okay) + 3 Right speaker (on little finger) to Sensor 1 (upper-left mic) (1=Okay) + 2 Left speaker (on index finger) to Sensor 3 (lower-right mic) (1=Okay) + 1 Left speaker (on index finger) to Sensor 2 (upper-right mic) (1=Okay) + 0 Left speaker (on index finger) to Sensor 1 (upper-left mic) (1=Okay) +Indicates if the speaker pings have reached the microphones. Should be 3Fh when +everything is fine, otherwise coordinate & rotation bytes may contain garbage +and one should ignore them. +Note: The six LEDs in the receiver unit seem to be wired to the serial joypad +data. So, after reading the last byte of a packet, the LEDs should reflect +Bit0-3 and Bit6-7 of the Error Flag byte (until the NMI handler reads the +following "Not Ready" byte in next frame). + +Controllers - Power Glove Games and Compatibilty Modes +------------------------------------------------------ + +Games with Glove Support +There have been only two games released. The first one with "faked" support +(merely configures the glove to simulate a joypad). The second one does +actually support analog inputs. + Bad Street Brawler (U) 1989 Mattel/Beam Software (uses digital mode only) + Super Glove Ball (U) 1990 Mattel/Rare/Novak (uses real analog low-level mode) +As far as known, these games have been sold only in USA. So, japanese users +have been stuck with the 14 built-in compatibility modes. + +Built-in Compatibilty Modes (Program 1-14) +The glove BIOS contains 14 built-in "programs" that are allowing to use it with +different existing games. + 1. Put the game into NES and press POWER. (Glove turns on and beeps.) + 2. Press PROG on glove. + 3. Press the number of the program you want to use on the number pad. + 4. Press ENTR. (The glove makes a dim beep.) + 5. Press ENTR again. (The glove beeps.) + 6. Press START or SELECT on your glove. (LED Panel turns on.) + 7. Make a fist a few times and center before you start playing. + 8. Repeat steps 2-5 to change programs. + Always make a fist a few times and re-center after you change programs. +Programs 1-13 are simulating joypad buttons when sensing special gestures. +Program 14 disables all sensors and allows to use the glove's control pad as +normal joypad. + +Extended Compatibilty Modes (Program A-I) +Aside from the actual game, the Bad Street Brawler game cartridge additionally +contains another 9 compatibility modes (for games like Gyruss and Gunsmoke). + 1. Put a special series game into the NES and press POWER. + 2. Select special program option as prompted. + 3. Select special series program as prompted. + 4. Turn off NES. You have 30 seconds to complete step 5. + 5. Put game you want to play in the NES and turn it back on. + 6. Make fists and center as usual, then press START, to start playing game. +BUG: The menu selection for the right column doesn't work (trying to select +Program F-I will mirror to Program A-D), and, Program C seems to have +accidently swapped clockwise & anti-clockwise directions. + +Controllers - Power Glove Drawings +---------------------------------- + + .-------. sensor 1 sensor 2 .-------..__ + | .-. |_____________________________________________| .-. | ''. LEDs: + | ((O)) |_____________________________________________| ((O)) | o | up + | '-' | upper-left upper-right | '-' | o o | lt rt + '-------' microphone microphone '-------' o | dn + .-----------------------------------------------------. | | + | .----------------------------------. ___ | | o o | rapid + | | | .' '. | |_____| fire + | | | | // | | | | LEDs + | | | | // | | | | + | | TV-Set | '.___.' | | | + | | | | | | + | | | ( ) ( ) | | | + | | | | | | + | | | ::::::::::::: | | | + | | | ::::::::::::: | | | + | | | ::::::::::::: | | | + | | | ::::::::::::: | | | sensor 3 + | | | | .--'-'--. + | '----------------------------------' | | .-. | + |_____________________________________________________| | ((O)) |###, + lower-right | '-' | # + ,###########################, microphone '-------' # + #" long cable "##, # + .------"------. "############################" + | junction | + .##| box : <--- ######################################, + # | | connect glove here "##########, + # '-------------' # + # short cable # + #' to NES very short long cable # + #' cable ___________________________________ # + ..------.. |''---..########/ Aup Aon Bup Bon \####" + | !!! !! ! ''-| |------/ LED (0) (1) (2) (3) (4) (PROG) \--. + .!.-------.. |speaker| !!!!| o SloMo Adn Aof Bdn Bof | | + | !!! !! ! '''| unit | !!!!| _ (5) (6) (7) (8) (9) (ENTER) | | + .!.---------.. | | !!!!| _| |_ | | + | !!! !! ! '''| | !!!!| |_ _| | | + '...---------... | | !!!!| |_| (CENTER) (SEL) (STA) (B) (A) | | + | !!! !! ! ''| __| !!!!|_______________________________________| | + '....----------...|___/' ''!! !! !! !! ________ !! !! !! | + / ,--------------------######---------------------' + .--''' / wrist-strap + | ...''' + '-----'' + Note: The "speaker unit" contains 2 ultrasonic speakers (above index finger + and little finger), plus one regular speaker (for producing beep sounds), + plus wires going to the flex sensors. The ultrasonic speakers must be aimed + towards the microphones for position sensing. + According to the glove manual, the microphones are intended to be hung on + the TV-Set. However, the surface of the screen may produce echos, and thus + mess-up signal sensing; results can be reportedly improved by depositing + the microphones elsewhere, possibly backed with towels for avoiding echos. + +Controllers - Power Glove Pinouts +--------------------------------- + +Pinouts for the CPU should be as shown below (info from Tim Deagan; +descriptions in middle column are assuming that the CPU has COP888CLMH-style +pinouts; but it might actually be a different COP888xxx variant). + Pin COP888 Power Glove + 1 C2,I/O INPUT C on 4021 ;\serial data + 2 C3,I/O INPUT D on 4021 ;/to NES and LEDs? + 3 G4,I/O,SO ? + 4 G5,I/O,SK DATA LATCH ;\serial data + 5 G6,I,SI,ME DATA CLOCK ;/from NES? + 6 G7,I/CKO,HALT RESTART XTAL + 7 CKI XTAL + 8 Vcc +5VDC + 9 I0,I R1 pullup,Button0,Button8,RIGHT + 10 I1,I R2 pullup,Button1,Button9,LEFT + 11 I2,I R3 pullup,Button2,ENTER ,DOWN + 12 I3,I R4 pullup,Button3,PROG ,UP + 13 I4,I R5 pullup,Button4, ,START + 14 I5,I R6 pullup,Button5, ,SELECT ;but, where + 15 I6,I R7 pullup,Button6, ,B ;is Center? + 16 I7,I R8 pullup,Button7, ,A + 17 L0,I/O,MIWU R26 gnd,THUMB + 18 L1,I/O,MIWU R27 gnd,INDEX + 19 L2,I/O,MIWU R28 gnd,MIDDLE + 20 L3,I/O,MIWU R29 gnd,RING + 21 C4,I/O ? ;\maybe these are + 22 C5,I/O Button0-7 & CENTER ; outputs to 8x3 + 23 C6,I/O ENTER ;/keypad matrix? + 24 C7,I/O GND + 25 L4,I/O,MIWU,T2A CLK on 4021 + 26 L5,I/O,MIWU,T2B RC net to LBlu,->|- red finger wires + 27 L6,I/O,MIWU ? + 28 L7,I/O,MIWU GRY from top of glove (XMTR2 ?) + 29 D0,O, I/O BIT 0 YEL from top of glove (XMTR1) + 30 D1,O, I/O BIT 1 GRN from top of glove (XMTR2) + 31 D2,O, I/O BIT 2 BLU from top of glove (BEEPER) + 32 D3,O, I/O BIT 3 PUR from top of glove (XMTR1 ?) + 33 D4,O, I/O BIT 4 INPUT E on 4021 ;\ + 34 D5,O, I/O BIT 5 INPUT F on 4021 ; serial data + 35 D6,O, I/O BIT 6 INPUT G on 4021 ; to NES and LEDs? + 36 D7,O, I/O BIT 7 INPUT H on 4021 ;/ + 37 GND GND + 38 RESET# ? + 39 G0,I/O,INT,ALE ? + 40 G1,WDOUT ? + 41 G2,I/O,T1B,WR# BRN to junct box (pin1 LM324 near rcvrs) + 42 G3,I/O,T1A,RD# ORG to junct box (RCs to LM324 near rcvrs) + 43 C0,I/O INPUT A on 4021 ;\serial data + 44 C1,I/O INPUT B on 4021 ;/to NES and LEDs? + +Power Glove Component List +Glove Speaker PCB + two ultrasonic speakers (near index finger/little finger knuckles) + one normal speaker (beeper) + three transistors, resistors, capacitors, diodes + wires to control-pad PCB, wires to finger flex sensors +Glove Control Pad PCB + (components here are mostly unknown) + Seems to consist of a 44pin National Semiconductor COP888-family CPU, + a 4021 shift-register, and possibly whatever other components. + one LED (on solder side), 21 buttons (on solder side) +Junction Box PCB + two LM324 chips (two quad-amplifiers) + three diodes, and many resistors and capacitors + DB9 connector (to glove), and wire to NES, and wire to microphone units +Microphone PCBs (three pieces) + TL062 (dual-amplifier) + one microphone, one capacitor, six resistors +LED PCB (near upper-right microphone PCB) + SN74LS164N (8bit serial-in, parallel-out shift-register) + six LEDs, six resistors, one capacitor + +Controllers - UForce +-------------------- + +--> Controllers - UForce I/O +--> Controllers - UForce Drawings +--> Controllers - UForce Games and Game Switches + +How the UForce Works (directly from the manual) +"UForce uses an array of sensors to create a three-dimensional Power Field +about 8 to 10 inches above or in front of each sensor. The Power Field senses +the position and motion of objects within it by combining information from all +its sensors." +Note: The so-called "Power Field" consists of 9 infra-red transmitters, each +one bundled with an infra-red receiver, meant to sense reflections from the +player's hands. + +Controllers - UForce I/O +------------------------ + +For reading analog data: Set Game Switches SW1+SW2+SW3 to the "Down" position +(otherwise the UForce will simulate a digital joypad). And, the UForce should +be connected to 1st controller port (the prototype cartridge supports only +4016h reads, not 4017h). + +Byte Reading +Bytes are read the same way as joypad1 (strobe 4016h.W.Bit0 1-then-0, then read +8 bits from 4016h.R.Bit, MSB first). Data appears to be transferred through a +shift-register (so no delays should be needed within the byte reading part), +however, short delays appear to be required between the separate bytes (exact +cycle values are unknown). + +Status Byte + 1st..6th Status Bits (00h=AllSixBitsHigh=Ready, Other=SomeBitLow=Busy) + 7th Select Button (0=High=Released, 1=Low=Pressed) + 8th Start Button (0=High=Released, 1=Low=Pressed) +The status byte should be usually polled within the NMI handler. If it's +indicating "Ready" (which reportedly happens about 10 times per second), then +the NMI handler should read 8 more bytes (containing the analog data described +below). +The Start/Select bits are usually read from "Ready" bytes (unknown if they can +be also read from "Busy" bytes). + +Analog Data Bytes + 1st Analog Data, Bit4 ;\5bit analog sensor value, + 2nd Analog Data, Bit3 ; bits are inverted (0=High=One, 1=Low=Zero), + 3rd Analog Data, Bit2 ; after undoing that inversion (XOR by 1Fh), + 4th Analog Data, Bit1 ; values are: 00h..1Eh = Distant..Closest + 5th Analog Data, Bit0 ;/(aka least..most IR light reflection) + 6th Analog Data, Bit0 (according to Kevin: duplicated, same as above) + 7th Presence Bit (according to Kevin: 0=High=Low=Sensor covered, heh?) + 8th Unused (according to Kevin: "0=NOT(0)=0" uh, that can't be true?) +The existing prototype software is merely treating the byte as "8bit analog +value", without giving special attention to the stuff in lower bits (so, +although the content of the LSBs is rather unclear, their exact values don't +really matter for emulation purposes). Also note: Kevin claims the analog range +to be only 00h..1Eh (not 00h..1Fh), this may be true, but he also claims that +the closest value is most distant, so better don't count on it. + +UForce Sensor Locations + Byte Number Official Naming Other Numbering + (within packet) (from manual) (kevtris doc) + 8th Top 1 + 6th 7th 1. 2. 2 3 + 5th 3rd'a 3. 4. 4 5 + 4th - 5. 6. 6 dummy + 1st 2nd 7. 8. 7 8 + 3rd'b Bottom 9 +The UForce has 9 sensors (plus one dummy location without sensor installed in +it). Of that 9 sensors, only 8 can be used at once (the 3rd byte in the 8-byte +data packet contains either the 3rd'a or 3rd'b value, depending on the SW4 +switch setting). + +Controllers - UForce Drawings +----------------------------- + +UForce Main Unit (with sensor numbers as ordered in the 8-byte data packet) + .---- sensor #8 + / + _______________________ _______ _______________________ + | . | ##### | . | + | | | | ..mmM | | | | + | | |_| FORCE | | | | + | | / \ | | + | | / \ | | + | |________________ / \ ________________| | + | _________________________________________________ | + | | | | + sensor | |'''. .'''| | sensor + #6---> | | :---------------------------------------: | | <--- #7 + | |...' '...| | + | | : : | | + | | : : | | + | | : : | | + | | : : | | + | | : : | | + | | : : | | + sensor | |'''. .'''| | sensor + #5---> | | :---------------------------------------: | | <--- #3a + | |...' '...| | + | | : : | | + _| |_:_____________________________________________:_| |_ + | | ______ ______ | | hinge + | |____| |_______________________________| |____| | <--- + |_| _________________________________________________ |_| + | | : : | | + | | : : | | + sensor | |'''. .'''| | dummy + #4---> | | :---------------------------------------: | | <--- + | |...' '...| | (no + | | : : | | sensor) + | | : : | | + | | : : | | + | | : add-on : | | + | | : .--- socket : | | + | | : / : | | + sensor | |'''. .'''. .'''| | sensor + #1---> | | :--------------- | ( ) | ---------------: | | <---#2 + | |...' | | '...| | + | |_____________________| |_____________________| | + | | + | ________________ \ / ________________ | + | | \ \ / / TURBO | | + | | ( ) \ \ / / ON A B | | + | | SELECT | | | | OFF ' ' | | + | | ( ) | | | | . . . . | | + | ' START ' | ##### | ' 1 2 3 4 ' | + |_______________________|_______|____GAME SWITCHES______| + \ + '--- sensor #3b +Of the 9 sensors, only 8 can be used at once. Game Switch 4 allows to select +between using sensor #3a or #3b. The other Game Switches select analog mode, or +digital joypad emulation modes. + +UForce Power Bar Accessory + _________________________________________________ + |\ POWER BAR /| + mirror --> \ For use with... / <-- mirror + |_ \___________________ ___________________/ _| + |___| <-- plug this nibble into socket + +This thing is badged "UForce Power Bar, For use with Mike Tysons's Punch Out!! +(and future games)". The bar can be plugged into the add-on socket between the +bottom-most sensor pair, there seem to be mirrors at the bar ends, which do +redirect that sensors towards the sides. + +UForce T-Bar with removeable Firing Grips Accessory + push-down _ _ push-down + button --> |_| _______________________________ |_| <-- button + | __| .-' '-. |__ | + .-' |-' L _____________ _____________ R '-| '-. + | | .-' | | '-. | | + \ |-' | | \ '-| / + grip --> | | | | \ | | <-- grip + | | | | T-shaped | | + | | | | handle-bar | | + |___| | | |___| + mirror --> | / | | | | \ | <-- mirror + |_____| | | |_____| + | | + | | + | | + | | + |___| <-- plug this end into socket + +This thing can be plugged into the add-on socket between bottom-most sensor +pair. It can be turned into all three directions. There aren't any +electronics/mechanics in the T-bar; it's only intended to keep the player's +hands at the height of the top-most sensor pair, which may then eventually +react to the player's steering efforts. +The two removeable handles have thumb buttons, which appear to turn mirrors +inside of the handles, which do then trigger the bottom-most sensors. + +Controllers - UForce Games and Game Switches +-------------------------------------------- + +Digital Game Modes +The five digital modes (called "Mode A-E") are used for compatibility with +existing games; where the UForce is using it's analog inputs to simulate +digital joypad signals matched for different game types. Naturally this isn't +working too well, as it's best it may be useful for adding some extra +difficulty to the games. + +Analog Game Mode +The analog mode (called "Mode F") was intended for future games that do +directly read the analog sensors. However, there hasn't been any such future +game ever released. There's only one prototype cartridge, that has leaked into +internet: + Uforce Power Games (USA) (Prototype) (1990) Broderbund +The cartridge contains four crude mini-games (Hose 'em Down, Nuclear Rat +Attack, Rock on Air, and Power Field B-Ball). The usage of the sensors is as +so: + Hose'em Down: + Use "Top" as ANALOG left/right + Use "Lower-Left in Lower Area" as ANALOG up/down + Nuclear Rat Attack: + Use upper-four sensors as DIGITAL push buttons + Rock on Air: + Use left four sensors as DIGITAL push buttons + Use "Top" as ANALOG pitch + Use "Bottom" as ANALOG volume + Power Field B-Ball + Use "Upper-Left in Upper Area" as walk left + Use "Lower-Left in Upper Area" as walk right + Use "Upper-right in Upper Area" as throw + Use whatever as jump + +UForce Game Modes + Mode SW1 SW2 SW3 SW4 Hinge/Angle Add-on Purpose + A Up Up Up Down Upright 85' T-Bar Various Games (Forward View) + B Down Up Up Up Tilt 110' Pow-Bar Mike Tyson's Punch-Out!! + C Up Down Up Down Upright 85' - Rad Racer + D Down Down Up Up Upright 85' - Excitebike + E Down Up Down Down Flat 180' - Various Games (Side Scroll) + F Down Down Down (Down) (var) (var) Analog (UForce Power Games) +Aside from the official 6 mode settings, there are some more possible settings +for SW1-SW3: + - Up Up Down (any) (any) (any) Reportedly same as Mode A + - Up Down Down (any) (any) (any) Unknown +SW4 does simply select which of the two "shared" sensors to use (either +bottom-most one, or the lower-right in upper-field one), so changing SW4 may +allow some desired or undesired variations. + +UForce Turbo A/B Switches +The two turbo switches can apply auto-fire to joypad button A/B signals. +Accordingly, they are used only in digital joypad emulation modes, not in +analog mode. The auto-fire rate is reportedly around 10Hz. + +Controllers - Barcode Readers +----------------------------- + +Datach - Joint ROM System (Bandai) (1992) +A mini-cartridge adaptor with built-in barcode reader. The device connects to +cartridge slot, and can be used (only) with seven special mini-cartridge games +(six of them actually supporting the barcode feature): + Dragon Ball Z: Gekito Tenkaichi Budokai (December 1992) + Ultraman Club: Spokon Fight!! (April 1993) + SD Gundam: Gundam Wars (April 1993) + Crayon Shin-Chan: Orato Poi Poi (August 1993) (this WITHOUT barcode support) + Yu Yu Hakusho: Bakuto Ankoku Bujutsue (October 1993) + Battle Rush: Build Up Robot Tournament (November 1993) + J League: Super Top Players (April 1994) +The barcode reader hardware can see only one pixel at a time: + [6000h].R.Bit3 Barcode Sensor (0=Black, 1=White) +The data seen during scanning is: + All Black ;no card inserted + 61 pixels White ;leading white space (ca. 61 pixels on included cards) + 95 pixels Stripes ;barcode (95 pixels for EAN-13 and UPC-A codes) + 61 pixels White ;ending white space (ca. 61 pixels on included cards) + All Black ;no card inserted +Example: In Dragon Ball Z, barcode 062982-144233 gives HP:51500, BP:32500, +DP:25000. +The included cards measure roughly 8.55cm x 5.9cm each. The existing games +support UPC-A and EAN-13 barcodes (both have 30 black stripes), EAN-8 barcodes +(22 black stripes), and, an unknown variable-length barcode format (with 27 or +more black stripes). UPC-E barcodes (17 black stripes) aren't supported. +The scanning software uses 8bit counters (incremented at 73 clk rate), for a +reasonable resolution & avoiding overflows (on wide 4pixel stripes), the +scanning time should be around 300..4600 clks per pixel. +The games are using a variant of "Mapper 16", but apparently with VRAM instead +of VROM. The VRAM has unknown size, and it's probably contained in the "Datach" +adaptor. +--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM +Note: Bandai also made a similar mini-cartridge device (named Sufami Turbo) for +the Super Famicom; that device features two cartridge slots, but doesn't +include a barcode reader. + +Barcode Battler II (Epoch) (1992) +A handheld console with built-in barcode reader and very simple LCD display. +The device can be used as standalone handheld console, or as external barcoder +reader for other consoles. Supported by only one Famicom game: + Barcode World (1992) Sunsoft (JP) (includes cable with 15pin connector) +Note: The Barcode Battler II is also supported by a couple of SNES games. +--> Controllers - Barcode Battler (barcode reader) +--> Controllers - Barcode Battler Transmission I/O +--> Controllers - Barcode Battler Drawings +In short: The Barcode Battler outputs barcodes as 20-byte ASCII string, at 1200 +Baud, 8N1. The NES software receives that bitstream via Port 4017h.Bit2. + +Barcode Format +--> Controllers - Barcode Formats + +Controllers - Barcode Battler (barcode reader) +---------------------------------------------- + +The Barcode Battler from Epoch allows to scan barcodes (either from special +paper cards, or from daily-life products like food packagings), games can then +use the barcode digits as Health Points, or other game attributes. + +Standalone-Mode +The device was originally designed as stand-alone gaming console with some push +buttons, a very simple LCD screen with 7-segment digits & some predefined LCD +symbols, and a built-in game BIOS (ie. without external cartridge slot, and +without any bitmap graphics). + +Link-Mode +Later versions (with black case) include an "EXT" link port, allowing to link +to other Barcode Battler hardware, or to Famicom/Super Famicom consoles. The +EXT port is probably bi-directional, but existing Famicom/Super Famicom games +seem to be using it only for reading barcodes (without accessing the LCD +screen, push buttons, speaker, or EEPROM). + +Barcode Battler Famicom (NES) Games + Barcode World (1992) Sunsoft (JP) (includes cable with 15pin connector) + +Barcode Battler Super Famicom (SNES) Games + Alice's Paint Adventure (1995) + Amazing Spider-Man, The - Lethal Foes (19xx) + Barcode Battler Senki Coveni Wars (1993) Epoch + Donald Duck no Mahou no Boushi (19xx) + Doraemon 2: Nobita's Great Adventure Toys Land (1993) + Doraemon 3: Nobita and the Jewel of Time (1994) + Doraemon 4 - Nobita to Tsuki no Oukoku (19xx) + Doroman (canceled) + Dragon Slayer - Legend of Heroes 2 (1993) Epoch + J-League Excite Stage '94 (1994) + J-League Excite Stage '95 (1995) + Lupin Sansei - Densetsu no Hihou wo Oe! (19xx) + Super Warrior Combat (19xx - does this game exist at all?) + +Barcode Battler Hardware Versions + Region__Case___EXT___Barcode-Reader__Name__________________Year___ + Japan White None Yes Barcode Battler 1991 + Japan Black 1 Yes Barcode Battler II 1992 + Japan Black 2 None Barcode Battler II^2 199x + Europe Black 1 Yes Barcode Battler 1992/1993 +The versions with one EXT socket can be connected to NES/SNES, or to one or +more of the "II^2" units (allowing more players to join the game). + +Connection to SNES/NES consoles +Connection to Super Famicom or SNES requires a "BBII INTERFACE": a small box +with 4 LEDs and two cables attached (with 3pin/7pin connectors), the interface +has been sold separetedly, it's needed to add a SNES controller ID code to the +transmission protocol. +Connection to Famicom consoles requires a simple cable (without interface box) +(with 3pin/15pin connectors), the cable was shipped with the "Barcode World" +Famicom cartridge, connection to NES would require to replace the 15pin Famicom +connector by 7pin NES connector. +The required 3pin EXT connector is available only on newer Barcode Battlers +(with black case), not on the original Barcode Battler (with white case). + Unknown if all 3 pins are actually used by NES/SNES cable/interface? + Unknown if NES/SNES software can access LCD/buttons/speaker/EEPROM ? + +Connectivity +"Connectivity mode is accessible if you plug in a standard 3.5mm mono jack plug +into the expansion port on the left hand side of the unit, hold down the +R-Battle and R-Power buttons and turn the unit on, the Barcode Battler II goes +into scanner mode." + +Barcode Battler II Interface +The hardware itself was manufactured by Epoch, and licensed by Nintendo (it +says so on the case). +The four lights, from left to right, indicate as follows: + "OK" All is well, the device is operating as normal. + "ER" Maybe there's something wrong? + "BBII" The Barcode Battler is sending data to the device. + "SFC" The SFC/SNES is waiting for a signal from the Barcode Battler. + +Component List (may be incomplete) + 80pin NEC uPD75316GF (4bit CPU with on-chip 8Kx8 ROM, 512x4 RAM, LCD driver) + 8pin Seiko S2929A (Serial EEPROM, 128x16 = 2Kbit) (same/similar as S29290) + 3pin EXT socket (3.5mm "stereo" jack) (only in new versions with black case) + LCD Screen (with 7-segment digits and some predefined words/symbols) + Five LEDs (labelled "L/R-Battle Side") + Seven Push Buttons (L/R-POWER, L/R-Battle, Power on/off, Select, Set) + Speaker with sound on/off switch (both on bottom side) + Barcode reader (requires card-edges to be pulled through a slot) + Batteries (four 1.5V AA batteries) (6V) + +Controllers - Barcode Battler Transmission I/O +---------------------------------------------- + +The Barcode Battler outputs barcodes as 20-byte ASCII string, at 1200 Baud, +8N1. The NES software receives that bitstream via Port 4017h.Bit2. The SNES +software requires a BBII Interface, which converts the 8bit ASCII digits into +4bit nibbles, and inserts SNES controller ID and status codes, the interface +should be usually connected to Controller Port 2 (although the existing SNES +games seem to accept it also in Port 1). + +Barcode Battler (with BBII Interface) SNES Controller Bits + 1st..12th Unknown/unused (probably always 0=High?) + 13th..16th ID Bits3..0 (MSB first, 1=Low=One) (must be 0Eh) + 17th..24th Extended ID Bits7..0 (MSB first, 1=Low=One) (must be 00h..03h) + (the SNES programs accept extended IDs 00h..03h, unknown + if/when/why the BBII hardware does that send FOUR values) + 25th Status: Barcode present (1=Low=Yes) + 26th Status: Error Flag 1 ? + 27th Status: Error Flag 2 ? + 28th Status: Unknown ? +Following bits need/should be read ONLY if the "Barcode Present" bit is set. + 29th-32th 1st Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 33th-36th 2nd Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 37th-40th 3rd Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 41th-44th 4th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 45th-48th 5th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 49th-52th 6th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 53th-56th 7th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 57th-60th 8th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 61th-64th 9th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 65th-68th 10th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 69th-72th 11th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 73th-76th 12th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 77th-80th 13th Barcode Digit, Bits3..0 (MSB first, 1=Low=One) + 81th and up Unknown/unused + Above would be 13-digit EAN-13 codes + Unknown how 12-digit UPC-A codes are transferred ;\whatever leading + Unknown if/how 8-digit EAN-8 codes are transferred ; or ending padding? + Unknown if/how 8-digit UPC-E codes are transferred ;/ +For some reason, delays should be inserted after each 8 bits (starting with +24th bit, ie. after 24th, 32th, 40th, 48th, 56th, 64th, 72th bit, and maybe +also after 80th bit). Unknown if delays are also needed after 8th and 16th bit +(automatic joypad reading does probably imply suitable delays, but errors might +occur when reading the ID bits via faster manual reading). + +Barcode Battler RAW Data Output +Data is send as 20-byte ASCII string. Bytes are transferred at 1200 Bauds: + 1 Start bit (must be 1=LOW) + 8 Data bits (LSB first, 1=LOW=Zero, 0=HIGH=One) + 1 Stop bit (must be 0=HIGH) +The first 13 bytes can contain following strings: + "nnnnnnnnnnnnn" ;13-digit EAN-13 code (ASCII chars 30h..39h) + ;12-digit UPC-A code (with ending/leading padding?) + " nnnnnnnn" ;8-digit EAN-8 code (with leading SPC-padding, ASCII 20h) + ;8-digit UPC-E code (with ending/leading padding?) + "ERROR " ;indicates scanning error +The last 7 bytes must contain either one of following ID strings: + "EPOCH",0Dh,0Ah ;<-- this is sent/accepted by existing hardware/software + "SUNSOFT" ;<-- this would be alternately accepted by the NES game +There are rumours that one "must" use a mono 3.5mm plug in order to receive +data - that's obviously bullshit, but it might indicate that the middle pin of +stereo plugs must be GNDed in order to switch the Barcode Battler into transmit +mode(?) + +Controllers - Barcode Battler Drawings +-------------------------------------- + +Barcode Battler - Handheld Console (Front) + _______________________________ + .---""" _______________________ """---. + | /\ | | /\ | + | \ \ | | / / | + | L \/ | LCD Screen | \/ R | + | POWER | | POWER | + | /\ | | /\ | + | \ \ | | / / | + | L \/ |_______________________| \/ R | + | BATTLE BATTLE | + | O O O O O | + | L <-- Battle Side --> R | + ) EXT | + | On/off Select Set | + | [====] [====] [====] | + '---_____________________________________---' + --> : _____________________________ : --> --> pull card this way + :/ CARD IN --> \: + |_______________________________| + +Barcode Battler - Handheld Console (Back) + _______________________________ + .---""" : : """---. + | : Battery Lid : | + | : (Four AA Batteries) : | + | : : | + | :.........................: | + | | + | | + | | + | __ | + | o |__| | + | o o o Sound | + | o on/off ( <-- 3.5mm 3pin + | Speaker | EXT socket + | | + '---__ __---' + | | + | | + |_______________________________| + +Barcode Battler - LCD Screen Layout + _______________ ___________ _______________ + | .-------. _|__ESCAPE___|_ .-------. | + | | FIGHT | / < SUPER HIT > \ |RECOVER| | + | |BARCODE| /|_______________|\ | MISS | | + | '-------' '-------' | + | (*) (/) (K) POWER INPUT (i) (/) (*) | + | _ _ _ _ _ _______ _ _ _ _ _ | + | |_||_||_|| || | |ENERGY | |_||_||_|| || | | + | |_||_||_||_||_| |DAMAGE | |_||_||_||_||_| | + | _ _ _ _ _ |_______| _ _ _ _ _ | + | |_||_||_|| || | |ATTACK | |_||_||_|| || | | + | |_||_||_||_||_| | MAGIC | |_||_||_||_||_| | + | _ _ _ _ _ |_______| _ _ _ _ _ | + | |_||_||_|| || | |DEFENCE| |_||_||_|| || | | + | |_||_||_||_||_| |SURVIVA| |_||_||_||_||_| | + |_________________|_______|_________________| + +Barcode Batter II Interface (SNES/SuperFamicom) & Simple Cable (Famicom) + _________________ + cables -> / _______ '''---> 3pin 3.5mm "stereo" EXT connector + _____|_____|____ '''---> 7pin SNES/SuperFamicom connector + ___| |___ + | | _.----> 3pin 3.5mm "stereo" EXT connector + | BBII INTERFACE | .-' + | | | + | O O O O | '-_ cable + |________________________| ''-------> 15pin Famicom connector + +Paper-Card Front (Picture Side) + _________________________________________________ + | | + | NINJA STAR WEAPON-17 | + | > INSERT | + | ----------------------^------------------------ | + | | | | + | ___ /___\ ____ | + | ___---""" /__/ \__\ """---___ | + | ---___ __ O __ ___--- | + | """---___\ _\ /_ /___---""" / | + | \ / / | + | | | /_ | + | ----------------------V--------------------'( ) | + | ST 400 ||| | + |_________________________________________________| + +Paper-Card Back (Description & Barcode) + _________________________________________________ + | | + | BARCODE BATTLER | + | NINJA STAR | + | 1992 Epoch | + | A lethal weapon which demands skill, patience | + | and, most important, perfect timing. Send it | + | spinning at the enemy when the Battler spirit is| + | with you and the effect can be devasting. Time | + | it wrong and the star may harmlessly bounce off | + | their defences. | + | || || |||| || || |||| || || |||| | + | || || |||| || || |||| || || |||| | + | || || |||| || || |||| || || |||| | + |_________________________________________________| + +Controllers - Barcode Formats +----------------------------- + +Common Barcode Formats + EAN-13 13-digits in 12 symbols (extra digit encoded in parity) + UPC-A 12-digits in 12 symbols + EAN-8 8-digits in 8 symbols + UPC-E 8-digits in 6 symbols (extra digits encoded in parity) + +Barcode Symbols +Each symbol consists of 7 pixels with 4 bars: White-Black-White-Black in first +half, and vice-versa in second half; this allows to determine the scanning +speed per symbol. There are 3 possible symbols (with inverse and/or reverse +pixels) for each digit: + Digit Left/Odd Left/Even Right/Even + 0 ...##.# .#..### ###..#. + 1 ..##..# .##..## ##..##. "." = White + 2 ..#..## ..##.## ##.##.. "#" = Black + 3 .####.# .#....# #....#. + 4 .#...## ..###.# #.###.. + 5 .##...# .###..# #..###. + 6 .#.#### ....#.# #.#.... Left Sync Mark: #.# + 7 .###.## ..#...# #...#.. Center Sync Mark: .#.#. + 8 .##.### ...#..# #..#... Right Sync Mark: #.# + 9 ...#.## ..#.### ###.#.. +12-digit UPC-A (and 8-digit EAN-8) barcodes use "Left/Odd" for the first 6 (or +4) symbols, and "Right/Even" for the remaining 6 (or 4) symbols. The +"Left/Even" symbols are used only for 13-digit EAN-13 and 8-digit UPC-E +barcodes (see below). + +UPC-A (12-digits in 12 symbols) +This is the original barcode format, used mainly in North America, but also +found on products that imported/exported to/from that area (namely, on many +Audio CDs). + +EAN-13 (13-digits in 12 symbols; extra digit encoded in parity) +This is an extension of the UPC-A format, with an additional leading digit (if +the digit is "0" then it's an UPC-A barcode, otherwise an international EAN-13 +barcode). +EAN-13 barcodes are having only 12 symbols (as UPC-A), the 13th digit is +encoded in the "parity" of the 2nd..6th symbol; the other symbols are fixed: +1st=Odd and 12th=Even allow to determine scanning direction; 7th..11th=Even +aren't containing any special information. +The parity (E=Left/Even, O=Left/Odd) for the 1st..6th symbol (aka 2nd..7th +digit) depends on the 1st digit: + Digit 1st=0 1st=1 1st=2 1st=3 1st=4 1st=5 1st=6 1st=7 1st=8 1st=9 + Parity OOOOOO OOEOEE OOEEOE OOEEEO OEOOEE OEEOOE OEEEOO OEOEOE OEOEEO OEEOEO +The parity for the 7th..12th symbol (aka 8nd..13th digit) is fixed (always +Right/Even). + +EAN-8 (8-digits in 8 symbols) +A short barcode for international use. Encoded as UPC-A, but only 4 symbols in +each half. + +UPC-E (8-digits in 6 symbols; extra digits encoded in parity) +This is a compressed UPC-A barcode; with the "middle zeros" removed from the +manufacturer/product number field. Unlike UPC-A, these barcodes are rarely +found outside of North America. + UPC-E UPC-A + tMmpppXc --> tMmX0000pppc ;with X=0..2 ;\for UPC-E, first digit (t) + tMmmpp3c --> tMmm00000ppc ; may be 0..1 only), + tMmmmp4c --> tMmmm00000pc ; last digit (c) must be checksum + tMmmmmXc --> tMmmmm0000Xc ;with X=5..9 ;/of the "decompressed" UPC-A code +The first digit (0 or 1), and the last digit (checksum, 0..9) are encoded as +"parity" of the six symbols: + Digit 8th=0 8th=1 8th=2 8th=3 8th=4 8th=5 8th=6 8th=7 8th=8 8th=9 + 1st=0 EEEOOO EEOEOO EEOOEO EEOOOE EOEEOO EOOEEO EOOOEE EOEOEO EOEOOE EOOEOE + 1st=1 OOOEEE OOEOEE OOEEOE OOEEEO OEOOEE OEEOOE OEEEOO OEOEOE OEOEEO OEEOEO + Left Sync Mark: #.# Center Sync Mark: None Right Sync Mark: .#.#.# +Whereas, E=Left/Even, O=Left/Odd (Right/Even symbols aren't used by UPC-E). + +Checksums +The barcode checksum is located in the last digit. This value must be chosen so +that the sum of all digits, plus twice the sum of each second digit sums up to +a decimal value ending with zero. + EAN-13 Checksum Weighting: 1-313131-313131 ;1=counted once + UPC-A Checksum Weighting: 313131-313131 ;3=counted thrice + EAN-8 Checksum Weighting: 3131-3131 + UPC-E Decompress UPC-E to UPC-A, then do UPC-A checksumming + +Notes +Scanning direction can be determined by checking "Odd/Even" parity of the first +& last symbol. +Error checking can be done by verifying the checksum digit and by rejecting any +invalid symbols. + +Controllers - Pachinko +---------------------- + +Pachinko Controller Games + Pachinko Daisakusen (J) 1991 Coconuts/C*Dream + Pachinko Daisakusen 2 (J) 1992 Coconuts/C*Dream + Pachio Kun 4 (J) 1991 Coconuts/C-Dream + Pachio Kun 5 (J) 1993 Coconuts/C-Dream +Pachinko is a japanese gambling game; its appearance is resembling pinball, but +concerning stupidity it's more resembling one-armed-bandit-style slot machines. + +Pachinko Controller Access +The controller is accessed like normal Joypad 3, but with the 8bit joypad data +being followed by additional 8bit ADC data. First do the normal 1-then-0 +strobing, then read 16bit from [4016h].Bit1: + 1st..8th bit --> same as normal joypad data + 9th..16th bit --> analog ADC data (MSB first, inverted, 1=Low=Zero) + 17th and up --> unknown/unused +Average analog range returned on real hardware is unknown. In software, the +used range is 00h=Stopped through 63h=Fastest. + +Coconuts Japan Pachinko Controller +The controller consists of normal joypad buttons, plus an analog trigger (or +analog dial?) in the middle of the controller. The joypad is used for menu +selections, the analog thing for firing the pachinko balls. + .----------. __.---------. + | ) | / \ + | / // \ + | _ | /| | + | _| |_ | /_| | + | |_ _| | \ B A | + | |_| \ ) ( ) ( ) | + | \___/ / + | SEL STA / + | coconuts japan / + '--------------------------' + +Controllers - Microphones +------------------------- + +Standard Famicom Microphone +On older Famicoms, the second control pad (that without Start and Select +buttons) has a microphone with volume control built-in. The signal goes to Bit +2 of Port 4016h (simple 1bit input, not an analogue ADC-converted input). +The signal is also merged with the PPUs sound output signals, as such, allowing +to use the television set/speaker as amplifier/megaphone. +Games that do use the Standard Microphone + * Atlantis no Nazo (NES = Super Pitfall II) - get the microphone power-up + and then yell into the microphone to freeze and kill most enemies. + * Hikari Shinwa: Palutena no Kagami (NES = Kid Icarus) - talk into the + microphone to bargain for lower shop prices. + * Raid on Bungeling Bay (NES = Raid on Bungeling Bay) - ? + * SD Kamen Rider -- in one of the mini games, blow air into the microphone + to get a windmill to spin. + * Takeshi no Chousenjou - microphone section, where players are required to + sing a verse of karaoke or talk whilst playing a pachislo minigame (the + microphone section was replaced in later versions of the game once the + microphone was dropped from the Famicom). + * Zelda no Densetsu: The Hyrule Fantasy (cart/disk) (NES = The Legend of + Zelda) - yell into the microphone to kill Pols Voice enemies. +Note: Many Coconuts games do also contain a Famicom Microphone reading +function: I Love Softball, Pachio Kun 1-6, Pachinko Daisakusen 1-2 (though +unknown when/if/which games do actually use that function). + +Bandai Microphone +Cartridge with attached "stage" microphone, two 2 push buttons (A and B), and +ROM expansion slot. +--> Mapper 188: UNROM-reversed + +NES LaserScope / Famicom Gun Sight (Konami) +This is basically a regular "Zapper" lightgun in form of a headset. The thing +contains a microphone that replaces the Zapper's trigger button; thus allowing +"voice activated" shooting. + +Controllers - Reset Button +-------------------------- + +Reset Button +As an additional "control" the console is equipped with a reset button, which +is grounding the 2A03s /RST pin (resets CPU and APU). +On NES consoles (not on Famicom consoles), the reset signal is also connected +to PPU /SYNC input, causing the picture to be disabled during reset (the PPU +registers are left unchanged though). For curiosity, the NES reset signal is +also connected to the power LED, the LED goes off when pressing Reset (or when +the lockout chip generates a reset). +Anyways, RAM and VRAM is left unaffected, so that the program may recover from +reset by invoking a warmboot rather than complete coldboot. As simple example, +it may, if desired, preserve high score values, etc. +The cartridge bus doesn't include a reset signal, so mapper registers would be +usually left unaffected as well - unless any mappers figure out any ridiculous +ways to detect resets, for example by examining address signals. + +SRAM Protection via Reset Button +The Reset button is also important for some games with battery backed SRAM: The +consoles cartridge bus becomes unstable during power-off, so that SRAM content +may get overwritten randomly. +As workaround, some games prompt the user to hold down the reset button during +power-off (eg. Maniac Mansion, MMC1). Other games include mappers that can +enable/disable SRAM, and don't need that trick (eg. Kirby's Adventure, MMC3). + +Controllers - Arcade Machines +----------------------------- + +VS Unisystem +Arcade Machine with additional coin-detection and DIP-switch inputs. Joysticks +and Lightguns are accessed slightly different as on NES. +--> VS System + +Play Choice 10 +Arcade Machine with additional coin-detection, DIP-switch, and game-select +inputs. The inputs are controlled by a separate Z80 CPU. More info: +--> Nintendo Playchoice 10 + +FamicomBox +For hotel rooms. +--> FamicomBox + +Storage Data Recorder +--------------------- + +Nintendo Data Recorder +Used to load/save BASIC programs, game positions, or custom edited levels. The +recorder is badged "Nintendo", but actually it's just an off-the-shelf audio +tape recorder (with speaker and microphone), connected via two cables +(load/save) with mono 3.5mm plugs to the "Family Basic Keyboard". + +Connection +The Data Recorder connects to the Famicom BASIC Keyboard (which itself connects +to 15pin controller port). +--> Controllers - Typewriter Keyboards +Note: There is also a device called S.D. Station (from Hori) which seems to +have Headphone and Recorder IN/OUT sockets... unknown if the recorder part is +identical with the Famicom Keyboard recorder connectors. + +Software that supports the Data Recorder + Castle Excellent (supports both Data Recorder and Turbo File) + Excitebike + Family Basic + Lode Runner (unknown HOW to access LOAD/SAVE menu... maybe via keyboard?) + Mach Rider + Wrecking Crew +Note: Accessing the load/save functions may be a difficult task: In Castle +Excellent it involves using 2nd Joypad, and to confirm selections by this or +that button (for selecting either Data Recorder, or Turbo File mode). + +Storage Turbo File +------------------ + +The Turbo File is an external battery-backed RAM-Disk made by ASCII. The device +connects to 15pin Famecom expansion port, accordingly, it's been sold only in +japan, and it's mainly supported by ASCII's own games. + +Turbofile (AS-TF02) +Original version, contains 8Kbytes battery backed RAM, and a 2-position PROTECT +switch, plus a LED (unknown purpose). + +Turbo File II (TFII) +Newer version, same as above, but contains 32Kbytes RAM, divided into four +8Kbyte slots, which can be selected with a 4-position SELECT switch. + +Turbo File Adapter +Allows to connect a Turbo File or Turbo File II to SNES consoles. Aside from +the pin conversion (15pin NES to 7pin SNES), it does additionally contain some +electronics (for generating a SNES controller ID, and a more complicated +protocol for entering the data-transfer phase). Aside from storing SNES game +positions, this can be also used to import NES files to SNES games. + +Turbo File NES I/O Ports + 4016h.Write.Bit0 = Data.Out (must be same as OLD data when READING data) + 4016h.Write.Bit1 = Reset Address to Offset 0000h + 4016h.Write.Bit2 = Data.Clock + 4017h.Read.Bit2 = Data.In (can be ignored when WRITING data) +To reset the address to offset 0000h: + [4016h]=00h ;reset address to zero + [4016h]=02h ;release reset +To read a bit (and to write-back the same unchanged value): + old=[4017h].bit2 ;get old data + [4016h]=old+06h ;output data and clk=high + [4016h]=old+02h ;output data and clk=low +To write a bit: + [4016h]=new+06h ;output data and clk=high + [4016h]=new+02h ;output data and clk=low +Bytes are usually transferred LSB first. Except, the oldest game (Castle +Excellent from 1986) did use MSB first. The address increments after each 8 +bits. To seek a specific address: Reset address to 0000h, then issue dummy +reads until the desired address is reached. + +Turbo File Memory +The first byte (at offset 0000h) is unused (possibly because that there is a +risk that other games with other controller access functions may destroy it); +after resetting the address, one should read one dummy byte to skip the unused +byte. The used portion is 8191 bytes (offset 0001h..1FFFh). The "filesystem" is +very simple: Each file is attached after the previous file, an invalid file ID +indicates begin of free memory (though SOME games seem to keep searching for +valid IDs even after that point?). + +Turbo File Fileformat (newer files) (1987 and up) +Normal files are formatted like so: + 2 ID "AB" (41h,42h) + 2 Filesize (16+N+2) (including title and checksum) + 16 Title in ASCII (terminated by 00h or 01h) + N Data Portion + 2 Checksum (all N bytes in Data Portion added together) + +Turbo File Fileformat (old version) (1986) +The oldest Turbo File game (Castle Excellent from 1986) doesn't use the above +format. Instead, it uses the following format, without filename, and with +hardcoded memory offset 0001h..01FFh (511 bytes): + 1 Don't care (should be 00h) ;fixed, at offset 0001h + 2 ID AAh,55h ;fixed, at offset 0002h..0003h + 508 Data Portion (Data, end code "BEDEUTUN", followed by some unused bytes) +CAUTION: + The early version has transferred all bytes in reversed bit-order, + so above ID bytes AAh,55h will be seen as 55h,AAh in newer versions! +Since the address is hardcoded, Castle Excellent will forcefully destroy any +other/newer files that are located at the same address. Most newer NES/SNES +games (like NES Fleet Commander from 1988, and SNES Wizardry 5 from 1993) do +include support for handling the Castle Excellent file. One exception that +doesn't support the file is NES Derby Stallion - Zenkoku Ban from 1992. + +Deleting Files +Delting files would require to relocate all following files - since the NES has +only 2K WRAM, this would require to do the relocation in smaller blocks - which +is simply not supported by most games. So far, the only way for deleting files +is to remove the batteries (wheras it may take some minutes until the data is +lost). +NES Derby Stallion - Zenkoku Ban (1992) does have some limited delete-support: +If there isn't free enough memory, then it does allow to erase the last-most +file(s); which can be done without relocations. +SNES Wizardry 5 (1993) does allow to delete individual files (the SNES has 128K +WRAM, so relocating the following files is pretty simple). + +NES Games that do support the Turbo File / Turbo File II + Best Play Pro Yakyuu (1988) ASCII (J) + Best Play Pro Yakyuu '90 (1990) (J) + Best Play Pro Yakyuu II (1990) (J) + Best Play Pro Yakyuu Special (1992) (J) + Castle Excellent (1986) ASCII (J) (early access method without filename) + Derby Stallion - Zenkoku Ban (1992) Sonobe Hiroyuki/ASCII (J) + Downtown - Nekketsu Monogatari (19xx) Technos Japan Corp (J) + Dungeon Kid (1990) Quest/Pixel (J) + Fleet Commander (1988) ASCII (J) + Haja no Fuuin (19xx) ASCII/KGD (J) + Itadaki Street - Watashi no Mise ni Yottette (1990) ASCII (J) + Ninjara Hoi! (J) + Wizardry - Legacy of Llylgamyn (19xx?) (J) + Wizardry - Proving Grounds of the Mad Overlord (1987) (J) + Wizardry - The Knight of Diamonds (1991) (J) +NES games that do support Turbo File should have a "TF" logo on the cartridge. + +Plus... (?) +Searching for: ad17404a4a290109068d1640 (late_nes_recv_joy2_byte opcodes) +Searching for: ad174029044a4a09068d1640 (newer_nes_recv_joy2_byte opcodes) + !! Best Keiba - Derby Stallion (1991) Sonobe Hiroyuki/ASCII (J) + !! Famicom Shougi - Ryuuousen (1991) I'MAX/HOME DATA (J) + !! Money Game 2 - Kabutochou no Kiseki, The (1989) Sofel Ltd (J) + ! Castlequest (U) US VERSION of Castle Excellent (FUNCTIONAL???) + ! Kunio 8-in-1 [p1] (pirate multicart, probably contains a TF-game?) + +SNES Games that support Turbo File Adapter & Turbo File Twin in TFII-Mode + Ardy Lightfoot (1993) + Derby Stallion II (1994) + Derby Stallion III (1995) (supports both TFII and STF modes) + Derby Stallion 96 (1996) (supports TFII and STF and Satellaview-FLASH-cards) + Derby Stallion 98 (NP) (1998) (supports both TFII and STF modes) + Down the World: Mervil's Ambition (1994) + Kakinoki Shogi (1995) ASCII Corporation + Tactics Ogre - Let Us Cling Together (supports both TFII and STF modes) + Wizardry 5 - Heart of the Maelstrom (1992) Game Studio/ASCII (JP) + BS Wizardry 5 (JP) (Satellaview BS-X version) +Note: The US version of Wizardry 5 (1993) contains 99% of the turbo file +functions, but lacks one opcode that makes the hardware detection +nonfunctional. Wizardry 5 was announced to be able to import game positions +from NES to SNES. + +Turbo File Schematic + .--------. 74HC368 .---||--GND .--------. D0-----PORT1.2 + GND---|1A /Y1|---NC | 680pF |4024 Q1|---NC + OUT2---|2A /Y2|-------------o-----/OUT2 | Q2|---NC + /OUT2---|3A /Y3|--------[100]--o------------|/CLK Q3|---NC + GND---|/OE1 | |1000pF | Q4|-------. + | - - - -| '--||-GND | Q5|---NC | + OUT1---|4A /Y4|-----------------------o----|RST Q6|---NC | + OUT0---|5A /Y5|----------. | | Q7|---NC | + GND---|6A /Y6|---NC | | '--------' | + /OUT2---|/OE2 | | | .-------------o-----' SRAM 8Kx8 + '--------' | | | | .-------.LH5164L-10 + OUT1-----[10K]---GND | | | .--------. '-|A0 NC|--NC + OUT2-----[10K]---GND | | | |4040 Q1|---|A1 D0|--D0 + .--------. 74HC573 | | | | Q2|---|A12 D1|--D1 + /OUT2---|G | | | '--|/CLK Q3|---|A7 D2|--D2 + /OUT2---|/OE | | | | Q4|---|A6 D3|--D3 + D7---|D0 Q0|---D6 | '----|RST Q5|---|A4 D4|--D4 + D6---|D1 Q1|---D5 | | Q6|---|A3 D5|--D5 + D5---|D2 Q2|---D4 | | Q7|---|A5 D6|--D6 + D4---|D3 Q3|---D3 | | Q8|---|A11 D7|--D7 + D3---|D4 Q4|---D2 o OFF | Q9|---|A10 /OE|--GND + D2---|D5 Q5|---D1 \ PROTECT | Q10|---|A9 /WE|--/OUT2 + D1---|D6 Q6|---D0 \ SWITCH | Q11|---|A8 /CE|--/GOOD + D0---|D7 Q7|-------o o-----------D7 | Q12|---|A2 CE2|--OUT1 + '--------' ON '--------' '-------' + Plus, a bunch of transistors, resistors, diodes that control supply and + battery, power LED, and power /GOOD signal. Battery standby supply is + wired to the SRAM, and also to the 74HC368. + Note: Turbo File II uses 32Kx8 SRAM which lacks CE2 pin, so schematic + may be a bit different; and of course, A13 and A14 are somehow wired + to the 4-position switch for 8K bank selection. + +Storage Battle Box +------------------ + +The Battle Box from IGS is an external storage device with 512 byte capactity. +--> Storage Battle Box I/O Access +--> Storage Battle Box Filesystem + +Battle Box Games + Armadillo (J) 199x + Battle Stadium - Senbatsu Pro Yakyuu (J) 1990 IGS + J-League Fighting Soccer - The King of Ace Strikers (J) 1993 IGS + Seiryaku Simulation - Inbou no Wakusei - Shancara (J) 1992 IGS + +Battle Box Schematic (BB-10) + .-------. + VCC--||--GND GND--|RES Q|---------------------------. + GND--|SET | 4027 TOSHIBA | TOSHIBA + PORT1.CLK--[330]--o------|CLK | Dual J-K TC89102P | TC89102P + | .---|J | flip-flop .---------. | .---------. + | | .-|K /Q|-------------|/CS | '---|/CS | + | | | '-------' VCC---|ORG |-------|ORG | + OUT0------------- | -o-o-----------------------|/CLK |-------|/CLK | + | .-------. | | | | + GND-|>|-PORT1.3 | GND--|RES Q|-------------|DI |-------|DI | + GND-|>|-PORT1.4 | GND--|SET | .---|DO |-------|DO | + GND-|>|-OUT0 '------|CLK | | '---------' '---------' + GND-|>|-PORT1.CLK VCC--|J | '----------------PORT1.3 + VCC--|K /Q|--------------------------PORT1.4 + Components: '-------' + 1x 4027 (dual J-K flip-flops) + 2x TOSHIBA TC89102P (two 256x8 bit EEPROMs) (=512 bytes total capacity) + 4x Z-diodes 6.2V, 1x resistor 330 ohm, 1x capacitor 100nF, 15pin connector + Note: ORG=VCC selects 128x16bit chip mode (ORG=GND would be 256x8bit mode) + +Storage Battle Box I/O Access +----------------------------- + +Battle Box + [4016h].W.Bit0 --> CLK to EEPROM (and, when set, enable chipselect toggle) + [4017h].R --> toggle DATA to EEPROM (always) + [4017h].R --> toggle 1st/2nd EEPROM chipselect (when [4016h].W.Bit0=1) + [4017h].R.Bit3 <-- DATA from EEPROM + [4017h].R.Bit4 <-- DATA to EEPROM (status of current toggled output value) + +Commands + Binary Toshiba NES + 10000000 01h 80h --> Read + 01100000 06h 60h --> Program + 00110000 0Ch 30h --> Chip Erase + 10110000 0Dh B0h --> Busy Monitor + 10010000 09h 90h --> Erase/Write Enable + 11010000 0Bh D0h --> Erase/Write Disable + +battle_box_command(cmd,addr,data) + if cmd<>B0h then battle_box_command(B0h,addr,0) ;- + [4016h]=01h ;OUT0=1 ;\start transfer, + dummy=[4017] ;toggle chipsel ; toggle chipsel + if (addr AND 1)<>battle_box_chipsel then dummy=[4017] ; depending on addr.0 + battle_box_chipsel = (addr AND 1) ;/ + battle_box_send_byte(((addr/2) AND FEh)+(addr AND 01h)) ;\send addr/cmd + battle_box_send_byte(cmd+addr/200h) ;/ + if cmd=B0h ;Busy Mode ;\wait busy (if any) + wait until battle_box_recv_bit=0 ;/ + if cmd=80h ;Read Word ;\ + data1st=battle_box_recv_byte ; read data (if any) + data2nd=battle_box_recv_byte ;/ + if cmd=60h ;Write Word ;\ + battle_box_send_byte(data1st) ; write data (if any) + battle_box_send_byte(data2nd) ;/ + dummy=[4017h] ;toggle chipsel ;\finish transfer + [4016h]=00h ;OUT0=0 ;/ + +battle_box_detect_which_chip_is_selected: + battle_box_command(80h,000h,data) ;read ID ("B"=42h, or "X"=58h) from addr 0 + battle_box_chipsel=battle_box_chipsel XOR data.bit3 + +battle_box_send_byte(data) + data=data XOR FFh ;-invert + for i=7 downto 0 + [4016h]=00h ;OUT0=0 + dummy=[4017h] ;toggle DTA.OUT and get output level + if dummy.bit4<>data.bit(i) then dummy=[4017h] ;toggle DTA.OUT + [4016h]=01h ;OUT0=1 + next i + +battle_box_recv_byte: + for i=7 downto 0 + data.bit(i)=battle_box_recv_bit + next i + data=data XOR FFh ;-invert + +battle_box_recv_bit: + [4016h]=00h ;OUT0=0 + dummy=[4017h] ;read DATA + bit=dummy.bit3 + [4016h]=01h ;OUT0=1 + +Notes +The Program command seems to be able to rewrite data without needing any prior +Erase. +After power-on, wait 1ms before accessing the chip. Then send Erase/Write +Enable or Disable as first command. + +Storage Battle Box Filesystem +----------------------------- + +Battle Box Filesystem +Overall Format + 000h..005h Root Header (6 bytes) + 006h..xxxh File(s) (variable size) (max 1F9h bytes) + yyyh First Free byte (1Ah) (1 byte) + zzzh..1FFh Unused Space (FFh filled or garbage or so) +Root Header (6 bytes) + 00h ID "B" for Chip 1 (42h) + 01h ID "X" for Chip 2 (58h) + 02h 00h ;\maybe total chip size 0200h ? + 03h 02h ;/ + 04h LSB ;\address of first FREE byte (ie. address of the 1Ah byte) + 05h MSB ;/ +File Format (0Dh+N+02h bytes per file) + 00h 42h "B" ;-File ID (42h="B"=Used File) (or 1Ah=First Free Byte) + 01h SIZE.LSB ;\Total Filesize (including File ID and Checksum) + 02h SIZE.MSB ;/ + 03h GAME.LSB ;\Game ID (0000h=Stadium, 0001h=Armadillo, 0002h=Soccer) + 04h GAME.MSB ;/ + 05h GAME.TITLE ;-Game Title (ASCII, 8 chars) (eg. "F SOCCER" or "RMADILLO") + 0Dh.. file body ;-Body (total_filesize minus 0Fh bytes) + ... CHK.LSB ;\Checksum (all bytes in BODY added together) + ... CHK.MSB ;/ +The existing games seem to allow only two files (if there are already two +files, they do erase a file before saving a new file; this is done even if +there would be enough free space for a third file). + +Battle Box Logical Byte Order + Offset Physical Content (Usage) + 000h 1st byte of 1st Word of Chip 1 (ID Byte: "B" for Chip 1) + 001h 1st byte of 1st Word of Chip 2 (ID Byte: "X" for Chip 2) + 002h 2nd byte of 1st Word of Chip 1 (00h) + 003h 2nd byte of 1st Word of Chip 2 (02h) + 004h 1st byte of 2nd Word of Chip 1 (address LSB of first free byte) + 005h 1st byte of 2nd Word of Chip 2 (address MSB of first free byte) + 006h 2nd byte of 2nd Word of Chip 1 (File ID: "B") (or 1Ah if no file) + 007h 2nd byte of 2nd Word of Chip 2 (File Size LSB) (or unused) + ... (...) + 1FCh 1st byte of 128th Word of Chip 1 + 1FDh 1st byte of 128th Word of Chip 2 + 1FEh 2nd byte of 128th Word of Chip 1 + 1FFh 2nd byte of 128th Word of Chip 2 +Emulators should use the same logical byte order (so that data and ASCII +filenames show up correctly in .sav files). However, games may more or less +randomly initialize the "B" and "X" ID bytes, so Chip 1 and Chip 2 may be +exchanged. + +Bit Order +The NES software is doing all transfers in reversed bit-order: Namely, commands +are opposite as in datasheet (eg. NES: 80h=Read, Toshiba: 01h=Read). Data is +also reversed (read-reversion and write-reversion are compensating themselves). +The 7bit addresses are also reversed (data is written to shuffled-addresses, +but de-shuffled on reading). The 7bit address should be normally followed by a +padding bit (with value "0"), the NES software seems to replace that padding +bit by the 1st/2nd chipselect bit (maybe somehow intended to allow to use one +chip with 8bit-address intead of two chips with 7bit address). Moreover, the +NES software puts additional address bits into unused locations of the command +byte (maybe also somehow intended for expansion to chips with more memory). + +Hori Game Repeater +------------------ + +The Game Repeater (GR-7) from Hori is a device that can record and playback +controller data. The data is stored in 16Kbytes of SRAM (assuming that many +games read 1 byte per frame, this allows to record about 5 minutes). The SRAM +isn't battery backed, but, for permanent storage, the SRAM content can be +loaded/saved to external tape recorder. +The device can be used to create "movies" that play back a whole level, and it +may be also useful for recording short button-sequences for getting through +difficult sections of a game. The playback function may obviously fail if a +game contains random elements (such like starting with different random seeds). +The recorded data is taken from the controller input, so it should be +impossible to data from the console (for using the SRAM as expansion +memory or writing game positions to tape) (unless the device should happen to +have support for doing that via another controller pin?). + +Chipset/Components + 1x Toshiba N (42pin 4bit single-chip CPU: ROM:2048x8, RAM:128x4) + 2x Toshiba TC5563APL-15 (28pin static ram: RAM:8192x8) + 1x TC4011BP 14pin (quad NAND) + 1x TC4062UBP ? (or is it "8"UBP?) 14pin + 1x TC4078BP 16pin (is that "8"BP?) + 1x TC4021BP 16pin (8bit parallel-in, serial-out shift register) + 1x NEC D4094BC ? 16pin (8bit serial-in, parallel-out shift register) + 3x small buttons (tape recorder LOAD,SAVE,VERIFY) + 1x bigger button (sampling START) + 2x two-position switches (REPEAT/RECORD, and STOP/STANDBY) + 2x small LEDs (tape recorder LOAD,SAVE) + 2x cassette connector (tape recorder LOAD,SAVE) + 1x male dsub 15pin connector (to famicom console) + 1x female dsub 15pin connector (to external joystick) + 1x DC input socket (from power supply) + 1x DC output cable (to famicom console) + 1x 7805 ? voltage converter + 1x unknown thing/unknown purpose (on front side) (connector? dip-switches?) +Plus one XTAL, plus resistors/diodes/capacitors. There's no battery on the SRAM +chips. + +Headphones +---------- + +Headphones can be connected to the 15pin Famicom Expansion Port. + S.D. Station (Hori) (adaptor for Headphones and Tape Recorder) + Joycard Sanusui SSS (Hudson) (with adapter for headphones) + Multi Adapter AX-1 (headphones plus auto-fire or so) + LaserScope/Gun Sight (Konami) (headset: headphones + voice-activated zapper) + +R.O.B. (Robotic Operating Buddy) +-------------------------------- + +R.O.B. (Robotic Operating Buddy) is a small wireless plastic robot, about 24 cm +in height. Command transmission from console to robot is done via flashing TV +frames. There is no direct feedback from the robot to the console (except that, +in Gyromite, the robot can be maneuvered to push buttons on joypad 2). + +R.O.B. Games +The Robot is used by two games: + Gyromite (Robot Gyro) (1985) (JP) (US) (EU) + Stack Up (Robot Block) (1985) (JP) (US) +Gyromite is a platform game in which the robot must be used to unlock red/blue +barriers (by dropping heavy spintops on the red/blue trays). In Stack-Up, one +must stack colored plastic blocks in a specific order. + +Hardware Accessories +General Accessories: + Sun-glasses (dark transparent cover, for compensating brightness of the TV) + 4 AA batteries (for powering the robot) +Gyromite Accessories: + 2 robot-gloves with zig-zagged surface (for holding the spinning gyros) + 2 gyros (heavy spintops that can be used to depress red/blue trays) + 2 red/blue trays (with levers to push buttons on joypad 2) + 2 black trays (for depositing gyros when not using them) + 1 spinner (accellerates the gyros; for stabilizing them on red/blue trays) + 1 battery (for powering the spinner motor) +Stack-Up Accessories: + 2 robot-gloves with flat rubber-coated surface (for holding blocks) + 5 differently colored stack-able blocks (to be arranged in specific orders) + 5 gray trays (for depositing the blocks on them) + +Drawings +--> R.O.B. Technical Drawings + +Robot Motors + Left/Right Motor five stopping points (60'/step, 240' total range) + Up/Down Motor six stopping points (1.4 cm/step, 7 cm total range) + Open/Close Motor two stopping points (7 cm/step, 7 cm total range) + +CRT-Signals + Command <------- Command Transfer Phase (13 Frames) --------> + Left xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.GGG.GGG.___.GGG.___.xxx.xxx + Right xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.___.GGG.___.GGG.___.xxx.xxx + Up xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.GGG.GGG.___.GGG.___.xxx.xxx + Down xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.___.GGG.GGG.GGG.___.xxx.xxx + Open xxx.xxx.___.___.___.GGG.___.GGG.GGG.GGG.___.GGG.GGG.GGG.___.xxx.xxx + Close xxx.xxx.___.___.___.GGG.___.GGG.___.GGG.GGG.GGG.GGG.GGG.___.xxx.xxx + Test ___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___.GGG.___ + Picture xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx.xxx +Whereas, "xxx"=Picture Frame, "___"=Black Frame, "GGG"=Green Frame "."=Vblank. + +Joypad 1 (user input) +In Gyromite, the joypad buttons are assigned as follows (in one game mode, the +joypad is also used to move the player character on the screen, in that mode, +Start-button must be pressed prior to each robot-command): + Left/Right --> Turn Shoulders & Arms & Shaft Left/Right (in 60' steps) + Up/Down --> Move Shoulders & Arms Up/Down (in 1.4cm steps) + Button A --> Open Arms (Release) + Button B --> Close Arms (Grab) +Stack-Up uses some sort of GUI to enter commands, so there's no direct relation +between joypad-buttons and motors in that game. + +Joypad 2 (attached to Gyromite Trays, for feedback from robot to console) +In Gyromite, dropping spintops on trays results in following feedback: + Red-Tray (Slot 2) ---> lever pushes B-Button on Joypad 2 + Blue-Tray (Slot 3) ---> lever pushes A-Button on Joypad 2 +There's no automatic feedback in Stack-Up (the user must manually push +Start-Button on Joypad 1 once when having finished a level). + +R.O.B. Technical Drawings +------------------------- + +Robot (Side View) + + Sun- Eyes (with CRT light sensor) + glasses | + | | LED (glows when sensing CRT signals) + _ __o____ + | --> |-| |_ <------ Head (to be aimed at TV Set) + |_ |-|_________| + _#_ <-------- Inner Shaft (holds head, not rotating) + | | + Hand | | <-------- Outer Shaft (rotates alongside with shoulders) + _ Arm __|___|____ + | |======| | <---- Shoulders (moves up/down along outer shaft) + |_|======|___________|----. + | | \ + Slot2 | | Slot1 \ <-- Spiral Cable (from base to shoulders) + Slot3 | | | | Pwr \ + \ ____|__|___|__|__|_ \ + |: # : # :|-' + |:________:________:| <---- Base + + +Robot Shoulders/Arms (Top View) + __ _______________ __ __ _______________ __ + / | Shaft | \ Shoulder / | Shaft | \ + | | ___ | | (top-view) | | ___ | | + |_ / | | \ _| |_ / | | \ _| + / || |___| || \ | || |___| || | + / | \_______________/ | \ | \\_______________// | + / / \ \ | |_ _| | + \ \ Open/Spread / / Arms |___ \ Close / ___| + \ \ (Release) / / \ \ (Grab) / / + | | | | \ \ / / + _|___|_ _|___|_ _\___\_ _/___/_ + | | O | | | | O | | Hands | | O | | | | O | | + |_|___|_| |_|___|_| |_|___|_| |_|___|_| + +Robot Base (Top View) + + Power Switch ----------. /////// <----- Spiral Cable + (for four AA batteries) _____|_____ (to shoulders) + _| |_| |_ + / | | \ + / | | \ + Accessory Slot 5 --> /5 | | 1\ <-- Accessory Slot 1 + (for stack-up tray, / / ___ \ \ (for stack-up tray, + or gyromite / | | | | \ or gyromite spinner) + black tray) \ | |___| | / + \ \ Shaft / / + Accessory Slot 4 --> \4 | | 2/ <-- Accessory Slot 2 + (for stack-up tray, \ | | / (for stack-up tray, + or gyromite \_| __3__ |_/ or gyromite red-tray + black tray) |__| ^ |__| with lever to B-Button) + | + Accessory Slot 3 (for stack-up tray, + or gyromite blue-tray with lever to A-Button) + +Stack-Up Accessories (five Blocks, five Trays, two Gloves) + __ __ + | \_/ | <------ white block |Arm| Block |Arm| + |__ __| | | _ __ _ | | + | \_/ | <------ red block _|___|_| # / \ # |_|___|_ + |__ __| | | O | | # | | # | | O | | + .===\_/===. <------ tray (gray ring) |_|___|/ # | | # \|___|_| + \\ Hand |__# \__/ #__| Hand + \\ <------ to slot on base unit Glove Glove + +Gyromite Accessories (two gyros, two gloves, one spinner, four trays) + ____ + Grab here ------------> (____) |Arm| Gyro |Arm| + (with robot claws) | | | | _ _ Axis _ | | + | | <-- Axis _|___|_| | / /| |_|___|_ + | | | | O | | |/ /\ \| | | O | | + Gyro | | (Spintop) |_|___|/ |\ \/ /| \|___|_| + ________|__|________ Hand |__|_\ \|__| Hand + Disk ---------> (____________________) Glove Glove + (side view) | | + | | + \/ + ___ ___ ___ ___ __ + | | | | (__ | | __) Lever | | + | | | | || || _ _ Lever Axis | | + |____\/____| | \/ | \\______//___________________ | | + _|______ | |____| \______/__________________ O\_ | | + | Motor \_____|_ | | | | / \___|(| | + | with Battery | | | | |_________________/_/______| |_ + |________________| |__| |__|________________________|_|__|_| + Spinner Black Trays Blue/Red Trays Joypad + +Cartridges and Mappers +---------------------- + +General Cartridge Info +--> Cartridge Overview +--> Cartridge ROM-Image File Formats +--> Cartridge IRQ Counters +--> Cartridge Bus Conflicts +--> Cartridge Cicurity Chip (CIC) (Lockout Chip) +--> Cartridge Cheat Devices +--> Cartridge Pin-Outs +--> Cartridge Shell Dimensions + +NES Mappers (Numbers as used in .NES fileformat) +--> Mapper 0: NROM - No Mapper (or unknown mapper) +--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT +--> Mapper 2: UNROM - PRG/16K +--> Mapper 3: CNROM - VROM/8K +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc. +--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +--> Mapper 7: AOROM - PRG/32K, Name Table Select +--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ +--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH +--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH +--> Mapper 11: Color Dreams - PRG/32K, VROM/8K +--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ +--> Mapper 13: CPROM - 16K VRAM +Mapper 14: Reportedly SL1632 +--> Mapper 15: X-in-1 - PRG/32K/16K, NT +--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM +(above with 24C02) +--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT +--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND +--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND +--> Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT +--> Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ) +--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 28: Action 53 homebrew X-in-1 +--> Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT +--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ +--> Mapper 34: Nina-1 - PRG/32K, VROM/4K +(above and/or BNROM ?) +Mapper 37: Reportedly ZZ +Mapper 39: Reportedly BMC Study & Game 32-in-1 +--> Mapper 40: FDS-Port - Lost Levels +--> Mapper 41: Caltron 6-in-1 +--> Mapper 42: FDS-Port - Mario Baby +--> Mapper 43: X-in-1 +--> Mapper 44: 7-in-1 MMC3 Port A001h +--> Mapper 45: X-in-1 MMC3 Port 6000hx4 +--> Mapper 46: 15-in-1 Color Dreams +(above called "Rumble Station"?) +--> Mapper 47: 2-in-1 MMC3 Port 6000h +--> Mapper 48: Taito TC190V +--> Mapper 49: 4-in-1 MMC3 Port 6xxxh +--> Mapper 50: FDS-Port - Alt. Levels +--> Mapper 51: 11-in-1 +--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM +Mapper 53: Reportedly Supervision 16-in-1 +Mapper 54: Reportedly BMC Noveldiamond 9999999-in-1 +Mapper 55: Reportedly BTL Mario1-Malee2 +--> Mapper 56: Pirate SMB3 +--> Mapper 57: 6-in-1 +--> Mapper 58: X-in-1 +Mapper 59: Reportedly .. +Mapper 60: Reportedly .. +--> Mapper 61: 20-in-1 +--> Mapper 62: X-in-1 +--> Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ +--> Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 66: GNROM - PRG/32K, VROM/8K +--> Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ +--> Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM +(Nantettatte Baseball Double Cassette System for mapper 68)? +--> Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ +--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT +--> Mapper 71: Camerica - PRG/16K +--> Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K +--> Mapper 73: Konami VRC3 - PRG/16K, IRQ +--> Mapper 74: Whatever MMC3-style +--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT +--> Mapper 76: Namco 109 - PRG/8K, VROM/2K +--> Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K +--> Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K +--> Mapper 79: AVE Nina-3 - VROM/8K +--> Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT +--> Mapper 81: AVE Nina-6 +--> Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K +--> Mapper 83: Cony +--> Mapper 84: Whatever +--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K +--> Mapper 87: Jaleco/Konami 16K VROM - VROM/8K +--> Mapper 88: Namco 118 +--> Mapper 89: Sunsoft Early - PRG/16K, VROM/8K +--> Mapper 90: Pirate MMC5-style +--> Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ +--> Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K +--> Mapper 93: 74161/32 - PRG/16K +--> Mapper 94: 74161/32 - PRG/16K +--> Mapper 95: Namcot MMC3-Style +--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH +--> Mapper 97: Irem - PRG HI +--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K) +--> Mapper 100: Whatever +Mapper 101: Reportedly ... +--> Mapper 105: X-in-1 MMC1 +Mapper 107: Reportedly Magicseries +--> Mapper 112: Asder - PRG/8K, VROM/2K/1K +--> Mapper 113: Sachen/Hacker/Nina +--> Mapper 114: Super Games +--> Mapper 115: MMC3 Cart Saint +--> Mapper 116: Whatever +--> Mapper 117: Future +--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ +--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ +--> Mapper 122: Whatever +Mapper 123: Reportedly H2288 +Mapper 132: Reportedly TXC 22211 +--> Mapper 133: Sachen +Mapper 137: Reportedly S8259D +Mapper 138: Reportedly S8259C +Mapper 139: Reportedly S8259B +Mapper 140: Reportedly Jaleco JF-xx +Mapper 141: Reportedly S8259A +Mapper 142: Reportedly KS 202 +Mapper 143: Reportedly TCA01 +Mapper 144: Reportedly AGCI 50282 +Mapper 145: Reportedly SA72007 +Mapper 146: Reportedly SA0161M +Mapper 147: Reportedly TCU01 +Mapper 148: Reportedly SA0037 +Mapper 149: Reportedly SA0036 +Mapper 150: Reportedly S74LS37AN +--> Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards +--> Mapper 152: Whatever +(above Bandai 74161/32+MIRR) +Mapper 153: No info (reportedly a variant of Mapper 16) BANDAI+WRAM +Mapper 154: Reportedly NAMCOT 118 +A0.D6.MIRR +Mapper 155: Reportedly MMC1A +Mapper 156: Reportedly DAOU 306 +Mapper 157: No info (reportedly a variant of Mapper 16) BANDAI+BARCODE (Datach) +Mapper 159: No info (reportedly a variant of Mapper 16) BANDAI+24C01 +--> Mapper 160: Same as Mapper 90 +--> Mapper 161: Same as Mapper 1 +Mapper 163: Reportedly NANJING +Mapper 164: Reportedly WAIXING / MARS PRODUCTION +Mapper 165: Reportedly WAIXING SHENGHUO HUIZHANG 2 +Mapper 166: Reportedly SUBOR (Russian) +Mapper 167: Reportedly SUBOR (Chinese) +--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ +Mapper 169: Reportedly N625092 +Mapper 170: Reportedly FUJIYA NROM +SECURITY +Mapper 171: Reportedly KAISER KS7058 +Mapper 172: Reportedly IDEA-TEK CNROM +SECURITY +--> Mapper 180: Nihon Bussan - PRG HI +(above UNROM M5) +--> Mapper 182: Same as Mapper 114 +(Mapper 182: Reportedly HOSENKAN ELECTRONICS) +Mapper 183: Reportedly BTL SHUI GUAN PIPE +--> Mapper 184: Sunsoft - VROM/4K +--> Mapper 185: VROM-disable +Mapper 186: Reportedly SBX +Mapper 187: No Info --> Mapper 187: Reportedly BTL SFZ297/KOF96/S3DB6 +--> Mapper 188: UNROM-reversed +(Mapper 188: Reportedly BANDAI KARAOKE STUDIO) +--> Mapper 189: MMC3 Variant +(Mapper 189: Reportedly YOKOSOFT / TXC) +Mapper 191: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.2K +Mapper 192: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.4K +Mapper 193: Reportedly MEGA SOFT (NTDEC) +Mapper 194: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.2K (alt) +Mapper 195: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.4K (alt) +Mapper 196: Reportedly MMC3 +A0/A2 +Mapper 197: Reportedly SUPER FIGHTER III +Mapper 198: Reportedly WAIXING MMC3 +XRAM.4K +Mapper 199: Reportedly WAIXING MMC3 +XRAM.4K +CRAM.8K +Mapper 200: Reportedly BMC 1200/36-IN-1 +Mapper 201: Reportedly BMC 21/8-IN-1 +Mapper 202: Reportedly BMC 150-IN-1 +Mapper 203: Reportedly BMC 35-IN-1 +Mapper 204: Reportedly BMC 64-IN-1 +Mapper 205: Reportedly BMC 15/3-IN-1 +Mapper 206: Reportedly DE1ROM (aka DxROM, aka pre-MMC3) +Mapper 207: Reportedly TAITO X-005 +MIRR +Mapper 208: Reportedly GOUDER BTL SF4 +Mapper 209: Reportedly J.Y.COMPANY +EXT.MIRR.CTRL +Mapper 210: Reportedly NAMCOT +Mapper 211: Reportedly J.Y.COMPANY +EXT.MIRR.ON +Mapper 212: Reportedly BMC SUPER HIK 300-IN-1 +Mapper 213: Reportedly BMC 9999999-IN-1 +Mapper 214: Reportedly BMC SUPER GUN 20-IN-1 +Mapper 215: Reportedly BMC SUPER 308 3-IN-1 / M-E3 +Mapper 216: Reportedly RCM MAGIC JEWELRY 2 +Mapper 217: Reportedly BMC SPC009 +--> Mapper 218: Nocash Single-Chip +--> Mapper 222: Dragon Ninja +--> Mapper 225: X-in-1 +--> Mapper 226: X-in-1 +--> Mapper 227: X-in-1 +--> Mapper 228: X-in-1 Homebrewn +--> Mapper 229: 31-in-1 +--> Mapper 230: X-in-1 plus Contra +--> Mapper 231: 20-in-1 +--> Mapper 232: 4-in-1 Quattro Camerica +--> Mapper 233: X-in-1 plus Reset +--> Mapper 234: Maxi-15 +(Mapper 234: Reportedly AVE D-1012) +Mapper 235: Reportedly BMC GOLDEN GAME 150/260-IN-1 +Mapper 236: Reportedly BMC 800/70-IN-1 +--> Mapper 240: C&E/Supertone - PRG/32K, VROM/8K +--> Mapper 241: X-in-1 Education +(Mapper 241: Reportedly MXMDHTWO / TXC) +--> Mapper 242: Waixing - PRG/32K, NT +--> Mapper 243: Sachen Poker - PRG/32K, VROM/8K +(Mapper 243: Reportedly SACHEN 74LS374N) +--> Mapper 244: C&E - PRG/32K, VROM/8K +(Mapper 244: Reportedly C&E DECATHLON) +Mapper 245: No Info (seems to be some sort of MMC3 variant) +(Mapper 245: Reportedly WAIXING MMC3 +EX.PRG) +--> Mapper 246: C&E - PRG/8K, VROM/2K, SRAM +(Mapper 246: Reportedly C&E PHONE SERM BERM) +Mapper 248: No Info +Mapper 249: No Info --> Mapper 249: Reportedly WAIXING MMC3 +EX.PRG/CHR +Mapper 250: No Info --> Mapper 250: Reportedly NITRA MMC3 +Mapper 251: No Info +Mapper 252: No Info --> Mapper 252: Reportedly WAIXING SAN GUO ZHI +Mapper 254: No Info --> Mapper 254: Reportedly BTL PIKACHU Y2K +--> Mapper 255: X-in-1 - (Same as Mapper 225) +XXX NROM-368 variant of NROM (and similar CPROM, CNROM variants) +Note: Mapper numbers in range 0..255 seem to be ALL used by now. +Mapper numbers 256..4095 can be defined in the "NES 2.0" file format. + +More Info +A still very incomplete (but growing) mapper list can be found here: + http://wiki.nesdev.com/w/index.php/Category:INES_Mappers + (when inventing new mapper numbers, best include them in above list) +There is some very detailed info on Kevin Horton's kevtris pages, which are, +unfortunately very messy. I think, most of the info is lost in chaos. +A lot of mappers are hiding here: + http://kevtris.org/mappers/mappers.html ;<-- secret undocumented link!? +For some reason, this page also hides some mappers: + http://kevtris.org/nes/mappers.html ;<-- official link on NES page!? +Plus some completely unlinked pages for konami mappers, eg. for VRC 7: + http://kevtris.org/nes/vrcvii.txt ;<-- or vrcvi for VRC 6 +And, there might be a couple of further mapper pages hiding elsewhere. + +Cartridge Overview +------------------ + +Standard Mappers +There are more than hundred different mappers, though most are unimportant, the +standard types are Mapper 0,1,2,3,4 for ROM-cartridges. And Mapper 20 for +Floppy disks. + Type Games Percent + Mapper 0 (NROM) 446 12.5% + Mapper 1 (MMC1) 723 20.3% + Mapper 2 (UNROM) 397 11.2% + Mapper 3 (CNROM) 273 7.7% + Mapper 4 (MMC3) 784 22.1% + Mapper 20 (FDS) ? x.x% + Other Mappers 932 26.2% + Total 3555 100.0% +Other mapper types are used by less than 2% per type, though together they make +up 26.2%. + +Non-standard Mappers +Some mappers like MMC5 have been used only in a few newer cartridges. Several +third-party companies (Konami, Irem, Jaleco, Bandai, Sunsoft, etc.) have +developed their own mappers which are used only for their own games. That +mappers may be important to play specific games, though they are often used +only by 1-2 titles. +Also, there have been various pirate / multi-game cartridges manufactured, +containing modified ROM-images with custom mapper circuits, these mappers are +completely unimportant since the original games used standard mappers. + +Maximum manufactured ROM Size +The largest single NES game that I know of is Dragonquest 4 / Dragon Warrior 4 +(XXX that's wrong). It has 1 megabyte of program ROM. Also, the Japanese game +Metal Slader Glory has 512K of PRG and 512K of CHR ROM, making it also a full +megabyte. Several pirate/unlicenced Famicom games are also pretty large. + +Minimum manufactured ROM Size +Although the .NES fileformat deems 16K PRG ROM games as the minimum, there have +been some 8K games manufactured, such as Galaxian. Later on, skilled +programmers have learned to squeeze better code into even less memory, but +nowadays most are probably dead. + +Banking Granularity +PRG ROM is usually split into banks of 8K, 16K, or 32K, a few mappers like MMC5 +also have smaller 1K SRAM banks. VROM is usually split into banks of 1K, 2K, +4K, or 8K. + +Note on Mapper Descriptions +In this document Bank Selections are sometimes described as 4K, or as 4x1K. + The linear address for a 4K bank is (N*4096). + The linear address for a 4x1K bank is ((N AND (NOT 3))*1024). +Ie. in the latter case, the bank value is specified in 1K-steps, with lower +bits ignored, and rounded down to a 4K boundary. + +Mapper Reset +In general, mapper registers are uninitialized on reset/power-up, and should be +initialized by software; if memory at FFFCh is mappable, then valid reset +vectors (and reset handlers) should be contained in all banks. +There is no reset signal available on cartridge bus, possible ways to detect +reset are to sense inactivity on A0 or PHI2 lines, to sense reads from the +reset vector at FFFCh, or to use power-up capacitors for coldboot detection +(though that not for warmboot). +Caution: Several mappers in this document are described to have initial +settings on reset or power-up. Most of that info has been taken from other +documents, in most cases that is unconfirmed, and probably incorrect. A few +mappers seem to be actually containing reset circuits though. + +Cartridge ROM-Image File Formats +-------------------------------- + +iNES Format (.NES) +This fileformat and mapper-numbers have been designed/assigned by Marat +Fayzullin (author of iNES emulator), please contact him if you want to make any +changes to the format or numbers. The file header is 16 bytes: + 00h File ID ("NES",1Ah) (aka 4Eh,45h,53h,1Ah) + 04h Number of 16K PRG-ROM pages + 05h Number of 8K CHR-ROM pages (00h=None / VRAM) + 06h Cartridge Type LSB + Bit7-4 Mapper Number (lower 4bits) + Bit3 1=Four-screen VRAM layout + Bit2 1=512-byte trainer/patch at 7000h-71FFh + Bit1 1=Battery-backed SRAM at 6000h-7FFFh, set only if battery-backed + Bit0 0=Horizontal mirroring, 1=Vertical mirroring + 07h Cartridge Type MSB (ignore this and further bytes if Byte 0Fh nonzero) + Bit7-4 Mapper Number (upper 4bits) + Bit3-2 Reserved (zero) + Bit1 1=PC10 game (arcade machine with additional 8K Z80-ROM) (*) + Bit0 1=VS Unisystem game (arcade machine with different palette) + 08h Number of 8K RAM (SRAM?) pages (usually 00h=None-or-not-specified) + 09h Reserved (zero) + 0Ah Reserved (zero) (sometimes 03h,10h,13h,30h,33h purpose unknown) (*) + 0Bh Reserved (zero) + 0Ch Reserved (zero) + 0Dh Reserved (zero) + 0Eh Reserved (zero) + 0Fh Nonzero if [07h..0Fh]=GARBAGE, if so, assume [07h..0Fh]=ALL ZERO (*) +The overall file structure is, in following order: + 16 byte Header + 512 byte Trainer ;-if any, see Byte 6, Bit2, mainly FFE games + N*16K PRG-ROM ;-see Byte 4 + N*8K CHR-ROM ;-if any, see Byte 5 + 8K (*) PC10 INST-ROM ;-if any, see Byte 7, Bit1 + 16 byte (*) PC10 PROM Data ;-if any, see Byte 7, Bit1 ;\required, but + 16 byte (*) PC10 PROM CounterOut;-if any, see Byte 7, Bit1 ;/often missing + 128 byte (*) Title ;-if any (rarely used) +Items marked as (*) are regulary used, but not offical part of the format. +Many PC10 files declare Z80-ROM as additional VROM bank (instead Byte7/Bit1). + +"NES v2.0" +This is an extension to the above iNES format, specs are at: + http://wiki.nesdev.com/w/index.php/NES_2.0 +according to that webpage, it's supported by only 1 emulator. + +.UNF - Universal NES Image File Format (UNIF) by Tennessee Carmel-Veilleux +A "newer" fileformat dated back to 2000, the relation between iNES mapper +numbers and UNIF MAPR names is still undocumented, and of course nobody uses +files with .UNF extension. Still, it's having one or two useful features, and +may become more popular if somebody dares to fix the MAPR problem, and to +rename it from .UNF to .NES extension. +File Header (32 bytes) + 00h-03h: "UNIF" tag identifier + 04h-07h: Revision number ("currently 4, for REV 7b, Revision 6 of UNIF" Huh!) + 08h-1Fh: Reserved for future usage +The header is followed by whatever chunks, all chunks are optional, and may or +may not be included in the file, only the PRG0 one is obviously required. +Software may skip any chunks which are uninteresting or unrecognized, each +chunk formatted as such: + 00h-03h: Chunk ID string (4-letter ASCII, described below) + 04h-07h: Length of Data Block in bytes (excluding above ID and length entry) + 08h... : Data +MAPR - Board Name (aka Mapper) (ASCIZ, suggested max: 32 chars) + This uses ASCIZ strings to describe the board names (instead of iNES + mapper numbers), it's meant to be more specific than mapper numbers, + for example, it's using different names for different MMC1-boards. + http://www.parodius.com/~veilleux/boardtable.txt + http://www.parodius.com/~veilleux/boardnames +PRG0..PRGF - Binary data of the PRG ROM +CHR0..CHRF - Binary data of the CHR ROM (aka VROM in general) + Normally using only PRG0 (and CHR0, if VROM used). + In rare cases, if the cart contains more than 1 PRG (or CHR) ROM chip, + then PRG1-F and CHR1-F may be used for the additional chips. +TVCI - Television Standards Compatability Information (One Byte) + 00h 60Hz/NTSC (USA, Japan, etc.) + 01h 50Hz/PAL (Germany, etc.) + 02h Compatible with both 50Hz and 60Hz refresh rates +CTRL - Controllers used by the cartridge (currently only 1 Byte / 8bit) + Bit0 Regular Joypad + Bit1 Zapper + Bit2 R.O.B. + Bit3 Arkanoid Controller (Paddle) + Bit4 Power Pad + Bit5 Four-Score adapter (NES 4-player adapter) (Not Famicom adapter!) + Bit6-7 Reserved +MIRR - Name Table Mirroring (1 Byte) + 00h Two-Screen Horizontal Mirroring (Hard Wired) + 01h Two-Screen Vertical Mirroring (Hard Wired) + 02h Single-Screen BLK0 (Hard Wired) + 03h Single-Screen BLK1 (Hard Wired) + 04h Four-Screens of VRAM (Hard Wired) + 05h Mirroring Controlled By Mapper Hardware +BATR - Battery installed on Board (1 dummy byte) + Presence of this chunk means yes, absence means no. +NAME - Game Title, ASCIZ String + Game Title +READ - Readme/Comments/Notes/Credits + Probably some sort of ASCII text of unspecified formatting +VROR - Allow homebrewn games to over-write VROM (1 dummy byte) + Presence of this chunk means yes, absence means no. +PCK0..PCKF - 32-bit CRCs for PRG0..PRGF blocks (4 bytes, each) +CCK0..CCKF - 32-bit CRCs for CHR0..CHRF blocks (4 bytes, each) + Intended "to make sth sure on EPROMs" ;-) Checksum algorythm not specified. +DINF - Dumper information block (204 Bytes) + 100 bytes ASCIZ name of the person who dumped the cart + 4 bytes day, month, year-lsb, year-msb when cartridge was dumped + 100 bytes ASCIZ agent "name of the ROM-dumping means used" +Note: All words and dwords in header/chunks stored LSB first. + +Cartridge IRQ Counters +---------------------- + +The MMC3's scanline counter +The MMC3 bases it's scanline counter on PPU address line A13 (which is why +IRQ's can be fired off manually by toggling A13 a bunch of times via $2006). +A13 cycles (0 -> 1) exactly 42 times per scanline, whereas the CPU count of +cycles per scanline is not an exact integer (113.67). + +Konami IRQ counters +Running at 113.75 cycles, including during VBlank. + +Famicom Disk System IRQ counters +Allows to count clock cycles, rather than scanlines. + +Cartridge Bus Conflicts +----------------------- + +/PRG Pin - Indicates CPU Memory Access to 8000h-FFFFh (LOW=Read or Write) +R/W Pin - Indicates CPU Direction (LOW=Write, HIGH=Read) + +The /PRG Pin indicates read-or-write access to the PRG ROM memory area at +8000h-FFFFh, the read/write direction could be determined by R/W Pin. Most +cartridges are ignoring the R/W signal, and are assuming all memory accesses to +be read-requests (which makes sense since ROM is read-only). +However, many cartridges have write-only mapper ports at 8000h-FFFFh, activated +when /PRG=LOW and R/W=LOW. Many of these carts (especially simple TTL circuits +like UNROM, CNROM, etc.) still activate ROM on any /PRG signal without checking +R/W, so that ROM outputs data simultaneously with the CPU writing data to the +mapper port. +Common workaround is to write to a ROM address that contains a value equal to +the written value. Also one could probably write to an address that contains +FFh (low signals are stronger than high signals, so the values would be +logically, or 'forcefully' ANDed. Don't know about any games using that method +though). Another workaround is to interprete the lower address bits instead of +the data bits (eg. Mapper 225), that's of course still producing a bus-conflict +(shortcut), but without disturbing the program flow. + +Cartridge Cicurity Chip (CIC) (Lockout Chip) +-------------------------------------------- + +Lockout chips are contained in most NES consoles, and in all NES cartridges. +Both chips are generating an identical serial data stream, and, everything +works fine if the streams match. Otherwise the chip in the console issues a +reset signal to the NES. + +That mechanism is intended both to prevent software piracy, and to prevent +third party developers from distributing (unlicensed) games. Also, an US +cartridge won't work on a UK console and vice versa, because of different +lockout chip versions used in different countries. + +The chips have been invented when releasing the NES in 1985, the original +Famicom didn't have lockout chips (nor do newer Famicoms; for backwards +compatibility reasons). There have been also some lockout chip revisions to +make newer NES consoles incompatible with some "faked" lockout chips from other +manufacturers. + +The lockout chips are 4bit microprocessors in DIL16 package with a built-in +program called 10NES, and are connected to S0,S1,S2,4MHz pins of the 72pin NES +cartridge slot. Pin 4 of the chip is used to configure the chip: + HIGH (+5V) Lock, used in console + LOW (GND) Key, used in cartridge +To disable the chip in the console, wire that pin to GND instead of 5V, the NES +will then work with any cartridges with or without lockout chip, and with +cartridges from other countries - though some NTSC (60Hz) games may be +incompatible with PAL (50Hz) refresh rates, and vice versa. + +NES cartridges are required to contain a CIC chip (security chip aka lockout +chip). The CIC is a small 4bit CPU with built-in ROM. An identical CIC is +located in the NES console. The same 4bit CPU (but with slightly different code +in ROM) is also used in SNES consoles/cartridges. +The CIC in the console is acting as "lock", and that in the cartridge is acting +as "key". The two chips are sending random-like bitstreams to each other, if +the data (or transmission timing) doesn't match the expected values, then the +"lock" issues a RESET signal to the console. Thereby rejecting cartridges +without CIC chip (or such with CICs for wrong regions). + +CIC Details +--> Cartridge CIC Pseudo Code +--> Cartridge CIC Instruction Set +--> Cartridge CIC Notes +--> Cartridge CIC Versions +--> Cartridge CIC Pinouts +And, for Tengen CIC clone's instruction set: +--> Cartridge CIC Tengen Clone + +Cartridge CIC Pseudo Code +------------------------- + +CicMain + CicInitFirst, CicInitTiming, CicRandomSeed, CicInitStreams + time=data_start, a=1, noswap=1, if snes then noswap=0 + mainloop: + for x=a to 0Fh + if nes then Wait(time-5), else if snes then (time-7) ;\verify idle + if (nes_6113=0) and (P0.0=1 or P0.1=1) then Shutdown ;/ + Wait(time+0) ;\ + if (console xor snes) then a=[00h+x].0, else a=[10h+x].0 ; output data + if noswap then P0.0=a, else P0.1=a ;/ + Wait(time+2-data_rx_error) ;\ + if (console xor snes) then a=[10h+x].0, else a=[00h+x].0 ; verify input + if noswap then a=(a xor P0.1), else a=(a xor P0.0) ; + if a=1 then Shutdown ;/ + Wait(time+3) ;\output idle + if noswap then P0.0=0, else P0.1=0 ;/ + if snes then time=time+92, else if nes then time=time+79 + next x + CicMangle(00h), CicMangle(10h) ;\mangle + if snes then CicMangle(00h), CicMangle(10h) ; (thrice on SNES) + if snes then CicMangle(00h), CicMangle(10h) ;/ + if snes then noswap=[17h].0 ;eventually swap input/output pins (SNES only) + a=[17h] + if a=0 then a=1, time=time+2 + if snes then time=time+44, else if nes then time=time+29 + goto mainloop + +CicMangle(buf) + for i=[buf+0Fh]+1 downto 1 + a=[buf+2]+[buf+3h]+1 + if a<10h then x=[buf+3], [buf+3]=a, a=x, x=1, else x=0 + [buf+3+x]=[buf+3+x]+a + for a=x+6 to 0Fh, [buf+a]=[buf+a]+[buf+a-1]+1, next a + a=[buf+4+x]+8, if a<10h then [buf+5+x]=[buf+5+x]+a, else [buf+5+x]=a + [buf+4+x]=[buf+4+x]+[buf+3+x] + [buf+1]=[buf+1]+i + [buf+2]=NOT([buf+2]+[buf+1]+1) + time=time+84-(x*6) + next i +Note: All values in [buf] are 4bit wide (aka ANDed with 0Fh). + +CicInitFirst + timer=0 ;reset timer (since reset released) + P0=00h + console=P0.3 ;get console/cartridge flag + if console + while P0.2=1, r=r+1 ;get 4bit random seed (capacitor charge time) + P1.1=1, P1.1=0 ;issue reset to CIC in cartridge + timer=0 ;reset timer (since reset released) + if nes_6113 and (console=1) + Wait(3), nes_6113_in_console=1, P0.0=1 ;request special 6113 mode + if nes_6113 and (console=0) + Wait(6), nes_6113_in_console=P0.1 ;check if 6113 mode requested + +CicRandomSeed + time=seed_start + for i=0 to 3 ;send/receive 4bit random seed (r) + bit=((i+3) and 3) ;bit order is 3,0,1,2 (!) + if console=1 Wait(time+0+i*15), P0.0=r.bit, Wait(time+3+i*15), P0.0=0 ;send + if console=0 Wait(time+2+i*15), r.bit=P0.1 ;recv + next i + +CicInitStreams + if snes + if ntsc then x=9, else if pal then x=6 + [01h..0Fh]=B,1,4,F,4,B,5,7,F,D,6,1,E,9,8 ;init stream from cartridge (!) + [11h..1Fh]=r,x,A,1,8,5,F,1,1,E,1,0,D,E,C ;init stream from console (!) + if nes_usa ;3193A + [01h..0Fh]=1,9,5,2,F,8,2,7,1,9,8,1,1,1,5 ;init stream from console + [11h..1Fh]=r,9,5,2,1,2,1,7,1,9,8,5,7,1,5 ;init stream from cartridge + if nes_6113_in_console then overwrite [01h]=5 or so ??? ;special-case + if nes_europe ;3195A + [01h..0Fh]=F,7,B,E,F,8,2,7,D,7,8,E,E,1,5 ;init stream from console + [11h..1Fh]=r,7,B,D,1,2,1,7,E,6,7,A,7,1,5 ;init stream from cartridge + if nes_hongkong_asia ;3196A + [01h..0Fh]=E,6,A,D,F,8,2,7,E,6,7,E,E,E,A ;init stream from console + [11h..1Fh]=r,6,A,D,E,D,E,8,E,6,7,A,7,1,5 ;init stream from cartridge + if nes_uk_italy_australia ;3197A + [01h..0Fh]=3,5,8,9,3,7,2,8,8,6,8,5,E,E,B ;init stream from console + [11h..1Fh]=r,7,9,A,A,1,6,8,5,8,9,1,5,1,7 ;init stream from cartridge + if_nes_famicombox ;3198A + (unknown) +Note: In most cases, the PAL region changes are simply inverted or negated NTSC +values (not/neg), except, one NES-EUR value, and most of the NES-UK values are +somehow different. The rev-engineered NES-UK values may not match the exact +original NES-UK values (but they should be working anyways). + +CicInitTiming + if snes_d411 -> seed_start=630, data_start=817 ;snes/ntsc + if snes_d413 -> (unknown?) (same as d411?) ;snes/pal + if nes_3193 -> (seems to be same as nes_3195?) ;nes/usa (v1) + if nes_3195 -> seed_start=32, data_start=200 ;nes/europe + if nes_3196 -> (unknown?) ;nes/asia + if nes_3197 -> (unknown?) ("burns five") ;nes/uk + if nes_6113 -> seed_start=32, data_start=201 ;nes/usa (v2) + if nes_6113_in_console -> seed_start=33, data_start=216 ;nes/special + if nes_tengen -> seed_start=32, data_start=201 ;nes/cic-clone + ;now timing errors... + data_rx_error=0 ;default + if console=0 and nes_3193a -> randomly add 0 or 0.25 to seed_start/data_start + if console=0 and snes_d413 -> always add 1.33 to seed_start/data_start (bug) + if console=0 and nes_6113 -> data_rx_error=1 (and maybe +1.25 on seed/data?) + if other_chips & chip_revisions -> (unknown?) +Note: 3197 reportedly "burns five extra cycles before initialization", but +unknown if that is relative to 3193 3195 timings, and unknown if it +applies to seed_start and data_start, and unknown if it means 1MHz +4MHz cycles. +Note: The "data_rx_error" looks totally wrong, but it is somewhat done +intentionally, so there might be a purpose (maybe some rounding, in case 6113 +and 3193 are off-sync by a half clock cycle, or maybe an improper bugfix in +case they are off-sync by 1 or more cycles). + +Wait(time) +Wait until "timer=time", whereas "timer" runs at 1MHz (NES) or 1.024MHz (SNES). +The "time" values are showing the of the I/O opcodes (ie. the I/O +opcodes at "time-1"). + +Shutdown (should never happen, unless cartridge is missing or wrong region) + a=0, if nes then time=830142, else if snes then time=1037682 + endless_loop: ;timings here aren't 100.000% accurate + if nes_3195 then time=xlat[P1/4]*174785 ;whereas, xlat[0..3]=(3,2,4,5) + if (console=0) and (snes or nes_6113) then P0=03h, P1=01h + if (console=1) then P1=a, Wait(timer+time), a=a xor 4 ;toggle reset on/off + goto endless_loop + +Cartridge CIC Instruction Set +----------------------------- + +CIC Registers + A 4bit Accumulator + X 4bit General Purpose Register + L 4bit Pointer Register (lower 4bit of 6bit HL) + H 2bit Pointer Register (upper 2bit of 6bit HL) + C 1bit Carry Flag (changed ONLY by "set/clr c", not by "add/adc" or so) + PC 10bit Program Counter (3bit bank, plus 7bit polynomial counter) + +CIC Memory + ROM 512x8bit (program ROM) (NES/EUR=768x8) (max 1024x8 addressable) + RAM 32x4bit (data RAM) (max 64x4 addressable) + STACK 4x10bit (stack for call/ret opcodes) + PORTS 4x4bit (external I/O ports & internal RAM-like ports) (max 16x4) + +Newer CIC Opcodes (6113, D411) (and probably F411,D413,F413) + 00 nop no operation (aka "addsk A,0" opcode) + 00+n addsk A,n add, A=A+n, skip if result>0Fh + 10+n cmpsk A,n compare, skip if A=n + 20+n mov L,n set L=n + 30+n mov A,n set A=n + 40 mov A,[HL] set A=RAM[HL] + 41 xchg A,[HL] exchange A <--> RAM[HL] + 42 xchgsk A,[HL+] exchange A <--> RAM[HL], L=L+1, skip if result>0Fh + 43 xchgsk A,[HL-] exchange A <--> RAM[HL], L=L-1, skip if result<00h + 44 neg A negate, A=0-A ;(used by 6113 mode) + 45 ? + 46 out [L],A output, PORT[L]=A + 47 out [L],0 output, PORT[L]=0 + 48 set C set carry, C=1 + 49 clr C reset carry, C=0 + 4A mov [HL],A set RAM[HL]=A + 4B ? + 4C ret return, pop PC from stack + 4D retsk return, pop PC from stack, skip + 4E+n ? + 52 movsk A,[HL+] set A=RAM[HL], L=L+1, skip if result>0Fh + 53 ? (guess: movsk A,[HL-]) + 54 not A complement, A=A XOR 0Fh + 55 in A,[L] input, A=PORT[L] + 56 ? + 57 xchg A,L exchange A <--> L + 58+n ? + 5C mov X,A set X=A + 5D xchg X,A exchange X <--> A + 5E ??? "SPECIAL MYSTERY INSTRUCTION" ;(used by 6113 mode) + 5F ? + 60+n testsk [HL].n skip if RAM[HL].Bit(n)=1 + 64+n testsk A.n skip if A.Bit(n)=1 + 68+n clr [HL].n set RAM[HL].Bit(n)=0 + 6C+n set [HL].n set RAM[HL].Bit(n)=1 + 70 add A,[HL] add, A=A+RAM[HL] + 71 ? (guess: addsk A,[HL]) + 72 adc A,[HL] add with carry, A=A+RAM[HL]+C + 73 adcsk A,[HL] add with carry, A=A+RAM[HL]+C, skip if result>0Fh + 74+n mov H,n set H=n ;2bit range, n=0..3 only (used: 0..1 only) + 78+n mm jmp nmm long jump, PC=nmm + 7C+n mm call nmm long call, push PC+2, PC=nmm + 80+nn jmp nn short jump, PC=(PC AND 380h)+nn + - reset PC=000h +Note: "skip" means "do not execute next instruction" + +Older CIC Opcodes (3195) (and probably 3193,3196,3197,etc.) + Exchanged opcodes 48 <--> 49 (set/clr C) + Exchanged opcodes 44 <--> 54 (neg/not A) + ROM Size is 768x8 (although only 512x8 are actually used) + +Note +The CIC is a 4bit Sharp CPU (maybe a Sharp SM4, but no datasheet exists) (the +instruction seems to be an older version of that in the Sharp SM5K1..SM5K7 +datasheets). + +Cartridge CIC Notes +------------------- + +Program Counter (PC) +The 10bit PC register consists of a 3bit bank (which gets changed only by +call/jmp/ret opcodes), and a 7bit polynomial counter (ie. not a linear +counter). After fetching opcode bytes, PC is "incremented" as so: + PC = (PC AND 380h) + (PC.Bit0 XOR PC.Bit1)*40h + (PC AND 7Eh)/2 +Ie. the lower 7bit will "increment" through 127 different values (and wrap to +00h thereafter). Address 7Fh is unused (unless one issues a JMP 7Fh opcode, +which would cause the CPU to hang on that address). + Format <------------- Valid Address Area ----------> <--Stuck--> + Linear 00 01 02 03 04 05 06 07 08 09 0A ... 7C 7D 7E or 7F 7F 7F 7F + Polynomial 00 40 60 70 78 7C 7E 3F 5F 6F 77 ... 05 02 01 or 7F 7F 7F 7F +To simplify things, programming tools like assemblers/disassemblers may use +"normal" linear addresses (and translate linear/polynomial addressses when +needed - the polynomial addresses are relevant only for encoding bits in +jmp/call opcodes, and for how the data is physically arranged in the chip ROMs +and in ROM-images). + +ROM-Images +The existing ROM-images are .txt files, containing "0" and "1" BITS in ASCII +format, arranged as a 64x64 (or 96x64) matrix (as seen in decapped chips). + Line 1..32 ---> Address X+9Fh..80h ;\Lines (Y) + Line 33..64 ---> Address X+1Fh..00h ;/ + Column 1+(n*W) --> Data Bit(n) of Address 000h+Y ;\ ;\ + Column 2+(n*W) --> Data Bit(n) of Address 020h+Y ; ; Columns (X) + Column 3+(n*W) --> Data Bit(n) of Address 040h+Y ; ; + Column 4+(n*W) --> Data Bit(n) of Address 060h+Y ; ; chips with 200h-byte + Column 5+(n*W) --> Data Bit(n) of Address 100h+Y ; ; (W=8) (64x64 bits) + Column 6+(n*W) --> Data Bit(n) of Address 120h+Y ; ; + Column 7+(n*W) --> Data Bit(n) of Address 140h+Y ; ; + Column 8+(n*W) --> Data Bit(n) of Address 160h+Y ; ;/ + Column 9+(n*W) --> Data Bit(n) of Address 200h+Y ; + Column 10+(n*W) --> Data Bit(n) of Address 220h+Y ; chips with 300h-byte + Column 11+(n*W) --> Data Bit(n) of Address 240h+Y ; (W=12) (96x64 bits) + Column 12+(n*W) --> Data Bit(n) of Address 260h+Y ;/ +Cautions: The bits are inverted (0=1, 1=0) in some (not all) dumps. Mind that +the bytes are arranged in non-linear polynomial fashion (see PC register). +Recommended format for binary ROM-images would be to undo the inversion (if +present), and to maintain the polynomial byte-order. +Note: Known decapped/dumped CICs are D411 and 3195A, and... somebody +decapped/dumped a CIC without writing down its part number (probably=6113). + +CIC Timings +The NES CICs are driven by a 4.000MHz CIC oscillator (located in the console, +and divided by 4 in the NES CIC). The SNES CICs are driven by the 24.576MHz APU +oscillator (located and divided by 8 in the console's audio circuit, and +further divided by 3 in the SNES CIC). +Ie. internally, the CICs are clocked at 1.000MHz (NES) or 1.024MHz (SNES). All +opcodes are executed within 1 clock cycles, except for the 2-byte long jumps +(opcodes 78h-7Fh) which take 2 clock cycles. The "skip" opcodes are forcing the +follwing opcode to be executed as a "nop" (ie. the skipped opcode still takes 1 +clock cycle; or possibly 2 cycles when skipping long jump opcodes, in case the +CPU supports skipping 2-byte opcodes at all). +After Reset gets released, the CICs execute the first opcode after a short +delay (3195A: randomly 1.0 or 1.25 cycles, D413A: constantly 1.33 cycles) +(whereas, portions of that delay may rely on a poorly falling edge of the +incoming Reset signal). + +CIC Ports + Name Pin Dir Expl + P0.0 1 Out Data Out ;\SNES version occassionally swaps these + P0.1 2 In Data In ;/pins by software (ie. Pin1=In, Pin2=Out) + P0.2 3 In Random Seed (0=Charged/Ready, 1=Charging/Busy) + P0.3 4 In Lock/Key (0=Cartridge/Key, 1=Console/Lock) + P1.0 9 Out Reset SNES (0=Reset Console, 1=No) + P1.1 10 Out Reset Key (0=No, 1=Reset Key) + P1.2 11 In Unused, or Reset Speed A (in 3195A) ;\blink speed of reset + P1.3 12 In Unused, or Reset Speed B (in 3195A) ;/signal (and Power LED) + P2.0 13 - Unused + P2.1 14 - Unused + P2.2 15 - Unused + P2.3 - - Unused + P3.0 - RAM Unused, or used as "noswap" flag (in SNES CIC) + P3.1 - - Unused + P3.2 - - Unused + P3.3 - - Unused +P0.0-P2.2 are 11 external I/O lines (probably all bidirectional, above +directions just indicates how they are normally used). P2.3-P3.3 are 5 internal +bits (which seem to be useable as "RAM"). Pin numbers are for 16pin NES/SNES +DIP chips (Pin numbers on 18pin SNES SMD chips are slightly rearranged). +P4,P5,P6,P7,P8,P9,PA,PB,PC,PD,PF are unknown/unused (maybe 12x4 further bits, +or mirrors of P0..P3). + +CIC Stream Seeds +There are different seeds used for different regions. And, confusingly, there +is a NES-CIC clone made Tengen, which uses different seeds than the real CIC +(some of the differences automatically compensated when summing up values, eg. +8+8 gives same 4bit result as 0+0, other differences are manually adjusted by +Tengen's program code). +Many of the reverse-engineered NES seeds found in the internet are based on the +Tengen design (the USA-seeds extracted from the decapped Tengen chip, the +EUR/ASIA/UK-seeds based on sampled Nintendo-CIC data-streams, and then +converted to a Tengen-compatible seed format). To convert them to real CIC +seeds: + Nintendo[1..F] = Tengen[1..F] - (2,0,0,0,0,0,8,8,8,8,8,8,8,8,2) +There are other (working) variations possible, for example: + Nintendo[1..F] = Tengen[1..F] - (2,0,0,0,0,A,E,8,8,8,8,8,8,8,2) + (That, for Tengen-USA seeds. The Tengen-style-EUR/ASIA/UK seeds may differ) +Whereas, the random seed in TengenKEY[1] is meant to be "r+2" (so subtracting 2 +restores "r"). + +CIC Stream Logs +There are some stream logs with filename "XXXX-N.b" where XXXX is the chip +name, and N is the random seed, and bytes in the file are as so: + Byte 000h, bit0-7 = 1st-8th bit on Pin 1 (DTA.OUT on NES)(DTA.OUT/IN on SNES) + Byte 001h, bit0-7 = 1st-8th bit on Pin 2 (DTA.IN on NES) (DTA.IN/OUT on SNES) + Byte 002h, bit0-7 = 9th-16th bit on Pin 1 + Byte 003h, bit0-7 = 9th-16th bit on Pin 2 + etc. +Caution: The "N" in the filename is taken as if the seed were transferred in +order Bit 3,2,1,0 (actually it is Bit 3,0,1,2). Ie. file "3195-1.b" would refer +to a NES-EUR-CIC with seed r=4. The signals in the files are sampled at 1MHz +(ie. only each fourth 4MHz cycle). + +The 6113 Chip +The 6113 chip was invented in 1987, and it replaced the 3193 chip in +US/Canadian cartridges (while US/Canadian consoles kept using 3193 chips). When +used in cartridges, the 6113 does usually "emulate" a 3193 chip. But, for +whatever reason, it can do more: + Console Cartridge Notes + 3193 3193 Works (the "old" way) ;\used combinations + 3193 6113 Works (the "new" way) ;/ + 6113 6113 Works (special seed/timing) ;\ + 6113 3193 Doesn't work ; not used as far as known + 6113 ?? Might work (??=unknown chip) ;/ +When used in consoles, the 6113 uses slightly different timings and seed values +(and does request cartridges with 6113 chips to use the 6113-mode, too, rather +than emulating the 3193). +One guess: Maybe Nintendo originally used different CICs for NTSC regions (like +3193/3194 for USA/Canada/SouthKorea), and later combined them to one region (if +so, all NES consoles in Canada or SouthKorea should contain 3194/6113 chips, +unlike US consoles which have 3193 chips). + +3195A Signals (NES, Europe) +The I/O ports are HIGH (for Output "1"), or LOW-Z (for Output "0" or Input). +Raising edges take circa 0.5us, falling edges take circa 3us. + 4MHz Clock Units ............................... + 1MHz Clock Units . . . . . . . . + ___________ ;\Console+Cartridge + Data Should-be __| |________________ ;/should be 3us High + __________ ;\actually 2.5us High + Data From Console __.' ''----.......____ ;/and 3us falling + __________ ;\ + Data From Cartridge __.' ''----.......____ ; either same as console + or, delayed: __________ ; or 0.25us later + Data From Cartridge ___.' ''----.......___ ;/ +After Power-up, the Cartridge CIC does randomly start with good timing, or with +all signals delayed by 0.25us. In other words, the Cartridge CIC executes the +first opcode 1.0us or 1.25us (four or five 4MHz cycles) after Reset gets +released. However, for some reason, pushing the Reset Button doesn't alter the +timing, the random-decision occurs only on Power-up. + +D413A Signals (SNES, Europe) +The D413A signals are looking strange. First, the software switches signals +High for 3us, but the actual signals are 3.33us High. Second, the signals on +one pin are constantly jumping back'n'forth by 1.33us (in relation to the other +pin). + 3.072MHz Clock Units ............................... + 1.024MHz Clock Units . . . . . . . . . . + ________ ;\Console+Cartridge + Data Should-be ________| |_____________ ;/should be 3us High + _________ ;\actually 3.33us high + Data From/To Console ________| '--..._______ ;/and 2us falling + _________ ;\ + Data From/To Cart ____| '--...___________ ; 1.33us earlier + or, delayed _________ ; or 1.33us later + Data From/To Cart ____________| '--...___ ;/ +The earlier/later effect occurs because the SNES CICs are occassionally +reversing the data-direction of the pins. Ie. in practice, Data from Cartridge +is constantly 1.33us LATER than from Console. +Software-wise, the D411 (and probably D413A) is programmed as if the Cartridge +CIC would start "immediately", but in practice, it starts 1.33us (four 3.072MHz +cycles) after releasing Reset (that offset seems to be constant, unlike as on +the 3195A where it randomly changes between 1.0us and 1.25us). + +Cartridge CIC Versions +---------------------- + +NES CIC Versions + 3193,3193A NES NTSC Cartridges and Consoles ;\USA,Canada + 6113,6113A,6113B1 NES NTSC Cartridges (not consoles) ;/(and Korea?) + 3194 Unknown/doesn't exist? + 3195,3193A NES PAL Cartridges and Consoles "PAL-B";-Europe + 3196(A?) NES PAL Cartridges and Consoles ;-Hong Kong,Asia + 3197(A?) NES PAL Cartridges and Consoles "PAL-A";-UK,Italy,Australia + 3198(A?) FamicomBox CIC Cartridges and Consoles ;\ + 3199(A?) FamicomBox Coin Timer (not a CIC) ; Japan + N/A Famicom Cartridges and Consoles ;/ + RFC-CPU10 (?) NES R.O.B. robot (no CIC, but maybe a 4bit Sharp CPU, too?) + +SNES CIC Versions + F411,F411A,F411B SNES NTSC Cartridges-with-SMD-Chipset and Consoles + D411,D411A,D411B SNES NTSC Cartridges-with-DIP-Chipset + F413,F413A,F413B SNES PAL Cartridges-with-SMD-Chipset and Consoles + D413,D413A,D413B SNES PAL Cartridges-with-DIP-Chipset + SA-1,S-DD1,MCC-BSC SNES Cartridges (coprocessors/mappers with on-chip CIC) + +NES CIC Clones + 23C1033 + 337002 ;Tengen's 16pin "Rabbit" CIC clone + 337006 ;Tengen's 40pin "RAMBO-1" mapper with built-in CIC clone + 4051 + 7660 + KC5373B + MX8018 + NINA + Ciclone ;homebrew multi-region CIC clone (based on Tengen design) +Aside from using cloned CICs, many unlicensed NES cartridges used a different +approach: injecting "wrong" voltages to the console, and "stunning" its CIC. + +SNES CIC Clones + 10198 - CIC clone + noname - CIC clone (black chip without any part number) + ST10198S - NTSC CIC clone + ST10198P - PAL CIC clone + 265111 - maybe also a CIC clone (used in Bung Game Doctor SF6) + D1 - maybe also a CIC clone (used in Super UFO Pro8) + 74LS112 - reportedly also a CIC clone (with fake part number) (UFO Pro6) + CIVIC 74LS13 16pin - CIC/D411 clone (used in a 8-in-1 pirate cart) + CIVIC CT6911 16pin - CIC clone (used in a 7-in-1 pirate cart) + 93C26 16pin - CIC clone (used in a 8-in-1 pirate cart) + D1 16pin - CIC? (used in Super VG pirate) + STS9311A 52583 16pin - CIC clone (used in Donkey King Country 3 pirate) + black blob 16pin - CIC/D411 clone (used in Sonic the Hedgehog pirate) + +CIC Chip Year/Week Date Codes + Name YYWW-YYWW + 3193 8539-8642 + 3193A 8547-8733 (in cartridges) (but should be in consoles for more years) + 3195 8627-8638 + 3195A 8647-9512 + 3197A 8647-9227 + 6113 8734-8823 + 6113A 8823-8933 + 6113B1 8847-9344 + +Cartridge CIC Pinouts +--------------------- + +XXX below "Cart.nn" pin-numbers are for SNES carts (not NES carts). + +CIC Pinouts +F411/F413: 18pin SMD-chip (used in console and in some carts) +D411/D413: 16pin DIP-chip (used in most carts) + SMD DIP Pin Dir Usage In Console In Cartridge + 1 1 P00 Out DTA0 Cart.55 CIC1 Cart.24 CIC0 + 2 2 P01 In DTA1 Cart.24 CIC0 Cart.55 CIC1 + 3 3 P02 In RANDOM Via capacitor to VCC NC + 4 4 P03 In MODE VCC=Console (Lock) GND=Cartridge (Key) + 5 NC - (NC) NC NC + 6 5 CL2 - (NC) NC SMD:NC or DIP:GND + 7 6 CL1 In CLK 3.072MHz (from APU) Cart.56 CIC3 (3.072MHz) + 8 7 RES In RESET From Reset button Cart.25 CIC2 (START) + 9 8 GND - GND Supply Supply + 10 9 P10 Out /RESET To PPU (and CPU/APU/etc) NC (or to ROM, eg. in SGB) + 11 10 P11 Out START Cart.25 CIC2 NC + 12 11 P12 - (NC) NC NC (or SlotID in FamicomBox) + 13 12 P13 - (NC) NC NC (or SlotID in FamicomBox) + 14 NC - (NC) NC NC + 15 13 P20 - (NC) NC NC + 16 14 P21 - (NC) NC NC (or SlotID in FamicomBox) + 17 15 P22 - (NC) NC NC (or SlotID in FamicomBox) + 18 16 VCC - VCC Supply Supply +P00=Out,P01=In are the initial directions (for the Random Seed transfer), later +on the directions are randomly swapped (ie. P00=In,P01=Out or P00=Out,P01=In). +START: short HIGH pulse on power-up or when releasing reset button. +/RESET: in console: to PPU, and from there to CPU,APU,Cart,Expansion. + +Cartridge CIC Tengen Clone +-------------------------- + +Tengen Registers + PC 8bit Program Counter (00h on Reset) + Acc 4bit Accumulator (aka A) + RamDta 4bit RAM Data-Read Register (aka X) + L 4bit RAM Address Register, LSB + H 1bit RAM Address Register, MSB (0 on Reset) + Cy 1bit Carry Flag + DATA_IN 1bit Input from master CIC + DATA_OUT 1bit Output to master CIC + +Tengen Memory + Program ROM = 256x12 bit + Data RAM = 32x4 bit + +Type 0 Opcodes - ADD/XNOR with optional Memory Load + 11-10 Must be 00b for Type 0 Opcodes + 9-6 ALU Source 1 and Destination (see list) + 5 ALU Source 2 (0=Zero, 1=RamDta) + 4 ALU Update Carry (0=No, 1=Yes) ;<-- done AFTER ALU + 3 --> RamDta=[H:L] ;<-- done BEFORE ALU + 2 ALU Type (0=ADD, 1=XNOR) + 1-0 ALU Source 3 (0..3 = 0,Cy,1,1-Cy) (should be 0 for XNOR?) + +Type 1 Opcodes - ADD with Immediate + 11-10 Must be 01b for Type 1 Opcodes + 9-6 ALU Source 1 and Destination (see list) + 5 Unknown/Unused (should be 0) + 4 ALU Update Carry (0=No, 1=Yes) ;<-- done AFTER ALU + 3-0 ALU Source 2 (Immediate 00h..0Fh) + +Type 2 Opcodes - ADD with optional Special Actions + 11-10 Must be 10b for Type 2 Opcodes + 9-6 ALU Source 1 and Destination (see list, optionally H:0 instead H:L) + 5 ALU Source 2 (0=Zero, 1=RamDta) + 4 ALU Source 3 (0=Zero, 1=DATA_IN) + 3 --> RamDta=[H:L] (or [H:0]) ;<-- done BEFORE ALU + 2 --> Force address H:0 instead H:L ;applies to BOTH read/write [H:L] + 1 --> DATA_OUT=Cy + 0 --> H=Cy ;<-- done AFTER reading/writing [H:L] + +Type 3 Opcodes - Jumps + 11-10 Must be 11b for Type 3 Opcodes + 9 Jump Condition (0=Always, 1=If Cy=0) + 8 Unknown/Unused (should be 0) + 7-0 Jump Target (PC=00h..FFh) + +ALU Source 1 and Destination (Bit9-6 of Type 0-2 Opcodes) + 00h Src=None, Dest=None 08h Src=L, Dest=[H:L]=Acc + 01h Src=None, Dest=None * 09h Src=Acc, Dest=[H:L]=Acc + 02h Src=Zero, Dest=Acc 0Ah Src=L, Dest=Acc + 03h Src=Acc, Dest=Acc * 0Bh Src=Acc, Dest=Acc + 04h Src=Zero, Dest=[H:L] 0Ch Src=L, Dest=[H:L] + 05h Src=Acc, Dest=[H:L] * 0Dh Src=Acc, Dest=[H:L] + 06h Src=Zero, Dest=L 0Eh Src=L, Dest=L + 07h Src=Acc, Dest=L * 0Fh Src=Acc, Dest=L +Note: 01h,03h,05h,07h are (occassionally used) dupes of 00h,0Bh,0Dh,0Fh. +Mind that Type 2 Opcodes can force RAM address H:0 instead of H:L. + +Update Carry (when Bit4=1 in Type 0 or 1 opcodes) + when ALU Dest = None ---> Cy = bit0 or (src2) + when ALU Type = ADD ---> Cy = carry-out of addition + when ALU Type = XNOR ---> Cy = bit3 of (src1 OR src2) (??) + +Timings +All opcodes take 1 clock cycle (clock is 1MHz). + +Tengen ROM-image +There is a "ROM-image" called "tengen2rom.txt" containing "0" and "1" bits in +ASCII format (mixed with some english text), the "binary" part contains the ROM +as seen under a microscope: +There are 2x6 blocks (mapped to the 12bit databus): + D11 D5 + D10 D4 + D9 D3 + D8 D2 + D7 D1 + D6 D0 +Each block contains 8x32 bits (for 8bit address bus): + Line 1..32 --> address X+(1Fh..00h) + Column 1..8 --> address (00h,20h,40h,60h,80h,A0h,C0h,E0h)+Y for D0..D5 + Column 1..8 --> address (E0h,C0h,A0h,80h,60h,40h,20h,00h)+Y for D6..D11 +Recommended format for a binary ROM-image would be padding the 12bit opcodes to +16bit (bit15-12 zero), and then storing it as a 512-byte file (with the 16bit +values in little-endian format). +Warning: The Tengen CIC stream initialization isn't done by "L=imm, [HL]=imm" +pairs, but rather by cryptic stuff like "L=L+X+cy, [HL]=A XNOR X". + +Cartridge Cheat Devices +----------------------- + +Game Genie (19xx) +The Game Genie is an adapter to be connected between the console and game +cartridge, it includes a BIOS ROM which prompts the user to enter 6-letter or +8-letter cheat-codes, and then starts the actual game. +The adapter compares the CPU address bus (PRG ROM area 8000h-FFFFh), and +optionally also the CPU data bus (reduces the risk to mess-up values in other +banks in cartridges with Memory Mappers), if the comparision matches, then the +value on data bus will be replaced. +Game Genie Code Format +The letters are translated into 4bit Hex-digits: + Hex 0 1 2 3 4 5 6 7 8 9 A B C D E F + Letter A P Z L G I T Y E O X U K S V N +Address/Data/Compare bits A14-A0, D7-D0, C7-C0 are scrambled as such: + Char Bit3 Bit2 Bit1 Bit0 Char Bit3 Bit2 Bit1 Bit0 + 1st D7 D2 D1 D0 2nd A7 D6 D5 D4 + 3rd LEN A6 A5 A4 4th A3 A14 A13 A12 + 5th A11 A2 A1 A0 6th CD3 A10 A9 A8 + 7th C7 C2 C1 C0 8th D3 C6 C5 C4 +6-Letter code: LEN=0, CD3 used as D3, acts as "[A]=D" +8-letter code: LEN=1, CD3 used as C3, acts as "If [A]=C then [A]=D" +Example: Code "SXIOPO" changes [91D9h]=ADh (Infinite lives in smb1). + +Pro Action Replay (PAR) (Datel) (1992) + XXX... + +Pro Action Rocky (by Cyber Gadget) (2003) (Japan/Famicom) +This thing seems to be the first and only cheat device released for the +japanese Famicom (although it came out much later than the NES cheat devices). +The strange name is apparently inspired on Elvis Presley or Sylvester Stallone +& on Datel's Pro Action Replay. The hardware uses ROM patches (and thus works +more like Game Genie than Pro Action Replay). Codes are 8-digit hex values in +following format. + DDCCAAAA ;Data,Compare,Address, ie. "if [AAAA]=CC then [AAAA]=DD" +And, of course, there's some annoying encryption... +Pro Action Rocky Encode (raw to code): + raw=raw AND FFFF7FFFh ;strip unused address MSB from the DDCCAAAAh value + for i=0 to 31 + code=code SHR 1 + if raw AND (1 SHL xlat[i]) then code=code XOR B8309722h + next i + code=code XOR FCBDD275h +Pro Action Rocky Decode (code to raw): + code=code XOR FCBDD275h, raw=00000000h + for i=31 to 0 + if code AND 80000000h then raw=raw+(1 SHL xlat[i]), code=code XOR B8309722h + code=code SHL 1 + next i + raw=raw OR 00008000h ;add unused/fixed address MSB to the DDCCAAAAh value +Pro Action Rocky Bit Translation (xlat[0..31]): + 15, 3,13,14, 1, 6, 9, 5, 0,12, 7, 2, 8,10,11, 4 + 19,21,23,22,20,17,16,18,29,31,24,26,25,30,27,28 + +Cartridge Pin-Outs +------------------ + +60-Pin Famicom Cartridge connector + 1 GND 19-25 PPU A6-A0 45 EXP SND_IN + 2-13 CPU A11-A0 26-29 PPU D0-D3 45,46 EXP SND_OUT + 14 CPU R/W 30-31 +5VDC 47 PPU /WR + 15 CPU /IRQ 32 PHI2 CLK 48 PPU NT /CS + 16 GND 33,35 CPU A12-A14 49 PPU NT /A13 + 17 PPU /RD 36-43 CPU D7-D0 49-56 PPU A7-A12,A13 + 18 PPU NT A10 44 CPU /PRG 57-60 PPU D7-D4 +The Famicom connector uses standard 2.54mm pitch. + +72-Pin NES Cart connector + Pin Dir Use Expl. __________________________ + 1 Out VEE GND 1| |36 + 2-13 Out CPU A11-A0 37|__________________________|72 + 14 Out CPU R/W + 15 I/O CPU /IRQ + 16-20 I/O EXP Expansion Port Pins 42-38 (not used by the console itself) + 21 Out PPU /R + 22 In PPU VA10 (A10 of internal 2K VRAM, ie. select BLK0 or BLK1) + 23-29 Out PPU A6-A0 + 30-33 I/O PPU D0-D3 + 34-35 I/O CIC S0-S1 (cicurity/lockup chip protocol signals) + 36 Out VCC +5VDC + 37 Out CPU 21.47727MHz (NTSC), 26.601712MHz (PAL) + 38 Out CPU PHI2 + 39-41 Out CPU A12-A14 + 42-49 I/O CPU D7-D0 + 50 Out CPU /PRG (PRG-ROM access, logical NAND of PHI2 and CPU A15) + 51-55 I/O EXP Expansion Port Pins 06-10 (not used by the console itself) + 56 Out PPU /W + 57 In PPU /VCS (internal 2K VRAM Chip-Select) + 58 Out PPU /A13 (inverted A13, wired to /VCS when used as name table) + 59-65 Out PPU A7-A9,A11,A10,A12-A13 + 66-69 I/O PPU D7-D4 + 70 I/O CIC S2 (cicurity/lockup chip protocol signals) + 71 Out CIC 4Mhz (cicurity/lockout chip clock line) + 72 Out VEE GND +Caution: The NES edge connector uses a nonstandard 2.5mm pitch (not 2.54mm). +And, the PCBs (including copper layers) are only 1.2mm thick (not 1.5mm). +There's no tolerance there (2.54mm pitch would produce short-cuts, and +inserting or removing 1.5mm PCBs works only with extreme force). + +Cartridge Shell Dimensions +-------------------------- + +NES Cart-Shell with NES-NROM PCB Dimensions + |------------------119.7mm----------------| + _________________________________________ _ _ + | |.......| | | + | |.......| | | + | |_______| | | + | | | 87.0mm + | | | + | 3.25mm 1.5mm | | + | |-|-|---------93.25mm---------|-| | | + _ _ | 1.5mm _________________________ | _ _ _|_ + _|_ 2.5mm | _| NES-NROM-256-06 | | | 6.0mm | + _|_ 6.0mm | _| |_ | _|_ | + | | | PCB, 100x40 mm | | | | + | | O| |O | | | + | |_ _ | Component Side | _ _| | 19.5mm | 40.0mm + | 17.0mm | || || | | | + _|_ | ||_ Edge-Connector, 2.5mm pitch _|| | _|_ | + | 14.5mm | | | ||||||||||||||||||||||||| | | | | 14.5mm | + _|_ | | |___________________________| | | _|_ _|_ + | | | | | + | | |-----------93.5mm----------| | | | 7.0mm + | ||------------100.0mm------------|| | | + |_|_________________________________|_| _|_ + + |-------------100.5mm-------------| + |---------------106.0mm---------------| + +NES Cart-Shell, Connector Side + 6.4mm 3.0mm 3.0mm 6.4mm Front/Component + |----|-| |-|----| Side + _ _ ____ _________________________________ ____ _ _ _ _ + _|_ 3.0mm | | _____________________________ | | | 13.0 | + | 10.75mm | | | _________________________ | | | | mm | 16.75 + _|_ '. | |_____________________________| | .' - -3.75 | mm + _|_ 3.0mm '._|_________________________________|_.' _|_ mm _|_ + 2.0mm 4.4mm + |-| |-----------100.5mm-----------| |--| Back/Solder + |-------------106.0mm-------------| Side + |------------------119.7mm------------------| + +NES Cart-Shell, Side View + |-24.0mm-|----------109.7mm--------------| Front/Component Side + _ _ ________ _______________________________ _ _ _ _ + _|_ 3.0mm |________| | | | + | | ____|__ __________ _ _ |||| | 13.0mm | 16.75 + | 10.75mm | |____ __:___PCB____| _|_ 1.2mm |||| | | + _|_ |________|...............................' ... | mm + _|_ 3.0mm |________|____________________________.' _|_3.75mm _|_ + 7.0mm 4.4mm + |---|------40.mm-------| |--| + |-----------------129.6mm-------------| Back/Solder Side + |-----------------134.0mm----------------| + +Caution +Above values aren't 100% correct. + +Mapper 0: NROM - No Mapper (or unknown mapper) +---------------------------------------------- + +NROM (No Mapper) +Used in games with (max) 32K ROM + 8K VROM, ie. games that do not require any +bank-switching hardware. +Name Table can be hardwired either to Horizontal or Vertical Mirroring. + +Unknown Mappers +ROM-Images with unknown mapping hardware are also often assigned as "Mapper 0". +Namely, if the ROM is bigger than 32K+8K, then it's obviously some unknown +stuff rather than NROM. + +Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT +-------------------------------------------- + +This mapper is used on numerous U.S. and Japanese games, including Legend of +Zelda, Metroid, Rad Racer, Mega Man 2, and many others. + 8000h-FFFFh + Bit 0 Serial data loaded to 5bit shift register (LSB=1st write) + Bit 7 Clear 5bit shift register (1=Reset, next write will be "1st write") +On fifth write, data in shift register is copied to Register 0..3 (depending on +upper address bits), and the shift register is automatically cleared. + 8000h-9FFFh Register 0 - Configuration Register + Bit0-1 Name Table Mirroring + 0 Single-Screen BLK0 + 1 Single-Screen BLK1 + 2 Two-Screen Vertical Mirroring + 3 Two-Screen Horizontal Mirroring + Bit2-3 PRG-Switching Mode (usually 3) + 0,1 Switchable 32K Area at 8000h-FFFFh (via Register 3) + 2 Switchable 16K Area at C000h-FFFFh (via Register 3) + And Fixed 16K Area at 8000h-BFFFh (always 1st 16K) + 3 Switchable 16K Area at 8000h-BFFFh (via Register 3) + And Fixed 16K Area at C000h-FFFFh (always last 16K) + Bit4 VROM Switching Size (for carts with VROM) + 0 Swap 8K of VROM at PPU 0000h + 1 Swap 4K of VROM at PPU 0000h and 1000h + A000h-BFFFh Register 1 + Bit4-0 Select 4K or 8K VROM bank at 0000h (4K and 8K Mode, see Reg0/Bit4) + C000h-DFFFh Register 2 + Bit4-0 Select 4K VROM bank at 1000h (used in 4K Mode only, see Reg0/Bit4) + E000h-FFFFh Register 3 + Bit3-0 Select 16K or 2x16K ROM bank (see Reg0/Bit3-2) + Bit4 RAM Disable (newer MMC1 revisions only) +Initially 1st and last 16K are mapped to 8000h and C000h. +In 32K PRG and 8K VROM mode, bank numbers specified in steps of two. + +Register 3 is restricted to sixteen 16K banks, cartridges with more than 256K +PRG ROM use Bit4 of Register 0-2 to expand the available memory area: + Register 0, Bit 4 + <1024K carts> + 0 = Ignore 256K selection register 1 + 1 = Acknowledge 256K selection register 1 + Register 1, Bit4 - 256K ROM Selection Register 0 + <512K carts> + 0 = Swap banks from first 256K of PRG + 1 = Swap banks from second 256K of PRG + <1024K carts with bit 4 of register 0 off> + 0 = Swap banks from first 256K of PRG + 1 = Swap banks from third 256K of PRG + <1024K carts with bit 4 of register 0 on> + Low bit of 256K PRG bank selection + Register 2, Bit4 - 256K ROM Selection Register 1 + <1024K carts with bit 4 of register 0 off> + Store but ignore this bit (base 256K selection on 256K selection Reg 0) + <1024K carts with bit 4 of register 0 on> + High bit of 256K PRG bank selection + +Reportedly some MMC1 carts have 16K SRAM, of which only 8K are battery backed, +no idea how/where the additionally 8K are accessed, and no idea which 8K are +battery backed and which are not (?). + +Mapper 2: UNROM - PRG/16K +------------------------- + +This mapper is used on many older U.S. and Japanese games, such as Castlevania, +Mega Man, Ghosts & Goblins, and Amagon. + 8000h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM at C000h-FFFFh (always last bank) +All carts using it have 8K of VRAM at PPU 0000h. Most carts with this mapper +are 128K. A few, mostly Japanese carts, such as Final Fantasy 2 and Dragon +Quest 3, are 256K. +Bus-conflicts. Uses a 74LS161 chip (connection: /PRG-CLK, R/W-/LOAD), and its +outputs are each ORed with A14 by a 74LS32 chip. +Board NES-UN-ROM-05 and Konami 531320 (both using only 3bits / 8banks) + +Mapper 3: CNROM - VROM/8K +------------------------- + +This mapper is used on many older U.S. and Japanese games, such as Solomon's +Key, Gradius, Cybernoid, and Hudson's Adventure Island. + 8000h-FFFFh + Bit 0-1 Select 8K VROM bank at PPU 0000h (initially 1st bank) + Bit 4-5 Security Diodes (some crude copy protection) +Bus-conflicts. Contains a 74LS161 counter chip mis-used as 4bit latch +(connection: /PRG-CLK, R/W-/LOAD). +Cybernoid supports both above Port 8000h-FFFFh, and alternately Port 6000h. + +Security Diodes +Some CNROM boards can be fitted with "Security Diodes", wired as so: + Mapper.Bit5 ---- D1 ---- PPU.A10 + Mapper.Bit4 ---- D2 ---- PPU.A12 +The diodes can be pointed in this or that direction (to or from PPU), the game +program code (or cartridge dumping device) must configure the two mapper +outputs according to the diode directions (so that no current will flow through +the diodes) (otherwise the diodes would cause shortcuts on the PPU address +lines, causing the VROM to output garbage). +There is also another board with Security Diodes and additional VROM-disable +feature: +--> Mapper 185: VROM-disable + +Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +-------------------------------------------------- + +A great majority of newer NES games (early 90's) use this mapper, both U.S. and +Japanese. Among the better-known MMC3 titles are Super Mario Bros. 2 and 3, +Mega Man 3, 4, 5, and 6, and Crystalis. + 8000h Index/Control (5bit) + Bit7 CHR Address Select (0=Normal, 1=Address Areas XOR 1000h) + Bit6 PRG Register 6 Area (0=8000h-9FFFh, 1=C000h-DFFFh) + Bit2-0 Command Number + 0 - Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh, if Bit7=1) + 1 - Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh, if Bit7=1) + 2 - Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh, if Bit7=1) + 3 - Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh, if Bit7=1) + 4 - Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh, if Bit7=1) + 5 - Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh, if Bit7=1) + 6 - Select 8K ROM at 8000h-9FFFh (or C000h-DFFFh, if Bit6=1) + 7 - Select 8K ROM at A000h-BFFFh + N/A - Fixed 8K ROM at C000h-DFFFh (or 8000h-9FFFh, if Bit6=1) + N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank) + 8001h Data Register (Indexed via Port 8000h) + A000h Mirroring Select (Bit0: 0=Vertical, 1=Horizontal Mirroring) + A001h Save RAM Control for RAM at 6000h-7FFFh: + Bit7: SRAM Chip Enable (0=Disable both read/write, 1=Enable) + Bit6: SRAM Write Protect (0=Read/Write-able, 1=Read-only) + C000h IRQ Reload Value (loaded into IRQ Counter on Counter underflow) + C001h IRQ Force Reload (writing any value will set the Counter to zero, + so that underflow/reload will occur at next rising edge of A13) + E000h IRQ Disable/Acknowledge (write any value) ;doesn't change/stop counter + E001h IRQ Enable (write any value) ;doesn't change/reload counter +The fixed PRG banks are always the LAST two 8K banks in the cart. +On carts with VROM, the first 8K of VROM is swapped into PPU $0000 on reset. +On carts without VROM, as always, there is 8K of VRAM at PPU $0000. + +The IRQ counter is decremented each scanline, based on PPU address line A13 +which toggles between Pattern Tables (LOW) and Name Tables (HIGH) 42 times per +scanline. The counter is paused during VBlank, which allows to use the same +settings for PAL and NTSC timings. Note that the counter gets clocked when +toggling A13 a bunch of times during VBlank by software via Port 2006h. + +MMC3 Boards +NES-TEROM - Max. 64K PRG, 64K CHR, optionally hardwired mirroring +NES-TQROM - Max. 128K PRG, 64K CHR, 8K CHR-RAM (see Mapper 119) +NES-TVROM - Max. 128K PRG, 64K CHR, 4-screen mirroring (Rad Racer II) +NES-TFROM - Max. 512K PRG, 64K CHR, optionally hardwired mirroring +NES-TGROM - Max. 512K PRG, 8K CHR-RAM +NES-TSROM - Max. 512K PRG, 256K CHR, 8K WRAM, Non-battery-backed. +NES-TKROM - Max. 512K PRG, 256K CHR, 8K WRAM, Battery-backed. +NES-TLROM - Max. 512K PRG, 256K CHR +NES-TLSROM - Max. ?K PRG, 128K CHR, NT-bank-select (see Mapper 118) +NES-TR1ROM - Max. 512K PRG, 64K CHR, 4-screen mirroring (Gauntlet) + +MMC3 Variants +--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ +--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ + +MMC6 (same as MMC3 but with on-chip PRG-RAM) (this is also named "Mapper 4") +NES-HKROM - used only by StarTropics and StarTropics 2 + +Multicarts with MMC3 and additional Game-Select Ports +--> Mapper 44: 7-in-1 MMC3 Port A001h +--> Mapper 45: X-in-1 MMC3 Port 6000hx4 +--> Mapper 47: 2-in-1 MMC3 Port 6000h +--> Mapper 49: 4-in-1 MMC3 Port 6xxxh +--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM + +Tengen MIMIC-1 (MMC3 Variant) +Tengen MIMIC-1 uses only Port 8000h (lower 3bit only) and Port 8001h. +The ROM-images are typically declared as "Mapper 4" even though it supports +only a subset of the MMC3 functions. Tengen's Gauntlet additionally contains 2K +SRAM to expand Name Table memory to 4K. + +IRQ Notes form Kevin Horton... +[Observe that the A12-stuff conflicts with above 42-step-A13-prescale] [?] +[According below, IRQ when counter=00h, but reload when counter<00h] [?] + * The IRQ counter WILL NOT STOP. It will continue to decrement and reload + as long as A12 on the PPU bus toggles. + * Whenever the IRQ counter changes from a non-zero value to 00h, the IRQ + flag will be set if it is enabled. + * The exact number of scanlines before the interrupt fires is (N+1), + where N = the IRQ reload value. 2 to 256 scanlines are supported. + * Writing 00h to C000h will result in a SINGLE interrupt being generated + on the next rising edge of A12. No more interrupts will be generated + until C000h is changed to a non-zero value. The counter is still being + reloaded, however, because writing a non-zero value to C000h results in + it firing an interrupt after the new count expires. + + * The IRQ counter WILL NOT DECREMENT AT ALL unless bit 3 OR bit 4 of 2000h + on the PPU are set! If both of these bits are clear, the IRQ counter will + not count no way no how!!! + If both are set, the counter decrements twice per frame on my MMC3, but + it may act erratically on your MMC3. Don't count on this effect occuring. + + * For some reason, yet to be determined, if both bits 3 and 4 of PPU + register 2000h are clear, the IRQ counter will not decrement, even if + the PPU address is manually manipulated (with 2001h set to 00h to disable + rendering) through 2006h. If either or both bits are set, the counter will + decrement properly if the PPU address is manually manipulated. + + Various notes and effects of the IRQ counter reloading stuff: + The IRQ counter reloading has some minor consequences that should be made + clear. Some games like Megaman 6 and Pinbot use this so emulating properly + is important for these games to work. + + MM6 will write to E000h to clear the flag, E001h to re-enable interrupts, + and finally it will write to C000h to set up a new time period. This is + legal SO LONG AS C000h is written to before the next scanline (remember: + the counter is reloaded on the NEXT rising edge of A12 after the counter + reaches 00h, and thus fires). + + Kevin did a little test to determine the effect of C001h on the IRQ counter + like so: + First, C000h had 02h written to it. Toggling A12 3 times resulted in an IRQ + being generated. The IRQ was cleared, then A12 was toggled 2 more times. + Next, 03h was written to C000h, C001h was written to, and finally 04h was + written to C000h. A12 was toggled again and it took *5* counts to flag an + interrupt, proving that the value of C000h is only checked at the time of + reloading on the rising edge of A12. Kevin performed other tests to + corroborate this, and they all passed (i.e. checking to see if the reload + happened on the FALLING edge of A12, etc.) + +Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc. +----------------------------------------------------------- + +Used by Gun Sight (Laser Invasion), Uchuu Keibitai SDF, Bandit Kings +(Suikoden), Castlevania 3, Nobunaga Sengoku (Nobunaga's Ambition 2), Nobunaga +Bushou, Shin 4 Nin Uchi Mahjong, Ishin no Arashi, L'Empereur, Ganbare Goemon +Gaiden (bugged hack?), Romance of the Three Kingdoms 2 (Sangokushi 2), Gemfire +(Royal Blood), Uncharted Waters (Daikoukai Jidai), Aoki Ookami, Just Breed, +Metal Slader Glory. + +--> Mapper 5: MMC5 - I/O Map +--> Mapper 5: MMC5 - CPU Memory Control +--> Mapper 5: MMC5 - Video Name Table +--> Mapper 5: MMC5 - Video Pattern Table +--> Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit +--> Mapper 5: MMC5 - Video EXRAM +--> Mapper 5: MMC5 - Sound Control + +Mapper 5: MMC5 - I/O Map +------------------------ + +Summary of all MMC5 Registers + 5000h Sound Channel 1 Pulse Control ;\ + 5002h Sound Channel 1 Frequency LSB ; + 5003h Sound Channel 1 Frequency MSB ;/ + 5004h Sound Channel 2 Pulse Control ;\ + 5006h Sound Channel 2 Frequency LSB ; + 5007h Sound Channel 2 Frequency MSB ;/ + 5010h Sound Channel 3 PCM Control/Status (R/W) + 5011h Sound Channel 3 PCM Data + 5015h Sound Channel 1 and 2 Enable/Status (R/W) + 5100h PRG Bank Size (Mode for Port 5114h-5117h) + 5101h CHR Bank Size + 5102h RAM Write Protect Key 1 + 5103h RAM Write Protect Key 2 + 5104h EXRAM Mode Setting + 5105h Name Table Select + 5106h Name Table Fill-Mode Tile Number + 5107h Name Table Fill-Mode Palette Number + 5113h-5117h PRG Bank Selection Registers + 5120h-5127h CHR Bank Selection for Sprites and for CPU Access + 5128h-512Bh CHR Bank Selection for Background + 5130h CHR Bank MSBs + 5200h Horizontal Split Control + 5201h Horizontal Split Scroll Position + 5202h Horizontal Split CHR Bank Selection + 5203h Vertical IRQ Counter + 5204h Vertical IRQ Control/Status (R/W) + 5205h Multiply Unit input/output (R/W) + 5206h Multiply Unit input/output (R/W) + 5800h Unknown... (Just Breed writes 0xh to this address) + 5C00h-5FFFh EXRAM (1K) (R/W) +Ports 5102h-5103h, 5105h-5107h, 5200h-5203h are Write Only. +Ports 5204h-5206h are Read/Write. Other Ports unknown. + +Mapper 5: MMC5 - CPU Memory Control +----------------------------------- + +5100h - PRG Bank Size Control (Mode for Port 5114h-5117h) + Bit7-2 Not used + Bit1-0 PRG Bank Size (0=32K, 1=16K, 2=Mixed, 3=8K) + +5102h-5103h - RAM Write Protect Keys + 5102h RAM Write Protect Key 0 (Lower 2bit must be 02h for write-enable) + 5103h RAM Write Protect Key 1 (Lower 2bit must be 01h for write-enable) +RAM is always read-able, but is write-able only with above settings. + +5113h-5117h - PRG Bank Selection Registers + Port Type Mode3/8K Mode2/Mixed Mode1/16K Mode0/32K + 5113h RAM 8K at 6000h 8K at 6000h 8K at 6000h 8K at 6000h + 5114h ROM/RAM 8K at 8000h, N/A , N/A , N/A + 5115h ROM/RAM 8K at A000h, 2x8K at 8000h, 2x8K at 8000h, N/A + 5116h ROM/RAM 8K at C000h, 8K at C000h, N/A , N/A + 5117h ROM 8K at E000h, 8K at E000h, 2x8K at C000h, 4x8K at 8000h +Lower one or two bits of 2x8K or 4x8K bank numbers are ignored. + +RAM bank selection via Port 5113h-5116h (not 5117h): + Bit7 ROM/RAM Mode (0=RAM, 1=ROM) (Port 5114h-5116h only, not 5113h,5117h) + Bit6-3 Not used + Bit2 RAM Chip Select (0=1st chip, 1=2nd chip, or open bus if single chip) + Bit1-0 Select 8K RAM Bank in currently selected RAM chip (32K chips only) +Existing RAM configurations are: 8K (single 8K chip), 16K (two 8K chips), +and 32K (single 32K chip). + +On reset, 8K mode is activated, and all ROM banks are set to the LAST 8K bank +in the cartridge. + +Mapper 5: MMC5 - Video Name Table +--------------------------------- + +5105h - Name Table Select + Bit1-0 Select NT0 VRAM at 2000h-23FFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE) + Bit3-2 Select NT1 VRAM at 2400h-27FFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE) + Bit5-4 Select NT2 VRAM at 2800h-2BFFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE) + Bit7-6 Select NT3 VRAM at 2C00h-2FFFh (0=BLK0, 1=BLK1, 2=EXRAM, 3=FILLMODE) +If it isn't used for other purpose, then EXRAM can be used as 3rd Name-table. + +5106h - Name Table Fill-Mode Tile Number (Bit7-0) +5107h - Name Table Fill-Mode Palette Number (only Bit1-0 used) +In FILLMODE, the entire Name-table is filled by Port 5106h/5107h settings. + +Mapper 5: MMC5 - Video Pattern Table +------------------------------------ + +5101h - CHR Page Size + Bit7-6 Not used + Bit1-0 CHR Bank Size (0=8K, 1=4K, 2=2K, 3=1K) +Bank selection registers below are 8bit, so 1K mode can address only 256K VROM, +8K mode could address up to 2MB VROM. + +5120h-5127h - CHR Bank Selection for Sprites and for CPU Access + Port Mode3/1K Mode2/2K Mode1/4K Mode1/8K + 5120h 1K at 0000h N/A N/A N/A + 5121h 1K at 0400h 2K at 0000h N/A N/A + 5122h 1K at 0800h N/A N/A N/A + 5123h 1K at 0C00h 2K at 0800h 4K at 0000h N/A + 5124h 1K at 1000h N/A N/A N/A + 5125h 1K at 1400h 2K at 1000h N/A N/A + 5126h 1K at 1800h N/A N/A N/A + 5127h 1K at 1C00h 2K at 1800h 4K at 1000h 8K at 0000h +Used for Sprite Tiles (not for Background Tiles), and also used for CPU VRAM +Access via Port 2006h/2007h. + +5128h-512Bh - CHR Bank Selection for Background + 5128h 1K at X000h N/A N/A N/A + 5129h 1K at X400h 2K at X000h N/A N/A + 512Ah 1K at X800h N/A N/A N/A + 512Bh 1K at XC00h 2K at X800h 4K at X000h 8K at 0000h +Used for Background Tiles, the "XN00h" addresses in 1K,2K,4K are shared for +both Pattern Tables at 0N00h and 1N00h, ie. BG Pattern Table selection in Port +2000h/Bit4 doesn't matter (except in 8K mode). + +5130h - CHR Bank MSBs +Just Breed, Gun Sight, and Uchuu Keibitai SDF write 00h to this address. + Bit7-6 Not used + Bit1-0 Upper 2bit for 8bit Port 5120h-512Bh, and for EXRAM 6bit Tile Banks +Writing to Port 5120h-512Bh copies the written 8bit value plus the 2bit port +5130h value to internal 10bit registers (subsequent writes to 5130h do not +affect those memorized 10bit bank numbers). + +Other Background CHR Bank Selection Modes (which do not use 5128h-512Bh) +In Horizontal Split Mode, left or right BG Tiles use 4K CHR bank in Port 5202h. +In ExGrafix Mode, 4K CHR banks are specified for each single BG Tile in EXRAM. + +Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit +------------------------------------------------------ + +MMC5 allows to split the screen horizontally and vertically. +Horizontal Split is handled by hardware (automatically mid-scanline). +Vertical Split is to be handled by software (upon IRQ during HBlank). + +5200h - Horizontal Split Control + Bit7 For the E function (0=Don't use, 1=Use) + Bit6 Boundary's side is for using Split Mode extension of graphics + (0=Left side, 1=Right side) + Bit5 Not used + Bit4-0 Left boundary is designated with the char. # to count places +Used by Uchuu Keibitai SDF, most or all other games don't use H-Split. + Examples for 5200h Settings: + 00h (not?) used yet + 82h Used for SplitMode GFX extension from left 1-2 character + C2h Used for SplitMode GFX extension from the right side 3 chars. + C0h Used for SplitMode GFX extension on the whole screen + D0h Used for SplitMode GFX extension on the right side of the screen + 90h Used for SplitMode GFX extension on the left side of the screen + +5201h - Horizontal Split Scroll Position +"$2005 determines the vertical movement; it can also delay ext. gfx's vert. +movement if necessary. It's written 2 times in bulk in the same way as it would +slip off a grade in $2005." + +5202h - Horizontal Split CHR Bank Selection + Bit7-6 Not used + Bit5-0 Select 4K VROM at both 0000h-0FFFh and 1000h-1FFFh +Presumably used for BG Tiles in the Horizontal Split area, instead of the +normal BG-CHR Bank Selection via 5128h-512Bh. + +5203h - Vertical IRQ Counter +MMC3-style, decremented each scanline, paused during VBlank. +A setting of 00h seems to disable the counter (or, maybe sets it to 256 lines). + +5204h - Vertical IRQ Control/Status (R/W) + Bit7/Write IRQ Enable (0=Disable, 1=Enable; forward IRQ Flag to CPU) + Bit7/Read IRQ Flag (0=No, 1=Interrupt Request; gets set even if disabled) + Bit6/Read In Frame Rendering Flag (0=Vblank, 1=Rendering/Non-Vblank) +The IRQ flag is cleared/acknowledged when reading 5204h, and also automatically +during Vblank. + +5205h - Unsigned Multiply unit Factor A (W) / Result LSB (R) +5206h - Unsigned Multiply unit Factor B (W) / Result MSB (R) +Multiplication is unsigned. There is no noticable delay (the 16bit result can +be read back right after writing). + +Mapper 5: MMC5 - Video EXRAM +---------------------------- + +5C00h-5FFFh - EXRAM +Built-in 1K RAM, can be used in different modes, as VRAM or as WRAM. + +5104h - EXRAM Mode Setting + Bit7-6 Not used + Bit1-0 Select EXRAM Mode + 0 VRAM Extra Name Table (via Port 5105h) + 1 VRAM ExGrafix Color Expansion (see below) + 2 General purpose WRAM (read/write) + 3 General purpose WRAM (write protected) +In VRAM modes, EXRAM can be probably accessed during VBlank only (just as +normal VRAM). In WRAM modes, EXRAM can be probably accessed at any time, for +use as general purpose Work RAM, instead of (or additionally to) normal SRAM. + +ExGrafix Mode (used by most MMC5 titles, except Castlevania 3) +5C00h-5FBFh - Tile Number banks and Palettes for 32x30 Tiles + Bit7-6 Palette Number for each Tile + Bit5-0 4K Bank Number for each Tile (upper 2bit in port 5130h) +The 6bit+2bit Bank Numbers expand each of the 8bit Tile Numbers in Name Table +entries 000h-3BFh to 16bit Tile Numbers (max 1MB VROM addressable). The Palette +Numbers allow to specify different palettes for each single Tile, instead of +the normal Name Table palettes which share one palette entry for each 4 Tiles. +Name Table entries 3C0h-3FFh and EXRAM 5FC0h-5FFFh are not used in this mode. +Also BG-CHR Bank Selection Ports 5128h-512Bh are not used. + +Mapper 5: MMC5 - Sound Control +------------------------------ + +MMC5 Sound, Japanese 60pin Famicom carts only, not NES 72pin carts. +The MMC5 sound registers (port 50xxh) are working very similar to NES APU +registers (port 40xxh), but without sweep support, without triangle/noise +channels, without real DMA, and with a bunch of other differences. + +5000h - MMC5 Sound Volume/Decay Channel 1 (Rectangle) +5004h - MMC5 Sound Volume/Decay Channel 2 (Rectangle) + 0-3 Volume / Envelope decay rate + When Bit4=1: Volume (0=Silent/None..F=Loud/Max) + When Bit4=0: Envelope decay rate, 240Hz/(N+1) for MMC5 + 4 Envelope decay disable (0=Envelope/Decay, 1=Fixed Volume) + 5 Length counter clock disable / Envelope decay looping enable + When Bit4=1: length counter clock disable + When Bit4=0: envelope decay looping enable + 0: Disable Looping, stay at 0 on end of decay [ \_____ ] + 1: Enable Looping, restart decay at F [ \\\\\\ ] + (Does this still affect Length counter clock disable ?) + 6-7 Duty cycle type (MMC5 duty is inverse of NES APU duty) + 0 [__--------------] 87.5% Whereas, + 1 [____------------] 75.0% [_] = LOW (zero) (0) + 2 [________--------] 50.0% [-] = HIGH (volume/decay) (0..F) + 3 [____________----] 25.0% +The Duty Cycle counter is reset when the length counter of the same channel is +written to (via 5003h/5007h). + +Initial Decay Volume: +Only a write out to 5003h/5007h will reset the current envelope decay counter +to a known state (to 0Fh=max) for the appropriate channel's envelope decay +hardware. Otherwise, the envelope decay counter is always counting down (by 1) +at the frequency currently contained in the volume / envelope decay rate bits +(even when envelope decays are disabled by setting bit 4), except when the +envelope decay counter contains a value of 0, and envelope decay looping (bit +5) is disabled (0). + +5002h - MMC5 Sound Frequency Channel 1 (Rectangle) +5006h - MMC5 Sound Frequency Channel 2 (Rectangle) + 0-7 Lower 8 bits of wavelength (upper 3 bits in Register 3) +F = 1.79MHz/(N+1)/16 for Rectangle channels + +5003h - MMC5 Sound Length Channel 1 (Rectangle) +5007h - MMC5 Sound Length Channel 2 (Rectangle) +Writing to the length registers restarts the length (obviously), and also +restarts the duty cycle (channel 1,2 only), and restarts the decay volume. + 0-2 Upper 3 bits of wavelength (unused on noise channel) + 3-7 Length counter load register (5bit value, see below) +The above 5bit value is translated to the actual 7bit counter value as such: + Bit3=0 and Bit7=0 (Dividers matched for use with PAL/50Hz) + Bit6-4 (0..7 = 05h,0Ah,14h,28h,50h,1Eh,07h,0Dh) + Bit3=0 and Bit7=1 (Dividers matched for use with NTSC/60Hz) + Bit6-4 (0..7 = 06h,0Ch,18h,30h,60h,24h,08h,10h) + Bit3=1 (General Fixed Dividers) + Bit7-4 (0..F = 7Fh,01h..0Fh) +The 7bit counter value is decremented at 120Hz rate (ie. MMC5 decrements faster +than NES APU), the counter and sound output are stopped when reaching a value +of zero. The counter can be paused (and restarted at current location) by +Length Counter Clock Disabled bits in Register 5000h/5004h. + +5010h MMC5 Sound Channel 3 PCM Control/Status (R/W) + Bit7/Write PCM IRQ upon Data=00h Enable (0=Disable, 1=Enable) + Bit7/Read PCM IRQ upon Data=00h Flag (0=None, 1=Interrupt Request) + Bit6-1 Not used + Bit0/Write Wave Output (0=Manual Write to 5011h, 1=Capture 8000h-BFFFh Reads) + +5011h MMC5 Sound Channel 3 PCM Data + Bit7-0 Unsigned 8bit PCM Data (01h..FFh) (or 00h=trigger IRQ) +Used only in "Manual" mode (writes to 5011h are ignored in "Capture" mode). + +MMC5 PCM Notes +Naturally, the cartridge cannot take control of the CPU bus (and thus can't +perform real DMA transfers), instead, it's supporting a semi-automatic +"Capture" mode, in that mode the CPU must read data from 8000h-BFFFh (eg. via +LDA 8xxxh), and the data is then automatically forwarded to the DAC (without +needing a STA 5011h opcode); this can save a few clock cycles. +Writing 00h to the DAC (either via Manual or Capture mode) leaves the DAC +unchanged, and does instead trigger an IRQ; which can be used to handle end of +data blocks, this can also save a few clock cycles. + +5015h MMC5 Sound Channel 1 and 2 Enable/Status (R/W) + Bit7-2 Not used + Bit1 Channel 2 (0=Disable, 1=Enable) + Bit0 Channel 1 (0=Disable, 1=Enable) + +Note +MMC5 Audio is used by Just Breed, Shin 4-Nin Uchi Mahjong, Metal Slader Glory. + +Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches +------------------------------------------------------------------- + +Front Far East (FFE) disk drive "backup unit" connects to the cartridge slot, +allows to load copies of games from floppy/hdd/cdrom into RAM (max 512K) and +VRAM (max 256K). + +FFE Mapper Modes +--> Mapper 2: UNROM - PRG/16K +--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ +--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ +--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ + +FFE IRQ Registers + 4501h IRQ Disable/Acknowledge (write any value, usually 00h) + 4502h IRQ set lower 8bit of 16bit counter + 4503h IRQ set upper 8bit of 16bit counter and Start/Enable IRQs +IRQ counter is incremented each clock cycle, and produces IRQ on overflow. + +FFE Trainers/Patches +All FFE games are patched to work with the "FFE" mappers. In case that the +patches don't fit into normal ROM area, additional 512-byte patches are often +located in SRAM area at 7000h-71FFh (or, in a few cases, reportedly at 5D00h), +that patch-area may be used to handle FFE memory mapping, or for +cheats/trainers. Some MMC games also contain similar trainers (maybe working on +FFE device, if it supports MMC mappers?, or otherwise working on emulators +only). + +FFE Configuration Registers +Configuration Registers are initialized before the game is started, so most +games don't need to access these registers, except for changing Name Table / +Mirroring bits. A few games might also change the mode bits. + 42FCh-42FFh Configuration Register 1 + A0 Name Table Mode (0=One-Screen, 1=Two-Screen) (with D4 below) + A1 Unknown (0=WE, 1=SW) (usually 1) + D7-D5 Memory Mode (0-7) "*MODE" + 1 Mapper 6 F4xxx + 2 Mapper 2 UNROM + 3 Mapper ? F4xxx + 4 Mapper 8 F3xxx/GNROM + 0,5-7 unknown (Great Tank uses settings 1 and 6) + ? unknown how to select Mapper 12 and Mapper 17 + + 0 Mapper 17 (Kaiketsu, Saiyuuki) + 7 Mapper 17 (Wing of Madoola) + D4 When A0=0: Select VRAM Page (?=BLK0, ?=BLK1) + When A0=1: ?Mirroring (0=Vertical, 1=Horizontal Mirroring) + D3-D0 Unknown (usually zero) + 43FEh Memory Control (apparently independendly of current Mode) (?) + D7-D2 Select ?K ROM at 8000h-? + D1-D0 Select 8K VROM at PPU 0000h-1FFFh + 43FFh Memory Control (as for current mode, ie. mirror of 8000h-FFFFh) (?) + 4500h Configuration Register 2 + D7-D6 FDS Mode (0=Disk/Load, 1=Reserved, 2=Cartridge, 3=Disk/Execute) + D5-D4 SRAM 6000h-7FFFh BANK "Present or Not" (0-3=?) + D3 SW Pin (maybe something related with above WE/SW selection) + D2-D0 PPU Mode Select (1or2?="*MODE" (32K), 5=256K, VRAM EXT, 7=256K) + +Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +----------------------------------------------- + +Several hacked Japanese titles use this mapper, such as the hacked version of +Wai Wai World. The unhacked versions of these games seem to use a Konami VRC +mapper, and it's better to use them if possible. + 8000h-FFFFh Memory Control (6bit) + Bit1-0 Select 8K VRAM (read/write-able) at PPU 0000h-1FFFh + Bit5-2 Select 16K ROM at 8000h-BFFFh (bank 0-0Fh) + N/A Fixed 16K ROM at C000h-FFFFh (always bank 7) (!) +Additional FFE registers: +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches + +Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +----------------------------------------------- + +10% of games declared as "Mapper 6" are this (and not Mapper 6). + 8000h-FFFFh Memory Control (6bit) + Bit3-0 Select 16K ROM at 8000h-BFFFh + Bit5-4 Select 8K VROM at PPU 0000h-1FFFh +Lower bits are ROM bank, upper bits VROM bank, ie. vice-versa as Mapper 6. +Additional FFE registers: +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches + +Mapper 7: AOROM - PRG/32K, Name Table Select +-------------------------------------------- + +Numerous games released by Rare Ltd. use this mapper, such as Battletoads, +Wizards & Warriors, and Solar Jetman. + 8000h-FFFFh Memory Control + Bit2-0 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank) + Bit4 One-Screen Name Table Select (0=BLK0, 1=BLK1) + Bit3,5-7 Not used +Uses a single 74LS161 chip (connection: /PRG-CLK, R/W-/LOAD). ANROM +additionally uses a 74LS02 to enable ROM only when R/W=HIGH and /PRG=LOW. +Board NES-AOROM-03: 256K PRG ROM (8 banks) (32pin ROM) (with bus-conflicts) +Board NES-ANROM-03: 128K PRG ROM (4 banks) (28pin ROM) (without bus-conflicts) +Board NES-AMROM: ? +All carts using it have 8K of VRAM at PPU 0000h. + +BNROM +Board NES-BNROM-01: 128K PRG ROM (4 banks) (28pin ROM) (with bus-conflicts) +Deadly Towers uses BNROM (with horizontal mirroring, instead of Bit4), the game +is typically marked as mapper 7 or mapper 34, although it's NOT AOROM nor +NINA-001. + +Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ +----------------------------------------------- + +Several hacked Japanese titles use this mapper, such as the hacked version of +Doraemon. + 8000h-FFFFh Memory Control (same as GNROM, Mapper 66) + Bit1-0 Select 8K VROM (usually read-only) at PPU 0000h-1FFFh + Bit5-4 Select 32K ROM at 8000h-FFFFh (initially 1st bank) +Additional FFE registers: +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches + +Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH +----------------------------------------------- + +Used only by Punch-Out, and Mike Tyson's Punch-Out. + A000h-AFFFh Select 8K ROM at 8000h-9FFFh (initially 1st bank) + N/A Fixed 24K ROM at A000h-FFFFh (always last three 8K banks) + B000h-CFFFh Select 4K VROM at PPU 0000h-0FFFh + D000h-DFFFh Select 4K VROM at PPU 1000h-1FFFh (used when latch=FDh) + E000h-EFFFh Select 4K VROM at PPU 1000h-1FFFh (used when latch=FEh) + F000h-FFFFh Mirroring Select (Bit0: 0=Vertical, 1=Horizontal mirroring) + PPU 1FD0h-1FDFh Access to Pattern Table 0, Tile FDh --> sets latch=FDh + PPU 1FE0h-1FEFh Access to Pattern Table 0, Tile FEh --> sets latch=FEh +The latch contains FEh on reset. The latch is automatically written to on any +access to PPU 1FD0h-1FEFh, which does usually happen when the PPU fetches +bitmap data for Tile FDh or FEh from Pattern Table 1. +The latches might also get changed on access to PPU 0FD0h-0FEFh (?) + +Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH +--------------------------------------------- + +Used only by Fire Emblem, Fire Emblem Gaiden, and Family War. + A000h-AFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) + B000h-BFFFh Select 4K VROM bank at PPU 0000h-0FFFh (used when latch0=FDh) + C000h-CFFFh Select 4K VROM bank at PPU 0000h-0FFFh (used when latch0=FEh) + D000h-DFFFh Select 4K VROM bank at PPU 1000h-1FFFh (used when latch1=FDh) + E000h-EFFFh Select 4K VROM bank at PPU 1000h-1FFFh (used when latch1=FEh) + F000h-FFFFh Mirroring Select (Bit0: 0=Vertical, 1=Horizontal mirroring) + PPU 0FD0h-0FDFh Access to Pattern Table 0, Tile FDh --> sets latch0=FDh + PPU 0FE0h-0FEFh Access to Pattern Table 0, Tile FEh --> sets latch0=FEh + PPU 1FD0h-1FDFh Access to Pattern Table 1, Tile FDh --> sets latch1=FDh + PPU 1FE0h-1FEFh Access to Pattern Table 1, Tile FEh --> sets latch1=FEh +The latches contain FEh on reset. Latches are automatically written to on any +access to PPU 0FD0h-0FEFh or 1FD0h-1FEFh, which does usually happen when the +PPU fetches bitmap data for Tile FDh or FEh. The new latch setting is then used +for all tiles (tiles FDh/FEh are still fetched from the latch +setting). + +Mapper 11: Color Dreams - PRG/32K, VROM/8K +------------------------------------------ + +This mapper is used on several unlicensed Color Dreams titles, including +Crystal Mines and Pesterminator. Not sure if their religious ("Wisdom Tree") +games use the same mapper or not. + 8000h-FFFFh Memory Control + Bit3-0 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank) + Bit7-4 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank) +Many games using this mapper are somewhat glitchy. Bus-conflicts. +Uses a single 74LS377 (8bit D flip-flop with clock enable). + +Mapper 12: FFE F6xxx - Not specified, NT, IRQ +--------------------------------------------- + +No info. Don't have a ROM-image. +Maybe this meant to be "Mapper ?", +--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +Additional FFE registers: +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches + +Mapper 13: CPROM - 16K VRAM +--------------------------- + +Used by Videomation (a bitmap drawing program). + N/A Fixed 4K VRAM at PPU 0000h-0FFFh (always Bank 0) + 8000h-FFFFh Select 4K VRAM at PPU 1000h-1FFFh (Bank 0-3) +16K VRAM for 32x30 different BG tiles (plus 64 sprites). Bus-conflicts. + +Mapper 15: X-in-1 - PRG/32K/16K, NT +----------------------------------- + +Used by Contra 100-in-1 (fake multicart with less than 100 different games), +and hacked versions of Crazy Climber, Dragon Ball, and Mobile Suit (single game +carts). + 8000h-FFFFh Memory Control (Decoded by address AND data lines) + D5-D0 Select 16K ROM Bank (X) + D6 Mirroring Control (0=Vertical, 1=Horizontal Mirroring) + D7 Select 8K ROM Bank (Y) (should be zero in non-8K-modes) + A1-A0 ROM Bank Mode (0=32K, 1=128K, 2=8K, 3=16K) + Mapping in different modes is: + 8K Mode - Bank (X*2+Y) at each 8000h, A000h, C000h, E000h + 16K Mode - Bank (X) at 8000h-BFFFh and (X) at C000h-FFFFh + 32K Mode - Bank (X) at 8000h-BFFFh and (X OR 1) at C000h-FFFFh + 128K Mode - Bank (X) at 8000h-BFFFh and LAST bank at C000h-FFFFh +Initially first 32K ROM selected. The cartridge contains 8K VRAM. + +Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM +------------------------------------------------ + +This mapper is used on several Japanese titles by Bandai, such as the +DragonBall Z series and the SD Gundam Knight series. + 6000h,7FF0h,8000h Select 1K VROM at PPU 0000h-03FFh + 6001h,7FF1h,8001h Select 1K VROM at PPU 0400h-07FFh + 6002h,7FF2h,8002h Select 1K VROM at PPU 0800h-0BFFh + 6003h,7FF3h,8003h Select 1K VROM at PPU 0C00h-0FFFh + 6004h,7FF4h,8004h Select 1K VROM at PPU 1000h-13FFh + 6005h,7FF5h,8005h Select 1K VROM at PPU 1400h-17FFh + 6006h,7FF6h,8006h Select 1K VROM at PPU 1800h-1BFFh + 6007h,7FF7h,8007h Select 1K VROM at PPU 1C00h-1FFFh + 6008h,7FF8h,8008h Select 16K ROM at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM at C000h-FFFFh (always last bank) + 6009h,7FF9h,8009h Mirroring/Page Select (Bit1-0) + 0 Two-Screen Vertical mirroring + 1 Two-Screen Horizontal mirroring + 2 Single-Screen BLK0 + 3 Single-Screen BLK1 + 600Ah,7FFAh,800Ah IRQ Control Register (Bit 0) + 0 Disable/Acknowledge IRQ + 1 Enable IRQ + 600Bh,7FFBh,800Bh Low byte of IRQ counter + 600Ch,7FFCh,800Ch High byte of IRQ counter + 600Dh,7FFDh,800Dh EPROM I/O Port - unknown how this works. +The IRQ counter is decremented each clock cycle if active, and set off when it +reaches zero. An IRQ interrupt is executed at that point. + +Datach Variant +Bandai's "Datach" games are using a Mapper 16 variant (with VRAM instead VROM), +and with built-in barcode reader. This seems to be occassionally referred to as +"Mapper 157" (though older Datach ROM-images are typically declared as "Mapper +16"). +--> Controllers - Barcode Readers + +Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ +----------------------------------------------- + +Several hacked Japanese titles use this mapper, such as the hacked versions of +Parodius and DragonBall Z 3. + 4504h Select 8K ROM at 8000h-9FFFh (initially 1st half of 1st 16K) + 4505h Select 8K ROM at A000h-BFFFh (initially 2nd half of 1st 16K) + 4506h Select 8K ROM at C000h-DFFFh (initially 1st half of last 16K) + 4507h Select 8K ROM at E000h-FFFFh (initially 2nd half of last 16K) + 4510h Select 1K VROM at PPU 0000h-03FFh + 4511h Select 1K VROM at PPU 0400h-07FFh + 4512h Select 1K VROM at PPU 0800h-0BFFh + 4513h Select 1K VROM at PPU 0C00h-0FFFh + 4514h Select 1K VROM at PPU 1000h-13FFh + 4515h Select 1K VROM at PPU 1400h-17FFh + 4516h Select 1K VROM at PPU 1800h-1BFFh + 4517h Select 1K VROM at PPU 1C00h-1FFFh +Additional FFE registers: +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches + +Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT +-------------------------------------------------------- + +This mapper is used on several Japanese titles by Jaleco, such as Baseball 3, +Lord of Kings, etc. + 8000h/8001h Select 8K ROM at 8000h-9FFFh (Lower/Upper 4bits) + 8002h/8003h Select 8K ROM at A000h-BFFFh (Lower/Upper 4bits) + 9000h/9001h Select 8K ROM at C000h-DFFFh (Lower/Upper 4bits) + N/A Fixed 8K ROM at E000h-FFFFh (always last bank) + 9002h Battery Back SRAM (Bit0: 0=Enable, 1=Disable) + (unused by Lord of Kings) + 9003h Unknown + (used by Lord of Kings) + A000h/A001h Select 1K VROM at PPU 0000h-03FFh (Lower/Upper 4bits) + A002h/A003h Select 1K VROM at PPU 0400h-07FFh (Lower/Upper 4bits) + B000h/A001h Select 1K VROM at PPU 0800h-0BFFh (Lower/Upper 4bits) + B002h/A003h Select 1K VROM at PPU 0C00h-0FFFh (Lower/Upper 4bits) + C000h/C001h Select 1K VROM at PPU 1000h-13FFh (Lower/Upper 4bits) + C002h/C003h Select 1K VROM at PPU 1400h-17FFh (Lower/Upper 4bits) + D000h/D001h Select 1K VROM at PPU 1800h-1BFFh (Lower/Upper 4bits) + D002h/D003h Select 1K VROM at PPU 1C00h-1FFFh (Lower/Upper 4bits) + E000h/E001h Lower 8bit of decrementing 16bit IRQ counter (Lower/Upper 4bits) + E002h/E003h Upper 8bit of decrementing 16bit IRQ counter (Lower/Upper 4bits) + F000h IRQ Control Register 0 + Bit0 Maybe 1=Load Counter? + F001h IRQ Control Register 1 + Bit0 IRQ Enable (0=Disabled, 1=Enable) + Bit1-3 IRQ Counter Width (0=16bit, 1=12bit, 2-3=8bit, 4-7=4bit) + With widths less than 16bit, underflows recurse only lower counter bits. + F002h Name Table Select (2bit) + 0 Two-Screen, Horizontal Mirroring + 1 Two-Screen, Vertical Mirroring + 2-3 Single-Screen BLK0 + F003h Unused (or an External I/O Port which is unused?) + +Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND +-------------------------------------------------------- + +This mapper is used on several Japanese titles by Namcot, such as Splatterhouse +and Family Stadium '90. + +Pattern Table Control + 8000h-87FFh Select 1K VROM at PPU 0000h-03FFh (with E800h/Bit6) + 8800h-8FFFh Select 1K VROM at PPU 0400h-07FFh ("") + 9000h-97FFh Select 1K VROM at PPU 0800h-0BFFh ("") + 9800h-9FFFh Select 1K VROM at PPU 0C00h-0FFFh ("") + A000h-A7FFh Select 1K VROM at PPU 1000h-13FFh (with E800h/Bit7) + A800h-AFFFh Select 1K VROM at PPU 1400h-17FFh ("") + B000h-B7FFh Select 1K VROM at PPU 1800h-1BFFh ("") + B800h-BFFFh Select 1K VROM at PPU 1C00h-1FFFh ("") +The upper two bits Port E800h-EFFFh are used to select VROM/VRAM mode (mind +that the lower six bits of that port Select 8K ROM at A000h-BFFFh). + E800h, Bit6 VROM/VRAM Mode for PPU 0000h-0FFFh (0=VROM+VRAM, 1=VROM-Only) + E800h, Bit7 VROM/VRAM Mode for PPU 1000h-1FFFh (0=VROM+VRAM, 1=VROM-Only) +In VROM-Only mode, VROM banks 0-FFh can be selected. In VROM+VRAM mode only +VROM banks 0-DFh can be selected, and values E0h-FFh select VRAM. + +Name Table Control + C000h-C7FFh Select 1K VROM/VRAM at PPU 2000h-23FFh (E0h and up = VRAM) + C800h-CFFFh Select 1K VROM/VRAM at PPU 2400h-27FFh (E0h and up = VRAM) + D000h-D7FFh Select 1K VROM/VRAM at PPU 2800h-2BFFh (E0h and up = VRAM) + D800h-DFFFh Select 1K VROM/VRAM at PPU 2C00h-2FFFh (E0h and up = VRAM) +Only VROM banks 0-DFh can be selected, and values E0h-FFh activate internal +VRAM, Bit0 of the bank number is then used to select BLK0 or BLK1. + +CPU Memory Control + E000h-E7FFh Select 8K ROM at 8000h-9FFFh (initially 1st half of 1st 16K) + Bit5-0 Page_number + E800h-EFFFh Select 8K ROM at A000h-BFFFh (initially 2nd half of 1st 16K) + Bit5-0 Page_number + Bit6 Select at CHR_address $0000-$0FFF 0:ROM&RAM 1:ROM + Bit7 Select at CHR_address $1000-$1FFF 0:ROM&RAM 1:ROM + F000h-F7FFh Select 8K ROM at C000h-DFFFh (initially 1st half of last 16K) + Bit5-0 Page_number + N/A Fixed 8K ROM at E000h-FFFFh (always 2nd half of last 16K) +The lower 6bit of these registers specify ROM bank numbers. Caution: The upper +2bit of E800h-EFFFh are used to select Pattern Table VROM/VRAM Mode. + +IRQ Control + 5000h-57FFh Bit7-0: Lower 8bit of 15bit IRQ counter (R/W) (!) + 5800h-5FFFh Bit6-0: Upper 7bit of 15bit IRQ counter (R/W) (!) + Bit7: 0=Disable IRQs, 1=Enable IRQs +The IRQ counter is incremented each clock cycle, an IRQ is generated when it +overflows (at 7FFFh, since it's a 15bit value). Sangokushi 2 uses IRQs, but +many other Namcot games don't use IRQs. + +Sound Control + 4800h Expand I/O Data Register + F800h Expand I/O Address Register + Bit7 Auto Increment (0=Disable, 1=Enable) + Bit6-0 Address (00h-7Fh) +Index Addresses: (Dots "..." = Japanese text, not translated) + 00h-3Fh See NAMCO.TXT, Japanese (.............) + 40h,48h,50h,58h,60h,68h,70h,78h Channel 1-8, Frequency Lower 8bit + 41h,49h,51h,59h,61h,69h,71h,79h See NAMCO.TXT, Japanese (......) + 42h,4Ah,52h,5Ah,62h,6Ah,72h,7Ah Channel 1-8, Frequency Middle 8bit + 43h,4Bh,53h,5Bh,63h,6Bh,73h,7Bh See NAMCO.TXT, Japanese (......) + 44h,4Ch,54h,5Ch,64h,6Ch,74h,7Ch Channel 1-8, Frequency Upper 2bit & Option + Bit7-5 Not used + Bit4-2 VVV: 8-(....)(... 2byte) ..: VVV=000... 16byte,VVV=100..8byte.... + Bit1-0 Frequency Upper 2bit + 45h,4Dh,55h,5Dh,65h,6Dh,75h,7Dh See NAMCO.TXT, Japanese (......) + 46h,4Eh,56h,5Eh,66h,6Eh,76h,7Eh Channel 1-8, Offset Address (00h-3Fh) + Bit7-1 AAAAAAA [6bit address stored in a 7bit value?] + Bit0 Not used + 47h,4Fh,57h,5Fh,67h,6Fh,77h,7Fh Channel 1-8 + Bit7-4 ????: 7...(kingofkings),3... + Bit3-0 VVVV: .... +Frequency: 0=Lowest, 3FFFFh=Highest. +According to Gorohs frequency table, Tone "C" of Octave "1-8" is: 1:47Eh, +2:8FBh, 3:11F6h, 4:23ECh, 5:47DAh, 6:8FB3h, 7:11F66h, 8:23ECCh. +According to my CPC frequency table, middle "C" of octave "0" should be +261.626Hz. No idea how to match that into a formula. + +Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND +-------------------------------------------------------- + +Used by Famicom Disk System only. +--> Famicom Disk System (FDS) + +Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ +-------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT +--------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ) +---------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +------------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ +-------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +------------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +VRC6 Sound Registers +Two Rectangle channels with 4bit volume levels each, one Saw channel with 5bit +volume level. These are added into a 6bit output level, and then merged with +normal Famicom sound signal. + +9000h/A000h - Channel 1/2 - Square Volume/Duty + Bit7-4 Duty Cycle bits: + 0000 - 1/16 "-_______________-_______________" ( 6.25%) + 0001 - 2/16 "--______________--______________" (12.50%) + 0010 - 3/16 "---_____________---_____________" (18.75%) + 0011 - 4/16 "----____________----____________" (25.00%) + 0100 - 5/16 "-----___________-----___________" (31.25%) + 0101 - 6/16 "------__________------__________" (37.50%) + 0110 - 7/16 "-------_________-------_________" (43.75%) + 0111 - 8/16 "--------________--------________" (50.00%) + 1xxx - 16/16 "--------------------------------" (100.00%) + Bit3-0 Linear Volume (0=Silence, 0Fh=Loudest) +100% Duty can be used as digitized mode, the channel permanently outputs high +level, ie. the current volume setting, and isn't affected by the frequency +registers. + +B000h - Channel 3 - Saw Volume Step + Bit7-6 Not used + Bit5-0 Volume Step (V) (0..2Ah=Silent..Loudest) (2Bh..3Fh=Wraps/Garbage) +The overall output looks like "//////" whereas each "/" is split into 7 steps, +the output level on step 1-7 is calculated as such: + FOR I=1 to 7 ;step 1-7 + IF I=1 THEN X=0 ;reset to 0 in 1st step + ELSE X=(X+V) AND FFh ;add accumulator + Output=(X/8) ;output upper 5bit of X + NEXT +Note: X is an 8bit value, and wraps on overflow, ie. if V>2Ah. + +9001h/A001h/B001h - Channel 1/2/3 - Frequency LSB + Bit7-0 Lower 8 bits of frequency data + +9002h/A002h/B002h - Channel 1/2/3 - Frequency MSB + Bit7 Channel disable (0=Disable, 1=Enable) + Bit6-4 Not used + Bit3-0 Upper 4 bits of frequency data +To calculate output frequency: + Channel 1/2: F=1.79MHz/16/(N+1) ;16-step duty cycles + Channel 3: F=1.79MHz/14/(N+1) ;7-step phases + +Mapper 21-26,73,75,85: Konami VRC Mappers +----------------------------------------- + +This chapter describes all known VRC variants. The different Port addresses are +specified as X.Y.Z which may look a bit abstract at the first glance, at second +glance it should be easier to understand as than using separate chapters for +each of the 13 variants. + +VRC Chip Versions + Type PRG Bank VROM Banks NT IRQ Sound + VRC1 PRG/8K VROM/4K NT - - + VRC2 PRG/8K VROM/1K NT - - + VRC3 PRG/16K VRAM IRQ - + VRC4 PRG/8K VROM/1K NT IRQ - + VRC6 PRG/16K/8K VROM/1K NT IRQ SOUND + VRC7 PRG/16K/8K VROM/1K NT IRQ SOUND +For most chips, there are different connection variants, VRC2a, VRC2b, etc. + +VRC Data Bus +VRC1, VRC2, and VRC3 use a 4bit data bus, connected to D3-D0, any 8bit +registers are thus split into two 4bit ports. VRC4 seems to have an additional +D4 pin, which is used only for 5bit PRG ROM banks. VRC6 and VRC7 have a full +8bit data bus. + +VRC Address Bus +Most VRCs have a 6bit address bus, described here as X.Y.Z - the upper four +address bits are always A15-A12 (X), however, the connection of the lower two +address bits (Y and Z) varies. VRC7 normally uses only X.Y bits (only the Sound +registers use X.Y.Z). VRC1/VRC3 uses only the X address bits. A15 serves as +chip select, and must be HIGH for all VRC registers. + +VRC Connection Variants of Lower two bits of X.Y.Z addresses + Mapper Y Z Used by + 75 VRC1 - - Ganbare Goemon 1, Junior Basket - Two on Two, King Kong 2, + Exciting Boxing, Jajamaru Ninpou Chou, Tetsuwan Atom + 22 VRC2a A0 A1 Twin Bee 3, Ganbare Pennant Race + 23 VRC2b A1 A0 Wai Wai World 1, Getsufuu Maden, Kaiketsu Yanchamaru 2 + Dragon Scroll, Gryzor/Contra, Jarinko Chie, Ganbare Goemon + 73 VRC3 - - Salamander + 21 VRC4a A2 A1 Wai Wai World 2 + 21 VRC4c A7 A6 Ganbare Goemon Gaiden 2 + 25 VRC4b A0 A1 Bio Miracle Bokutte Upa, Ganbare Goemon Gaiden, Gradius 2, + Racer Mini Yonku + 25 VRC4d A2 A3 Teenage Mutant Hero Turtles 1+2, Goal!! + 23 VRC4e A3 A2 Parodius da!, Akumajou Special, Crisis Force, + Tiny Toon Adventures 1, Moe Pro! + 24 VRC6a A1 A0 Akumajou Densetsu (Castlevania 3) + 26 VRC6b A0 A1 Esper Dream 2, Mouryou Senki Madara + 85 VRC7 A4 (A5) Lagrange Point (Z=A5 used for Sound only) + 85 VRC7b A3 (?) Tiny Toon Adventures 2 (no Sound - maybe not a VRC7 ?) +Note that most mapper numbers are shared for two different connection variants, +mapper 23 is even shared for different chip versions, the unused address bits +are usually zero, so that software and hardware could, for example, reproduce +Z=(A0 OR A2) for mapper 23. +VRC2a variant uses VROM bank outputs Bit1-7, all other VRCs use Bit0 and up. + +PRG ROM Bank Registers (decoded by X or X.Y parts of the X.Y.Z address) + VRC1 VRC2 VRC3 VRC4 VRC6 VRC7 Expl. + - - F - 8 - Select 16K ROM at 8000h-BFFFh + 8 8 - 8 - 8.0 Select 8K ROM at 8000h-9FFFh + A A - A - 8.1 Select 8K ROM at A000h-BFFFh + C - - - C 9.0 Select 8K ROM at C000h-DFFFh + - FIX FIX FIX - - Fixed 8K ROM at C000h-DFFFh (last-1 8K) + FIX FIX FIX FIX FIX FIX Fixed 8K ROM at E000h-FFFFh (last-0 8K) +The 16K banks of VRC3/VRC6 are Linear Addresses divided by 16K (not by 8K). +VRC4 can swap 8000h-9FFFh and C000h-DFFFh, see VRC4 Memory Control below. + +VROM Bank Registers (VRC2,VRC4=2x4bit LSB/MSB, VRC6,VRC7=8bit) + VRC2,4 VRC6 VRC7 Expl. + B.0.0/1 D.0.0 A.0 Select 1K VROM bank at PPU 0000h-03FFh + B.1.0/1 D.0.1 A.1 Select 1K VROM bank at PPU 0400h-07FFh + C.0.0/1 D.1.0 B.0 Select 1K VROM bank at PPU 0800h-0BFFh + C.1.0/1 D.1.1 B.1 Select 1K VROM bank at PPU 0C00h-0FFFh + D.0.0/1 E.0.0 C.0 Select 1K VROM bank at PPU 1000h-13FFh + D.1.0/1 E.0.1 C.1 Select 1K VROM bank at PPU 1400h-17FFh + E.0.0/1 E.1.0 D.0 Select 1K VROM bank at PPU 1800h-1BFFh + E.1.0/1 E.1.1 D.1 Select 1K VROM bank at PPU 1C00h-1FFFh +Note that VRC2A uses Bit7-1 of the 2x4bit register, VRC2B uses Bit6-0, VRC4 and +up use Bit6-0 (or all bits, Bit7-0, for large VROMs). +Lagrange Point contains VRAM instead VROM, the VRAM map-able. +Salamander (VRC3) contains VRAM, which appears to be map-able. + +VRC1 VROM Bank Registers (5bit values, split into 4+1 bits) + 9 Bit0: Mirroring, Bit1-2: MSBs of VROM banks, Bit3: Unused/zero + E Lower 4bit of 4K VROM bank at PPU 0000h-0FFFh (MSB in Bit1 of Register 9) + F Lower 4bit of 4K VROM bank at PPU 1000h-1FFFh (MSB in Bit2 of Register 9) + +IRQ Registers (VRC1,VRC2=N/A, VRC3,VRC4=2x4bit, VRC6,VRC7=8bit) + VRC4 VRC6 VRC7 VRC3 Expl. + F.0.0/1 F.0.0 E.1 A/B IRQ Reload value + F.1.0 F.0.1 F.0 C IRQ Control (Bit0: 0=Disable, Bit1: 0=One-Shot) + F.1.1 F.1.0 F.1 D IRQ Acknowledge (write any value to this address) +IRQ Reload is loaded to actual counter on write to IRQ Control Register, and on +Counter overflow. If IRQ Control Regiser Bit1 is set, then the counter is +automatically Restarted and Reloaded on Overflow. +The IRQ counter is incremented each 113.75 cycles (or each 114 cycles?), which +is almost exactly once per NTSC-scanline, including for "hidden" scanlines +during VBlank (only exception is VRC3, which is incremented every 256 cycles). +Mind that PAL/NTSC have different VBlank/Hblank times, and so, need different +counter values. The VRC4 games Goal! and Moe Pro! appear to be bugged pirate +ports from original Jaleco mapper to Konami-style mapper, these games do +incorrectly acknowledge IRQs by writing zero to the IRQ Control register rather +than by writing any value to the IRQ Acknowledge register, not sure if that +works on real VRC4 hardware. + +VRC4 Memory Control (VRC4 only - not VRC2,6,7) + 9.0.1 (or 9.1.0?) Memory Control (2bit) +Bit1: PRG ROM Swap (0=Normal, 1=Swap) When swapped: Port 8.0.0 controls ROM at +C000h-DFFFh, and ROM at 8000h-9FFFh becomes fixed, containing the 1st half of + 16K. +Bit0: Enable SRAM at 6000h-7FFFh (0=Disable, 1=Enable), VRC6 is having an +equivalent function Bit7 of Name Table Control register. + +Name Table Control + VRC1 VRC2,4 VRC6 VRC7 Expl. + 9 9.0.0 B.1.1 E.0 Mirroring/Page Select +Mirroring selection VRC2,VRC4,VRC7: Bit1-0, VRC6: Bit3-2, VRC1: Bit0: + 0 Two-Screen Vertical mirroring (VRC1: Register 9, Bit0=0) + 1 Two-Screen Horizontal mirroring (VRC1: Register 9, Bit0=1) + 2 Single-Screen BLK1 (VRC1: N/A) + 3 Single-Screen BLK0 (VRC1: N/A) +On VRC6, bit5 additionally inverts the BLK-outputs, BLK0 then becomes BLK1, and +vice versa, that also applies in Two-Screen modes, ie. the upper-left name +table may be either BLK1 or BLK0. +And, on VRC6, Bit7 controls SRAM (0=Disable, 1=Enable). +Note: VRC1 is also used by some VS System games. The VS System has 4K VRAM for +Four-Screen nametables (so, the VRC1's mirroring flag is probably ignored on +the VS System). + +VRC6 Sound Registers +--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND + +VRC7 OPL2 Sound Registers + 9.1.0 Index Register + 9.1.1 Data Register +--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND + +Unknown Registers +VRC3 - Salamander writes 00h to Port 8000h and 9000h. + +Mapper 28: Action 53 homebrew X-in-1 +------------------------------------ + +Used by the Action 53 homebrew multicart series. Supports NROM (1x16K/1x32K +PRG), UNROM (max 16x16K PRG), AOROM/ANROM/BNROM (max 8x32K PRG), CNROM (max +4x8K CHR). +The menu should initialize the four registers per game (for CHR ROM games it +should also relocate data to CHR RAM), and should finally set {5000h]=00h/01h +to select CHR/PRG mapping. The games can then simply use [8000h] to change CHR +ot PRG mapping (and usually don't need to touch [5000h] themselves; unless they +want to use both CHR and PRG banking, or want to change Hori/Vert mirroring). + +Registers + 4444h Unknown (used by menu software) + 5000h-5FFFh Select index (00h,01h,80h,81h) (bit1-6=Reserved) + 8000h-FFFFh Write data to selected register +Some games ported from SGROM (=what?) may rewrite Reg[80h], usually to change +mirroring. + +Reg[00h]: CHR bank (CNROM style) + 0-1 Select 8K VRAM at PPU 0000h-1FFFh (max 32Kbyte addressable) + 2-3 Reserved (0) + 4 One-Screen Name Table Select (0=BLK0, 1=BLK1) + 5-7 Reserved (0) +Bit4 is copied to Reg[80h].Bit0 when Reg[80h].Bit1=0 (otherwise bit4 is +ignored). + +Reg[01h]: PRG bank (inner bank) (AOROM/ANROM/BNROM/UNROM style) + 0-3 Select 16K/32K ROM bank at 8000h-HFFFh or C000h-FFFFh or 8000h-FFFFh + 4 One-Screen Name Table Select (0=BLK0, 1=BLK1) + 5-7 Reserved (0) +Bit4 is copied to Reg[80h].Bit0 when Reg[80h].Bit1=0 (otherwise bit4 is +ignored). + +Reg[80h]: Mode + 0-1 Nametable mode (0=BLK0, 1=BLK1, 2=VertMirroring, 3=HoriMirroring) + 2-3 PRG bank mode (0=32K, 1=Same as 0, 2=16K at C000h, 3=16K at 8000h) + 4-5 PRG outer bank size (0=32K, 1=64K, 2=128K, 3=256K) + 6 Reserved (0) + 7 Reserved (0 or 1 used by menu, but has no function) +If Reg[80h].Bit1=0 then Reg[80h].Bit0 can be also changed via writes to +Reg[00h/01h].Bit4. + PRG Bank Mode 8000h-BFFFh C000h-FFFFh + 32K at 8000h Var: outer*2+inner*2+0 Var: outer*2+inner*2+1 ;AOROM etc + 16K at 8000h Var: outer*2+inner*1 Fixed: outer*2+1 ;UNROM + 16K at C000h Fixed: outer*2+0 Var: outer*2+inner*1 +Merging "outer+inner" is masking off outer.LSBs and inner.MSBs depending on +outer bank size (ie. it's no real addition with overlapping bits). However, the +fixed banks are NOT masking off outer.LSBs. + +Reg[81h]: PRG bank (outer bank) (max 8Mbyte) + 0-7 Select 32K ROM bank at 8000h-FFFFh (initially last 16K at C000h) +When the outer bank size is set greater than 32K, the bank number is not barrel +shifted. Instead, the least significant bits are ignored. Bits 5 through 3, for +example, always control PRG ROM A20 through A18. + +Reset +Power-up reset maps last 16K of ROM to C000h-FFFFh (and leaves everything else +uninitialized). Soft reset does not affect any hardware registers, however, +games should contain some stub for redirecting their reset vector(s) to restart +the menu. + +Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT +------------------------------------------- + +This mapper is used on several Japanese titles by Irem, such as ImageFight 2. + 9FFFh Control Register (Bit1,0) + Bit0 - Name Table ?Mirroring (0=Horizontal, 1=Vertical Mirroring) + Bit1 - Port 8FFFh Switching Mode (see above) + 8FFFh When 9FFFh/Bit1=0: + Select 8K ROM bank at 8000h-9FFFh (initially 1st 8K bank) + Fixed 8K ROM bank at C000h-DFFFh (always 1st half of last 16K) + When 9FFFh/Bit1=1: + Fixed 8K ROM bank at 8000h-9FFFh (always 1st 8K bank) + Select 8K ROM bank at C000h-DFFFh (initially probably 9FFFh/Bit1=0) + AFFFh Select 8K ROM bank at A000h-BFFFh (initially 2nd 8K bank) + N/A Fixed 8K ROM bank at E000h-FFFFh (always last 8K bank) + BFF0h Select 1K VROM bank at PPU 0000h-03FFh + BFF1h Select 1K VROM bank at PPU 0400h-07FFh + BFF2h Select 1K VROM bank at PPU 0800h-0BFFh + BFF3h Select 1K VROM bank at PPU 0C00h-0FFFh + BFF4h Select 1K VROM bank at PPU 1000h-13FFh + BFF5h Select 1K VROM bank at PPU 1400h-17FFh + BFF6h Select 1K VROM bank at PPU 1800h-1BFFh + BFF7h Select 1K VROM bank at PPU 1C00h-1FFFh + +Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ +------------------------------------------------------------ + +Used by Don Doko Don I, II, Flintstones - Rescue of Dino & Hoppy, Bakushou +Jinsei Gekijou I, II, III, Insector X, Operation Wolf, Power Blazer, Golf Ko +Open, Akira, Takeshi no Sengoku Fuuunji, Jetsons - Cogswell's Caper, Bubble +Bobble 2, Captain Saver. + +TC0190 and TC0350 are slightly different, one has IRQs, one doesn't. No idea +which is which, so they'll be referenced as Type I and II. + +Type I and II - Memory Banking Registers + 8000h Select 8K ROM bank at 8000h-9FFFh (Type I: Bit6=Mirroring, see below) + 8001h Select 8K ROM bank at A000h-BFFFh + N/A Fixed 16K ROM bank at C000h-FFFFh (always last 16K) + 8002h Select 2K VROM bank at PPU 0000h-07FFh + 8003h Select 2K VROM bank at PPU 0800h-0FFFh + A000h Select 1K VROM bank at PPU 1000h-13FFh + A001h Select 1K VROM bank at PPU 1400h-17FFh + A002h Select 1K VROM bank at PPU 1800h-1BFFh + A003h Select 1K VROM bank at PPU 1C00h-1FFFh + +Type I - Mirroring + 8000h Bit4-0:See above, Bit6:Mirroring (0=Vertical, 1=Horizontal Mirroring) +Ignore this bit if Type II registers are used. + +Type II - Mirroring and IRQ + C000h IRQ Counter (incremented every scanline, paused during VBlank) + C001h IRQ Related (write same value as to C000h) + C002h IRQ Start/Enable (write any value) + C003h IRQ Acknowledge/Stop (write any value) + E000h Mirroring (Bit6) (0=Vertical, 1=Horizontal Mirroring) + E001h,E002h,E003h Unknown + +Mapper 34: Nina-1 - PRG/32K, VROM/4K +------------------------------------ + +Used by Impossible Mission II. + 7FFEh Select 4K VROM bank at PPU 0000h-0FFFh (4bit) + 7FFFh Select 4K VROM bank at PPU 1000h-1FFFh (4bit) + 7FFDh Select 32K ROM bank at 8000h-FFFFh (1bit) (initially 1st bank) +Contains 8K WRAM at 6000h-7FFFh (not sure if last three bytes can be used). +Uses six TTL chips, 2x74LS173, 74LS139, 74LS133, 74LS74, and 74LS00, and a +faux-lockout chip labelled 'NINA'. + +Note: BNROM is accidentally also marked Mapper 34, although it's actually a +AOROM variant. For details, see +--> Mapper 7: AOROM - PRG/32K, Name Table Select + +Mapper 40: FDS-Port - Lost Levels +--------------------------------- + +Used by Super Mario Bros 2 - Lost Levels. + 8000h-9FFFh Disable/Reset IRQ counter (by writing any value) + A000h-BFFFh Enable/Start IRQ counter (by writing any value) + C000h-DFFFh Not Used + N/A Fixed 8K ROM at 6000h-7FFFh (always bank 6) + N/A Fixed 8K ROM at 8000h-9FFFh (always bank 4) + N/A Fixed 8K ROM at A000h-BFFFh (always bank 5) + E000h-FFFFh Select 8K ROM at C000h-DFFFh + N/A Fixed 8K ROM at E000h-FFFFh (always bank 7, ie. last bank) +When enabled, IRQ generated after 4096 clock cycles (about 36 scanlines). + +Uses different ports, but the features are about same as: +--> Mapper 50: FDS-Port - Alt. Levels + +Mapper 41: Caltron 6-in-1 +------------------------- + +Used by Caltron 6-in-1 cartridge only. + 6000h-67FFh Main Control Register (decoded by ADDRESS lines A0-A5) + A2-A0 Select 32K ROM at 8000h-FFFFh + A2 MSB of above bank number - also enables second register + A4-A3 Upper two bits of 8K VROM bank at 0000h-1FFFh + A5 Name Table (0=Vertical, 1=Horizontal Mirroring) + 8000h-FFFFh Auxilary CHR control (decoded by DATA lines D0-D1) + This register is write-protected when above A2=0 (!) + D1-D0 Lower two bits of 8K VROM bank at 0000h-1FFFh +When the NES is switched on, or the reset button is pressed, both registers are +cleared to 00h, done by a cool little diode / RC circuit on the PHI2 line. + +Mapper 42: FDS-Port - Mario Baby +-------------------------------- + +Used only by one game: A pirate copy of Bio Miracle Boukette Upa, renamed to +Mario Baby, and modified to work as cartridge (instead FDS floppy disk). + E000h-FFFCh Select 8K ROM at 6000h-7FFFh + N/A Fixed 32K ROM at 8000h-FFFFh (always last 32K) + E001h-FFFDh Select mirroring (Bit3: 0=Vertical, 1=Horizontal Mirroring) + E002h-FFFEh IRQ Control (Bit1: 0=Disable/Reset, 1=Enable/Start) + E003h-FFFFh Not used +When enabled, IRQ generated after 24576 clock cycles (about 216 scanlines). +These ports are mirrored from E000h-FFFFh, every 4 bytes. +Consists of a whopping 11 chips - 9 TTL/CMOS, 8K RAM, and 128K ROM. + +Mapper number 42 is also assigned to Ai Senshi Nicol. In short, doing this: + 8000h Select 8K VROM at PPU 0000h-1FFFh + F000h Select 8K ROM at 6000h-7FFFh + N/A Fixed 32K ROM at 8000h-FFFFh (always last 32K) +However, it is doing some odd initialization, writing to Port E000h (index, 1-5 +used), and Port F000h (data for index 1-5, looks like 8K ROM banks at 8000h, +A000h, C000h, 6000h, E000h). Note that: A) the last 32K seem to be always +mapped to 8000h-FFFFh. B) each final write to F000h seems to be done with index +4. If that behaviour doesn't change later on in the game, then Port F000h (or +even E000h) could be interpreted exactly as for Mario Baby. + +Mapper 43: X-in-1 +----------------- + +Used by 150-in-1 (a fake containing 56 games, plus some cheat modes, chip 0 is +1024K, chip 1 is 512K, chip 2-3 are not installed). + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A7-A0 Select 32K ROM Bank (From currently selected Chip) + A9-A8 Select ROM Chip (Empty bus if selected chip not installed) + A10 Not used (Always zero) + A11 Bank Mode (0=32K, 1=16K; Lower/Upper half via A12) + A12 Select 16K ROM Bank (0=Lower, 1=Upper) (Should be zero in 32K mode) + A13 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A14 Not used (Always zero) +Initially 1st 32K selected. The cartridge includes 8K VRAM. + +Mapper 44: 7-in-1 MMC3 Port A001h +--------------------------------- + +Used by Super Big 7-in-1. + A001h - Select 128K ROM/VROM Block (0..5) or last 256K ROM/VROM Block (6) +Block 0 seems to be required on power-up. + +The rest of both mappers is same as MMC3 (for the selected block of memory), +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 45: X-in-1 MMC3 Port 6000hx4 +----------------------------------- + +Used in Super 3-in-1, Super 4-in-1, Super 8-in-1, Hero 8-in-1, Super 13-in-1, +and 1000000-in-1 (a fake with 1000000 duplicated/nonsense titles). +Configuration value initialized by each FOUR writes to Port 6000h. + 6000h 1st write - Configuration Bits 0-7 + 6000h 2nd write - Configuration Bits 8-15 + 6000h 3nd write - Configuration Bits 16-23 + 6000h 4th write - Configuration Bits 24-31 +The meaning of the 32 configuration bits is: + Bit7-0 VROM base in 1K steps + Bit15-8 ROM base in 8K steps + Bit19-16 VROM mask in 1K steps, Mask=(2 SHL (X AND 7))+(X AND 8)/8 + Bit23-20 VROM base in 256K steps + Bit29-24 ROM mask in 8K steps, Mask=(3Fh AND (NOT X)) + Bit30 LOCK (set when menu selection completed, probably locks Port 6000h) + Bit31 ??? +Memory selections are Bank=((Mmc3Bank AND ConfigMask) OR ConfigBase). For MMC3 +Registers 0 and 1 (map 2x1K banks), above formula applies to both banks, ie. +VROM Mask=0 maps same 1K bank twice (instead two continous 1K banks). +128K Block 3 seems to be required on power-up, ie. the entry point is at the +end of 512K ROMs, or in the middle of 1024K ROMs. The MMC3 Port A001h +apparently can write-protect Port 6000h (just like it disables SRAM at +6000h-7FFFh). At least some carts have at least 2K SRAM (Mario 3 in Super +8-in-1 uses RAM at 7800h-7FFFh). + +The rest of the mapper is same as MMC3 (for the selected block of memory), +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 46: 15-in-1 Color Dreams +------------------------------- + +Used by Rumble Station 15-in-1, which contains 15 Color Dreams games. + 6000h-7FFFh Multicart Memory Control + Bit0-3 Select 64K ROM Block (initially 1st bank) (always same as below) + Bit4-7 Select 64K VROM Block (initially 1st bank) (always same as above) + 8000h-FFFFh Memory Control (selection within current 64K block) + Bit1 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank) + Bit6-4 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank) +Port 8000h-FFFFh is same as Mapper 11, except that it is limited to 64K, and +except that it doesn't seem to have bus-conflicts (the menu always uses Port +8888h, regardless of underlaying ROM content). +In some games ROM/VROM is less than 64K, so some memory areas are unused. +--> Mapper 11: Color Dreams - PRG/32K, VROM/8K + +Note: The Rumble Station is not a cartridge - it is a complete NES with +built-in games, assembled in a "wing-shaped" gamepad case (ie. it consists of a +CPU, PPU, APU, ROM, mapper, and joypad). + +There's also a "Rumble Station Mark 2" - claiming to contain 29 games - +actually containing only 16 games - which may use different mapper? + +Mapper 47: 2-in-1 MMC3 Port 6000h +--------------------------------- + +Used by 2-in-1 cart "Super Spike V'Ball + Nintendo World Cup". + 6000h Select 1st or 2nd half of ROM/VROM (0 or 1) +The rest of the mapper is same as MMC3 (for the selected block of memory), +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +The cartridge doesn't have SRAM, but the MMC3 Port A001h can apparently +write-protect Port 6000h (just like it could disable SRAM at 6000h-7FFFh). + +Mapper 48: Taito TC190V +----------------------- + +Reportedly "Tatio TC190V" used by "FlintStone". +Sounds like the Type II (or Type I?) variant of Mapper 33: +--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ + +Mapper 49: 4-in-1 MMC3 Port 6xxxh +--------------------------------- + +Used by Super HIK 4-in-1. +ROM/VROM are split into 128K blocks each, done as such: + [6000h]=01h ;init + [6800h]=00h ;game 0 + [6808h]=08h crashes ? + [6841h]=41h ;game 1 + [6881h]=81h ;game 2 + [68C1h]=C1h ;game 3 +The rest of the mapper is same as MMC3 (for the selected block of memory), +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +The cartridge doesn't have SRAM, but the MMC3 Port A001h apparently can +write-protect Ports at 6000h-7FFFh (just like it could disable SRAM at +6000h-7FFFh). + +Mapper 50: FDS-Port - Alt. Levels +--------------------------------- + +Used by Super Mario Bros 2 - Alt. Levels. + 4022h Select 8K ROM at C000h-DFFFh + Bit0 and/or Bit3 ZERO Bank 0 + Bit0 and/or Bit3 SET Bank 0Ch (or maybe INCREMENT bank number?) + Other Bits Unknown + 4122h IRQ Control + Bit0 and/or Bit1 ZERO Disable/Acknowledge + Bit0 and/or Bit1 SET Enable/Start + N/A Fixed 8K ROM at 6000h-7FFFh (always bank 0Fh, ie. last bank) + N/A Fixed 8K ROM at 8000h-9FFFh (always bank 08h) + N/A Fixed 8K ROM at A000h-BFFFh (always bank 09h) + N/A Fixed 8K ROM at E000h-FFFFh (always bank 0Bh) +When enabled, IRQ generated after 4096 clock cycles (about 36 scanlines). + +Uses different ports, but the features are about same as: +--> Mapper 40: FDS-Port - Lost Levels + +Mapper 51: 11-in-1 +------------------ + +Used by 11-in-1, containing ball games, like "soccer ball", and "golf ball". + 6000h Mode Register + Bit1 ROM Block Size (0=128K Mode, 1=32K Mode) + Bit4 Unknown + 8000h Base Address in 32K Steps (X) (0-0Fh) + 32K Mode: Select 32K Bank (X) at 8000h-FFFFh (initially 1st 32K bank) + 128K Mode: Select 16K Bank (X*2 OR 07h) at C000h-FFFFh + And: Select 8K Bank (X*4 OR 23h) at 6000h-7FFFh (for FDS ports) + C000h Lower 16K Select (Y) (0-1Fh) (128K Mode only, UNROM-style) + 128K Mode: Select 16K Bank (Y*2 OR Y/10h) at 8000h-BFFFh +The cartridge does have 8K VRAM, even though there's a ROM-image around in +which somebody has incorrectly included a copy of above 8K VRAM as "8K VROM". + +Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM +------------------------------------------- + +Used by Mario Party 7-in-1 (or short, Mari7in1). +"It's MMC3 and an extra bank control register. There is 1Mbyte of PRG ROM and +1Mbyte of CHR ROM on this cart. Interestingly, all the games appear to be NTSC, +except SMB2. For some reason, this is the PAL version! It consists of 1 6264 8K +RAM chip (for WRAM), and 3 glop-tops. 2 are 1Mbyte ROMs while the remaining +chip is the mapper." + 6800h Bank Control Byte + Bit7 Not used + Bit6 VROM Bank Size (0=256K, 1=128K) + Bit5,2,4 VROM 128K Bank (Bit4 not used in 256K CHR mode) + Bit3 PRG ROM Bank Size (0=256K, 1=128K) + Bit2,1,0 PRG ROM 128K Bank (Bit0 not used in 256K PRG mode) +Note: Bit2 is both MOST significant PRG bit, and MIDDLE significant CHR bit. +After a reset, this register is 00h. It can only be written once. +To reset it and allow another write, you must reset the console. + +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 56: Pirate SMB3 +---------------------- + +Used only by a pirate copy of Super Mario Bros. 3. + 8000h Unknown (always 08h) (maybe counter LSBs, if any) + 9000h Bit7-4 of 16bit IRQ counter + A000h Bit11-8 of 16bit IRQ counter + B000h Bit15-12 of 16bit IRQ counter + C000h IRQ Anable (FFh=Enable, 00h=Disable) + D000h IRQ Acknowledge (Always write FFh, or EFh) + E000h Ignore - MMC3-index (Port 8000h) relicts redirected to E000h + F000h Select 8K ROM at 8000h-9FFFh + F001h Select 8K ROM at A000h-BFFFh + F002h Select 8K ROM at C000h-DFFFh + N/A Fixed 8K ROM at E000h-FFFFh (always last bank) + F003h Unknown (always 10h) + F400h Select 1K VROM at PPU 0000h-03FFh + F401h Select 1K VROM at PPU 0400h-07FFh + F402h Select 1K VROM at PPU 0800h-0BFFh + F403h Select 1K VROM at PPU 0C00h-0FFFh + F404h Select 1K VROM at PPU 1000h-13FFh + F405h Select 1K VROM at PPU 1400h-17FFh + F406h Select 1K VROM at PPU 1800h-1BFFh + F407h Select 1K VROM at PPU 1C00h-1FFFh +The cartridge often uses silly mirrors like C5A7h, mask 8000h-EFFFh by F000h, +and F000h-FFFFh by F407h. The IRQ counter is incremented every clock cycle. + +Mapper 57: 6-in-1 +----------------- + +Used by Game Star 6-in-1 GK-L01A, 6-in-1 GK-L02A, and 54-in-1 GK-54. + 8000h Extra Port for CNROM Games in 2nd 64K of VROM + Bit2-0 Select 8K VROM at PPU 0000h-1FFFh (ORed with value in Port 8800h) + Bit5-3 Not used (zero) + Bit6 Must be set for Second 64K Block of VROM + Bit7 Must be set for First 64K Block of VROM + 8800h Main Port + Bit2-0 Select 8K VROM at PPU 0000h-1FFFh (ORed with value in Port 8000h) + Bit3 Mirroring (0=Vertical, 1=Horizontal Mirroring) + Bit4 ROM Size (0=16K; Bank X twice, 1=32K; Bank X and X+1) + Bit7-5 Select 16K ROM at 8000h-BFFFh and C000h-FFFFh (X) +All carts have 128K ROM and 128K VROM and contain 6 games (even "54-in-1"). + +Mapper 58: X-in-1 +----------------- + +Used by 68-in-1 (a fake containing only 8 games). + C000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A2-A0 Select 16K ROM Bank at 8000h-BFFFh and C000h-FFFFh (X) + A5-A3 Select 8K VROM Bank at PPU 0000h-1FFFh + A6 ROM Size (0=32K; Bank X and X+1, 1=16K; Bank X twice) + A7 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A12-A8 Unknown (Usually 0,/A6,0,/A6,A5,A3, except in yie-ar-kung-fu) + +Note: Study and Game 32-in-1 declared as "Mapper 58" should be Mapper 241, +--> Mapper 241: X-in-1 Education + +Mapper 61: 20-in-1 +------------------ + +Used by 20-in-1. + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A3-0 Select 32K ROM Bank at 8000h-FFFFh + A4 Bank Size (0=32K, 1=16K; only lower/upper half via Bit5) + A5 Select lower/upper half of selected 32K bank (in 16K mode) + A7 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A6,A8-A14 Not used (always 0) +There's also a version of the same cartridge with slightly different mapper: +--> Mapper 231: 20-in-1 + +Mapper 62: X-in-1 +------------------ + +Used by 700-in-1 (a fake containing only somewhat 50-100 games). + 8000h-BFFFh Memory Control (Decoded by address AND data lines) + A4-A0,D1-D0 Select 8K VROM at PPU 0000h-1FFFh + A5 ROM Size (0=32K; Bank X-1 and X, 1=16K; Bank X twice) + A7 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A6,A13-A8 Select 16K ROM at 8000h-BFFFh and C000h-FFFFh (X) + A14 Always 0 ? +ROM Bank lower bit (A8) should be always SET in 32K Mode. Initially 1st 32K. + +Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ +------------------------------------------------------- + +Used by Shinobi, Klax, and Skull & Crossbones. + 8000h Index/Control (6bit) + Bit7 CHR Address Select (0=Normal, 1=Address Areas XOR 1000h) + Bit6 PRG Address Select (0=Normal, 1=Address Areas plus 2000h) + Bit5 CHR Bank Size (0=Normal, 1=Use 1K-resolution instead 2x1K) + Bit3-0 Command Number (Note: Index 0-7 same as for MMC3) + 0 - Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh, if Bit7=1) + 1 - Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh, if Bit7=1) + 2 - Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh, if Bit7=1) + 3 - Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh, if Bit7=1) + 4 - Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh, if Bit7=1) + 5 - Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh, if Bit7=1) + 6 - Select 8K ROM at 8000h-9FFFh (or A000h-BFFFh, if Bit6=1) + 7 - Select 8K ROM at A000h-BFFFh (or C000h-DFFFh, if Bit6=1) + F - Select 8K ROM at C000h-DFFFh (or 8000h-9FFFh, if Bit6=1) + N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank) + 8 - Select 1K VROM page at PPU 0400h (used only if Bit5=1) + 9 - Select 1K VROM page at PPU 0C00h (used only if Bit5=1) + 8001h Data Register (indexed via Port 8000h) + A000h Mirroring Select (Bit0: 0=Vertical, 1=Horizontal Mirroring) + A001h Not used + C000h IRQ Reload Value (for decrementing Scanline-/clock-cycle-counter) + C001h IRQ Clock Source (Bit0: 0=Scanline Counter, 1=System Clock div 4) + E000h IRQ Disable/Acknowledge (write any value) + E001h IRQ Enable (write any value) + +Write to C000h: After N+1 clocks have occured, the IRQ flag will be set. N is +the value written to C000h. Writing a value of 00h will cause NO interrupts to +be generated at all. (Note: if C001h is written to, then a value of 00h can be +used- it will cause an interrupt to be generated in 2 clocks after C001h is +written to. No more interrupts will be generated unless C001h is written to +again). +Write to C001h: Will trigger a reload of the IRQ counter (and select the +desired clock source). One thing of note, after writing, the IRQ counter will +expire after a count of N+2 instead of N+1. In this case, a value of 00h in +C000h WILL generate an interrupt after 2 clocks. A value of FFh likewise +generates an interrupt after 257d clocks. + +Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ +------------------------------------------------- + +Used by Daiku no Gensan 2, Kaiketsu Yanchamaru 3, and Spartan X 2. +Note: Ai Sensei no Oshiete declared as "Mapper 65" is maybe a Konami mapper? + 9000h Unknown + 9001h Unknown + 9003h,9004h IRQ Control (not sure about difference between 9003h/9004h) + (00h=Disable IRQ, C0h=Enable IRQ, other values unknown) + 9005h IRQ Counter MSB of decrementing 16bit counter + 9006h IRQ Counter LSB of decrementing 16bit counter + B000h Select 1K VROM bank at PPU 0000h-03FFh + B001h Select 1K VROM bank at PPU 0400h-07FFh + B002h Select 1K VROM bank at PPU 0800h-0BFFh + B003h Select 1K VROM bank at PPU 0C00h-0FFFh + B004h Select 1K VROM bank at PPU 1000h-13FFh + B005h Select 1K VROM bank at PPU 1400h-17FFh + B006h Select 1K VROM bank at PPU 1800h-1BFFh + B007h Select 1K VROM bank at PPU 1C00h-1FFFh + 8000h Select 8K ROM bank at 8000h-9FFFh (initially 1st half of 1st 16K) + A000h Select 8K ROM bank at A000h-BFFFh (initially 2nd half of 1st 16K) + C000h Select 8K ROM bank at C000h-DFFFh (initially 1st half of last 16K) + N/A Fixed 8K ROM bank at E000h-FFFFh (always 2nd half of last 16K) + +Mapper 66: GNROM - PRG/32K, VROM/8K +----------------------------------- + +This mapper is used on several Japanese titles, such as Dragon Ball, and on +U.S. titles such as Gumshoe and Dragon Power. + 8000h-FFFFh Memory Control (2x2bits) + Bit1-0 Select 8K VROM bank at PPU 0000h-1FFFh (initially 1st bank) + Bit5-4 Select 32K ROM bank at 8000h-FFFFh (initially 1st bank) +This mapper is used on the DragonBall (NOT DragonBallZ) NES game. + +Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ +------------------------------------------- + +Used by Fantasy Zone 2. + 8000h IRQ Acknowledge (write any data to this address) + 8800h-8FFFh Select 2K VROM bank at PPU 0000h-07FFh + 9800h-9FFFh Select 2K VROM bank at PPU 0800h-0FFFh + A800h-AFFFh Select 2K VROM bank at PPU 1000h-17FFh + B800h-BFFFh Select 2K VROM bank at PPU 1800h-1FFFh + C800h-CFFFh IRQ Counter (two writes: 1st=MSB, 2nd=LSB) + (16bit decrementing clock cycle counter) + D800h-DFFFh IRQ Control (Bit4: 0=Disable, 1=Enable) + E800h-EFFFh No info - maybe Mirroring control ? + F800h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) + +Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM +----------------------------------------------- + +This mapper is used by After Burner I and II, and by Maharaja. + 8000h Select 2K VROM bank at PPU 0000h-07FFh + 9000h Select 2K VROM bank at PPU 0800h-0FFFh + A000h Select 2K VROM bank at PPU 1000h-17FFh + B000h Select 2K VROM bank at PPU 1800h-1FFFh + C000h Select 1K VROM bank as BLK0 (in VROM Mode) (from LAST 128 banks) + D000h Select 1K VROM bank as BLK1 (in VROM Mode) (from LAST 128 banks) + E000h Name Table Control + Bit4 Name Table VROM Mode (0=VRAM, 1=VROM via Port C000h/D000h) + Bit0 Name Table Mirroring (0=Horizontal, 1=Vertical Mirroring) + F000h Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) + +Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ +--------------------------------------------------------------- + +This mapper is used by Batman, Hebereke, Pyokotan no Da Meiro, Barcode World, +Gremlin 2, Honoo no Doukyuuji 1 and 2, and Gimmick. + 8000h Index Register (4bit) + 0 - Select 1K VROM at PPU 0000h-03FFh + 1 - Select 1K VROM at PPU 0400h-07FFh + 2 - Select 1K VROM at PPU 0800h-0BFFh + 3 - Select 1K VROM at PPU 0C00h-0FFFh + 4 - Select 1K VROM at PPU 1000h-13FFh + 5 - Select 1K VROM at PPU 1400h-17FFh + 6 - Select 1K VROM at PPU 1800h-1BFFh + 7 - Select 1K VROM at PPU 1C00h-1FFFh + 8 - Select 8K ROM/RAM at 6000h-7FFFh + Bit6=0 --> Select 8K ROM (Page number in bit5-0) + Bit6=1,Bit7=1 --> Select 8K SRAM + Bit6=1,Bit7=0 --> Select 8K "pseudo-random numbers?" + 9 - Select 8K ROM at 8000h-9FFFh + A - Select 8K ROM at A000h-BFFFh + B - Select 8K ROM at C000h-DFFFh + C - Select Mirroring + 0 Two-Screen, Vertical Mirroring + 1 Two-Screen, Horizontal Mirroring + 2 One-Screen, BLK0 + 3 One-Screen, BLK1 + D - IRQ control (00h=Disable, 81h=Enable, other values?) + E - IRQ LSB of decrementing clock cycle counter + F - IRQ MSB of decrementing clock cycle counter + N/A - Fixed 8K ROM at E000h-FFFFh (always last 8K bank) + A000h Data Register (indexed via Port 8000h) + +Mapper 70: Bandai - PRG/16K, VROM/8K, NT +---------------------------------------- + +Used by Taito's Arkanoid 2, and various Bandai games: Space Shadow, Kamen Rider +Club, Saint Seiya, Pocket Zaurus, Gegege no Kitarou 2, and two Family Trainer +games. + C000h-C0FFh Memory Control + Bit7 Name Table Select (0/1 = BLK0/BLK1) (One-Screen Mode only) + Bit6-4 Select 16K ROM at 8000h-BFFFh + Bit3-0 Select 8K VROM at PPU 0000h-1FFFh +Bus-Conflicts, memory at C000h-C0FFh should be filled by 00h-FFh. + +Mapper 71: Camerica - PRG/16K +----------------------------- + +This mapper is used on Camerica's unlicensed NES carts, including Firehawk and +Linus Spacehead. + 8000h-BFFFh Unknown + C000h-FFFFh Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) +All carts using it have 8K of VRAM at PPU 0000h-1FFFh. +Many ROMs from these games are incorrectly defined as mapper 2. + +Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K +-------------------------------------------------- + +Used by Pinball Quest, Pro Tennis, Pro Judo. + 8000h-FFFFh Memory Control + Bit7-6 Function Select + 0 Confirm Selection + 1 Select 8K VROM bank at PPU 0000h-1FFFh + 2 Select 16K ROM bank at 8000h-BFFFh (lower half of PRG memory) + 3 Reserved (would probably select both PRG+VROM) + Bit5-4 Not used + Bit0-3 ROM or VROM Bank Number for above Selection +Bus-conflicts. Example: To select PRG Bank 7, first write 87h, then 07h. +Same as Mapper 92, except that this one maps the LOWER half of PRG memory. + +Not sure if that makes sense, but it appears to consist of three latches, +latch1 directly accessed from CPU, the other latches loaded from the latch1 on +high-to-low transitions in bit6/7. + +Mapper 73: Konami VRC3 - PRG/16K, IRQ +------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 74: Whatever MMC3-style +------------------------------ + +Reportedly "Taiwan MMC3 -Varient Mapper#0" used by "KidNiKi3J(hacked)". +Personally, I have a ROM-image named "Ji Jia Zhan Shi", which may or may not be +same as "KidNiKi3J(hacked)". + +Anyways, that ROM-image seems to be basically MMC3-compatible, +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +except that it gets wrong anytime when selecting ROM bank number 14h via +Register 7, don't know what is/should be happenening there (?) + +Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT +---------------------------------------------------------- + +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +Mapper 76: Namco 109 - PRG/8K, VROM/2K +-------------------------------------- + +Used by Digital Devil / Megami Tensei. + 8000h Index/Control (3bit) + Bit2-0 Command Number + 0 - Not used + 1 - Not used + 2 - Select 2K VROM at PPU 0000h-07FFh + 3 - Select 2K VROM at PPU 0800h-0FFFh + 4 - Select 2K VROM at PPU 1000h-17FFh + 5 - Select 2K VROM at PPU 1800h-1FFFh + 6 - Select 8K ROM at 8000h-9FFFh + 7 - Select 8K ROM at A000h-BFFFh + N/A - Fixed 16K ROM at C000h-FFFFh (always last bank) + 8001h Data Register (Indexed via Port 8000h) + +Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K +---------------------------------------------- + +Used by Napoleon Senki. + 8000h-FFFFh Memory Control + Bit0-1 Select 32K ROM bank at 8000h-FFFFh + Bit2-3 Not used + Bit4-7 Select 2K VROM bank at PPU 0000h-07FFh + 6K VRAM at PPU 0800h-1FFFh (ie. upper 6K of Pattern Tables are VRAM) + 2K VRAM at PPU 2800h-2FFFh (ie. uses Four-Screen Name Tables) +Bus-conflicts. + +Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K +--------------------------------------------- + +Used by Holy Diver, and Cosmo Carrier (Uchuusen). The two games seem to be +using different/incompatible mapper circuits for name table control? + 8000h-FFFFh Memory Control + Bit2-0 Select 16K ROM bank at 8000h-BFFFh (initially 1st bank) + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) + Bit3 Name Table Control + Jaleco/Cosmo Carrier: One-Screen (0=BLK0, 1=BLK1) + Irem/Holy Diver: Two-Screen (0=Horizontal, 1=Vertical Mirroring) + Bit7-4 Select 8K VROM bank at PPU 0000h-1FFFh + +Mapper 79: AVE Nina-3 - VROM/8K +------------------------------- + +[See also] +--> Mapper 113: Sachen/Hacker/Nina +Made by American Video Entertainment (AVE), used by Krazy Kreatures, Double +Strike, etc. + 4100h Bit1-0 Select 8K VROM bank at PPU 0000h-1FFFh +Port decoded as A14=A8=HIGH, A15=A13=LOW, ie. with mirrors at 4100h-41FFh, +4300h-43FFh ... 5F00h-5FFFh. Contains 74LS175, 74LS138, and "Nina"-lockout +chip. + +Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT +----------------------------------------------- + +Used by Fudou Myouou Den (Demon Sword), Kyonshiizu 2, Mirai Shinwa Jarvas, +Taito Grand Prix - Eikou heno License, Yamamura Misa Suspense - Kyouto Ryuu no +Tera Satsujin, Minelvaton Saga. + 7EF0h Select 2x1K VROM at PPU 0000h-07FFh (Bit7: Name Table, see below) + 7EF1h Select 2x1K VROM at PPU 0800h-0FFFh (Bit7: Name Table, see below) + 7EF2h Select 1K VROM at PPU 1000h-13FFh + 7EF3h Select 1K VROM at PPU 1400h-17FFh + 7EF4h Select 1K VROM at PPU 1800h-1BFFh + 7EF5h Select 1K VROM at PPU 1C00h-1FFFh + 7EF6h Unknown (usually FFh, 01h, or 00h) + 7EF8h SRAM Enable (A3h=Enable, FFh=Disable) + 7EFAh Select 8K ROM 8000h-9FFFh + 7EFCh Select 8K ROM A000h-BFFFh + 7EFEh Select 8K ROM C000h-DFFFh + N/A Fixed 8K ROM E000h-FFFFh (always last bank) + 7EF7h,7EF9h Not used + 7EFBh,7EFDh,7EFFh Dupes of 7EFAh,7EFCh,7EFEh used by Kyonshiizu 2 only + 7F00h-7FFFh SRAM Area (seems to be only 256 bytes or less used) +Bit7 of 7EF0h and Bit7 of 7EF1h are somehow related to Name Tables: Most carts +use Vertical Mirroring, these carts always have both bits cleared. Demon Sword +uses One-Screen mode, either both bits cleared (BLK0), or both bits set (BLK1). + +Mapper 81: AVE Nina-6 +--------------------- + +Made by American Video Entertainment (AVE), used by Deathbots, Mermaids of +Atlantis, etc. +No info. For Deathbots, see: +--> Mapper 113: Sachen/Hacker/Nina + +Also, presumably mis-numbered "Mapper 81 - Taito C075" +Reportedly "Tatio C075" used by "(many Japanese title from tatio)". +Don't have a ROM-image that is assigned as Mapper 81. Don't know which titles +are using it. Maybe meant to be Taito's Arkanoid 2, ie. this mapper: +--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT + +Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K +------------------------------------------- + +Used by SD Keiji Blader, and Kyuukyoku Harikiri 1, 2, 3. + 7EF0h Select 2x1K VROM at PPU 0000h-07FFh (or 1000h-17FFh if swapped) + 7EF1h Select 2x1K VROM at PPU 0800h-0FFFh (or 1800h-1FFFh if swapped) + 7EF2h Select 1K VROM at PPU 1000h-13FFh (or 0000h-03FFh if swapped) + 7EF3h Select 1K VROM at PPU 1400h-17FFh (or 0400h-07FFh if swapped) + 7EF4h Select 1K VROM at PPU 1800h-1BFFh (or 0800h-0BFFh if swapped) + 7EF5h Select 1K VROM at PPU 1C00h-1FFFh (or 0C00h-0FFFh if swapped) + 7EF6h Swap PPU 0000h-0FFFh / 1000h-1FFFh (Bit1: 0=Normal, 1=Swap) + 7EF7h SRAM .... CAh,00h,01h,40h + 7EF8h SRAM .... 69h,00h,40h + 7EF9h SRAM .... 84h,00h,40h + 7EFAh Select 8K ROM 8000h-9FFFh (Bit7-2) + 7EFBh Select 8K ROM A000h-BFFFh (Bit7-2) + 7EFCh Select 8K ROM C000h-DFFFh (Bit7-2) + N/A Fixed 8K ROM E000h-FFFFh (unknown?) + 7EFDh SRAM .... FFh + 7EFEh SRAM .... FFh,07h + 7EFFh SRAM .... FFh + 6000h-7FFFh SRAM Area (probably 8K size, at least 6000h-73xxh used) + +Mapper 83: Cony +--------------- + +There are different Cony variants for cartridges of different size: + Cony (A) 128K+256K Fatal Fury 2 + Cony (B) 256K+512K World Heroes 2 + Cony (C) 4x256K+4x256K Dragon Ball Z 4-in-1 + Also used by Garou Densetsu Special? +Cony (A) and (C) only - 8bit bank numbers (256x1K=256K): + 8310h Select 1K VROM at PPU 0000h-03FFh (in current 256K block) + 8311h Select 1K VROM at PPU 0400h-07FFh (in current 256K block) + 8312h Select 1K VROM at PPU 0800h-0BFFh (in current 256K block) + 8313h Select 1K VROM at PPU 0C00h-0FFFh (in current 256K block) + 8314h Select 1K VROM at PPU 1000h-13FFh (in current 256K block) + 8315h Select 1K VROM at PPU 1400h-17FFh (in current 256K block) + 8316h Select 1K VROM at PPU 1800h-1BFFh (in current 256K block) + 8317h Select 1K VROM at PPU 1C00h-1FFFh (in current 256K block) +Cony (B) only - 8bit bank numbers (256x2K=512K): + 8310h Select 2K VROM at PPU 0000h-07FFh + 8311h Select 2K VROM at PPU 0800h-0FFFh + 8316h Select 2K VROM at PPU 1000h-17FFh + 8317h Select 2K VROM at PPU 1800h-1FFFh +Cony (A) only - 4bit bank numbers (16x8K=128K): + 8300h Select 8K ROM at 8000h-9FFFh + 8301h Select 8K ROM at A000h-BFFFh + 8302h Select 8K ROM at C000h-DFFFh + N/A Fixed 8K ROM at E000h-FFFFh (always last bank) +Cony (B) and (C) only - 4bit bank numbers (16x16K=256K): + 8000h Select 16K ROM at 8000h-BFFFh (in current 256K block) + N/A Fixed 16K ROM at C000h-FFFFh (last bank in current 256K block) +Cony (A) and (B) and (C): + 8200h IRQ Counter LSB, writing to this address acknowledges IRQs + 8201h IRQ Counter MSB, writing to this address starts counting +Cony (A) and (B) only: + 8100h IRQ Control (Bit7=Enable IRQs) (other bits unknown) Bit7, unlike C + 5000h Unknown, program reads from this address +Cony (C) only: + 8100h IRQ Control (Bit1=Enable IRQs) (other bits unknown) Bit1, unlike A/B + B000h Select 256K ROM/VROM Windows (upper two address bits) + Bit0-3 Unknown + Bit4,6 Bit0 of 256K Block Number + Bit5,7 Bit1 of 256K Block Number + Used values are 00h,50h,A0h,F0h. Other values could probably select + separate 256K banks for ROM/VROM. The ROM selection also affects + the "fixed" 16K at C000h-FFFFh (last bank in current 256K block). + B0FFh Probably same as B000h + B1FFh Probably same as B000h + 510Xh Unknown, program reads/writes to/from this address + 430Xh Unknown, program reads from this address + +Mapper 84: Whatever +------------------- + +No info. Reportedly "PC-SMB2J" used by "SMBJ2". +Don't have a ROM-image, unless it is meant to be same as Mapper 40 or 50: +--> Mapper 40: FDS-Port - Lost Levels +--> Mapper 50: FDS-Port - Alt. Levels + +Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--------------------------------------------------------------- + +VRC7 General Memory and IRQ Registers +--> Mapper 21-26,73,75,85: Konami VRC Mappers + +VRC7 Sound Registers +The sound generation is done using FM synthesis, so the music sounds like +"Adlib" OPL2 music. All sound registers are accessed through only two physical +registers. + 9010h (aka 9.1.0) Index register + 9030h (aka 9.1.1) Data Register +There are 6 channels, each containing three registers, and 8 custom instrument +control registers. + +Index 10h-15h - Channel 0-5, Frequency LSB + Bit7-0 Lower 8bit of 9bit Frequency (f; 0-1FFh) + +Index 20h-25h - Channel 0-5, Frequency MSB, Octave, Trigger + Bit7-5 Unknown + Bit4 Channel trigger + Bit3-1 Octave Select (o; 0-7) + Bit0 Upper 1bit of 9bit Frequency (f; 0-1FFh) +Frequency is calculated as: F = 49722Hz * f / 2^(19-o) + +Index 30h-35h - Channel 0-5, Instrument and Volume + Bit7-4 Instrument number (0=Custom, 1-0Fh=Fixed Instruments) + Bit3-0 Volume + +Index 00h-07h - Custom Instrument (Instrument 0) +Note: I will not provide too extensive documentation of the instrument +registers since their functions are identical to those of the OPL2 chip, +commonly found on Adlib/Soundblaster/compatible cards, and there is alot +of information out on how to program these. I will use terminology +similar to that found in said documents. My VRC7 "emulator" test program +I wrote simply re-arranged and tweaked the register writes to correspond +with the OPL2 registers. + Here's a link to a good document about this chip: + http://www.ccms.net/~aomit/oplx/ +The tremolo depth is set to 4.3db and the vibrato depth is set to 14 cent +(in reguards to OPL2 settings; to achieve this you would write 0C0h to +OPL register 0BDh). All operator connections are fixed in FM mode. (Where +Modulator modulates the Carrier). + +Index 00h (Modulator) +Index 01h (Carrier) + Bit7 Tremolo Enable + Bit6 Vibrato Enable + Bit5 Sustain Enable + Bit4 KSR + Bit3-0 Multiplier + +Index 02h + Bit7-6 Key Scale Level + Bit5-0 Output Level + +Index 03h + Bit7-5 Not used (Write 0's) + Bit4 Carrier Waveform + Bit3 Modulator Waveform + There are only two waveforms available. Sine and rectified sine (only + the positive cycle of the sine; negative cycle "chopped off".) + Bit2-0 Feedback Control + +Index 04h (Modulator) +Index 05h (Carrier) + Bit7-4 Attack + Bit3-0 Decay + +Index 06h (Modulator) +Index 07h (Carrier) + Bit7-4 Sustain + Bit3-0 Release + +Register Settings for the 15 fixed instruments +These instruments are not 100% correct! There is no way to extract the register +settings from the chip short of an electron microscope. +I have "tuned" these instruments best I could, though I know a couple +are not exactly right. +Table shows Register 0-7 settings for Instrument 1-0Fh + 1 - 05 03 10 06 74 A1 13 F4 + 2 - 05 01 16 00 F9 A2 15 F5 + 3 - 01 41 11 00 A0 A0 83 95 + 4 - 01 41 17 00 60 F0 83 95 + 5 - 24 41 1F 00 50 B0 94 94 + 6 - 05 01 0B 04 65 A0 54 95 + 7 - 11 41 0E 04 70 C7 13 10 + 8 - 02 44 16 06 E0 E0 31 35 + 9 - 48 22 22 07 50 A1 A5 F4 + A - 05 A1 18 00 A2 A2 F5 F5 + B - 07 81 2B 05 A5 A5 03 03 + C - 01 41 08 08 A0 A0 83 95 + D - 21 61 12 00 93 92 74 75 + E - 21 62 21 00 84 85 34 15 + F - 21 62 0E 00 A1 A0 34 15 + +Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K +--------------------------------------------------- + +Used only by Moero Pro Baseball (Red/Black). + 6000h Memory Control + Bit6,1,0 Select 8K VROM bank at PPU 0000h-1FFFh + Bit5,4 Select 32K ROM bank at 8000h-FFFFh + Bit7,3,2 Not used (always zero) + 7000h Unknown +Also used by Lum no Wedding Bell though that does use only VROM banking. +Functional same as Mapper 87, though that does as well use only VROM banking. + +Mapper 87: Jaleco/Konami 16K VROM - VROM/8K +------------------------------------------- + +Used only by Hyper Olympic, Goonies, Choplifter, Argus, Ninja Jajamaru Kun, +City Connection. + 6000h Select 8K VROM bank at PPU 0000h-1FFFh (Bit 1 used only) + +Mapper 88: Namco 118 +-------------------- + +Used by Devil Man, Dragon Spirit, Namcot Mahjong 3, Quinty. + 8000h Index/Control (3bit) + Bit2-0 Command Number + 0 - Select 2x1K VROM at PPU 0000h-07FFh (Banks 0-63) + 1 - Select 2x1K VROM at PPU 0800h-0FFFh (Banks 0-63) + 2 - Select 1K VROM at PPU 1000h-13FFh (Banks 64-127) + 3 - Select 1K VROM at PPU 1400h-17FFh (Banks 64-127) + 4 - Select 1K VROM at PPU 1800h-1BFFh (Banks 64-127) + 5 - Select 1K VROM at PPU 1C00h-1FFFh (Banks 64-127) + 6 - Select 8K ROM at 8000h-9FFFh + 7 - Select 8K ROM at A000h-BFFFh + N/A - Fixed 16K ROM at C000h-FFFFh (always last bank) + 8001h Data Register (Indexed via Port 8000h) +The carts have 128K VROM, of which the lower 64K can be mapped only to Pattern +Table 0, the upper 64K only to Pattern Table 1. +Devil Man additionally writes 00h to Port C000h, purpose unknown. +Devil Man ROM-image is declared as 4-screen-vertical-mirror, that is nonsense. + +Mapper 89: Sunsoft Early - PRG/16K, VROM/8K +------------------------------------------- + +Used by only by Mito Koumon. + 8000h-FFFFh Memory Control + Bit7 Unknown - maybe Name Table related, maybe not. + Bit6-4 Select 16K ROM bank at 8000h-BFFFh + N/A Fixed 16K ROM bank at C000h-FFFFh (always last bank) + Bit3-0 Select 8K VROM bank at PPU 0000h-1FFFh +The program seems to attempt (unsuccesfully) to resolve bus-conflicts. + +Mapper 90: Pirate MMC5-style +---------------------------- + +Used by some pirate titles (Taiwan) such as Super Mario World, Tekken2 and +Mortal Kombat. Features similar functions as MMC5, though the Port addresses +are completely different. + + 5000h(W) Maths Coprocessor Parameter A + 5001h(W) Maths Coprocessor Parameter B + 5000h(R) Maths Coprocessor 8bit Result of A*B + 8000h PRG 8K at 8000h-9FFFh + 8001h PRG 8K at A000h-BFFFh or 16k PRG bank at $A000-? + 8002h PRG 8K at C000h-DFFFh + 8003h PRG 8K at E000h-FFFFh + 9000h/A000h LSB/MSB of VROM bank at PPU 0000h (1K,2K,4K,8K) + 9001h/A001h LSB/MSB of VROM bank at PPU 0400h (1K) + 9002h/A002h LSB/MSB of VROM bank at PPU 0800h (1K,2K) + 9003h/A003h LSB/MSB of VROM bank at PPU 0C00h (1K) + 9004h/A004h LSB/MSB of VROM bank at PPU 1000h (1K,2K,4K) + 9005h/A005h LSB/MSB of VROM bank at PPU 1400h (1K) + 9006h/A006h LSB/MSB of VROM bank at PPU 1800h (1K,2K) + 9007h/A007h LSB/MSB of VROM bank at PPU 1C00h (1K) + B000h/B004h LSB/MSB of 1K VROM bank at PPU 2000h (Name Table VROM mode) + B001h/B005h LSB/MSB of 1K VROM bank at PPU 2400h (Name Table VROM mode) + B002h/B006h LSB/MSB of 1K VROM bank at PPU 2800h (Name Table VROM mode) + B003h/B007h LSB/MSB of 1K VROM bank at PPU 2C00h (Name Table VROM mode) + + $C000 irq registers Unknown + $C001 irq registers Unknown + $C006 irq registers Unknown + $C007 irq registers Unknown + $C002 irq clear irq_flag=0 and INT signal is clear + $C003 irq reset if $C005=0, irq_flag=0 + else, irq_flag=1 and irq_counter=irq_latch + $C004 irq reset It seems same of $C003 + $C005 irq counter irq_flag=1, irq_latch = irq_counter = value +IRQs work like MMC3 does. +IRQ counter is decremented at every scanline, always while not blanking +(scanline < 240), and background or sprites are enabled. When it reaches +zero (or a negative value), IRQ is triggered _IF_ the irq_flag is set, +clearing the irq_flag and irq_latch. + + + D000h Bank Mode + Bit1-0 PRG Bank Size + 0 Fixed last 32K at 8000h-FFFFh (initial setting) + 1 16K Banks, and Fixed last 16K at C000h-FFFFh + 2 8K Banks, via Bits 2,7, and Ports 8000h-8003h + 3 8K in reverse mode? + Bit2 PRG Bank at E000h in 8K Mode (0=Last 8K, 1=Port 8003h) + Bit4-3 VROM Bank Size (0=8K, 1=4K, 2=2K, 3=1K) + Bit5 Name Table Source (0=VRAM via D001h, 1=VROM via B00Xh) + Bit6 Not used + Bit7 PRG Bank at 6000h (1=enabled) (Similiar/Instead E000h?) + D001h Name Table Control (in VRAM mode) (only lower 2bit used) + 0 Two-Screen, Vertical mirroring + 1 Two-Screen, Horizontal mirroring + 2,3 One-Screen, BLK0 + + $D002 unknown Unused? + $D003 bank page Only used by larger carts + +if (bankmode.bit5), map CHR data in the nametable area using $B00x values, +But, if (high byte, low byte) != (0,0) or (0,1) or (0,2) or (0,3), +so bankmode.bit5 is cleared, and mirroring does not change. + for(i=0;i<4;i++) { + if(!nam_high_byte[i] && (nam_low_byte[i] == i)) { + bankmode &= 0xdf; //clear bit5 --> use VRAM with mirroring + return; + next +If you ignore it, a lot of crappy gfx might be displayed. + +Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ +---------------------------------------- + +This mapper is used on the pirate cart with a title screen reading "Street +Fighter 3". It may or may not have been used in other bootleg games. + 6000h Select 2K VROM bank at PPU 0000h-07FFh + 6001h Select 2K VROM bank at PPU 0800h-0FFFh + 6002h Select 2K VROM bank at PPU 1000h-17FFh + 6003h Select 2K VROM bank at PPU 1800h-1FFFh + 7000h Select 8K ROM bank at 8000h-9FFFh + 7001h Select 8K ROM bank at A000h-BFFFh + N/A Fixed 16K ROM bank at C000h-FFFFh (always last 16K) + 7006h IRQ Disable/Acknowledge (write any value) + 7007h IRQ Enable (write any value) +When enabled, IRQs are requested every 8 scanlines, except during VBlank. +Vertical mirroring is always active. + +Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K +-------------------------------------------------- + +Used by Moero Pro Soccer, Moero Pro Baseball'88. + 8000h-FFFFh Memory Control + Bit7-6 Function Select + 0 Confirm Selection + 1 Select 8K VROM bank at PPU 0000h-1FFFh + 2 Select 16K ROM bank at C000h-FFFFh (upper half of PRG memory) + 3 Reserved (would probably select both PRG+VROM) + Bit5-4 Not used + Bit0-3 ROM or VROM Bank Number for above Selection +Bus-conflicts. Example: To select PRG Bank 7, first write 87h, then 07h. +Same as Mapper 72, except that this one maps the UPPER half of PRG memory. + +Mapper 93: 74161/32 - PRG/16K +----------------------------- + +Used only by Fantasy Zone. + 8000h-FFFFh Memory Control + Bit0 Unknown, seems to be always set. + Bit1-3 Always zero + Bit4-6 Select 16K ROM bank at 8000h-BFFFh + Bit7 Always zero +Bus-conflicts. Uses VRAM. + +Mapper 94: 74161/32 - PRG/16K +----------------------------- + +Used only by Senjou no Okami (Capcom's Commando, japanese version). + 8000h-FFFFh Memory Control + Bit0-1 Always zero + Bit2-4 Select 16K ROM bank at 8000h-BFFFh + Bit5-7 Always zero +Bus-conflicts. Uses VRAM. + +Mapper 95: Namcot MMC3-Style +---------------------------- + +Looks like MMC3, but doesn't seem to have IRQs and various other functions. +Used by Dragon Buster 1, and maybe many other "MMC3" games. + 8000h Index/Control (3bit) + Bit2-0 Command Number + 0 - Select 2x1K VROM at PPU 0000h-07FFh + 1 - Select 2x1K VROM at PPU 0800h-0FFFh + 2 - Select 1K VROM at PPU 1000h-13FFh + 3 - Select 1K VROM at PPU 1400h-17FFh + 4 - Select 1K VROM at PPU 1800h-1BFFh + 5 - Select 1K VROM at PPU 1C00h-1FFFh + 6 - Select 8K ROM at 8000h-9FFFh + 7 - Select 8K ROM at A000h-BFFFh + N/A - Fixed 16K ROM at C000h-FFFFh (always last bank) + 8001h Data Register (Indexed via Port 8000h) + +Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH +------------------------------------------------ + +Used by Oeka Kids Anpanman no Hiragana Daisuki, and Oeka Kids Anpanman to +Oekaki Shiyou (note: these games do require the Oeka Kids Tablet controller, +see Controllers chapter for details). + 8000h-FFFFh + Bit0-1 Select 32K PRG-ROM bank at 8000h-FFFFh (2bit) (AOROM-style) + Bit2 Select 16K CHR-RAM bank at PPU:0000h-1FFFh (via below 4K banks) + PPU:2000h-20FFh Select 1st 4K (of above 16K) at PPU:0000h-0FFFh (Latch=0) + PPU:2100h-21FFh Select 2nd 4K (of above 16K) at PPU:0000h-0FFFh (Latch=1) + PPU:2200h-22FFh Select 3rd 4K (of above 16K) at PPU:0000h-0FFFh (Latch=2) + PPU:2300h-23FFh Select 4th 4K (of above 16K) at PPU:0000h-0FFFh (Latch=3) + N/A Fixed Last 4K (of above 16K) at PPU:1000h-1FFFh + PPU:2400h-2FFFh Other Nametables (same 4K mapping as PPU:2000h-23FFh) +Name table seems to be mapped in One-Screen mode (though maybe one of the four +bits of the 74HC161 chip allows to select Two-Screen mode, or to swap BLK0 and +BLK1)? +Reading (and probably writing) PPU name table entries (PPU:2000h-23FFh) does +automatically change the 4K bank at for lower half of 8K CHR-RAM (this allows +to display full-screen 16K bitmaps). +For manually setting the 4K bank, it's enough to set the PPU address to +2000h-23FFh via Port 2006h (without actually needing to read/write anything +from/to that address via Port 2007h) (ie. apparently, the PPU does output the +selected address immediately, even though no reading/prefetching occurs at that +time yet). +Bus-conflicts. Chipset: 128K PRG-ROM, 32K CHR-RAM, 74HC02 (quad NOR), 74HC161 +(4bit-counter; probably used as simple 4bit latch; without counting), 74HC74 +(dual flipflop). + +Mapper 97: Irem - PRG HI +------------------------ + +Used by Kaiketsu Yanchamaru. + 8000h-FFFFh Memory Control + Bit7-6 Unknown (used values are 1,2 - values 0,3 unused) + (Maybe Name Table Mirroring) + Bit5-4 Not used (always zero) + Bit3-0 Select 16K ROM bank at C000h-FFFFh (upper block!) + N/A Fixed 16K ROM bank at 8000h-BFFFh (always LAST 16K bank) +Bus-conflicts. + +Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K) +------------------------------------------------------ + +This is the standard "on-board" mapper used by most VS System games. +--> VS System + +Mapping is done via "controller" port, + Port 4016h/Write: + Bit2 VS Unisystem Select 8K VROM bank at PPU 0000h-1FFFh + Bit1 VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ) + Bit0 Joypad Strobe (as usually) +For games with 40K PRG-ROM (VS Gumshoe has 40K PRGROM+16K CHRROM): + Bit2 additionally selects 8K PRG-ROM (bank 0 or 4) at 8000h-9FFFh, + Note: Due to .NES fileformat, the 40K PRG-ROM is zeropadded to 48K. +Above bank selection uses an expansion port output, which does not show up on +NES/Famicom cartridge bus, and thus works only with VS Unisystem arcade +machines. +Most (or all?) of these games use 4-screen mirroring. + +The standard VS System games are consisting of EPROM Sets rather than of +Cartridges. Typically consisting of up to six EPROMs: + 1A PRG-ROM E000h-FFFFh 2A CHR-ROM Bank 1 + 1B PRG-ROM C000h-DFFFh 2B CHR-ROM Bank 0 + 1C PRG-ROM A000h-BFFFh + 1D PRG-ROM 8000h-9FFFh +For the VS Dualsystem's second CPU, the PRG-ROMs are 6A..6D and CHR-ROMs are +8A-8B accordingly. The names are based on the mainboard coordinates, eg. "1A" +is located somewhere near "row 1, column A". + +Mapper 100: Whatever +-------------------- + +No info. Don't have any such ROM-images. +Reportedly "MMC3/Nestice/Trainer/Buugy Mode Used in hacked roms !!" +Sounds like homebrew hacks that work only on certain emulators, but not on real +MMC3 hardware. Or it is just meant to be corrupted .NES files with garbage in +reserved header entries at [07h..0Fh], thus changing mapper number 04h (MMC3) +to 64h (100 decimal). + +Mapper 105: X-in-1 MMC1 +----------------------- + +Used by Nintendo World Championships 1990. Works similar like normal MMC1: +--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT +However, the four registers are used like this: + Register 0 Configuration Register (same as MMC1) + Register 1 ROM Bank Base (Bit4 unknown) + Register 2 Not used + Register 3 ROM Bank (same as MMC1, but ORed with Base) +And, accessing Register 3 via Port FFF0h (instead normal FFFFh) appears to mask +(zero) the new Register 3 bank number, until writing to Register 1. +Initially first 32K. + +NB. The Championships 3-in-1 multicart doesn't have a game selection menu, it +runs game 1 until reaching a certain score, and then switches to game 2, and so +on. The controls are strange: it appears one can start the cartridge only when +connecting a zapper to port 1, or a joypad to port 2, whilst gameplay works +only with joypad at port 1. + +Mapper 112: Asder - PRG/8K, VROM/2K/1K +-------------------------------------- + +Used by Huang Di, and San Guo Zhi - Qun Xiong Zheng Ba. + 8000h Index (0-7) + 0 Select 8K ROM at 8000h-9FFFh + 1 Select 8K ROM at A000h-BFFFh + 2 Select 2x1K VROM at PPU 0000h-07FFh + 3 Select 2x1K VROM at PPU 0800h-0FFFh + 4 Select 1K VROM at PPU 1000h-13FFh + 5 Select 1K VROM at PPU 1400h-17FFh + 6 Select 1K VROM at PPU 1800h-1BFFh + 7 Select 1K VROM at PPU 1C00h-1FFFh + N/A Fixed 16K ROM at C000h-FFFFh (always last 16K) + A000h Data (indexed via Port 8000h) + C000h Unknown, always 00h + E000h Unknown, always 00h + +Mapper 113: Sachen/Hacker/Nina +------------------------------ + +[Seems to be same as Nina-3 and/or Nina-6] +--> Mapper 79: AVE Nina-3 - VROM/8K +--> Mapper 81: AVE Nina-6 + +Used by Metal Fighter, Side Winder, Rad Racket - Deluxe Tennis II, AV Hanafadu +Club, AV Soccer, Papillion, Deathbots, Mahjong Companion, 4-in-1 Total Funpack. + 4100h-41FFh Memory Control (commonly used addresses: 4100h, 4101h, 4120h) + Bit0-2 Select 8K VROM bank at PPU 0000h-1FFFh + Bit3-4 Select 32K ROM bank at 8000h-FFFFh (bigger carts only) +Many of these games seem to have been originally desiged for mappers at +8000h-FFFFh, and do still write to these addresses. Also, "16 Mahjong" is +declared as Mapper 113, though it uses 8000h-FFFFh only? + +There's also a variant in which ROM selection is moved to Bit2: +--> Mapper 133: Sachen + +Mapper 114: Super Games +----------------------- + +Used by Lion King, Super Donkey Kong, and Pocohontos. Mask addresses by E001h. + 6000h Unknown (usually zero, except Lion King before crashing?) + 8000h Unknown (see notes below) + A000h Memory Control Index (see list below) + C000h Memory Control Data (indexed via A000h) + E000h IRQ Acknowledge (write any value) + 6001h Unknown (always zero) + 8001h Unknown (see notes below) + A001h IRQ Counter (MMC3-style, decremented per scanline, paused in VBlank) + C001h IRQ Counter + E001h IRQ Start +Memory Control Indexes are: + 0 Select 2x1K VROM at PPU 0000h-07FFh + 1 Select 1K VROM at PPU 1400h-17FFh + 2 Select 2x1K VROM at PPU 0800h-0FFFh + 3 Select 1K VROM at PPU 1C00h-1FFFh + 4 Select 8K ROM at 8000h-9FFFh + 5 Select 8K ROM at A000h-BFFFh + 6 Select 1K VROM at PPU 1000h-13FFh + 7 Select 1K VROM at PPU 1800h-1BFFh +Port 8001h, Bit0 seems to be used as IRQ disable in Lion King. All games seem +to use Vertical Mirroring, but Pocohontos seems to toggle Name Tables via Port +8000h and 8001h during initialization. + +Mapper 115: MMC3 Cart Saint +--------------------------- + +Used by Yuu Yuu Hakusho Final - Makai Saikyou Retsuden. + 6000h Unknown (used values 00h, A0h, A4h) + 6001h Unknown (always 00h) +No idea how it does work, but the game appears to work when selecting +8K ROM bank number 8 at 8000h-9FFFh when [6000h]=A4h. Otherwise the mapper +works like MMC3: +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +Note: MMC3 Register 7 be initialized to 01h on reset. + +Mapper 116: Whatever +-------------------- + +No info. Don't have a ROM-image. +Reportedly "PC-Reserved" used by "AV beautiy fighting(not playable yet)". + +Mapper 117: Future +------------------ + +Used by Sangokushi 4 (a clone of Warrior of Fate). +Appears related with Mapper 90. + 8000h Select 8K ROM at 8000h-9FFFh + 8001h Select 8K ROM at A000h-BFFFh + 8002h Select 8K ROM at C000h-DFFFh + N/A Fixed 8K ROM at E000h-FFFFh (last bank) + 9000h Unknown (always FFh) + 9001h Unknown (always 08h) + 9003h Unknown (always 00h) + A000h Select 1K VROM at PPU 0000h-03FFh + A001h Select 1K VROM at PPU 0400h-07FFh + A002h Select 1K VROM at PPU 0800h-0BFFh + A003h Select 1K VROM at PPU 0C00h-0FFFh + A004h Select 1K VROM at PPU 1000h-13FFh + A005h Select 1K VROM at PPU 1400h-17FFh + A006h Select 1K VROM at PPU 1800h-1BFFh + A007h Select 1K VROM at PPU 1C00h-1FFFh + A008h-A00Fh Unknown (always 01h, probably VROM bank related) + C001h IRQ Counter/Start (MMC3, decremented per scanline, paused in VBlank) + C002h IRQ Acknowledge (write any value) + C003h IRQ Counter/Start (always write same value as to C001h) + D000h Unknown (always 00h) + E000h IRQ Enable (Bit0), upper 7bit unknown (always 0000011b) + F000h Unknown (always 00h) + +Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ +------------------------------------------------------------------ + +Used by Goal 2, Pro Sport Hockey, Armadillo, and Ys III. +MMC3 variant with special Name Tables connnection. The CHR ROM bank numbers are +limited to 7bit values (128 1K-banks), the normal MMC3 Name Table Mirroring +Register (Port A000h) is not used. Instead, Bit7 of the CHR ROM bank(s) is +connected to VA10 line (selecting name table BLK0 or BLK1). The relation +between the separate CHR bank registers and VA10 is unknown? Probably, NT0 at +2000h-23FFh is controlled by CHR bank for 0000h-03FFh, NT1 at 2400h-27FFh by +CHR bank for 0400h-07FFh, and so on. +Otherwise same as MMC3: +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ +--------------------------------------------------------------- + +Used by Pinbot and High Speed. +Contains 64K CHR ROM plus 8K CHR-RAM, selected by Bit6 of the CHR bank numbers +(0=ROM, 1=RAM). The CHR-RAM can be banked and mapped like the CHR ROM. Mapping +hardware consists of MMC3B plus 74HC32 (used to disable ROM when RAM enabled by +CE=A16=HIGH). +Otherwise same as MMC3: +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 122: Whatever +-------------------- + +No info. Don't have a ROM-image. +Reportedly "74161/32" used by "Madoola No Tsubasa". +Maybe "Madoola No Tsubasa" is same as "Wing of Madoola" (?) +--> Mapper 184: Sunsoft - VROM/4K + +Mapper 133: Sachen +------------------ + +Used by Jovial Race. + 4120h Memory Control + Bit1-0 Select 8K VROM at PPU 0000h-1FFFh + Bit2 Select 32K ROM at 8000h-FFFFh +Appears to be a variant of Mapper 113, with PRG ROM selection moved to Bit2. + +Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards +---------------------------------------------------- + +This is a nonsense mapper number for VS Unisystem games with daughterboards. +--> VS System +Namely, this mapper number is used for VS Gradius (VRC1), VS Goonies (VRC1), +and VS TKO Boxing (MMC3-style). The correct mappers for that games should be: +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT + +Mapper 152: Whatever +-------------------- + +The readme of Pocketnes (for Gameboy Advance) mentions existance Mappper 152. +No info. Don't have any ROM-images. + +Mapper 160: Same as Mapper 90 +----------------------------- + +Seems to be duplicate/nonsense, same as Mapper 90, used by Aladdin. +--> Mapper 90: Pirate MMC5-style + +Mapper 161: Same as Mapper 1 +---------------------------- + +Seems to be duplicate/nonsense, same as Mapper 1, used by Hanjuku Eiyuu. +--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT + +Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ +------------------------------------------- + +Used only by RacerMate Challenge II. + 6000h..600Fh Unknown (looks like Debug LED Control or so) + B000h Memory Banking (74LS174; 6bit D flip-flop) + N/A Fixed 4K CHR-RAM at PPU:0000h-0FFFh (bank 00h) + D0-D3 Select 4K CHR-RAM at PPU:1000h-1FFFh (bank 00h..0Fh) + D4-D5 Unused + D6-D7 Select 16K PRG-ROM at 8000h-BFFFh (bank 00h..03h) + N/A Fixed 16K PRG-ROM at C000h-FFFFh (bank 03h) + F000h IRQ/counter control or so ;\maybe IRQ ack,reset,enable,disable + F080h IRQ/counter control or so ;/or whatever (maybe 7474 flipflop) +The game does also require a special controller: +--> Controllers - RacerMate Bicycle Training System +Note: The IRQ function is used as baudrate timer for the controller data +transfers (not as video/scanline interrupt). Used ports/values are: + [F080h]=FFh disable IRQ and/or reset IRQ-counter or so + [F000h]=00h enable IRQ and/or start IRQ-counter or so +Above two ports are mirrored to C000h-FFFFh, they are actually only ONE port, +using either A7 (old PCB design) or D2 (revised PCB design) as input to one of +the 7474's flipflops. The output from 1st flipflop is somehow forwarded to the +2nd flipflop (eventually unlocking SRAM writes at some point). + +Unknown Details +Unknown if both SRAM chips are battery backed. Unknown what the 7474 is used +for (maybe IRQ/counter control related). Port 6000h-600Fh seems to have no +function; there are no latches or RAM in the cartridge that could be mapped to +that addresses (except maybe the 7474), and there should be nothing special in +the "modified NES" console (the game does reportedly work on any normal NES +with "CIC disabled"). + +Racer-Mate PCB R982-073 + U1 28pin HY52256A SRAM 32Kx8 (CHR-RAM) + U2 28pin HY52256A SRAM 32Kx8 (CHR-RAM) + U3 28pin 27C512 EPROM 64Kx8 (badged V903_128) (PRG-ROM) + U4 16pin 74LS174 (6bit D flip-flop with reset) ;memory banking + U5 14pin 74HCT32 (quad OR gates) + U6 14pin 74LS00 (quad NAND gates) + U7 14pin 74HCT32 (quad OR gates) + U8 14pin 74LS00 (quad NAND gates) + U9 14pin 74HCT74 (dual flipflop) ;maybe IRQ status/control? + U10 16pin 74HCT4040N (12bit counter with reset) ;IRQ counter (input=PHI2) + U11 16pin Unknown, maybe CIC (not installed) + B1 2pin Maxell Battery + J1J2 3pin Jumpers (J2 installed) + J3J4 3pin Jumpers (J3 installed) + J1 72pin Cart-edge connector (for NES consoles) (not Famicom) +Plus 2 transistors, 2 diodes (near battery), resistors, capacitors. +Early cartridges used Tengen CIC clones. Later cartridges didn't include any +CICs for legal reasons (and instead, beared a sticker saying says that it'll +work only with special modified NES consoles; ie. such with CIC disabled). + +Cautions/Confusions +Existing ROM-images may include 64K VROM (ie. the video RAM dumped as if it +were ROM); this is wrong, ignore that garbage, and instead, allocate 64K VRAM. +There's some info that claims memory to be controlled by Port 8000h, with +D0,D1,D2=PRG-ROM/16K, and D3,D6,D7=CHR-RAM/8K; this is wrong on about every +single detail, ignore that. +The cartridge does reportedly use horizontal mirroring (but, that info seems to +come from same person who dumped RAM as ROM, and who talked about Port 8000h, +so chances are around 80% that this info is wrong, too). + +Mapper 180: Nihon Bussan - PRG HI +--------------------------------- + +Used by Crazy Climber. And MGC 2011? + 8000h-FFFFh Memory Control + Bit7-3 Not used (always zero) + Bit2-0 Select 16K ROM bank at C000h-FFFFh (upper block!) + N/A Fixed 16K ROM bank at 8000h-BFFFh (always FIRST 16K bank) +Bus-conflicts. +Same as UNROM, but with fixed bank at 8000h-BFFFh instead of C000h-FFFFh. +Note: Crazy Climber uses two standard joypads, but wants them to be held +rotated by 90 degrees. + +Mapper 182: Same as Mapper 114 +------------------------------ + +--> Mapper 114: Super Games + +Mapper 184: Sunsoft - VROM/4K +----------------------------- + +Used by Atlantis no Nazo, Kanshakudama, and Wing of Madoola. + 6000h Select VROM Banks + Bit2-0 Select 4K VROM at PPU 0000h-0FFFh + Bit6-4 Select 4K VROM at PPU 1000h-1FFFh + +Mapper 185: VROM-disable +------------------------ + +Used for copy-protected "NROM" games with (max) 32K PRG-ROM and 8K VROM. + 8000h-FFFFh + Bit 0-1 Select 8K VROM or Open Bus at PPU 0000h + Bit 4-5 Security Diodes (some crude copy protection) +The actual board is a CNROM variant, with the VROM bank-selection bits misused +to deselect VROM (the games do verify that feature and refuse to run if the +deselection doesn't work), plus CNROM-style Security Diodes. For details see: +--> Mapper 3: CNROM - VROM/8K + +Example Values +Values used to switch VROM on/off are: + Off On Title + F0h 0Fh Bird Week + 00h 33h B-Wings + 00h 11h Mighty Bomb Jack + 20h 22h Sansuu 1 Nen - Keisan Game + 20h 22h Sansuu 2 Nen - Keisan Game + 00h FFh Sansuu 3 Nen - Keisan Game + 13h 21h Spy vs Spy +Above games are working when mapping an empty VROM bank (FFh-filled) either +when (X)=13h, or when (X AND 0Fh)=0. + +Mapper 188: UNROM-reversed +-------------------------- + +Used by Karaoke Studio. Appears to be same as UNROM, but the first/second 128K +are exchanged in the ROM-image (for unknown reason), ie. all bank numbers +(including the fixed "last" bank) are XORed by 08h. + ... aka bit3 = chipselect (1=Main ROM, 0=Expansion ROM) +--> Mapper 2: UNROM - PRG/16K +Or, maybe only the first 8 banks are used, and the further banks are garbage? +Bus-conflicts. + +Microphone +The cartridge does have an external microphone attached to it. +As far as known, the microphone signal is passed to the Audio In pin on the +cartridge slot (and thus forwarded to the speaker in the TV Set). +Reportedly, the game can "judge" good/bad singers, so there must be some way to +read the microphone level by software; I/O ports and bit-depth are unknown. +The game does read whatever 3bit value from Port 6000h. + + Karaoke Studio (main cartridge with microphone and 128K main ROM) (Jul 1987) + Karaoke Studio Senyou Cassette Vol. 1 (128K expansion ROM) (Oct 1987) + Karaoke Studio Senyou Cassette Vol. 2 (128K expansion ROM) (Feb 1988) +The expansion ROMs are small cartridges that can be plugged into the main +cartridge; ROM-images for expansion carts should be 256K in size (the 128K main +ROM plus 128K expansion ROM badged together). + +See also +--> Controllers - Microphones + +Mapper 189: MMC3 Variant +------------------------ + +Used by Master Figher 2, and Street Fighter 2. There are three Master Fighter 2 +versions, the 1st works as described below, the 2nd works but has distorted +background, the 3rd doesn't work - ROM addresses appear corrupted (?). And, +Street Fighter 2 works completely different - uses Ports 4132h for ROM, and +4122h/4123h for VROM (?) Anyways, the one working one works as such: + 610xh Select 32K ROM Block (D7-D0 should match A7-A0, eg. [6103h]=03h) +The rest of the mapper is same as MMC3 (for the selected block of memory), +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ + +Mapper 218: Nocash Single-Chip +------------------------------ + +Used by Magic Floor (2012) and Starfight (2018). Contains only one single +PRG-ROM chip (and a CIC, if required) (and, in case of the bewitched Magic +Floor cartridge: it's planned to contain a hair, a finger nail, and a drop of +blood; the existing prototype PCB lacks these components though). +There's no CHR-ROM or CHR-RAM. Instead, the console's internal 2Kbyte Name +Table RAM is mapped as CHR-RAM. The 2K RAM is permanently selected (/VCS wired +to GND), and can be used in four modes by wiring VA10 to one of the +PPU.A10..A13 address lines: + VA10 Effect on iNES Byte 6 UNIF "MIRR" + to Name Tables Bit3.Bit0 Bit7-0 + PPU.A10 Two-Screen, Vertical Mirroring 0.1 01h + PPU.A11 Two-Screen, Horizontal Mirroring 0.0 00h + PPU.A12 One-Screen, BLK0 1.0 02h + PPU.A13 One-Screen, BLK1 1.1 03h + Note: Bit 3 in Byte 6 of iNES header would be usually Four-Screen flag, + but, for this mapper it is used as One-Screen flag. +The VA10 connection does, of course, also affect the CHR-RAM mapping at +0000h-1FFFh. BLK1 would be the most common case (1K NT plus 1K CHR-RAM). BLK0 +would allow to swap CHR RAM via Port 2000h.Bit3-4. Two-Screen would allow to +use two NTs (and to squeeze CHR data into unused NT areas). Two-Screen would +also allow to use 2K OBJ tiles (when leaving BG unused). +Note: 1K CHR-RAM allows to use as much as 64 tiles of 2bpp (or, with suitable +color attributes, 128 monochrome tiles of 1bpp). + +Mapper 222: Dragon Ninja +------------------------ + +Used by a pirate copy of Dragon Ninja. + 8000h Select 8K ROM at 8000h-9FFFh + A000h Select 8K ROM at A000h-BFFFh + N/A Fixed 16K ROM at C000h-FFFFh (last 16K) + 9000h Unknown (always E0h = Vertical Mirroring) + B000h/B001h Lower/upper 4bit of 1K VROM bank at PPU 0000h-03FFh + B002h/B003h Lower/upper 4bit of 1K VROM bank at PPU 0400h-07FFh + C000h/C001h Lower/upper 4bit of 1K VROM bank at PPU 0800h-0BFFh + C002h/C003h Lower/upper 4bit of 1K VROM bank at PPU 0C00h-0FFFh + D000h/D001h Lower/upper 4bit of 1K VROM bank at PPU 1000h-13FFh + D002h/D003h Lower/upper 4bit of 1K VROM bank at PPU 1400h-17FFh + E000h/E001h Lower/upper 4bit of 1K VROM bank at PPU 1800h-1BFFh + E002h/E003h Lower/upper 4bit of 1K VROM bank at PPU 1C00h-1FFFh + F000h IRQ Counter/Stop/Set/Ack + F001h IRQ Counter/Stop/Set/Ack + F002h IRQ Counter/Start (incrementing approx every 120 (?) cycles) + +Mapper 225: X-in-1 +------------------ + +Used by 52-in-1, 58-in-1, 64-in-1, 72-in-1, 110-in-1, 115-in-1 carts. The reset +vectors in all games are redirected to the game selection menu, and all +copyright messages have been shamelessly removed. + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A14,A5-0 Select 8K VROM bank at PPU 0000h-1FFFh + A14,A11-A6 Select PRG 2x16K ROM bank at 8000h-FFFFh + A12 Select PRG page size (0=32K, 1=16K) + 0 32K page at 8000h-FFFFh (LSB/A6 of bank number ignored) + 1 16K page mirrored to 8000h-BFFFh and C000h-FFFFh + A13 ?Mirroring select (0=Vertical, 1=Horizontal Mirroring) + A15 Must be "1" + 5800h-5FFFh 4x4bit Register File (D0-D3 data bits, addressed via A0-A1) +The 4x4bit latch is used as 16bit "RAM", used to restore the old menu selection +when re-entering the menu by pushing the Reset button. +A14 is shared for both PRG/VROM in larger 2048K+1024K carts (those with more +than 100 games), smaller 1024K+512K carts don't use A14. + +Mapper 226: X-in-1 +------------------ + +Used by Super 42-in-1 (1024K), and 76-in-1 (2048K). +Typically booted with opcode 8E 8E 8E 00 - MOV [8E8E],X; BRK in RAM. + 8000h,8E8Eh Memory Control + Bit4-0 Bank Number Bit4-0 + Bit5 Mode + 0 Map 32K ROM at 8000h-FFFFh (bank bits 6-1 used, bit0 ignored) + 1 Map the same 16K ROM bank at both 8000h-BFFFh and C000h-FFFFh + Bit6 Name Table (0=Horizontal, 1=Vertical Mirroring) + Bit7 Bank Number Bit5 + 8001h Upper Bit of bank selection (2048K carts only) + Bit0 Bank Number Bit6 +The "VROM" banks of the original games are contained in PRG ROM, and are copied +to 8K VRAM at PPU 0000h-1FFFh when starting a game. +See also: +--> Mapper 233: X-in-1 plus Reset +--> Mapper 230: X-in-1 plus Contra + +FROM 226.TXT +Mapper hardware is provided by five 74-series ICs; LS74A, LS273, LS139, LS02 +and LS153. A diode and capacitor are arranged to reset the mapping when the +Reset button is pressed. + Register 1, Bit 1 - controls whether the CHR-RAM is write-protected: + 0 - not write-protected + 1 - write-protected +When the Reset button is pressed, both registers are reset to all zero bits. + +Mapper 227: X-in-1 +------------------ + +Used by 1200-in-1 (a fake containing only 14 different games). + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A6-A2 Select 16K ROM at 8000h-BFFFh (X) + A1 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A14-A13 Menu mode (00b=Menu, 11b=Other) + A9 128K Mode (1=128K, 0=Other) + A0 32K Mode (1=32K, 0=Other) + A11-A10,A8 Always 0 + A12 Usually 1 (except when initializing VRAM for game) + A7 Usually 1 (except menu/contra/galaxian) +16K ROM at C000h-FFFFh is Bank 0 in Menu Mode (and on reset), Bank (X OR 1) in +32K Mode, Bank (X OR 7) in 128K Mode, or otherwise Bank (X) in 16K mode. + +Mapper 228: X-in-1 Homebrewn +---------------------------- + +Used in two carts with incredible crude homebrewn games: Action 52 (multicart +52-in-1) and Cheetah Men 2 (single game cart). + 8000h-FFFFh Memory Control (Decoded by address AND data lines) + A3-A0,D1-D0 Select 8K VROM at PPU 0000h-1FFFh + A12-A7 Select 32K ROM at 8000h-FFFFh + A14-A13,A6-A4,D7-D2 Not used (always zero) + 5FF0h-5FF3h 4x4bit Register File (D0-D3 data bits, addressed via A0-A1) +The 4x4bit latch is used as 16bit "RAM", used to restore the old menu selection +when re-entering the main menu (used in Action52 multicart only). + +Notes +Action52 has an odd ROM-size of 1.5MB, Banks 30h-3Fh are probably mirrors. +There seems to be no Name Table control bit (unless it is shared with +bank-selection bits), most games look better at Vertical Mirroring (eg. +cheetahmen, silversword), though some look better at Horizontal Mirroring (eg. +criticalbp). + +Mapper 229: 31-in-1 +------------------- + +Used by 31-in-1 (512K+256K). + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A4-A0 Bank Selection, shared for PRG and VROM: + Select 8K VROM bank at PPU 0000h-1FFFh + Select 16K ROM bank at 8000h-BFFFh and same bank at C000h-FFFFh + A selection of 01h works special, it maps 16K ROM banks 0 and 1, + and bank 1 VROM, used for Super Mario which has 32K PRG ROM. + A6-A5 Name Table + 0 Two-Screen, Vertical Mirroring + 1 Two-Screen, Horizontal Mirroring + 2 Probably one-screen, used on boot + 3 Probably one-screen, used in menu + A14 The menu sets this bit when accessing bank 0 + +Mapper 230: X-in-1 plus Contra +------------------------------ + +Used in a 640K ROM-image. The 1st 128K contain a single game (Contra), the +remaining 512K contain a 22-in-1 multicart. NB. the multicart menu also tries +to detect further ROM, and if any such found, displays a 63-in-one menu. +No idea if/how selection between Contra and 22-in-1 works. The 22-in-1 part is +identical with Mapper 226 (banks 0..31 located AFTER the 1st 128K): +--> Mapper 226: X-in-1 + +Mapper 231: 20-in-1 +------------------- + +Used by 20-in-1. + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A7-A6 Name Table Setting (0-3) + 0 Probably one-screen (used by menu only) + 1 Two-Screen Vertical Mirroring + 2 Two-Screen Horizontal Mirroring + 3 Not used + A5 Always opposite of A1, ie. A5=(A0 XOR 1), probably 2nd chip-select + A4-A1 Select 32K ROM bank at 8000h-FFFFh + A0 Mode (0=Normal, 1=Mirror 1st half selected 32K bank to C000h-FFFFh) +The "VROM" banks of the original games are contained in PRG ROM, and are copied +to 8K VRAM at PPU 0000h-1FFFh when starting a game. +There's also a version of the same cartridge with slightly different mapper: +--> Mapper 61: 20-in-1 + +Mapper 232: 4-in-1 Quattro Camerica +----------------------------------- + +Used by Camerica 4-in-1 games with 256K ROM and 8K VRAM - Quattro Adventure, +Quattro Arcade, and Quattro Sports. + 9000h Select 64K block for 8000h-FFFFh (block number in Bit4-3) + C000h-Fxxxh Select 16K ROM bank at 8000h-BFFFh (within current 64K) + N/A High 16K ROM bank at C000h-FFFFh (last 16K of current 64K) + FFF0h,FFF1h Unknown - Write any value at proper timing (maybe lockout) +In some (not all) ROM-images, 2nd/3rd game seem to be mis-exchanged. + +Mapper 233: X-in-1 plus Reset +----------------------------- + +Used by "42 Games" which is almost the same as "Super 42-in-1" (Mapper 226, +which comes with separate 22 and 20 games menues, prompting the user to press +Select to switch to the next menu). + +42 Games (1024K ROM) comes with a "Level 1-4" main menu, each "Level" allows to +select from 10 or 11 games. That main menu shows up only if the cartridge +detects a special reset function, if that detection fails, then it assumes to +be a 512K ROM, and enters a 22 or 20 games menu. That means, the cartridge can +be split into two fully functional 512K ROMs when removing the reset function. +That reset function appears to work like this: + FFFDh Reading from this address (the MSB of reset vector) destroys the + current Bank selection, probably setting it to a value of FFh, at + least anything different than 00h or 80h +Aside from the extra reset function, it is same as Mapper 226, +--> Mapper 226: X-in-1 + +There's also ROM named "Unknown" numbered as Mapper 233 with other +functionality? + +Mapper 234: Maxi-15 +------------------- + +Used by the AVE Maxi 15 Game Cartridge. + Registers are set by writing *or reading* certain locations. In the case + of writing, the programmer would need to ensure that the written value and + that put on the data bus by the program ROM do not conflict. +On power-up, and when the Reset button is pressed, registers R1 and R2 are +cleared. R3 is not cleared when Reset is pressed. After R1 has been set to a +non-zero value, it cannot be changed until the Reset button is pressed. + FF80h-FF9Fh Configuration Register (R1) + Bit7 Name Table Control (0=Vertical, 1=Horizontal Mirroring) + Bit6 Page Mode ROM/VROM Size (0=32K, 1=64K) + Bit5-0 Select 32K ROM/VROM bank (LSB ignored in 64K Page Mode) + Bit5 is wired to /CS or /OE of the ROM chips, ie. both ROM + and VROM are disabled when bit5 is set (unless additional ROMs + would be connected to inverted Bit5, in larger carts). + FFE8h-FFF7h Memory Banking Register (R2) + Bit7 Not Used + Bit6-4 Select 8K VROM at PPU 0000h-1FFFh (Bit6 not used in 32K Page mode) + Bit3-1 Not Used + Bit0 Select 32K ROM at 8000h-FFFFh (Bit0 not used in 32K Page mode) + FFC0h-FFDFh Lockout Register (R3) + Initially it is not possible to access R3. This is only possible + after R1 has been set to a non-zero value. + Bit7-2 Not Used + Bit1 CIC RST + Bit0 CIC OUT +Memory-mapping hardware consists of eleven chips: 74LS273, 2x74LS322, +2x74LS175, 2x74LS138, 74LS30, 74HC08, 74HC04 and a 4053. There are several +discrete components, mostly related to the CIC-defeating function. + +Mapper 240: C&E/Supertone - PRG/32K, VROM/8K +-------------------------------------------- + +Used by Jing Ke Xin Zhuan (via Port 4800h), and Sheng Huo Lie Zhuan (via Port +4120h, or alternately GNROM-style via Port 8000h-FFFFh with bus-conflicts). + 4120h,4800h,8000h-FFFFh Memory Control + Bit7-6 Not used (always zero) + Bit5-4 Select 32K ROM at 8000h-FFFFh (initially any 32K bank) + Bit3-0 Select 8K VROM at PPU 0000h-1FFFh + +Mapper 241: X-in-1 Education +---------------------------- + +Used by Education Games 18-in-1, and Study and Game 32-in-1. + 8000h-FFFFh Select 32K ROM at 8000h-FFFFh (initially 1st 32K bank) + 5FF0h-5FFFh/Write Unknown (No info) + 5FF0h-5FFFh/Read Unknown (somewhat Bit6: 1=Ready/Okay) +Both cartridges require a special keyboard controller, similar as the Famicom +keyboard, but with different keyboard matrix. +--> Controllers - Typewriter Keyboards + +Mapper 242: Waixing - PRG/32K, NT +--------------------------------- + +Used by Wai Xing Zhan Shi. + 8000h-FFFFh Memory Control (Write any data, port decoded by address lines) + A6-A3 Select 32K ROM at 8000h-FFFFh (initially 1st 32K bank) + A1 Mirroring (0=Vertical, 1=Horizontal Mirroring) + A7,A0 Always 1 + A14-A8,A2 Always 0 +Similar as Mapper 227 (without using the various memory modes though), +--> Mapper 227: X-in-1 + +Mapper 243: Sachen Poker - PRG/32K, VROM/8K +------------------------------------------- + +Used by Mei Nu Quan (Honey Peach), and Poker III 5-in-1. + 4100h Index (0-7) + 4101h Data for above index +The separate register indexes are: + 0 Unknown, always 00h + 1 Unknown, always 00h + 2 Bit3 of 8K VROM at PPU 0000h-1FFFh + 3 Unknown, always 00h + 4 Bit0 of 8K VROM at PPU 0000h-1FFFh + 5 Select 32K ROM at 8000h-FFFFh + 6 Bit2,1 of 8K VROM at PPU 0000h-1FFFh + 7 Unknown, always 05h +Formula for VROM Registers 2,4,6: Bank=(R2*8)+(R4 AND 1)+(R6 AND 3)*2 + +Mapper 244: C&E - PRG/32K, VROM/8K +---------------------------------- + +Used by Decathlon only. Note: Cat Ninden Teyandee translations declared as +"Mapper 244" seem to be MMC3 games. + 8000h-FFFFh Memory Control + Bit7 Not used (zero) + Bit6-4 Swap bits (some sort of confusion / copy protection, see below) + Bit3 Set ROM or VROM bank (0=ROM, 1=VROM) + Bit2-0 Select 32K ROM at 8000h-FFFFh or 8K VROM at PPU 0000h-1FFFh +Swap bits for ROM Bank Number: + Bit4=1: XOR bank number by 03h + Bit5=1: Exchange bank number Bit0,1 + Bit6=1: Not used +Swap bits for VROM Bank Number: + Bit4=1, Bit5=1, Bit6=1: XOR bank number by 07h (without further exchanges) + Bit4=0, Bit5=1, Bit6=1: Not used + Bit4=1: Exchange bank number Bit 0,1 (processed first) + Bit5=1: Exchange bank number Bit 1,2 + Bit6=1; Exchange bank number Bit 2,0 (processed last) +Bus-conflicts. + +Mapper 246: C&E - PRG/8K, VROM/2K, SRAM +--------------------------------------- + +Used by Fong Shen Bang - Zhu Lu Zhi Zhan. + 6000h Select 8K ROM at 8000h-9FFFh + 6001h Select 8K ROM at A000h-BFFFh + 6002h Select 8K ROM at C000h-DFFFh + 6003h Select 8K ROM at E000h-FFFFh (initially probably last bank, or bank 3) + 6004h Select 2K VROM at PPU 0000h-07FFh + 6005h Select 2K VROM at PPU 0800h-0FFFh + 6006h Select 2K VROM at PPU 1000h-17FFh + 6007h Select 2K VROM at PPU 1800h-1FFFh +The cartridge also contains SRAM at 6000h-7FFFh. +Not sure if SRAM at 6000h-6007h can be used. + +Mapper 255: X-in-1 - (Same as Mapper 225) +----------------------------------------- + +Duplicated/nonsense mapper number, 255 is functional same as 225. + +--> Mapper 225: X-in-1 + +Famicom Disk System (FDS) +------------------------- + +Famicom Disk System (FDS) is a Famicom extension unit which was produced by +Nintendo and only sold in Asian countries. It consists of a disk drive +accepting 2.5" or 3" (?) floppies, 32K of RAM to load programs into, 8K of +VRAM, and some other hardware described below. + +--> FDS Memory and I/O Maps +--> FDS I/O Ports - Timer +--> FDS I/O Ports - Disk +--> FDS I/O Ports - Sound +--> FDS BIOS Disk Format +--> FDS BIOS Disk Functions +--> FDS BIOS Disk Errors +--> FDS BIOS Data Areas in WRAM +--> FDS Disk Drive Operation + +FDS Memory and I/O Maps +----------------------- + +FDS Memory Map + 4020h-40FFh I/O Ports (2C33) (Disk, Sound, Timer) + 6000h-DFFFh 32K WRAM + E000h-FFFFh 8K FDS BIOS ROM +Caution: Parts of the FDS 32K WRAM, and of the built-in 2K WRAM are reserved +for use by the FDS BIOS: 0000h-000Eh, 00F9h-0103h, and DFF6h-DFFFh. + +FDS VRAM Map + 0000h-1FFFh Pattern Tables - 8K VRAM +Note: Horizontal/Vertical Name Table Mirroring can be selected via Port 4025h. + +FDS I/O Map (2C33 Registers) + 4020h Timer IRQ Counter Reload value LSB (W) + 4021h Timer IRQ Counter Reload value MSB (W) + 4022h Timer IRQ Enable/Disable (W) + 4023h 2C33 I/O Control Port + 4024h Disk Data Write Register (W) + 4025h Disk Control Register (W) + 4026h Disk External Connector Output (W) + 4030h Disk Status Register 0 (R) + 4031h Disk Data Read Register (R) + 4032h Disk Status Register 1 (R) + 4033h Disk External Connector Input (R) + 4040h..407Fh Sound Wave RAM - 64 x 6bit sample data (R/W) + 4080h Sound Volume Envelope (W) + 4082h Sound Wave RAM Sample Rate LSB (W) + 4083h Sound Wave RAM Sample Rate MSB and Control (W) + 4084h Sound Sweep Envelope (W) + 4085h Sound Sweep Bias (W) + 4086h Sound Modulation Frequency LSB (W) + 4087h Sound Modulation Frequency MSB (W) + 4088h Sound Modulation Table (W) + 4089h Sound Wave RAM Control (W) + 408Ah Sound Envelope Base Frequency (W) + 4090h Sound Current Volume Gain Level (6bit) (R) + 4092h Sound Current Sweep Gain Level (6bit) (R) + +FDS I/O Ports - Timer +--------------------- + +Interrupt Timer intended to produce mid-screen scanline interrupts. + +4020h - Timer IRQ Counter Reload value LSB (W) +4021h - Timer IRQ Counter Reload value MSB (W) + Reload value loaded to actual 16bit counter register on write to 4022h, + and on counter underflow. Counter is decremented once per CPU clock cycle. + +4022h - Timer IRQ Enable/Disable (W) + Bit1 Enable (0=Stop/Acknowledge? Timer IRQ, 1=Start/Enable Timer IRQ) +Note: Timer IRQ Flag is found in Bit0 of Port 4030h (Disk Status Register 0); +reading that status register does (also?) acknowledge IRQs. + +The IRQ Vector is controlled by the BIOS via [0101h] and [DFFEh], +--> FDS BIOS Data Areas in WRAM + +FDS I/O Ports - Disk +-------------------- + +Disk access can be handled by using the FDS BIOS, so there's usually no need to +write to below ports directly, the only exception would be the Screen Mirroring +flag, to change it: Read the current value from [FAh], change Bit3, then write +the new value to both [FAh] and [4025h]. + +4025h - Disk Control Register (W) (Read-able copy in WRAM at 00FAh) + Bit0 Drive Motor (0=On, 1=Off) + When active (0), causes disk drive motor to stop. During this time, + $4025.1 has no effect. Uh, Active=0=Stop ? + Bit1 \ = Set drive head to the start of the first track. + When active (0), causes disk drive motor to turn on. This bit must stay + active throughout a disk transfer, otherwise $4032.1 will always return 1. + When deactivated, disk drive motor stays on until disk head reaches most + inner track of disk. + Bit2 Disk Data Direction (0=Write, 1=Read) + Bit3 Screen Mirroring (0=Vertical, 1=Horizontal Mirroring) + Bit4 Enable CRC Phase (0=Read/Write Data, 1=Verify/Write CRC) + Bit5 Unknown (Should be always 1) + Bit6 GAP Control, Read Mode: 1=Reset CRC, and wait for end of GAP. + Write Mode: 1=Reset CRC, and start writing data. 0=Write GAP (zeros) + Bit7 Disk IRQs on every byte transfer (0=Disable, 1=Enable) + +4030h - Disk Status Register 0 (R) + Bit0 Timer IRQ Flag (0=None, 1=IRQ: Timer Underflow) + Bit1 Disk IRQ Flag (0=None, 1=IRQ: Request Data Transfer via 4024h/4031h) + Reset when $4024, $4031, or $4030 has been serviced. + Bit4 CRC Status (0=Okay, 1=Error, Checksum at end of block not matching) + Bit6 Lost Data (0=Okay, 1=Error, CPU didn't process 4024h/4031h in time) + Bit7 Unknown +Bits in this register seem to be reset to zero after reading; namely, IRQs are +acknowledge after reading, and, error flags are probably cleared, too. + +4032h - Disk Status Register 1 (R) + Bit0 Disk Presence (0=Inserted, 1=Not inserted) + Bit1 Disk Rewind Flag (0=Ready/Playback, 1=Rewind Active) + Bit2 Write Protection (0=Writeable, 1=Read-only, or Disk not inserted) + Bit6 Usually 1 (probably relict of recent opcode byte) + +4031h - Disk Data Read Register (R) +4024h - Disk Data Write Register (W) + 8bit data received from / to be written to disk (least significant first). +Note: Disk IRQ Flag indicates when next byte is to be transferred. + +4026h - External Connector Output (W) (Read-able copy in WRAM at 00F9h) +4033h - External Connector Input (R) (Inputs work only if Outputs=High) + Bit0-6 External Connector Pins 3-9 (0=Low, 1=High/Input) + Bit7 Power Good (0=Okay, 1=Battery power low) +Port 4026h should output High to any input pins, especially Bit7 should be +always set to configure Power Good as input. + +4023h - 2C33 I/O Control Port + Bit0 Disk I/O (0=Disable, 1=Enable) + Bit1 Sound (0=Disable, 1=Enable) + +FDS I/O Ports - Sound +--------------------- + +4040h..407Fh - Wave RAM - 64 x 6bit sample data (Read/Write) +Writes to these registers are ignored unless Write Mode is turned on (see +register 4089h). + +4089h - Wave RAM Control (Write Only) + Bit7 Wave Write Mode (1=Stop Sound output & Allow to write to Wave RAM) + Bit6-2 Not used + Bit1-0 Master Volume (0-3 = 100%,66%,50%,40% = 30/30,20/30,15/30,12/30) + +4082h - Wave RAM Sample Rate LSB (Write Only) + Bit7-0 Lower 8 bits of the main unit's frequency (upper 4 bits in 4083h) +4083h - Wave RAM Sample Rate MSB and Control (Write Only) + Bit7 Main Unit disable (0=Enable, 1=Disable Sound Output) + Bit6 Envelope disable (0=Normal, 1=Disable Volume/Sweep Envelopes) + Bit5-4 Not used + Bit3-0 Upper 4 bits of the main unit's frequency +Main Unit / Sample Rate: (per entry of the 64-entry wave ram) + F = 1.79MHz * (Freq + Mod) / 65536 + Mod = Frequency change based on the Modulation unit +If the 12bit frequency is zero, the Main unit is disabled (channel silent). + +408Ah - Envelope Base Frequency (Write Only) + Bit7-0 Envelope Base Frequency, Fbase=1.79MHz/8/N +Fbase used by 4080h and 4084h. Volume/Sweep Envelope are disabled if N=0. + +4080h - Volume Envelope (Write Only) + Bit7 Volume Envelope Mode (0=Volume Envelope, 1=Fixed Volume) + Bit6 Volume Envelope Direction (When enabled / at specified rate) + 0=Decrease Volume by 1 (only if Volume>00h) + 1=Increase Volume by 1 (only if Volume<20h) + Bit5-0 When Bit7=1: Volume Level (0-20h=Muted-Loudest, 21h-3Fh=Same as 20h) + Bit5-0 When Bit7=0: Volume Envelope Rate, F=Fbase/(N+1) +The volume level can be set to 00h-3Fh by write with Bit7=1, this level is also +used as initial volume when switching to envelope mode by setting Bit7=0. +In decrease mode, initial values 21h-3Fh are resulting delayed decrease; volume +stays at maximum level until the value gets smaller than 20h. + +4084h - Sweep Envelope (Write Only) + Bit7 Sweep Envelope Disable (1=Disable) + Bit6 Sweep Envelope Mode (0=Decrease, 1=Increase sweep gain) + Bit5-0 When Bit7=1: Sweep Gain + Bit5-0 When Bit7=0: Sweep Envelope Rate, F=Fbase/(N+1) + +4085h - Sweep Bias (Write Only) + Bit7 Not used + Bit6-0 Sweep Bias (signed 7bit; -40h..+3Fh) +Sweep Bias is a used by the Modulation unit in calculating frequency bend. +Sweep Bias negative: Modulation unit will be bending frequency down. +Sweep Bias positive: Modulation unit will be bending frequency up. +Any write to Sweep Bias register resets Modulation Unit's address to zero. This +address is used by the Modulation Unit when looking up entries written to the +Modulation table (via $4088). + +4086h - Modulation Frequency LSB (Write Only) + Bit7-0 Lower 8bit of 12bit Modulation frequency +4087h - Modulation Frequency MSB (Write Only) + Bit7 Modulation Enable/Disable (0=Enable, 1=Disable) + Bit6-4 Not used + Bit3-0 Upper 4bit of 12bit Modulation frequency +Modulation Unit: Modulation Rate (per entry of the 64-entry modulation table) + F = 1.79MHz * ModFreq / 65536 +If the 12bit frequency is zero, the Modulation unit is disabled. + +4088h - Modulation Table (Write Only) + Bit7-3 Not used + Bit2-0 Modulation input +Writing to this register puts the value written at the END of the modulation +table **twice**, and shifts each entry already in the table 2 places to the +front. The first 2 entries of the Modulation table are shifted out and lost. +old, old <-- ModTable_0 <-- ModTable_1 <-- ... <-- ModTable_63 <-- new, new + +4090h - Current Volume Gain Level (6bit) (Read Only) +4092h - Current Sweep Gain Level (6bit) (Read Only) + +4023h - 2C33 I/O Control Port + Bit0 Disk I/O (0=Disable, 1=Enable) + Bit1 Sound (0=Disable, 1=Enable) + +FDS Sound by Disch, Release 1, 07/14/2004, based on info from Nori. + +---- Sound Notes ---- + +Sweep Envelope and Modulation Units +Sweep Envelope unit behaves just like the Volume Envelope, only it alters Sweep +Gain instead of Volume Gain. The Envelope Unit never pushes Sweep Gain above +$20, but it still can get above $20 if set that way via $4084. + Increase/Decrease mode is determined by bit 6 of $4084 +Sweep Gain is used when calculating the Frequency change in the Modulation +Unit... +The Modulation Unit, when clocked, takes 1 step through the Modulation Table +(set by writes to $4088). The Sweep Bias is adjusted based on the 3-bit value +in the table: + 0:Bias=Bias+0 1:Bias=Bias+1 2:Bias=Bias+2 3:Bias=Bias+4 + 4:Bias=0 5:Bias=Bias-4 6:Bias=Bias-2 7:Bias=Bias-1 +The address of the Modulation unit is incremented so that next clock it will +use the next 3-bit value in the table. This address wraps at 64 and can be +reset to zero by any write to $4085. +Sweep Bias wraps to fit within a signed 7-bit value, if it goes greater than +63, it wraps around to -64, and if it goes below -64, it wraps to 63. +The Modulation Unit works by altering the Frequency of the Main Unit by a value +calculated from the Sweep Gain and Sweep Bias values: + temp = Sweep_Bias * Sweep_Gain; + if temp AND 0Fh then + if Sweep_Bias<0 then temp=temp-10h else temp=temp+20h + temp=temp/10h + if temp>193 then temp -= 258; // not a typo... for some reason the wraps + if temp<-64 then temp += 256; // are inconsistent + Mod = Freq * temp / 64; +In this code, Freq is the 12-bit MAIN UNIT frequency, and Mod is the amount +that frequency is altered. This generated 'Mod' value is used in the frequency +calculation of the main unit (given earlier): + Hz = NES * (Freq + Mod) / 65536 +If at any time the Modulation unit is off, 'Mod' is zero. Otherwise 'Mod' is +the above calculated value. If Freq + Mod produces a number less than or equal +to zero, the channel is presumably silenced. + +Unit Activity +There are many factors that could disable a unit, here's an overview section to +cover all the needed requirements for the channel to be active. +Remember that each unit can be active regardless of the activitiy of other +units. For example... even though the main unit is off and the channel is +silent, this does not mean the Volume Envelope or Modulation units are +inactive. +If any of the supplied conditions are false... the unit is inactive and will +not be clocked. All conditions must be true for the unit to be active. + +Volume Envelope Unit: + - Volume Envelope must be enabled (bit 7 of $4080 must be off) + - Envelope Speed must be nonzero (set by $408A) + - Envelope must be enabled (bit 6 of $4083 must be off) + +Sweep Envelope Unit: + - Sweep Envelope must be enabled (bit 7 of $4084 must be off) + - Envelope Speed must be nonzero (set by $408A) + - Envelope must be enabled (bit 6 of $4083 must be off) + +Modulation Unit: + - Modulation must be enabled (bit 7 of $4087 must be off) + - Modulation frequency must be non-zero (set by $4086/$4087) + +Main Unit (Wave RAM Sound Output): + - Main Unit must be enabled (bit 7 of $4083 must be off) + - Main Unit Frequency must be non-zero (set by $4082/$4083) + - 'Freq + Mod' must be greater than zero (see Frequency Calculation section) + - Write Mode must be off (bit 7 of $4089 must be off) + +FDS BIOS Disk Format +-------------------- + +Each disk has two sides, each side having a capacity of circa 64K, typically +less than 64K data because some space is used for gaps and headers, also the +exact capacity may vary depending on the transfer rate/rotation speed of the +drive that has recorded the disk. To change an active side, the disk has to be +removed, flipped, and inserted back into the drive. + +The drive doesn't support random access, and the disk is NOT split into tracks +and sectors. The data is stored sequentially on a single "track" which is wound +in a spiral, starting at the outer edge, towards the center of the disk. + +Side Header Block (56 bytes) (1st block on disk) + 00h Block Type (01h) + 01h-0Eh Disk ID (Must be ASCII string "*NINTENDO-HVC*") + 0Fh Maker ID + 10h-13h Game Name (usually 4 letter ASCII) + 14h Version Number (usually 00h) + 15h Side Number (00h=Side A, 01h=Side B) (00h=bootable) + 16h Disk Number (00h=First, 01h=Second, etc.) (00h=bootable) + 17h-18h Extra Disk ID Field + 19h Highest File ID for Boot files (all files with File ID's less + or equal than this value are loaded automatically on power-up) + 1Ah-37h Reserved Space (30 bytes, ignored by BIOS) + +File Number Block (2 bytes) (2nd block on disk) + 00h Block Type (02h) + 01h Number of Files on this side + +File Header Block (16 bytes) (for each file, 3rd,5th,7th... block on disk) + 00h Block Type (03h) + 01h File Number (00h=First file on this side, 01h=Second, etc.) + 02h File ID (used to access files by Load Files function) + 03h-0Ah File Name (not used, the BIOS access files by above File ID) + 0Bh-0Ch Target Address (LSB, MSB) + 0Dh-0Eh File Size (LSB, MSB) + 0Fh Target Area (00h=WRAM, Other=VRAM) + +File Data Block (1+LEN bytes) (for each file, 4th,6th,8th... block on disk) + 00h Block Type (04h) + 01h-LEN Data (LEN=File Size in File Header Block) + +Gaps, Start Bits, CRC Values +Each block is preceded by a GAP (a stream of "0" bits), followed by a Start Bit +("1"), followed by the actual bytes contained in the block, followed by a 16bit +CRC value. + +FDS Disk Images +Disk Images should have extension ".fds" and are having a 16-byte header: + 00h 4 File ID ("FDS",1Ah) + 04h 1 Number of Sides (usually 1 or 2; or more, eg. in Gunfight) + 05h 11 Reserved (00h-filled) +Followed by the Disk Image (65500 bytes per side, padded with 00h if less bytes +are used). The image contains raw data (without low level information like +GAP-lengths, leading start bits, or trailing checksums), it should be usually +starting with the 56-byte Side Header Block (ie. 01h,"*NINTENDO-HVC*", etc.). + +FDS BIOS Disk Functions +----------------------- + +Disk Boot +On power-up, the FDS does call the Load Files function to load the boot files. +The DiskID is FFh-filled (wildcards), except the Side Number and Disk Number +entries which must be both 00h on boot-able disks. LoadList is empty, +indicating to load all boot files, ie. all files with File IDs less or equal +than the Disk Header's Boot ID value. +There must be at least two boot files on the disk, one containing the program +with entrypoint (16bit pointer, which must be loaded to DFFCh), the other file +containing the Nintendo License string (E0h bytes, which must be loaded to PPU +2800h, and which is verified against a copy in BIOS at ED37h). + +DiskID +Used by most BIOS functions to ensure that the correct disk/side is inserted. +DiskID consists of 10 bytes which are compared against Disk Header Block +[0Fh..18h]. Each DiskID byte may be set to FFh, which is used as wildcard, +comparision always passes okay for that bytes. If the comparision does not +match then error codes 04h..10h are returned, indicating which entry didn't +match. + +E1F8h - Load Files +The function scans files on disk, respectively, the execution time is the +same, no matter how many/how large files are loaded. On the contrary, multiple +calls to LoadFiles would be unneccessarily slow. + RETaddr: pointer to DiskID + RETaddr+2: pointer to LoadList + A on return: error code + Y on return: count of files actually found +LoadList is a list of up to 20 File IDs, if the list contains less than 20 IDs +then it must be terminated by FFh. If LoadList is empty (FFh in the first byte) +then the boot files are loaded, that are all files with File IDs less or equal +than the Disk Header's Boot ID value. + +E32Ah - Get Disk Information + RETaddr: pointer to DiskInfo + A on return: error code +The DiskInfo pointer should point to a free memory location, which will receive +the following data: + 0Ah bytes Disk Header Block [0Fh..18h], manufacturer, disk name, etc. + 1 byte File Number Block [01h], number of files on disk (N) + N*9 bytes File Header Block [02h..0Ah], File ID and Filename, for each file + 2 bytes Disk Size (MSB,LSB) +Disk size is equal to the sum of each file's size entry, plus an extra 261 per +file. + +E237h - Append File +Sets A=FFh (append after last file), ie. same as A=FileCount, then continues at +E239h (Write File). + +E239h - Write File +Register A specifies how many old files are to be kept preserved on disk, these +files are read/skipped, and the new file is then written to disk after those +files, and the disks FileCount is set to A+1, making the new file to be the +last file on disk, any further files are deleted/hidden. +In a second cycle, the written data is verified, if the verification fails +(error 26h), then the file count is decremented, ie. the new file is deleted. + RETaddr: pointer to DiskID + RETaddr+2: pointer to FileInfo + A on call: File Number (00h=First) (FFh=Append after last file) + A on return: error code +FileInfo occupies 17 bytes, the first 14 bytes contain File Header entries +[02h..0Fh], ie. File ID, Filename, Load Address, Filesize, and Load Area. +The last 3 bytes contain the Source Address and Source Area (which may or may +not be same as Load Address and Load Area). + +E2BBh - Adjust File count + RETaddr: pointer to DiskID + A on call: number to reduce current file count by + A on return: error code + Special error: #$31 if A is less than the disk's file count +Reads in disk's file count, decrements it by A, then writes the new value back. + +E2B7h - Check File count + RETaddr: pointer to DiskID + A on call: number to set file count to + A on return: error code + Special error: #$31 if A is less than the disk's file count +Reads in disk's file count, compares it to A, then sets the disk's file count +to A. + +E305h - Set File count (alt. 1) + RETaddr: pointer to DiskID + A on call: number to set file count to + A on return: error code +Sets the disk's file count to A. + +E301h - Set File count (alt. 2) + RETaddr: pointer to DiskID + A on call: number to set file count to minus 1 + A on return: error code +Sets the disk's file count to A+1. + +Don't expect disk calls to return quick; it may take several seconds to +complete. The ROM BIOS always uses disk IRQ's to transfer data between the +disk, so programs must surrender IRQ control to the ROM BIOS during these disk +calls. The value at [$0101] however, is preserved on entry, and restored on +exit. + +WRAM Target Addresses +Target Addresses should be in range 0200h-07FFh or 6000h-DFFFh. The BIOS +rejects (silently ignores) most attempts to load data to 0000h-01FFh. In +particular, it rejects Target Addresses at 0-1FFh (including mirrors at +800h,1000h,1800h), it also rejects wraps from FFFFh to 0000h. +However, it does not reject wraps to mirrors (eg. from 7FFh to 800h), clever +use of this feature might allow to modify values on stack, and to bypass the +Boot License. +Furthermore, target address 2000h can be used to enable NMIs during loading, +the games Bislot, Bisyosya, and Bishojo Control are using this trick to abort +the boot process and to start the game - without Boot License - via NMI vector +at [DFFAh]. + +VRAM Source/Target Addresses +Mind that the screen should be disabled when loading/writing VRAM data, Port +2001h/Bit3-4 should be zero, otherwise VRAM could be accessed only in VBlank. +Mind that physical content of VRAM addresses 2400h-2BFFh changes depending on +current mirroring. The BIOS re-initializes parts of VRAM after loading the boot +files on power up, overwriting any boot-files loaded to that areas. + +Boot License String +32x7 characters in VRAM 2800h-28DFh (and copy in BIOS at ED37h) + " NINTENDO r " + " FAMILY COMPUTER TM " + " " + " THIS PRODUCT IS MANUFACTURED " + " AND SOLD BY NINTENDO CO;LDT. " + " OR BY OTHER COMPANY UNDER " + " LICENSE OF NINTENDO CO;LTD.. " +By using Non-ASCII BIOS Tile Numbers: A..Z=0Ah..23h SPC=24h .=26h ;=27h r=28h. +See WRAM Target Addresses above for methods to bypass the Boot License. + +FDS BIOS Disk Errors +-------------------- + +Error codes are returned in both A and X registers (plus zero flag, Z=okay) + 00h Okay (no error) (zero flag set) + 01h No disk inserted (Port 4032h, Bit0) + 02h No battery/power (Port 4033h, Bit7) + 03h Disk write-protected (Port 4032h, Bit2) + 04h Bad Side Header [0Fh], Maker ID + 05h Bad Side Header [10h..13h], Game name + 06h Bad Side Header [14h], Game version + 07h Bad Side Header [15h], Side number (flip the disk) + 08h Bad Side Header [16h], Disk number + 09h Bad Side Header [17h], Extra ID Value 1 + 10h Bad Side Header [18h], Extra ID Value 2 + 20h Bad Nintendo License String (must be loaded to PPU 2800h-28DFh on boot) + 21h Bad Side Header [01h..0Eh], Disk ID (must be "*NINTENDO-HVC*") + 22h Bad Side Header [00h], Block ID must be 01h + 23h Bad File Number [00h], Block ID must be 02h + 24h Bad File Header [00h], Block ID must be 03h + 25h Bad File Data [00h], Block ID must be 04h + 26h Write-Verify Error (verification of written data failed) + 27h Block CRC Read Failure (Port 4030h, Bit 4) + 28h Lost Data (Port 4030h, Bit 6), CPU didn't read from 4031h in time + 29h Lost Data (Port 4030h, Bit 6), CPU didn't write to 4024h in time + 30h Disk Full (Port 4032h, Bit 1), Disk head has reached most inner track + 31h Data number of a disk doesn't match up (?) + +FDS BIOS Data Areas in WRAM +--------------------------- + +The BIOS uses several places in memory, but only some of them are expected to +be maintained by game code. + + Addr Size Expl. +Scratch Area (destroyed by any calls to BIOS disk functions) + 0000h 2 first 16bit parameter + 0002h 2 second 16bit parameter + 0004h 1 previous stack frame + 0005h 1 error retry count + 0006h 1 file counter + 0007h 1 current block type + 0008h 1 boot ID code + 0009h 1 dummy read flag + 000Ah 2 16bit destination address + 000Ch 2 16bit transfer length count + 000Eh 1 file found counter +Copies of I/O Ports (used to READ content of Write-Only I/O Ports) +The BIOS does (and the game should) keep these bytes in sync with the ports. + 00F9h 1 value last written to [$4026] $FF on reset (disk ext connector) + 00FAh 1 value last written to [$4025] $2E on reset (disk control) + 00FBh 1 value last written to [$4016] 0'd on reset (joypad) + 00FCh 1 value last written to [$2005]#2 0'd on reset (ppu scrolling) + 00FDh 1 value last written to [$2005]#1 0'd on reset (ppu scrolling) + 00FEh 1 value last written to [$2001] $06 on reset (ppu control) + 00FFh 1 value last written to [$2000] $80 on reset (ppu control) +IRQ/NMI/Reset Control + 0100h 1 Action on NMI (set to C0h on reset) + 0101h 1 Action on IRQ (set to 80h on reset) + 0102h 2 Action on Reset (AC35h after disk-boot, 5335h after warm-boot) +IRQ/NMI/Reset Vectors + DFF6h 2 Game NMI vector 1, used if [0100h]=01xxxxxxb + DFF8h 2 Game NMI vector 2, used if [0100h]=10xxxxxxb + DFFAh 2 Game NMI vector 3, used if [0100h]=11xxxxxxb + DFFCh 2 Game Reset vector, used if [0102h]=5335h or =AC35h + DFFEh 2 Game IRQ vector, used if [0101h]=11xxxxxxb +If [0100h..0102h] don't match then the IRQ/NMI/Reset is handled internally by +the BIOS, without using (and without changing) the Game vectors. +Address DFFCh contains the initial entrypoint at disk boot, and is also used as +warm-boot vector when pushing the Reset button at a later time. + +There may be more structured data areas in the zero page (for example, the BIOS +joypad routines use $F5..$F8 for storing controller reads), but only the listed +ones are used by the disk call subroutines. + +FDS Disk Drive Operation +------------------------ + +When the head reaches the end of the disk (most inner track), it returns to the +beginning of the disk (most outer track) and the cycle repeats, upon request +from the RAM adaptor. This means that on every scan, the entire disk is read +(which takes about 6 seconds). The disk drive signals the RAM adaptor when the +head has been positioned to the outer most track, and is starting a new scan. + +FDS data transfer protocol +Like most disk drive units, the FDS disk drive is sending it's data out via +serial connection. + 1.Data ------------__________________------______------ + 2.Rate ---___---___---___---___---___---___---___---___ + 3.XOR ___---___------___---___---______------______--- + 4.Write ___------_________------_________------------___ + 5.Read ___-_____-________-_____-________-___________-__ +The 1st row shows a 8bit data value, in this example A3h, or 10100011b, +transferred LSB first. The 2nd row shows the transfer rate clock. The data/rate +signals are XORed, as shown in the 3rd row. The actual signal written to disk +is shown in the 4th row, magnetic polarity changes on any Low-to-High +transitions of the XOR-signal. When reading from disk, spikes of one +microsecond length are received on any polarity changes, as shown in the 4th +row. + +The RAM adaptor expects a transfer rate of 96.4kHz, although the tolerance it +has for this rate is +/- 10%. This tolerance is neccessary since, the disk +drive can NOT turn the disk at a constant speed. + +First GAP +The length of the first GAP period present on typical FDS disks (relative to +the instant the disk drive's "-ready" signal is activated) is about 40000 bits, +after which the first block start mark (indicating the beginning of the first +file) will appear. +The disk drive unit signals the RAM adaptor when the head has moved to the +beginning of the disk via the "-ready" signal it sends out (more on this +later). The "-ready" signal is based on a mechanical switch inside the drive +which is activated when the head is brought back to the outer most edge of the +disk (the beginning). Because the switch will usually be triggered prematurely, +the first 13000 bits (approx.) of data the drive will send out immediately +after this switch is activated will be invalid. To compensate for this, the RAM +adaptor purposely ignores the first 26100 bits (approx.) sent to it since it +recieves the "-ready" signal from the disk drive. + +Further GAPs +The typical GAP period size used between files on FDS disks is roughly 976 bits +(this includes the bits that are ignored by the RAM adaptor). +the RAM adaptor always ignores the first 488 bits (approx.) to follow after the +immediate end of any file. This period allows the RAM adaptor (or the game +rather) an oppertunity to make the switch from reading from the disk to writing +or vice-versa. + +Final "GAP" +- The rest of the disk is filled with 0's after the last file is recorded +(although it really shouldn't matter what exists on the disk after this). + +CRC calculation +CRC appended to the immediate end of every file. The CRC is 16-bits, and is +generated with a 17 bit poly. The poly used is 10001000000100001b (the X25 +standard). Right shift operations are used to calculate the CRC (this +effectively reverses the bit order of the polynomial, resulting in the 16-bit +poly of 8408h). The file this algorithm is designed to work on has no block +start mark in it ($80), and has 2 extra bytes at the end (where a CRC +calculation would normally reside) which are 0'd. While the block start mark is +actually used in the calculation of a FDS file CRC, you'll see in the algo +below that the block start mark ($80) is moved directly into a register. + // ax is used as CRC accumulator + // si is the array element counter + // di is a temp reg + // Size is the size of the file + 2 (with the last 2 bytes as 0) + // Buf points to the file data (with the 2 appended bytes) + mov ax,8000h // this is the block start mark + sub si,si // zero out file byte index ptr + @@lop1: + mov dl,byte ptr Buf[si] + inc si + REPT 8 + shr dl,1; rcr ax,1; sbb di,di; and di,8408h; xor ax,di + ENDM + cmp si,Size + jc @@lop1 +// ax now contains the CRC. +Special thanks to Val Blant for assistance in cracking the CRC algorithm used +by the FDS. + +- Some unlicenced FDS games activate the "-stop motor" signal (and possibly +even "-write", even though the storage media is not intended to be written to) +when a media transfer is to be discontinued, while "-scan media" is still +active. While this is an unorthodoxed method of doing this, the best way to +handle this situation is to give the "-stop motor" signal priority over any +others, and force data transfer termination during it's activation. + +- Check out the FDS loader project (which uploads *.FDS files to the RAM +adaptor) for source code to my working disk drive emulator. + +Hardware disk copy protection +Apparently, Nintendo had designed FDS disk drive units so that they cannot +reprogram entire disks, while still somehow being able to write the contents of +individual files to the end of disks. Now, there's alot of undocumented things +going on inside the disk drive unit, so I'm just going to say that there are +two evil IC's you've got to watch out for inside the FDS disk drive- the 3213, +and the 3206. There is a collection of 6 "FDS-COPY" jpegs over at NESdev which +(pg. 4 right side, and pg. 5) give a pretty graphic overview of the steps +involved in modding a stock FDS disk drive, so that it may reprogram disks. +Although I haven't built the specific circuit described in the jpegs, I had +designed & built a similar working circuit to defeat the FDS's evil copy +protection circuitry, with excellent results. + +Software disk copy protection +Special thanks to Chris Covell for bringing this to attention. +Apparently, some FDS disks implement a very simple copy protection scheme, +which the game relies on in order for the game to refuse to work on the copied +disk. Normally, the number of files that exist on an FDS disk is stored in the +second block recorded on it. However, some games maintain "invisible" files, +which are basically files that exist beyond what the file count number in the +file count block indicates. This poses somewhat of a problem for copy software +like FDSLOADR, since these tools rely on the file count block, and don't assume +that there is any valid data past the last file found on the disk. This means +that when these types of disks are copied, the invisible files will be lost, +and when the game loads the files that do exist, the game's going to give the +user heat about there being a file missing or somthing, gumming up the works. +However in practice, when an FDS disk is programmed, the unused end of the disk +is usually completely zeroed out, and this makes detecting the end of the disk +simple: just wait to find a GAP period of extreme length. Except in rare cases, +this model for detecting the true end of an FDS disk should generally provide +the best results for copying the complete contents for all types of FDS disks. +[That may be as well a trick to improve disk boot speed, not necessarily a copy +protection.] + +Physical disk lockout mechanism +Ever wonder why Nintendo engraved their company's name along the handle edge of +all FDS disks? Inside the FDS disk drive bay, sitting just behind the lower +part of the front black plastic faceplate, is a little plastic block with the +letters "Nintendo" carved out of a hard plastic block. This basically forces +disks that don't have holes in those locations from completely loading into the +drive, circumventing usage. Now while many companies made FDS disks with those +holes cut out, I'm sure there must be some disks out there that are compatable +with the FDS, but don't have the holes. So, the solution is to simply +disassemble the FDS disk drive, remove the disk cage, and remove the two screws +securing the "Nintendo" letterblock. + +VS System +--------- + +Nintendo's VS Systems are arcade machines with same chipset as NES consoles. +There are two versions: + VS UniSystem --> 1-2 players (1 Monitor, 1 CPU, 1 PPU, 1 ROM-Set) + VS DualSystem --> 2-4 players (2 Monitors, 2 CPUs, 2 PPUs, 2 ROM-Sets) +The DualSystem essentially contains two NES consoles that can be linked +together (or optionally can be used as two independend consoles, each one +running a different game). + +--> VS System Controllers +--> VS System Games +--> VS System PPUs and Palettes +--> VS System Protections +--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K) + +VS System Controllers +--------------------- + +Controller Ports +Port 4016h/Write: + Bit0 Joypad Strobe (as usually) + Bit1 VS Dualsystem: Send IRQ to other CPU (0=No, 1=IRQ) + Bit2 Select 8K VROM bank at PPU 0000h-1FFFh (Mapper 99 games only) +Port 4016h/Read: + Bit2 Credit Service Button (0=Released, 1=Service Credit) + Bit3-4 DIP Switch 1-2 (0=Off, 1=On) + Bit5-6 Credit Left/Right Coin Slot (0=None, 1=Coin) (Acknowledge via 4020h) + Bit7 VS Dualsystem: Master/Slave ID (0=Slave CPU, 1=Master CPU) +Port 4017h/Read: + Bit2-7 DIP Switch 3-8 (0=Off, 1=On) +Port 4020h/Write: + Bit0 Acknowledge Coin Slot Signal (0=Normal, 1=Acknowledge Coin) +Memory at 6000h-67FFh: + 2Kbyte of shared RAM for VS Dualsystem CPU-to-CPU communications. + Access, according to schematic: + Owner depends on OUT-1 output from MASTER(?) CPU ;<--that is: "2J" CPU + aka IRQ input from SLAVE(?) CPU (or vice-versa?) ;<--that is: "8J" CPU + Typically handshake involves IRQ from Master CPU, followed by a + response-IRQ from Slave CPU. + +Joysticks +The Joysticks are working like normal Joypads, but with different bit +assignments, Start/Select are renamed to Button 1-4, and controls for Player 1 +and 2 are exchanged: + Read NES/4016h VS/4016h NES/4017h VS/4017h + 1st Button A (1) Button A (2) Button A (2) Button A (1) + 2nd Button B (1) Button B (2) Button B (2) Button B (1) + 3rd Select (1) Button 1 Select (2) Button 2 + 4th Start (1) Button 3 Start (2) Button 4 + 5th Up (1) Up (2) Up (2) Up (1) + 6th Down (1) Down (2) Down (2) Down (1) + 7th Left (1) Left (2) Left (2) Left (1) + 8th Right (1) Right (2) Right (2) Right (1) +Reportedly, some VS games have those inputs assigned differently? +--> Controllers - Joypads + +Lightguns +VS Lightguns are more or less same as NES Zappers, but the signals are injected +to the "joypad" shift registers (the normal NES-like connection would conflict +with VS DIP-Switches), for details on both VS and NES guns, see: +--> Controllers - Lightguns (Zapper) + +Coin Slots +There are two coin slots (maybe for different coins?). Some games allow to +change the number of coins per game via DIP-Switches; ie. in some cases one +needs to insert more than one coin before the game starts (or push the coin +button more than once in emulators). Credit Service Button (inside the cabinet) +typically adds a free game. +Exact purpose of the Coin Acknowledge output is unknown. +At least some VS games (eg. Clu Clu Land) do accept Coin signals only if they +fall within whatever min/max lengths; there is no such timing restriction for +the service button. + +DIP-Switches +Allow to configure the games. Such like: Skipping the title screen, muting +sound effects, changing difficulty, changing PPU palette (on third-party +games), changing coins per game. +Some Daughterboards do contain additional DIP-Switches (used to change capacity +of the ROMs). + +VS System Games +--------------- + +VS System Games + PPU Mapper Title + *RP2C04-0001 MMC3+? Atari RBI Baseball + RP2C04-0003 DUAL Balloon Fight (... Dualsystem only?) + RP2C04-0001 DUAL Baseball (... Dualsystem only?) + *RP2C04-0001 - Battle City + RP2C04-0002 UNROM Castlevania + RP2C04-0004 - Clu Clu Land + RP2C04-0003 MMC1 Dr. Mario + RC2C03B - Duck Hunt (Lightgun) (one version) + RC2C03C - Duck Hunt (Lightgun) (other/same version) + RP2C04-0003 - Excite Bike (instructions in demo-mode) (Nintendo) 1984 + RP2C04-0004 - Excite Bike (status-bar in demo-mode) (Nintendo) 1984 + RP2C04-0001 MMC3 Freedom Force (Lightgun) (1988 Sunsoft) + RP2C04-0002 - Golf + RC2C03B ? - Golf (Japan version?) XXX doesn't match ANY palette?? + RP2C04-0003 VRC1 Goonies + RP2C04-0001 VRC1 Gradius + RC2C05-03 40K+16K Gumshoe (Lightgun) + RP2C04-0001 - Hogan's Alley (Lightgun) + RP2C04-0004 - Ice Climber (Unisystem) + RP2C04-0004 DUAL Ice Climber (Dualsystem) (JAPAN) "splitscreen-vertical" + RP2C04-0002 - Ladies Golf + RP2C04-0002 - Mach Rider (Endurance Course version) + RP2C04-0001 - Mach Rider (Fighting Course version) (Japan version) + RC2C03B DUAL Mahjang (... Dualsystem only?) + RC2C05-02 - Mighty Bomb Jack (Japan) + RC2C05-01 - Ninja Jajamaru Kun (Japan) + RP2C04-0001 - Pinball + RC2C03B - Pinball (Japan) + RP2C04-0001 Sunsoft3 Platoon + RP2C04-0002 DUMMY Raid on Bungeling Bay (Japan) + RP2C04-0002 - Slalom + RP2C04-0002 - Soccer (japan version) + RP2C04-0003 - Soccer (other version) + *RC2C03B - Star Luster + RP2C04-0004 - Super Mario Bros. + RP2C04-0004 - Super Mario Bros. (alternate version) + RP2C04-0004 - Super Mario Bros. (Super Skater/Skate Kids CHR-ROM hack) + *RP2C04-0001 MMC3 Super Sky Kid + *RP2C04-0001 MMC3+? Super Xevious + RC2C03B DUAL Tennis (... Dualsystem only?) + *RP2C04-0001 - Tetris (by Tengen) + *RP2C04-0003 MMC3+? TKO Boxing + RC2C05-04 UNROM Top Gun + RP2C04-0002 DUAL Wrecking Crew (... Dualsystem only?) + RC2C05-05 ? (this PPU is used by which game ???) (does it exist?) + RP2C03B ? (this PPU is used by Playchoice 10; not by VS System) + RP2C03G ? (this PPU is used by which game ???) (does it exist?) +Note: The "*" marked entries are third-party games that do support different +PPUs (typically selected via DIP switch 6-8, the PPUs listed in the above table +are used when all DIP switches are OFF). + +VS System Mappers +Below should be the correct mapper numbers used by VS games. Observe that +ROM-images do often contain incorrect mapper numbers (probably because there is +no automatic tool for dumping the VS ROM-Sets) (in worst case, the .NES header +is even missing the VS-flag). + - Mapper 99 (standard VS System mapper; games without daughterboard) + 40K+16K Mapper 99 (with some extension to access 40K PRG-ROM) + DUAL Mapper 99 (Dualsystem, requires two ROM-sets, two CPUs/PPUs etc.) + DUMMY Mapper 99 (single-player, but requires Dummy PRG-ROM on second CPU) + MMC1 Mapper 1 (MMC1, or actually some pre-MMC1 74xxx-logic) + MMC3 Mapper 4 (MMC3, or actually some third-party pre-MMC3 chip) + MMC3+? Mapper 4 (plus protection chip at 5Exxh or 5xxxh) + Sunsoft3 Mapper 67 (Sunsoft-3 chip) + UNROM Mapper 2 (UNROM) + VRC1 Mapper 75 (Konami VRC1 chip) +The "Mapper 99" games consist of several 8Kbyte EPROMs (to be mounted directly +on the mainboard). The other games use special daughterboards (to be mounted +between CPU/PPU and mainboard). +The "MMC3" chips are actually some sort of pre-MMC3 28pin Shrink-DIP chips from +Namco, with part number "108 JAPAN", so correct mapper number would be "Mapper +206" or so? + +VS System PPUs + RC2C03B (standard palette) ;\standard palette + RC2C03C (standard palette) ;/ + RC2C05-01 (with ID ([2002h] AND xxh)=?) ;\ + RC2C05-02 (with ID ([2002h] AND 3Fh)=3Dh) ; standard palette, but with + RC2C05-03 (with ID ([2002h] AND 1Fh)=1Ch) ; swapped port 2000h/2001h, + RC2C05-04 (with ID ([2002h] AND 1Fh)=1Bh) ; and Chip ID in port 2002h + RC2C05-05 (with ID ([2002h] AND xxh)=?) ;/ + RP2C04-0001 (special palette 1) ;\ + RP2C04-0002 (special palette 2) ; special palettes + RP2C04-0003 (special palette 3) ; + RP2C04-0004 (special palette 4) ;/ +For reference, below are some more RGB PPUs (although not used in VS System): + RP2C03B (standard palette) ;<-- Playchoice 10 ;\standard palette, but not + RP2C03G (standard palette) ;<-- used where? ;/actually VS System related +And, RP2C03C and RC2C05-99 do exist (the above obscure RP2C03G and RC2C05-05 +chip names might be actually mistyped names, and might be actually being meant +to mean RP2C03C and RC2C05-99). + +Reportedly further VS games: + Babel no Tou (by Namco, 1986) + Family Boxing (by Namco/Wood Place, 1987; japanese "TKO Boxing") + Family Stadium '87 (by Namco, 1987; sequel to RBI Baseball) + Family Stadium '88 (by Namco, 1988; sequel to RBI Baseball) + Family Tennis (by Namco, 1987) + Head to Head Baseball (ever finished/released?, by Nintendo, 1986) + Lionex (prototype by Sunsoft, 1987) + Madura no Tsubasa (prototype by Sunsoft, 1987) + Predators (prototype by Williams, 1984) + Pro Yakyuu Family Stadium (by Namco, 1986; Japan version of RBI Baseball) + Quest of Ki (by Namco/Game Studio, 1988) + Super Chinese (by Namco/Culture Brain, 1988) + Toukaidou 53tsugi (prototype by Sunsoft, 1985) + Trojan (by Capcom, 1987) + Urban Champion (1984) + Volleyball (1986) + Walkure no Bouken (by Namco, 1986) + Wild Gunman (1984, light gun game) +and maybe Kung-Fu, Football, etc. + +VS System PPUs and Palettes +--------------------------- + +PPU Name Tables +The VS System seems to be fitted with 4K VRAM. If that is true, and if there's +no way to disable that, then VS games are probably always running in +Four-Screen mode. Ie. ignore any different mirroring settings in .NES file +header, and ignore any Name Table mode selections via VRC1/MMC1/MMC3/Sunsoft3 +mappers. + +PPU ID Codes +There are some PPUs with swapped control port addresses, and IDs in lower 5bit +of the PPU status port. + RC2C05-01 (with ID ([2002h] AND xxh)=?) ;\ + RC2C05-02 (with ID ([2002h] AND 3Fh)=3Dh) ; standard palette, but with + RC2C05-03 (with ID ([2002h] AND 1Fh)=1Ch) ; swapped port 2000h/2001h, + RC2C05-04 (with ID ([2002h] AND 1Fh)=1Bh) ; and Chip ID in port 2002h + RC2C05-05 (with ID ([2002h] AND xxh)=?) ;/ +Unknown: RC2C05-05 does it really exist, which game is using it, what's its ID? +Unknown: RC2C05-01 what ID does it have (if any) (game doesn't check it)? +Unknown: RC2C05-03 game wants a 6bit ID, does that PPU support the "Sprite +Lost" flag, if yes, why/how is it set in the ID check? Maybe always initially +set on Reset, or always occuring shortly after reset (in case OBJ y-coordinates +are initially all same)? + +PPU Palettes +The "Standard" Palette does resemble the NES palette. The other four palettes +do have these colors rearranged, and have some additional colors. +All five VS palettes are much more colorful than the "pastelized" NES palette +(roughly same as on a NES when setting the TV Set to MIN Brightness & MAX +Color). +The PPU's Color Emphasis Bits are also different as on NES PPUs: On a VS-PPU, +they are forcing the selected color(s) to max brightness. For example, when +setting all three Emphasis Bits, the whole screen will become white (on a NES, +the normal picture would be kept displayed at reduced brightness). + +Below palette tables are showing 3:3:3 bit RGB values (eg. 700=Red, 070=Green, +007=Blue). + +RP2C04-0001, Special Palette 1 + 755,637,700,447,044,120,222,704,777,333,750,503,403,660,320,777 + 357,653,310,360,467,657,764,027,760,276,000,200,666,444,707,014 + 003,567,757,070,077,022,053,507,000,420,747,510,407,006,740,000 + 000,140,555,031,572,326,770,630,020,036,040,111,773,737,430,473 + +RP2C04-0002, Special Palette 2 + 000,750,430,572,473,737,044,567,700,407,773,747,777,637,467,040 + 020,357,510,666,053,360,200,447,222,707,003,276,657,320,000,326 + 403,764,740,757,036,310,555,006,507,760,333,120,027,000,660,777 + 653,111,070,630,022,014,704,140,000,077,420,770,755,503,031,444 + +RP2C04-0003, Special Palette 3 + 507,737,473,555,040,777,567,120,014,000,764,320,704,666,653,467 + 447,044,503,027,140,430,630,053,333,326,000,006,700,510,747,755 + 637,020,003,770,111,750,740,777,360,403,357,707,036,444,000,310 + 077,200,572,757,420,070,660,222,031,000,657,773,407,276,760,022 + +RP2C04-0004, Special Palette 4 + 430,326,044,660,000,755,014,630,555,310,070,003,764,770,040,572 + 737,200,027,747,000,222,510,740,653,053,447,140,403,000,473,357 + 503,031,420,006,407,507,333,704,022,666,036,020,111,773,444,707 + 757,777,320,700,760,276,777,467,000,750,637,567,360,657,077,120 + +All other VS System PPUs reportedly use this (or similar?) Standard Palette + 333,014,006,326,403,503,510,420,320,120,031,040,022,000,000,000 + 555,036,027,407,507,704,700,630,430,140,040,053,044,000,000,000 + 777,357,447,637,707,737,740,750,660,360,070,276,077,000,000,000 + 777,567,657,757,747,755,764,772,773,572,473,276,467,000,000,000 +In the "standard" RGB palettes, color 0Dh is all black, which means that TWO of +the composite NES gray-shades are missing on RGB PPUs. Note/caution: There is +an "improved" RGB palette with THREE extra gray-shades (111,222,444) in the +internet: that palette was invented/intended to make an open source emulator +look "better" than real hardware - that "improvement" was adopted by many other +emulators (probably without even being aware of the unreal grays). + +French "RGB" (home-use NES consoles, not arcade) +France is using SECAM as television standard, frame rate is 50Hz (like PAL), +but color encoding is different. The other big video standard in france appears +to be to have TV Sets fitted with RGB input. +Like many other manufacturers, Nintendo didn't produce SECAM PPUs. Instead they +have used a PAL to RGB converter attached to a standard PAL PPU. That pseudo +"RGB" output is thus having same artifacts as composite PAL pictures. + +VS System Protections +--------------------- + +Unprotected Games +VS Games are consisting of sets of EPROMs without any special hardware (apart +from custom cabinet front plates), the are no CIC lockout chips. That (and the +relative high price of the games) made it quite inviting to upgrade the +cabinets with illegal copies of newer games, or with unlicensed third-party +games. + +Nintendo Protections +To prevent piracy & unlicensed games, Nintendo has made a bunch of different +PPUs: PPUs with different palettes, and PPUs with different Port +2000h/2001h/2002h. + +Third-Party Protections +Thirty-Party games can be often DIP-switched to work with different palettes +(thus bypassing Nintendo's protection). Instead, some thirty-party games do +require some special "ID chip" mapped at 5xxxh or 5Exxh, and refuse to boot if +the thing doesn't respond with expected values (see below for details). + +Daughterboards +These are mainly used to access more memory. But, to some level they do also +act as protection, since one needs to buy the boards. Some boards can be +DIP-switched to work with different games with ROM capacites though. + +Raid on Bungeling Bay +This game consists of seven 8Kbyte EPROMs. Six PRG/CHR EPROMs for first CPU, +and one PRG EPROM for second CPU (without any CHR ROM here). This extra EPROM +isn't doing anything useful (no sound/video output, and coprocessor-like +maths), it's just doing a short handshake with the other CPU, and then it hangs +in an endless loop. +The purpose is unknown; it may be some crude protection (won't work if the +extra EPROM doesn't say "I am here"). Or maybe the game supports DUAL mode (and +in UNI mode, requires the second CPU to say "I am NOT here"). +Basically, the game needs a response IRQ from other CPU (with don't care +response at 67E0h-67FFh), and additionally DIP 5 must be ON. + +TKO Boxing Protection (Namco) +Protection unit is contained in a 28pin chip with part number "126 JAPAN". + [5E00h].Read ;-reset data stream (returns unknown/dummy value) + [5E01h].Read ;-return data stream (returns FFh,BFh,B7h,etc.) +TKO Boxing contains pre-computed 32 values in ROM: + FF,BF,B7,97,97,17,57,4F,6F,6B,EB,A9,B1,90,94,14 ;1st..16th read + 56,4E,6F,6B,EB,A9,B1,90,D4,5C,3E,26,87,83,13,51 ;17th..32th read +That is, the initial value (FFh on first read) is XORed by following values: + 40,08,20,00,80 ;XORed after 1st..5th read + 40,18,20,04,80 ;XORed after 6th..10th read + 42,18,21,04,80 ;XORed after 11th..15th read + 42,18,21,04,80 ;etc. + 42,18,21,44,88 + 62,18,A1,04,90 + 42 +The exact way how that pattern is generated (and how it continues after 32 +reads) is unknown. Note: The way how TKO Boxing is programmed, it CAN only +verify the first 31 values, and actually DOES only verify first 7 values +(unless there are further checks hidden "deeper" in the game). + +Atari RBI Baseball Protection (Namco) +Protection unit is contained in a 28pin chip with part number "127 JAPAN". + [5E00h].Read ;-reset data stream (returns unknown/dummy value) + [5E01h].Read ;-return data stream (returns whatever...) +RBI Baseball verifies only two values: B4h on 5th read, and 6Fh on 10th read. +This is different as in TKO Boxing (which would return 97h and 6Bh). + +Super Xevious Protection (Namco) +Uses whatever protection chip (unknown part number). +The game is doing the following check upon Reset: + Write: [5098h]=38h, [5132h]=9Eh, [5263h]=22h, [5300h]=90h + Verify: [54FFh]=05h, [5678h]=01h, [578Fh]=89h, [5567h]=37h + Write: [5056h]=44h, [51C8h]=72h, [526Ah]=9Ah, [5300h]=FEh + Verify: [54FFh]=05h, [5678h]=00h, [578Fh]=D1h, [5567h]=3Eh +That can be faked by returning following values upon [5400h..57FFh] reads: + 05h, 01h, 89h, 37h, 05h, 00h, D1h, 3Eh +Unknown how the hardware works in reality; it looks like four 8bit latches, and +scrambled data, possibly by XORing data & address lines. + +Controllers +Some VS games do reportedly some controller buttons exchanged with each other, +so they can be played only when buying a special controller front panels or so. +Unknown which games and which buttons that applies to. + +Nintendo Playchoice 10 +---------------------- + +The Nintendo Playchoice 10 (PC10) arcade cabinets can contain up 10 NES games +(on special cartridges). Aside from the NES-compatible hardware, the thing +contains a Z80 CPU and a custom video circuit for handling game selection, +coin/credits, game title/instructions display and bookkeeping. + +--> PC10 Memory Map and I/O Ports +--> PC10 Video Circuit +--> PC10 Title/Instructions (INST ROM) +--> PC10 NES-Side +--> PC10 Games and Cartridge PCBs +--> PC10 Cabinet and BIOS Versions +--> PC10 Pin-Outs +--> Z80 CPU Specifications + +PC10 Memory Map and I/O Ports +----------------------------- + +Z80 Memory Map + 0000h-7FFFh 32K BIOS ROM Area (usually 16K chip, mirrored within 32K area) + 8000h-87FFh 2K Work RAM + 8800h-8BFFh 1K Lower 1K of Battery RAM + 8C00h-8FFFh 1K Upper 1K of Battery RAM (when disabled: mirror of Lower 1K) + 9000h-97FFh 2K Video RAM (write only, and disabled during video output) + 9800h-BFFFh 10K Unused (open bus) + C000h-DFFFh 8K Cartridge BIOS (resides on each game cartridge) + E000h-FFFFh 8K Memory-mapped PROM I/O Ports + +Z80 I/O Map - READ (by IN opcodes) + 00h Button/Status + bit 0: Channel select button (aka Button 1) (0=Released, 1=Pressed) + bit 1: Enter button (aka Button 2) (0=Released, 1=Pressed) + bit 2: Dual-Monitor with Reset button (0=Released, 1=Pressed) + Single-Monitor with Reset button (0=Pressed, 1=Released) + Single-Monitor without Reset button (Always 0=No Reset Button) + (Presence of the single monitor reset button works as so: + The button may not be held down during power-up (obviously). + The freeplay mode DIP-switch setting and R99 shunt-lead removal + are accidentally causing the button-detection to be skipped. + Bugfix: change the two jumps to address 0378h to address 036Bh) + bit 3: Vblank NMI Occurred on NES Side (0=Yes, 1=No) + bit 4: unknown... is USED ! "R99 0 ohm Shunt Lead to GND" ? + (allow to insert more coins for PRIME TIME ...?) + bit 5: Coin 2 button (0=None, 1=Coin Insterted) + bit 6: Service button (0=Released, 1=Pressed) + bit 7: Coin 1 button (0=None, 1=Coin Insterted) + 01h DIP-switch 1, Bits 0-7 (A..H) (0=Off, 1=On) + bit 0..5: (A..F) Coinage (credits per left/right coin slot) + bit 6: (G) Sound enable for Attraction/Demo mode (0=Off, 1=On) + bit 7: (H) Automatic Selftest upon Power-Up (0=Off, 1=On) + 02h DIP-switch 2, Bits 0-7 (I..P) (0=Off, 1=On) + bit 0..5: (I..N) Timer Speed (credit decrease rate) + bit 6: (O) Divide all coinage settings by 2 (see A..F) + bit 7: (P) Freeplay Mode (only when bit0..6 = zero) + 03h Reading from this address sets Bit3 of read Port 00h back to 1=False +Port 04h..FFFFh are mirrors of Port 00h..03h. + +Z80 I/O Map - WRITE (by OUT opcodes) (all write ports are using bit 0 only) + 00h VRAM Access (0=by Z80 CPU, 1=by Video circuit) + 01h Game Controls (0=Disable, 1=Enable) + 02h PPU RP2C03B Display output (0=Disable, 1=Enable) + 03h APU N2A03 Sound output (0=Disable, 1=Enable) + 04h CPU N2A03 Reset (0=Reset, 1=Run) + 05h CPU N2A03 Stop (0=Stop, 1=Run) + 06h Display Output Select (0=Z80/Video circuit, 1=NES/RP2C03B PPU) + (Only on single monitor version) + 07h Unknown...? is USED ! (even in single-monitor bios!) + or, 06h,07h = both N/C + 08h Z80 NMI Control (0=Disable, 1=Enable) + 09h Watchdog Control (0=Enable, 1=Disable) + 0Ah PPU RP2C03B Reset (0=Reset PPU, 1=Run PPU) + 0Bh Game Channel Select Bit0 ;\Slot Select (0-9) (0Ah..0Fh=Open Bus) + 0Ch Game Channel Select Bit1 ; affects NES CPU/PPU memory, + 0Dh Game Channel Select Bit2 ; and Z80 INST-ROM and PROM + 0Eh Game Channel Select Bit3 ;/ + 0Fh Upper 1K of Battery RAM (0=Disable, 1=Enable) +Below 4bit Ports in Single-Monitor version only (remaining time display): + 10h 7-Segment LED 4th Digit (LSB) ;\Four 74HC4511 BCD-to-7-segment drivers, + 11h 7-Segment LED 3rd Digit ; and four GL-8E040 7-segment LED displays + 12h 7-Segment LED 2nd Digit ; (bit0-3:00h..09h="0..9", 0Ah..0Fh=Blank) + 13h 7-Segment LED 1st Digit (MSB) ;/ +Mirrors should be as so: + 10h..1Fh Mirrors of Port 00h..0Fh (Dual-Monitor version only) + 14h..1Fh Mirrors of Port 10h..13h (Single-Monitor version only) + 20h..FFFFh Mirrors of Port 00h..1Fh (all versions) + +Watchdog +The watchdog is disabled (and its frame counter is reset to zero) when Port 08h +and/or Port 09h are set to nonzero values; ie. the watchdog is active ONLY +during periods when NMIs are off (Port 08h=0) and only when the Watchdog is on +(Port 09h=0). When active, the watchdog resets the Z80 CPU after 8 frames. + +Z80 Memory Mapped I/O at E000h..FFFFh - Ricoh RP5H01 serial 72bit PROM +Data Write: + 7-5 Unused + 4 PROM Test Mode (0=Low=6bit Address, 1=High=7bit Address) + 3 PROM Clock (0=Low, 1=High) ;increment address on 1-to-0 transition + 2-1 Unused + 0 PROM Address Reset (0=High=Reset to zero, 1=Low=No Change) +Data Read and Opcode Fetch: + 7-5 Always set (MSBs of RST Opcode) + 4 PROM Counter Out (0=High=One, 1=Low=Zero) ;PROM Address Bit5 ;\both + 3 PROM Data Out (0=High=One, 1=Low=Zero) ;PROM Data ;/inverted + 2-0 Always set (LSBs of RST Opcode) +The 72bit PROM contains 9 bytes (8 "normal" bytes, and 1 "test" byte which was +originally intended for testing purposes, but can be also mis-used to contain +"normal" data). After resetting the address to zero, the the PROM will be +(repeatedly) outputting the following bytes (LSB first): + DATA (when TEST=0): a, b, c, d, e, f, g, h, a, b, c, d, e, f, g, h + DATA (when TEST=1): a, b, c, d, e, f, g, h, i, i, 00,00,i, i, 00,00 + COUNTER OUT (always): 00,00,00,00,FF,FF,FF,FF,00,00,00,00,FF,FF,FF,FF + (the PC10 mainboard inverts that signals, so Z80 will see inverse of above) +In the PC10, the PROM contains a decryption key, used for deciphering the +INST-ROM content. Most of the decryption is done by code in the INST-ROM (so +one could completely omit that part in homebrew INST-ROMs). The BIOS accesses +the PROM in only two places: In the INST-ROM checksum calculation (which thus +requires whatever stable data coming from the PROM). And, the Z80 NMI handler +(which checks that CounterOut is High after 32 reads). + +PC10 Video Circuit +------------------ + +PC10 VRAM (32x28 character "BG Map") +VRAM is located at 9000h-97FFh. VRAM is write-only, and can be accessed only +when video output is disabled via Port OUT[00h], to avoid flickering, this +should be usually done only during VBlank (ie. in the Z80 NMI handler). +Each character line occupies 40h bytes (20h words). The words are: + Bit0-10 Character number (000h..7FFh) (usually only 000h..3FFh installed) + Bit11-15 Palette number (00h..1Fh) +The upper 2 lines and lower 2 lines are masked for V-Blank period, so actually +used VRAM consists of 28 lines at 9080h..977Fh. + +PC10 Charset (for the Z80 Video Circuit) + '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",: abcdefghijkl+ ' ;000-03F + '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",:mnopq?()/=+ ' ;040-07F + 'abcdefghijklABCmEnoHIpqLMNOPrRSTUstuYv!wxyzr' ;080-0BF + 'stuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ,-!'()  ' ;0C0-0FF + '0 1 2 3 4 5 6 7 8 9 TIMEInsertCoin ' ;100-13F + ' Tim NearUp FillUpTimeAnd ' ;140-17F + '' ;180-1BF + '' ;1C0-1FF + 'ChannelSelectEnter.ButtonsGameTart ' ;200-23F + ' ' ;240-27F + ' ' ;280-2BF + '  ' ;2C0-2FF + ' ' ;300-33F + 'cntrlTM' ;340-37F + '' ;380-3BF + 'c1986nintendo ' ;3C0-3FF +The 400h characters are stored in three 2764 chips (three 8Kx8 EPROMs): IC +"8P"=CHR0, IC "8M"=CHR1, IC "8K"=CHR2 (each chip containing one color-plane of +the 8-color characters). Optionally, for 800h characters, the mainboard could +be fitted with 27128 chips. +The "" graphics symbols are used by the BIOS (and by instruction pages in +Excitebike, Mario Bros, and Super Mario Bros). There are no japanese +characters. + +PC10 Palette (for the Z80 Video Circuit) +Below palette table is showing 4:4:4 bit RGB values (all digits are inverted, +0=Brightest, F=Darkest, eg. 0FF=Red, F0F=Green, FF0=Blue). + Pal <-------- Color 0..7 ---------> Pal <-------- Color 0..7 ---------> + 00: FFF,000,000,000,000,000,000,000 10: FAF,0BF,000,027,00B,FAF,FA9,F08 + 01: 94D,FFF,000,00B,024,1FF,AFF,FD8 11: FAF,A5D,303,707,00B,FAF,307,FFF + 02: F9F,03F,FAF,000,000,000,FFF,FFF 12: 000,000,000,000,000,000,000,000 + 03: FFF,000,FFF,9FF,06F,0FF,047,F40 13: 000,000,000,000,000,000,000,000 + 04: 048,9FF,000,000,000,F95,FFA,FFF 14: 000,048,000,000,000,F9F,72F,FFF + 05: F9F,0FF,F0B,00A,000,000,FFF,FFF 15: 000,000,000,000,000,000,000,000 + 06: F9F,88F,0FF,000,000,000,FFF,FFF 16: 000,000,000,000,000,000,000,000 + 07: F9F,11F,5FF,000,000,000,FFF,FFF 17: 000,FAF,000,000,000,FCF,039,FFF + 08: 000,000,000,000,000,000,000,000 18: F8F,000,00B,000,000,036,FFF,FFF + 09: 000,000,000,000,000,000,000,000 19: FAB,2CF,F07,029,111,FFF,4F1,F93 + 0A: 000,000,000,000,000,000,000,000 1A: 000,000,000,000,000,000,000,000 + 0B: 000,000,000,000,000,000,000,000 1B: FAF,000,FF5,FF0,F40,5AF,024,0FF + 0C: 000,000,000,000,000,000,000,000 1C: FAF,0FF,046,6D9,008,FF4,F30,300 + 0D: 000,000,000,000,000,000,000,000 1D: FAF,0F9,F7F,838,415,7BE,27D,048 + 0E: 000,000,000,000,000,000,000,000 1E: FAF,0FF,000,02F,F4F,5DF,888,766 + 0F: 000,000,000,000,000,000,000,000 1F: F9F,007,000,00F,0FF,027,FFF,FFF +The 100h palette entries are containing 42h different colors. The Palette data +is stored in three N82S129N chips (three 256x4bit PROMs): IC "6D"=Blue, IC +"6E"=Green, IC "6F"=Red. + +PC10 Character Sets - Available Characters per Color +The PC10's character set ROM contains four character sets, all having +identically looking characters, but with different color numbers, and with +different amounts of defined characters: + Charset0: 0123456789.'!-",:+?()/=ABCDEFGHIJKLMNOPQRSTUVWXYZabc..xyz + Charset1: 0123456789 '!- , () ABCDEFGHIJKLMNOPQRSTUVWXYZabc..xyz + Charset2: 0123456789.'!-",:+ ABCDEFGHIJKLMNOPQRSTUVWXYZ + Charset3: ! ABC E HI LMNOP RSTU Y +Title strings must use Charset2 (and will be changed to Charset0 for the +currently selected title). +Instruction text can have the Charset ROM colors combined with different VRAM +palette attributes. To match up with the window border, the background color +should be dark green (as so in palette 10h-11h and also in 1Bh-1Eh). Possible +Charset vs Palette combinations for Instruction Texts are: + Palette: 10h 11h 1Bh 1Ch 1Dh 1Eh + Charset0: White Mint D.Blue Orange2 D.Green White + Charset1: Orange L.Green Blue Magenta P.Green Orange3 + Charset2: Red M.Green White Red Pink Red + Charset3: Yellow Yellow - - - - +Accordingly, there are several restrictions on coloring. For example, Red +cannot be used with lowercase letters. + +PC10 Z80 Video Circuit Timings - Dual Monitor Version +The Z80 Video Circuit is producing roughly NTSC-style timings (the output is +passed straight to the built-in RGB monitor, so there has been no need to match +exact television standards). + Resolution 32x28 tiles of 8x8 pix each (=256x224 pixels) + Dotclk = 5.040MHz (X2 oscillator, 20.160MHz, divided by 4) + Dots per line = 327 total dots (256 visible dots, plus 71 h-blank dots) + Lines per frame = 256 total lines (224 visible lines, plus 32 v-blank lines) + VBlank at Y=F0h..0Fh (when V5=1, V6=1, V7=1, latched at raising V4) + Vsync at Y=F8h..FBh (when Vblank=1, V4=1, V3=1, V2=0) + Hsync when HBlank=1, H1=1, H2=0 + Screen Border Color during H/V-Blanking is Color 0 of Palette 0 (Black) + Frame Rate = 60.20642202Hz = 5.040MHz / 256 Lines / 327 Dots + Z80 NMI (if enabled) is generated on begin of Z80 Circuit's Vblank (Y=F0h) +The Z80 Video Circuit's frame rate is NOT synchronized with the NES PPU. + +PC10 Z80 Video Circuit Timings - Single Monitor Version +Not much known here. There's no schematic for the Single Monitor version. +According to a component list, the X2 oscillator for the Z80 video circuit is +21.47727MHz (same as the X3 oscillator for the NES). Accordingly, one may +assume that dots/line and lines/frame are also matched to NES timings (else the +display would shake when switching between Z80 picture and NES picture). + +LED Character Set (74HC4511 BCD-driver with yellow-green GL-8E040 display) +The Single-Monitor version is having a 4-Digit LED display for displaying the +remaining time during Game (and also in Menu). The LED Digits 00h..09h are as +so: + _ _ _ _ _ _ _ + | | | _| _| |_| |_ |_ | |_| |_| + |_|. |. |_. _|. |. _|. |_|. |. |_|. |. + +Digit 06h/09h may vary from chip to chip: existing Playchoice cabinets are +drawing them as shown above (without upper/lower horizontal line, as specified +by Toshiba and Philips) (whilst Texas Instruments specifies them with extra +lines). The "." dot (eighth LED segment) is always off in the Playchoice. + +PC10 Title/Instructions (INST ROM) +---------------------------------- + +Hardcoded INST-ROM Addresses + C000h 16bit ptr to "Data" for 40h-byte Area (passed on stack to C0FFh) + C001h 8bit value (initial chksum value) + C0FEh 16bit ptr to rst 38h handler (not used by BIOS) overlaps below C0FFh! + C0FFh code: rst 00h handler when I<>00h (get_40h_byte_area_function) + C3C3h code: Opcode E9h (JP HL) + C784h 16bit ptr to rst 30h handler (not used by BIOS) + C9BEh code: wait_1_frame function + XXX the BIOS NMI handler does occassionally remap a different slot + while the mainprogram is executing the C9BEh function, + so, the C9BEh stuff must be identical (or very similar) + in all INST-ROMs + C9C9h code: Opcode C9h (RET) + D000h homebrew title string (used by the gamehacker's homebrew BIOS) + D0FEh 16bit ptr to rst 28h handler (not used by BIOS) overlaps below D0FFh! + D0FFh code: rst 10h handler (not used by BIOS, used only by INST ROM) + D3D3h 16bit ptr to rst 20h handler (not used by BIOS) + D784h 16bit ptr to rst 18h handler (RET P, LD HL,[80E3], LD [HL],00, RET) + DFFFh 8bit value (can be used as final chksum adjustment byte) + +40h-byte Area (aka HDR) (retrieved via C0FFh) + 00h 1 GameID (must be unique number for Bookkeeping) (or 00h=Empty Slot) + 01h 2 16bit ptr to 16bit ptr to Token code (demo_duration_function) + 03h 2 16bit ptr to 16bit ptr to Z80 code (draw_instruction_function) + 05h 1 Decryption Offset (to be subtracted from bytes at [05h..1Ch]) + 06h 16h Unknown/Unused (eleven words in range C000h..FFFFh or so?) + 1Ch 1 Opcode E9h (JP HL) + 1Dh 3 Zerofilled (overwritten by leading Slot number for Title string) + 20h 18h Title (18h bytes) (space, title, space, dotted-line, player symbols) + 38h 8 Zerofilled (overwritten by variables) + +Title (18h bytes) (space, title, space, dotted-line, player symbols) +Must consist of following characters: + 00h..2Bh 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ.'!-"",: + 3Ch + + 3Eh Dotted line + 3Fh Space + 3Dh,F9h Lightgun Symbol + FBh..FEh Two Player Symbol ("@/@@") +Last 5 bytes of title should be: + 3E,3F,3F,3F,3F Normal single-player game (eg. 1942, Castlevania, Metroid) + 3E,FB,FC,FD,FE Two-player game (eg. Balloon, Contra) + 3D,F9,3F,3F,3F Lightgun game (eg. Hogan) + +Instructions (aka "How-to-Play" screens) +Instructions are displayed in a 30x22 character window (originated at 90C2h in +VRAM), existing games are containing 1-3 pages of text. +The text is displayed by repeatedly calling functions in INST ROM during Vblank +(that functions should display only one text line at a time; to avoid +flickering that would occur when exceeding vblank time). +The initial function call goes to [HDR[03h]], aside from drawing text, that +function may manipulate the call address at [DE-1] (so further calls would go +to different addresses), and some sort of general purpose index at [DE-2] +(bit0-6 are initially 01h, and must be kept nonzero, and can be otherwise used +for general purpose such like drawing yloc, commercial games use it as +decryption offset) (bit7 should be set at the end of a page, causing the BIOS +to wait for Enter button). + +Token Interpreter (for defining the Demo Duration) +The demo duration is, for some strange reason, defined by tokens. The token +program pointer consists of a 16bit base plus 8bit index. The token entrypoint +is Base=[HDR[01h]] with Index=00h. The token interpreter is very simple: It can +wait... and wait... and wait, and not much more. + Token Param(s) Function + 00h..0Fh - sleep_1_frame + 10h..1Fh - mark_finished (to be followed by token F0h) + 20h..2Fh Index,BaseLsb,BaseMsb jump + 30h..3Fh Index,BaseLsb,BaseMsb jump_if_user_is_not_interested + 40h..4Fh Index,BaseLsb,BaseMsb jump_if_user_is_interested + 50h..7Fh NNh (max 0Fh else bugs) sleep_n_seconds (aka 64-frame units) + 80h..8Fh NNh sleep_n_frames + 80h..8Fh 02h jump_if_single_monitor + 90h..FFh - terminate (to be preceeded by token 10h) +The "jump_if_single_monitor" acts as normal on Dual-Monitor BIOS (sleeps 2 +frames), but has a special jump function on Single-Monitor BIOS (jumps to +Base=Base-0008h, Index=00h). +User is "interested" means that the user has manually entered the instructions +mode; that "interest" should be usually handled by executing additional sleep +tokens to increase the demo duration. + +Checksum +The INST-ROM checksum must be C9h. The checksum is calculated by adding/xoring +8192 bytes from INST-ROM with 8192 PROM reads (for details, see the BIOS code +near the "compare A,C9h" opcode). + +Tools +The a22i assembler (in no$nes debugger's utility menu) contains some .pc10 +directives for creating INST ROMs. See the magicnes.zip package on no$nes +webpage for sample source code. The INST ROMs will work without decryption PROM +(they will only require a minimalistic circuit that drags the two decryption +signals to HIGH upon /CHANNEL_SELECT). + +PC10 NES-Side +------------- + +The PC10 cartridges are usually containing PRG-ROM and CHR-ROM on EPROMs +(though, despite of the EPROM-storage, they are usually byte-identical to +normal NES ROM-cartridge versions). Nonetheless, there are a few things to +recurse when making PC10 games (and eventually customize NES games +accordingly): + +NES PPU Palette +The PC10 uses a RGB palette, the colors are similar to NES Composite colors, +but not 100% same: PC10 colors are more colorful than the pastelized NES +colors. Pastel-cyan and two grayshades are completely missing. And, some colors +are having wrong intensities, so fade-in/fade-out effects programmed for the +NES can produce ugly flickering on the PC10. The color emphasis bits are also +working differently as on NES. The PC10 palette is same as the "standard" VS +System palette, for details see: +--> VS System PPUs and Palettes + +NES NMI Disable +The PC10 BIOS is watching the NES NMI signal. If the NES disables NMIs for a +longer period (around 255 frames), then it'll treat the game to have locked up, +and will terminate the game. If that happens more than twice, then it will +additionally remove the game from the menu's cartridge list. + +NES Controller Disable +The PC10 can disable the NES controllers in demo mode. For some reason, it +doesn't disable the serial shift-register outputs, but rather only the +Select/Start parallel inputs (and lightgun trigger). Accordingly, to prevent +the game being played in demo mode, starting the game should work ONLY via +Start button (ie. not via Button A/B). + +NES Controller Connection +The PC10 has two "joypads" and one "zapper", unlike as on NES, it isn't +possible to disconnect them, so the game must work with that hardware connected +(which should be usually no problem). +Whereas, the lightgun seems to be an optional add-on, not installed in all +cabinets (especially not in tabletop cabinets). +The Start/Select buttons are mapped to the Joypad 1 input. The Joypad 2 input +doesn't have any such buttons (similar as japanese Famicom joypads). + +NES Pause / Timings +It seems to be possible to "pause" the NES CPU. Unknown if this is actually +done during game-execution... if so, pausing/unpausing may get the CPU offsync +with the PPU, which might confuse & crash a few NES games. Initial CPU Reset +time vs PPU Reset time may be also different as on normal NES. +And, reportedly, the PC10 RGB-PPU timing isn't exactly same as NES NTSC-PPU +timing (reportedly something to do with missing dots on some NTSC scanlines or +so). + +NES IRQs +On older PC10 mainboards, the /IRQ pin is wired as output (rather than as +input), making it incompatible with games that do use IRQs. The mainboards can +be upgraded (with two wires) to support IRQs. The upgrade may be found on many +mainboards as it's required for PCH1-01-ROM-G game cards. + +Communicating between NES and Z80 CPUs +There is no intended CPU-to-CPU communication support. However, with some +trickery, it should be possible. On the Z80 side, one could place custom code +in the C9BEh function (which is called once every mainloop cycle). For +NES-to-Z80 transfers one could enable/disable NES NMIs to transfer 1bit per +frame. For Z80-to-NES transfers one could eventually issue specially timed CPU +or PPU Reset pulses. + +PC10 Games and Cartridge PCBs +----------------------------- + +PC10 Cartridge PCB Versions + PCH1-01-ROM Mapper 0 (NROM) + PCH1-01-ROM-A Mapper 3 (CNROM - VROM/8K) + PCH1-01-ROM-B Mapper 2 (UNROM - PRG/16K) + PCH1-01-ROM-C Mapper 87 (Jaleco/Konami 16K VROM - VROM/8K) + PCH1-01-ROM-D Mapper 1 (MMC1 with VRAM) + PCH1-01-ROM-E Mapper 9 (MMC2) (...plus battery ??) + PCH1-01-ROM-F Mapper 1 (MMC1 with VROM) + PCH1-01-ROM-G Mapper 4 (MMC3 xxx) + PCH1-01-ROM-H Mapper 119 (MMC3 TQROM) + PCH1-01-ROM-I Mapper 7 (AOROM - PRG/32K, Name Table Select) + PCH1-01-ROM-J N/A ? + PCH1-01-ROM-K Mapper 1 (MMC1 with VRAM... plus battery ??) + +Known/released PC10 Games + PCH1-02-ROM 1942 (1986/1985) Capcom + PCH1-01-ROM Balloon Fight (1985/1986) Nintendo + PCH1-01-ROM Baseball (1985/1984) Nintendo + PCH1-02-ROM-F Baseball Stars (1989/1986) SNK + PCH1-01-ROM-I Captain Skyhawk (1990/1989) Milton Bradley + PCH1-02-ROM-B Castlevania (1987) Konami + PCH1-02-ROM-F Chip 'n Dale Rescue Rangers (1990) Capcom + PCH1-02-ROM-B Contra (1988) Konami + PCH1-01-ROM-F Double Dragon (1988) Technos + PCH1-02-ROM-B Double Dribble (1987) Konami + PCH1-02-ROM-F Dr. Mario (1990) Nintendo + PCH1-01-ROM Duck Hunt (1985) Nintendo + PCH1-01-ROM Excitebike (1985) Nintendo + PCH1-01-ROM-F Fester's Quest (1989) Sunsoft + PCH1-01-ROM-G Gauntlet (1985) Atari/Tengen + PCH1-01-ROM Golf (1985) Nintendo + PCH1-01-ROM-C Goonies, The (1986) Konami + PCH1-01-ROM-A Gradius (1986) Konami (said to exist in two PRG-ROM versions) + PCH1-01-ROM Hogan's Alley (1985) Nintendo + PCH1-02-ROM Kung Fu (1985) Irem + CUSTOM Magic Floor (2012) nocash (homebrew) + PCH1-01-ROM Mario Bros. (1984/1986) Nintendo + PCH1-01-ROM-K Mario's Open Golf (1991) Nintendo + PCH1-04-ROM-G Mega Man 3 (1990) Capcom + PCH1-01-ROM-D Metroid (1986) Nintendo + PCH1-01-ROM-E Mike Tyson's Punch-Out!! (1987) Nintendo + PCH1-01-ROM-F Ninja Gaiden (1989) Tecmo + PCH1-03-ROM-G Ninja Gaiden II: The Dark Sword of Chaos (1990) Tecmo + PCH1-03-ROM-G Ninja Gaiden III: The Ancient Ship of Doom (1991) Tecmo + PCH1-02-ROM-G Nintendo World Cup (Soccer) (1990) Technos + PCH1-01-ROM-H Pinbot (1990/1988) Rare + PCH1-02-ROM-G Power Blade (1991) Taito + PCH1-02-ROM-B Pro Wrestling (1987/1986) Nintendo + PCH1-02-ROM-D Rad Racer (1987) Square + PCH1-02-ROM-G Rad Racer II (1990) Square + PCH1-01-ROM-F R.C. Pro-Am (1988/1987) Rare + PCH1-02-ROM-G Rockin' Kats (1991) Atlus + PCH1-01-ROM-B Rush'n Attack (1987) Konami + PCH1-01-ROM-B Rygar (1987) Tecmo + PCH1-01-ROM-I Solar Jetman: Hunt for the Golden War(p)ship (1990) Rare + PCH1-02-ROM-G Super C (1990) Konami + PCH1-02-ROM Super Mario Bros. (1985) Nintendo + PCH1-01-ROM-G Super Mario Bros. 2 (1988) Nintendo + PCH1-01-ROM-G Super Mario Bros. 3 (1990) Nintendo + PCH1-01-ROM-F Tecmo Bowl (1989) Tecmo Inc. + PCH1-01-ROM-F Teenage Mutant Ninja Turtles (1989) Konami + PCH1-03-ROM-G Teenage Mutant Ninja Turtles II: The Arcade Game (1990) Konami + PCH1-01-ROM Tennis (1985) Nintendo + PCH1-01-ROM-A Track & Field (1987) Konami + PCH1-01-ROM-B Trojan (1987/1986) Capcom + PCH1-01-ROM Volleyball (1987/1986) Nintendo + PCH1-01-ROM Wild Gunman (1985) Nintendo + PCH1-02-ROM-F Yo! Noid (1990) Capcom +As seen above, release dates are somewhat unclear; dates before 1986 are +apparently referring to the original NES version, not the PC10 release date. + +Mystical PC10 Games + (unseen) Goonies II, The (19xx) Konami + (unseen) RBI Baseball (1987) Atari/Tengen + (unseen) Shatterhand (1991) Jaleco +These titles have been somewhere announced, and might have been actually +released, but so far no collectors ever seem to have ever found these +cartridges. + +PC10 Cabinet and BIOS Versions +------------------------------ + +Dual-Monitor Upright Cabinets +The upper monitor (for Z80 menu, instructions, and remaining time/credit +display) is usually smaller than the lower one (NES game picture). There seems +to be also a variant with two big monitors. Front panel is having 5 control +buttons. + +Single-Monitor Cabinets +The BIOS can switch the monitor to display either the Z80 or NES picture. The +remaining credit/time is displayed via 4-digit 7-segment LED displays. Front +panel can have 4 or 5 control buttons. Switching the BIOS to the correct front +panel type seems to rely on inversion of the reset button signal, and seems to +work properly only on certain dip-switch settings. + +Single-Monitor Upright Cabinets +These are usually upgraded VS System cabinets with a PC10 mainboard (either +original VS System cabinets, or even older cabinets that have been formerly +upgraded to become a VS System). The cabinets are having VS System style front +panels with only four buttons (named 1-4) instead of the normal five PC10 +buttons (Channel Select, Enter, Reset, Start, Game Select). + +Single-Monitor Countertop/Sitdown Cabinets +The Playchoice "countertop" version (a white box to be placed on a bar counter +or table) is a native PC10 cabinet (with 5 control buttons). The "red tent" +version (a red tent-shaped console with two legs) is an upgraded VS Dual System +sitdown version (with 4 control buttons). + +Official BIOSes (IC "8T") + PCH1-C.8T Dual-Monitor Version (CRC32=D52FA07Ah) (16Kbytes) + PCK1-C.8T Single-Monitor Version (CRC32=503EE8B1h) (16Kbytes) +There aren't any further known versions/revisions. + 0BE8CEB4 + + +Homebrew BIOSes + Oliver Achten's BIOS v0.1 (2002) (CRC32=FB96DE76h) (8Kbytes) + gamehacker's BIOS v1.0 (CRC32=18B4E0B5h) (16Kbytes) + gamehacker's BIOS v1.1 (CRC32=80BD20EFh) (16Kbytes) +The homebrew BIOSes are allowing to play NES games without PROMs. They are +suffering some restrictions: +Oliver's BIOS doesn't have any support for Titles/Instructions (neither for +original nor homebrew games). The BIOS can be DIP-Switched to Single/Dual +Monitor mode. Unknown if coin inputs are supported. +Gamehacker's BIOSes are supporting Titles (from original games and homebrew +games; for the latter, the title can be stored in custom INST ROM format, or in +SRAM; which probably only lasts for some days/weeks?). Instructions aren't +supported (neither for original nor homebrew games). Unknown if this BIOS +supports both Single and Dual Monitor versions. The BIOS doesn't support coin +inputs (freeplay mode only) + +PC10 Pin-Outs +------------- + +PC10 Cartridge Slot (3x32 pins per slot; 10 slots) + A1 - B1 PROM.RESET C1 Z80./INST.ROM.SEL + A2 - B2 PROM.CLOCK C2 Z80.DD7 + A3 - B3 PROM.TEST C3 Z80.DD6 + A4 - B4 Z80.AD7 C4 Z80.DD5 + A5 - B5 Z80.AD6 C5 Z80.DD4 + A6 - B6 Z80.AD5 C6 Z80.DD3 + A7 Z80.AD11 B7 Z80.AD4 C7 Z80.DD2 + A8 Z80.AD10 B8 Z80.AD3 C8 Z80.DD1 + A9 Z80.AD9 B9 Z80.AD2 C9 Z80.DD0 + A10 Z80.AD8 B10 Z80.AD1 C10 Z80.AD12 + A11 PROM.ADDR5 B11 Z80.AD0 C11 Z80./MREQ.RD + A12 PROM.DATA B12 PPU./PA13 C12 PPU./VRAMCS + A13 PPU.PA8 B13 PPU.PD7 C13 PPU.VRAMA10 + A14 PPU.PA9 B14 PPU.PD6 C14 PPU.PA7 + A15 PPU.PA10 B15 PPU.PD5 C15 PPU.PA6 + A16 PPU.PA11 B16 PPU.PD4 C16 PPU.PA5 + A17 PPU.PA12 B17 PPU.PD3 C17 PPU.PA4 + A18 PPU.PA13 B18 PPU.PD2 C18 PPU.PA3 + A19 PPU./WE B19 PPU.PD1 C19 PPU.PA2 + A20 PPU./RD B20 PPU.PD0 C20 PPU.PA1 + A21 NES.PHI2 B21 NES./ROM.SEL C21 PPU.PA0 + A22 NES.A8 B22 NES.R/W C22 NES./IRQ (see note) + A23 NES.A9 B23 NES.D7 C23 NES.A0 + A24 NES.A10 B24 NES.D6 C24 NES.A1 + A25 NES.A11 B25 NES.D5 C25 NES.A2 + A26 NES.A12 B26 NES.D4 C26 NES.A3 + A27 NES.A13 B27 NES.D3 C27 NES.A4 + A28 NES.A14 B28 NES.D2 C28 NES.A5 + A29 /CH1..10 B29 NES.D1 C29 NES.A6 + A30 SOUND B30 NES.D0 C30 NES.A7 + A31 VCC B31 VCC C31 VCC + A32 GND B32 GND C32 GND +Note: The NES./IRQ appears to be somehow bugged on older mainboards +(PCH1-01-CPU and PCH1-02-CPU), Nintendo seems to have released a document that +describes how to upgrade that mainboards (for PCH1-01-ROM-G game card +compatibilty). The document says to disconnect pin 11 and 12 of IC "4L", and to +rewire that pins to whatever locations on the mainboard (not quite clear what +signals they shall be wired to exactly) (the bug as such seems to be that IC +"4L" is passing /IRQ as output, rather than as input) (so, maybe, the bugfix +just means to say to swap the two pins?). + +Wiring of 74LS367 on PC10 pro wrestling cart + .----._.----. + /chsel 1| /G1 Vcc |16 VCC + (Conn) Chr A13 2| 1A1 /G2 |15 /chsel + +5 pullup 3| 1Y1 2A1 |14 CHR /A13 (PC10 Connector) + (Conn) PRG /CE 4| 1A2 2Y1 |13 CIRAM /CE (PC10 Connector) + +5 pullup 5| 1Y2 2A2 |12 /CSel INST ROM (PC10 Conn) + (Brd) CIRAM A10 6| 1A3 2Y2 |11 Pin 20 U4 + (Conn)CIRAM A10 7| 1Y3 2A3 |10 N/C + GND 8| GND 2Y3 | 9 N/C + '-----------' + +PC10 "P1" Connector (called "P2" in schematic) + 1 /MRED (Main Screen / NES Picture) + 2 /MGRN + 3 /MBLUE + 4 MVGND + 5 /SRED (Sub Screen / Z80 Picture) + 6 /SGRN + 7 /SBLU + 8 SVGND + 9 /SSYNC + 10 /MSYNC + 11 GND + 12 GND + 13 GND + 14 GND + 15 +5V + 16 +5V + 17 +5V + 18 +5V + 19 ? + 20 ? as 19 + 21 ? + 22 ? as 21 + 23 +24V + 24 Service + 25 ? ;schematic: Counter 2 + 26 Counter1 + 27 ? + 28 ? + 29 ? + 30 ? + 31 ? via jumper to 26 ;schematic: Coin 2 + 32 Coin1 + 33 2.B Button + 34 2.A Button + 35 ? to GND + 36 2.Right + 37 ? to GND + 38 2.Left + 39 ? to GND + 40 2.Up + 41 ? to GND + 42 2.Down + 43 ? to GND + 44 GameSelect + 45 ? to GND + 46 ? + 47 ? NC + 48 Reset + 49 ? NC + 50 Start + 51 SSound (shortcut with MSound) + 52 MSound (shortcut with SSound) + 53 ? + 54 GND (Sound) + 55 GND + 56 GND + +PC10 "P2-to-P1" Connector (called "P1" in schematic) + 1 1.Right + 2 1.Left + 3 1.Down + 4 1.Up + 5 GND + 6 ? to 4016h.Bit3 + 7 1.B Button + 8 1.A Button + 9 GND + 10 ? to 4016h.Bit4 (INP0.D4) + 11 CH.Select + 12 Enter + 13 GND + 14 GND + 15 ? + 16 GND + 17 GunTrigger + 18 GunHit + 19 +5V + 20 +5V + +PC10 Single-Monitor version Connectors? +P2 (36 pin) + Parts Side | Solder Side + GND | A/19 | 1 | GND + LED00-DD3 | B/20 | 2 | 2P Right + LED01-DD2 | C/21 | 3 | 2P Left + LED02-DD1 | D/22 | 4 | 2P Up + LED03-DD0 | E/23 | 5 | 2P Down + +5V | F/24 | 6 | 2P ButtonA + +5V | H/25 | 7 | 2P ButtonB + LED04-AD4 | J/26 | 8 | Button1/Channel Select + LED05-AD1 | K/27 | 9 | Button3/Game Select + LED06-AD0 | L/28 | 10| Button2/Channel Enter + LED07-/IOWR | M/29 | 11| Button4/Game Start + | N/30 | 12| 1P Right + | P/31 | 13| 1P Left + +5V | R/32 | 14| 1P Up + | S/33 | 15| 1P Down + | T/34 | 16| 1P ButtonA + ResetButton(if any?) | U/35 | 17| 1P ButtonB + GND | V/36 | 18| GND + +P1 (44pin) + Parts Side | Solder Side + ----------------------------+------------------------------- + GND | A/23 | 1 | GND + GND | B/24 | 2 | GND + +5V | C/25 | 3 | +5V + +5V | D/26 | 4 | +5V + +12V | E/27 | 5 | +12V + | F/28 | 6 | + | H/29 | 7 | Coin Switch #1 + | J/30 | 8 | Coin Switch #2 (if any?) + | K/31 | 9 | Video Red (inv) + | L/32 | 10| Video Green (inv) + GND | M/33 | 11| GND + | N/34 | 12| Video Blue (inv) + | P/35 | 13| Video Sync + | R/36 | 14| + | S/37 | 15| + -5V (or +12V?) | T/38 | 16| -5V (or +12V?) + (?) | U/39 | 17| (?) (or COUNTER?) + | V/40 | 18| + | W/41 | 19| (?) (or SERVICE Button?) + | X/42 | 20| Audio (no amp) + GND | Y/43 | 21| GND + GND | Z/44 | 22| GND + ------------------------------------------------------ + Note: Connect Video Ground and Audio Ground to GND + Video color signals need to be inverted for regular Jamma + Audio signal needs to be amplified for regular Jamma + +Z80 CPU Specifications +---------------------- + +--> Z80 Register Set +--> Z80 Flags +--> Z80 Instruction Format +--> Z80 Load Commands +--> Z80 Arithmetic/Logical Commands +--> Z80 Rotate/Shift and Singlebit Operations +--> Z80 Jumpcommands & Interrupts +--> Z80 I/O Commands +--> Z80 Interrupts +--> Z80 Meaningless and Duplicated Opcodes +--> Z80 Garbage in Flag Register +--> Z80 Compatibility +--> Z80 Pin-Outs +--> Z80 Local Usage + +Z80 Register Set +---------------- + +Register Summary + 16bit Hi Lo Name/Function + --------------------------------------- + AF A - Accumulator & Flags + BC B C BC + DE D E DE + HL H L HL + AF' - - Second AF + BC' - - Second BC + DE' - - Second DE + HL' - - Second HL + IX IXH IXL Index register 1 + IY IYH IYL Index register 2 + SP - - Stack Pointer + PC - - Program Counter/Pointer + - I R Interrupt & Refresh + +Normal 8bit and 16bit Registers +The Accumulator (A) is the allround register for 8bit operations. Registers B, +C, D, E, H, L are normal 8bit registers, which can be also accessed as 16bit +register pairs BC, DE, HL. +The HL register pair is used as allround register for 16bit operations. B and +BC are sometimes used as counters. DE is used as DEstination pointer in block +transfer commands. + +Second Register Set +The Z80 includes a second register set (AF',BC',DE',HL') these registers cannot +be accessed directly, but can be exchanged with the normal registers by using +the EX AF,AF and EXX instructions. + +Refresh Register +The lower 7 bits of the Refresh Register (R) are incremented with every +instruction. Instructions with at least one prefix-byte (CB,DD,ED,FD, or +DDCB,FDCB) will increment the register twice. Bit 7 can be used by programmer +to store data. Permanent writing to this register will suppress memory refresh +signals, causing Dynamic RAM to lose data. + +Interrupt Register +The Interrupt Register (I) is used in interrupt mode 2 only (see command "im +2"). In other modes it can be used as simple 8bit data register. + +IX and IY Registers +IX and IY are able to manage almost all the things that HL is able to do. When +used as memory pointers they are additionally including a signed index byte +(IX+d). The disadvantage is that the opcodes occupy more memory bytes, and that +they are less fast than HL-instructions. + +Undocumented 8bit Registers +IXH, IXL, IYH, IYL are undocumented 8bit registers which can be used to access +high and low bytes of the IX and IY registers (much like H and L for HL). Even +though these registers do not officially exist, they seem to be available in +all Z80 CPUs, and are quite commonly used by various software. + +Z80 Flags +--------- + +Flag Summary +The Flags are located in the lower eight bits of the AF register pair. + Bit Name Set Clr Expl. + 0 C C NC Carry Flag + 1 N - - Add/Sub-Flag (BCD) + 2 P/V PE PO Parity/Overflow-Flag + 3 - - - Undocumented + 4 H - - Half-Carry Flag (BCD) + 5 - - - Undocumented + 6 Z Z NZ Zero-Flag + 7 S M P Sign-Flag + +Carry Flag (C) +This flag signalizes if the result of an arithmetic operation exceeded the +maximum range of 8 or 16 bits, ie. the flag is set if the result was less than +Zero, or greater than 255 (8bit) or 65535 (16bit). After rotate/shift +operations the bit that has been 'shifted out' is stored in the carry flag. + +Zero Flag (Z) +Signalizes if the result of an operation has been zero (Z) or not zero (NZ). +Note that the flag is set (1) if the result was zero (0). + +Sign Flag (S) +Signalizes if the result of an operation is negative (M) or positive (P), the +sign flag is just a copy of the most significant bit of the result. + +Parity/Overflow Flag (P/V) +This flag is used as Parity Flag, or as Overflow Flag, or for other purposes, +depending on the instruction. +Parity: Bit7 XOR Bit6 XOR Bit5 ... XOR Bit0 XOR 1. +8bit Overflow: Indicates if the result was greater/less than +127/-128. +HL Overflow: Indicates if the result was greater/less than +32767/-32768. +After LD A,I or LD A,R: Contains current state of IFF2. +After LDI,LDD,CPI,CPD,CPIR,CPDR: Set if BC<>0 at end of operation. + +BCD Flags (H,N) +These bits are solely supposed to be used by the DAA instruction. The N flag +signalizes if the previous operation has be an addition or substraction. The H +flag indicates if the lower 4 bits exceeded the range from 0-0Fh. (For 16bit +instructions: H indicates if the lower 12 bits exceeded the range from +0-0FFFh.) +After adding/subtracting two 8bit BCD values (0-99h) the DAA instruction can be +used to convert the hexadecimal result in the A register (0-FFh) back to BCD +format (0-99h). Note that DAA also requires the carry flag to be set correctly, +and thus should not be used after INC A or DEC A. + +Undocumented Flags (Bit 3,5) +The content of these undocumented bits is filled by garbage by all instructions +that affect one or more of the normal flags (for more info read the chapter +Garbage in Flag Register), the only way to read out these flags would be to +copy the flags register onto the stack by using the PUSH AF instruction. +However, the existence of these bits makes the AF register a full 16bit +register, so that for example the code sequence PUSH DE, POP AF, PUSH AF, POP +HL would set HL=DE with all 16bits intact. + +Z80 Instruction Format +---------------------- + +Commands and Parameters +Each instruction consists of a command, and optionally one or two parameters. +Usually the leftmost parameter is modified by the operation when two parameters +are specified. + +Parameter Placeholders +The following placeholders are used in the following chapters: + r 8bit register A,B,C,D,E,H,L + rr 16bit register BC, DE, HL/IX/IY, AF/SP (as described) + i 8bit register A,B,C,D,E,IXH/IYH,IXL/IYL + ii 16bit register IX,IY + n 8bit immediate 00-FFh (unless described else) + nn 16bit immediate 0000-FFFFh + d 8bit signed offset -128..+127 + f flag condition nz,z,nc,c AND/OR po,pe,p,m (as described) + (..) 16bit pointer to byte/word in memory + +Opcode Bytes +Each command (including parameters) consists of 1-4 bytes. The respective bytes +are described in the following chapters. In some cases the register number or +other parameters are encoded into some bits of the opcode, in that case the +opcode is specified as "xx". Opcode prefix bytes "DD" (IX) and "FD" (IY) are +abbreviated as "pD". + +Clock Cycles +The clock cycle values in the following chapters specify the execution time of +the instruction. For example, an 8-cycle instruction would take 2 microseconds +on a CPU which is operated at 4MHz (8/4 ms). For conditional instructions two +values are specified, for example, 17;10 means 17 cycles if condition true, and +10 cycles if false. +Note that in case that WAIT signals are sent to the CPU by the hardware then +the execution may take longer. + +Affected Flags +The instruction tables below are including a six character wide field for the +six flags: Sign, Zero, Halfcarry, Parity/Overflow, N-Flag, and Carry (in that +order). The meaning of the separate characters is: + s Indicates Signed result + z Indicates Zero + h Indicates Halfcarry + o Indicates Overflow + p Indicates Parity + c Indicates Carry + - Flag is not affected + 0 Flag is cleared + 1 Flag is set + x Flag is destroyed (unspecified) + i State of IFF2 + e Indicates BC<>0 for LDX(R) and CPX(R), or B=0 for INX(R) and OUTX(R) + +Z80 Load Commands +----------------- + +8bit Load Commands + Instruction Opcode Cycles Flags Notes + ld r,r xx 4 ------ r=r + ld i,i pD xx 8 ------ i=i + ld r,n xx nn 7 ------ r=n + ld i,n pD xx nn 11 ------ i=n + ld r,(HL) xx 7 ------ r=(HL) + ld r,(ii+d) pD xx dd 19 ------ r=(ii+d) + ld (HL),r 7x 7 ------ (HL)=r + ld (ii+d),r pD 7x dd 19 ------ + ld (HL),n 36 nn 10 ------ + ld (ii+d),n pD 36 dd nn 19 ------ + ld A,(BC) 0A 7 ------ + ld A,(DE) 1A 7 ------ + ld A,(nn) 3A nn nn 13 ------ + ld (BC),A 02 7 ------ + ld (DE),A 12 7 ------ + ld (nn),A 32 nn nn 13 ------ + ld A,I ED 57 9 sz0i0- A=I ;Interrupt Register + ld A,R ED 5F 9 sz0i0- A=R ;Refresh Register + ld I,A ED 47 9 ------ + ld R,A ED 4F 9 ------ + +16bit Load Commands + Instruction Opcode Cycles Flags Notes + ld rr,nn x1 nn nn 10 ------ rr=nn ;rr may be BC,DE,HL or SP + ld ii,nn pD 21 nn nn 13 ------ ii=nn + ld HL,(nn) 2A nn nn 16 ------ HL=(nn) + ld ii,(nn) pD 2A nn nn 20 ------ ii=(nn) + ld rr,(nn) ED xB nn nn 20 ------ rr=(nn) ;rr may be BC,DE,HL or SP + ld (nn),HL 22 nn nn 16 ------ (nn)=HL + ld (nn),ii pD 22 nn nn 20 ------ (nn)=ii + ld (nn),rr ED x3 nn nn 20 ------ (nn)=rr ;rr may be BC,DE,HL or SP + ld SP,HL F9 6 ------ SP=HL + ld SP,ii pD F9 10 ------ SP=ii + push rr x5 11 ------ SP=SP-2, (SP)=rr ;rr may be BC,DE,HL,AF + push ii pD E5 15 ------ SP=SP-2, (SP)=ii + pop rr x1 10 (-AF-) rr=(SP), SP=SP+2 ;rr may be BC,DE,HL,AF + pop ii pD E1 14 ------ ii=(SP), SP=SP+2 + ex DE,HL EB 4 ------ exchange DE <--> HL + ex AF,AF 08 4 xxxxxx exchange AF <--> AF' + exx D9 4 ------ exchange BC,DE,HL <--> BC',DE',HL' + ex (SP),HL E3 19 ------ exchange (SP) <--> HL + ex (SP),ii pD E3 23 ------ exchange (SP) <--> ii + +Blocktransfer + Instruction Opcode Cycles Flags Notes + ldi ED A0 16 --0e0- (DE)=(HL), HL=HL+1, DE=DE+1, BC=BC-1 + ldd ED A8 16 --0e0- (DE)=(HL), HL=HL-1, DE=DE-1, BC=BC-1 + ldir ED B0 bc*21-5 --0?0- ldi-repeat until BC=0 + lddr ED B8 bc*21-5 --0?0- ldd-repeat until BC=0 + +Z80 Arithmetic/Logical Commands +------------------------------- + +8bit Arithmetic/Logical Commands + Instruction Opcode Cycles Flags Notes + daa 27 4 szxp-x decimal adjust akku + cpl 2F 4 --1-1- A = A xor FF + neg ED 44 8 szho1c A = 00-A + r xx 4 szhonc see below + i pD xx 8 szhonc see below, UNDOCUMENTED + n xx nn 7 szhonc see below + (HL) xx 7 szhonc see below + (ii+d) pD xx dd 19 szhonc see below + r xx 4 szhon- see below + i pD xx 8 szhon- see below, UNDOCUMENTED + (HL) xx 11 szhon- see below + (ii+d) pD xx dd 23 szhon- see below + r xx 4 szhp00 see below + i pD xx 8 szhp00 see below, UNDOCUMENTED + n xx nn 7 szhp00 see below + (HL) xx 7 szhp00 see below + (ii+d) pD xx dd 19 szhp00 see below +Arithmetic commands: + add A,op see above 4-19 szho0c A=A+op + adc A,op see above 4-19 szho0c A=A+op+cy + sub op see above 4-19 szho1c A=A-op + sbc A,op see above 4-19 szho1c A=A-op-cy + cp op see above 4-19 szho1c compare, ie. VOID=A-op +Increment/Decrement commands: + inc op see above 4-23 szho0- op=op+1 + dec op see above 4-23 szho1- op=op-1 +Logical commands: + and op see above 4-19 sz1p00 A=A & op + xor op see above 4-19 sz0p00 A=A XOR op + or op see above 4-19 sz0p00 A=A | op + +16bit Arithmetic Commands + Instruction Opcode Cycles Flags Notes + add HL,rr x9 11 --h-0c HL = HL+rr ;rr may be BC,DE,HL,SP + add ii,rr pD x9 15 --h-0c ii = ii+rr ;rr may be BC,DE,ii,SP (!) + adc HL,rr ED xA 15 szho0c HL = HL+rr+cy ;rr may be BC,DE,HL,SP + sbc HL,rr ED x2 15 szho1c HL = HL-rr-cy ;rr may be BC,DE,HL,SP + inc rr x3 6 ------ rr = rr+1 ;rr may be BC,DE,HL,SP + inc ii pD 23 10 ------ ii = ii+1 + dec rr xB 6 ------ rr = rr-1 ;rr may be BC,DE,HL,SP + dec ii pD 2B 10 ------ ii = ii-1 + +Searchcommands + Instruction Opcode Cycles Flags Notes + cpi ED A1 16 szhe1- compare A-(HL), HL=HL+1, DE=DE+1, BC=BC-1 + cpd ED A9 16 szhe1- compare A-(HL), HL=HL-1, DE=DE-1, BC=BC-1 + cpir ED B1 x*21-5 szhe1- cpi-repeat until BC=0 or compare fits + cpdr ED B9 x*21-5 szhe1- cpd-repeat until BC=0 or compare fits + +Z80 Rotate/Shift and Singlebit Operations +----------------------------------------- + +Rotate and Shift Commands + Instruction Opcode Cycles Flags Notes + rlca 07 4 --0-0c rotate akku left + rla 17 4 --0-0c rotate akku left through carry + rrca 0F 4 --0-0c rotate akku right + rra 1F 4 --0-0c rotate akku right through carry + rld ED 6F 18 sz0p0- rotate left low digit of A through (HL) + rrd ED 67 18 sz0p0- rotate right low digit of A through (HL) + r CB xx 8 sz0p0c see below + (HL) CB xx 15 sz0p0c see below + (ii+d) pD CB dd xx 23 sz0p0c see below + r,(ii+d) pD CB dd xx 23 sz0p0c see below, UNDOCUMENTED modify and load +Whereas may be: + rlc rotate left + rl rotate left through carry + rrc rotate right + rr rotate right through carry + sla shift left arithmetic (b0=0) + sll UNDOCUMENTED shift left (b0=1) + sra shift right arithmetic (b7=b7) + srl shift right logical (b7=0) + +Singlebit Operations + Instruction Opcode Cycles Flags Notes + bit n,r CB xx 8 xz1x0- test bit n ;n=0..7 + bit n,(HL) CB xx 12 xz1x0- + bit n,(ii+d) pD CB dd xx 20 xz1x0- + set n,r CB xx 8 ------ set bit n ;n=0..7 + set n,(HL) CB xx 15 ------ + set n,(ii+d) pD CB dd xx 23 ------ + set r,n,(ii+d) pD CB dd xx 23 ------ UNDOCUMENTED set n,(ii+d) and ld r,(ii+d) + res n,r CB xx 8 ------ reset bit n ;n=0..7 + res n,(HL) CB xx 15 ------ + res n,(ii+d) pD CB dd xx 23 ------ + res r,n,(ii+d) pD CB dd xx 23 ------ UNDOCUMENTED res n,(ii+d) and ld r,(ii+d) + ccf 3F 4 --h-0c h=cy, cy=cy xor 1 + scf 37 4 --0-01 cy=1 + +Z80 Jumpcommands & Interrupts +----------------------------- + +General Jump Commands + Instruction Opcode Cycles Flags Notes + jp nn C3 nn nn 10 ------ jump to nn, ie. PC=nn + jp HL E9 4 ------ jump to HL, ie. PC=HL + jp ii pD E9 8 ------ jump to ii, ie. PC=ii + jp f,nn xx nn nn 10;10 ------ jump to nn if nz,z,nc,c,po,pe,p,m + jr nn 18 dd 12 ------ relative jump to nn, ie. PC=PC+d + jr f,nn xx dd 12;7 ------ relative jump to nn if nz,z,nc,c + djnz nn 10 dd 13;8 ------ B=B-1 and relative jump to nn if B<>0 + call nn CD nn nn 17 ------ call nn ie. SP=SP-2, (SP)=PC, PC=nn + call f,nn xx nn nn 17;10 ------ call nn if nz,z,nc,c,po,pe,p,m + ret C9 10 ------ pop PC ie. PC=(SP), SP=SP+2 + ret f xx 11;5 ------ pop PC if nz,z,nc,c,po,pe,p,m + rst n xx 11 ------ call n ;n=00,08,10,18,20,28,30,38 + nop 00 4 ------ no operation + +Interrupt Related Commands + Instruction Opcode Cycles Flags Notes + di F3 4 ------ IFF1=0, IFF2=0 ;disable interrupts + ei FB 4 ------ IFF1=1, IFF2=1 ;enable interrupts + im 0 ED 46 8 ------ read opcode from databus on interrupt + im 1 ED 56 8 ------ execute call 0038h on interrupt + im 2 ED 5E 8 ------ execute call (i*100h+databus) on int. + halt 76 N*4 ------ repeat until interrupt occurs + reti ED 4D 14 ------ pop PC, IFF1=IFF2, ACK (ret from INT) + retn ED 45 14 ------ pop PC, IFF1=IFF2 (ret from NMI) + 1+var ------ IFF1=0,IFF2=0, exec opcode from databus + 12 ------ IFF1=0,IFF2=0, CALL 0038h + 18 ------ IFF1=0,IFF2=0, CALL [I*100h+databus] + ? ------ IFF1=0, CALL 0066h + +Z80 I/O Commands +---------------- + + Instruction Opcode Cycles Flags Notes + in A,(n) DB nn 11 ------ A=PORT(A*100h+n) + in r,(C) ED xx 12 sz0p0- r=PORT(BC) + in (C) ED 70 12 sz0p0- **undoc/illegal** VOID=PORT(BC) + out (n),A D3 nn 11 ------ PORT(A*100h+n)=A + out (C),r ED xx 12 ------ PORT(BC)=r + out (C),0 ED 71 12 ------ **undoc/illegal** PORT(BC)=00 + ini ED A2 16 xexxxx MEM(HL)=PORT(BC), HL=HL+1, B=B-1 + ind ED AA 16 xexxxx MEM(HL)=PORT(BC), HL=HL-1, B=B-1 + outi ED A3 16 xexxxx B=B-1, PORT(BC)=MEM(HL), HL=HL+1 + outd ED AB 16 xexxxx B=B-1, PORT(BC)=MEM(HL), HL=HL-1 + inir ED B2 b*21-5 x1xxxx same than ini, repeat until b=0 + indr ED BA b*21-5 x1xxxx same than ind, repeat until b=0 + otir ED B3 b*21-5 x1xxxx same than outi, repeat until b=0 + otdr ED BB b*21-5 x1xxxx same than outd, repeat until b=0 + +Z80 Interrupts +-------------- + +Interrupt Flip-Flop (IFF1,IFF2) +The IFF1 flag is used to enable/disable INTs (maskable interrupts). +In a raw INT-based system, IFF2 is always having the same state than IFF1. +However, in a NMI-based system the IFF2 flag is used to backup the recent IFF1 +state prior to NMI execution, and may be used to restore IFF1 upon NMI +completion by RETN opcode. +Beside for the above 'backup' function, IFF2 itself is having no effect. +Neither IFF1 nor IFF2 affect NMIs which are always enabled. +The following opcodes/events are modifying IFF1 and/or IFF2: + EI IFF1=1, IFF2=1 + DI IFF1=0, IFF2=0 + IFF1=0, IFF2=0 + IFF1=0 + RETI IFF1=IFF2 + RETN IFF1=IFF2 +When using the EI instruction, the new IFF state isn't applied until the next +instruction has completed (this ensures that an interrupt handler which is +using the sequence "EI, RET" may return to the main program before the next +interrupt is executed). +Interrupts can be disabled by the DI instruction (IFF=0), and are additionally +automatically each time when an interrupt is executed. + +Interrupt Execution +An interrupt is executed when an interrupt is requested by the hardware, and +IFF is set. Whenever both conditions are true, the interrupt is executed after +the completion of the current opcode. +Note that repeated block commands (such like LDIR) can be interrupted also, the +interrupt return address on the stack then points to the interrupted opcode, so +that the instruction may continue as normal once the interrupt handler returns. + +Interrupt Modes (IM 0,1,2) +The Z80 supports three interrupt modes which can be selected by IM 0, IM 1, and +IM 2 instructions. The table below describes the respective operation and +execution time in each mode. + Mode Cycles Refresh Operation + 0 1+var 0+var IFF1=0,IFF2=0, read and execute opcode from databus + 1 12 1 IFF1=0,IFF2=0, CALL 0038h + 2 18 1 IFF1=0,IFF2=0, CALL [I*100h+databus] +Mode 0 requires an opcode to be output to the databus by external hardware, in +case that no byte is output, and provided that the 'empty' databus is free of +garbage, then the CPU might tend to read a value of FFh (opcode RST 38h, 11 +cycles, 1 refresh) - the clock cycles (11+1), refresh cycles (1), and executed +operation are then fully identical as in Mode 1. +Mode 1 interrupts always perform a CALL 0038h operation. The downside is that +many systems may have ROM located at this address, making it impossible to hook +the interrupt handler directly. + +Mode 2 calls to a 16bit address which is read from a table in memory, the table +pointer is calculated from the "I" register (initialized by LD I,A instruction) +multiplied by 100h, plus an index byte which is read from the databus. The +following trick may be used to gain stable results in Mode 2 even if no index +byte is supplied on the databus: For example, set I=40h the origin of the table +will be then at 4000h in memory. Now fill the entire area from 4000h to 4100h +(101h bytes, including 4100h) by the value 41h. The CPU will then perform a +CALL 4141h upon interrupt execution - regardless of whether the randomized +index byte is an even or odd number. + +Non-Maskable Interrupts (NMIs) +Unlike INTs, NMIs cannot be disabled by the CPU, ie. DI and EI instructions and +the state of IFF1 and IFF2 do not have effect on NMIs. The NMI handler address +is fixed at 0066h, regardless of the interrupt mode (IM). Upon NMI execution, +IFF1 is cleared (disabeling maskable INTs - NMIs remain enabled, which may +result in nested execution if the handler does not return before next NMI is +requested). IFF2 remains unchanged, thus containing the most recent state of +IFF1, which may be used to restore IFF1 if the NMI handler returns by RETN +instruction. +Execution time for NMIs is unknown (?). + +RETN (return from NMI and restore IFF1) +Intended to return from NMI and to restore the old IFF1 state (assuming the old +state was IFF1/IFF2 both set or both cleared). + +RETI (return from INT with external acknowledge) +Intended to return from INT and to notify peripherals about completion of the +INT handler, the Z80 itself doesn't send any such acknowledge signal (instead, +peripherals like Z80-PIO or Z80-SIO must decode the databus during /M1 cycles, +and identify the opcode sequence EDh,4Fh as RETI). Aside from such external +handling, internally, RETI is exactly same as RETN, and, like RETN it does set +IFF1=IFF2 (though in case of RETI this is a dirt effect without practical use; +within INT handlers IFF1 and IFF2 are always both zero, or when EI was used +both set). Recommended methods to return from INT are: EI+RETI (when needing +the external acknowledge), or EI+RET (faster). + +Z80 Meaningless and Duplicated Opcodes +-------------------------------------- + +Mirrored Instructions +NEG (ED44) is mirrored to ED4C,54,5C,64,6C,74,7C. +RETN (ED45) is mirrored to ED55,65,75. +RETI (ED4D) is mirrored to ED5D,6D,7D. + +Mirrored IM Instructions +IM 0,X,1,2 (ED46,4E,56,5E) are mirrored to ED66,6E,76,7E. +Whereas IM X is an undocumented mirrored instruction itself which appears to be +identical to either IM 0 or IM 1 instruction (?). + +Duplicated LD HL Instructions +LD (nn),HL (opcode 22NNNN) is mirrored to ED63NNNN. +LD HL,(nn) (opcode 2ANNNN) is mirrored to ED6BNNNN. +Unlike the other instructions in this chapter, these two opcodes are officially +documented. The clock/refresh cycles for the mirrored instructions are then +20/2 instead of 16/1 as for the native 8080 instructions. + +Mirrored BIT N,(ii+d) Instructions +Unlike as for RES and SET, the BIT instruction does not support a third +operand, ie. DD or FD prefixes cannot be used on a BIT N,r instruction in order +to produce a BIT r,N,(ii+d) instruction. When attempting this, the 'r' operand +is ignored, and the resulting instruction is identical to BIT N,(ii+d). +Except that, not tested yet, maybe undocumented flags are then read from 'r' +instead of from ii+d(?). + +Non-Functional Opcodes +The following opcodes behave much like the NOP instruction. +ED00-3F, ED77, ED7F, ED80-9F, EDA4-A7, EDAC-AF, EDB4-B7, EDBC-BF, EDC0-FF. +The execution time for these opcodes is 8 clock cycles, 2 refresh cycles. +Note that some of these opcodes appear to be used for additional instructions +by the R800 CPU in newer turbo R (MSX) models. + +Ignored DD and FD Prefixes +In some cases, DD-prefixes (IX) and FD-prefixes (IY) may be ignored by the CPU. +This happens when using one (or more) of the above prefixes prior to +instructions that already contain an ED, DD, or FD prefix, or prior to any +instructions that do not support IX, IY, IXL, IXH, IYL, IYH operands. In such +cases, 4 clock cycles and 1 refresh cycle are counted for each ignored prefix +byte. + +Z80 Garbage in Flag Register +---------------------------- + +Nocash Z80-flags description +This chapter describes the undocumented Z80 flags (bit 3 and 5 of the Flags +Register), these flags are affected by ALL instructions that modify one or more +of the normal flags - all OTHER instructions do NOT affect the undocumented +flags. + +For some instructions, the content of some flags has been officially documented +as 'destroyed', indicating that the flags contain garbage, the exact garbage +calculation for these instructions will be described here also. + +All information below just for curiosity. Keep in mind that Z80 compatible CPUs +(or emulators) may not supply identical results, so that it wouldn't be a good +idea to use these flags in any programs (not that they could be very useful +anyways). + +Normal Behaviour for Undocumented Flags +In most cases, undocumented flags are copied from the Bit 3 and Bit 5 of the +result byte. That is "A AND 28h" for: + RLD; CPL; RLCA; RLA; LD A,I; ADD OP; ADC OP; XOR OP; AND OP; + RRD; NEG; RRCA; RRA; LD A,R; SUB OP; SBC OP; OR OP ; DAA. +When other operands than A may be modified, "OP AND 28h" for: + RLC OP; RL OP; SLA OP; SLL OP; INC OP; IN OP,(C); + RRC OP; RR OP; SRA OP; SRL OP; DEC OP +For 16bit instructions flags are calculated as "RR AND 2800h": + ADD RR,XX; ADC RR,XX; SBC RR,XX. + +Slightly Special Undocumented Flags +For 'CP OP' flags are calculated as "OP AND 28h", that is the unmodified +operand, and NOT the internally calculated result of the comparision. +For 'SCF' and 'CCF' flags are calculated as "(A OR F) AND 28h", ie. the flags +remain set if they have been previously set. +For 'BIT N,R' flags are calculated as "OP AND 28h", additionally the P-Flag is +set to the same value than the Z-Flag (ie. the Parity of "OP AND MASK"), and +the S-flag is set to "OP AND MASK AND 80h". + +Fatal MEMPTR Undocumented Flags +For 'BIT N,(HL)' the P- and S-flags are set as for BIT N,R, but the +undocumented flags are calculated as "MEMPTR AND 2800h", for more info about +MEMPTR read on below. +The same applies to 'BIT N,(ii+d)', but the result is less unpredictable +because the instruction sets MEMPTR=ii+d, so that undocumented flags are +" AND 2800h". + +Memory Block Command Undocumented Flags +For LDI, LDD, LDIR, LDDR, undocumented flags are "((A+DATA) AND 08h) + +((A+DATA) AND 02h)*10h". +For CPI, CPD, CPIR, CPDR, undocumented flags are "((A-DATA-FLG_H) AND 08h) + +((A-DATA-FLG_H) AND 02h)*10h", whereas the CPU first calculates A-DATA, and +then internally subtracts the resulting H-flag from the result. + +Chaotic I/O Block Command Flags +The INI, IND, INIR, INDR, OUTI, OUTD, OTIR, OTDR instructions are doing a lot +of obscure things, to simplify the description a placeholder called DUMMY is +used in the formulas. + DUMMY = "REG_C+DATA+1" ;for INI/INIR + DUMMY = "REG_C+DATA-1" ;for IND/INDR + DUMMY = "REG_L+DATA" ;for OUTI,OUTD,OTIR,OTDR + FLG_C = Carry of above "DUMMY" calculation + FLG_H = Carry of above "DUMMY" calculation (same as FLG_C) + FLG_N = Sign of "DATA" + FLG_P = Parity of "REG_B XOR (DUMMY AND 07h)" + FLG_S = Sign of "REG_B" + UNDOC = Bit3,5 of "REG_B AND 28h" +The above registers L and B are meant to contain the new values which are +already incremented/decremented by the instruction. +Note that the official docs mis-described the N-Flag as set, and the C-Flag as +not affected. + +DAA Flags +Addition (if N was 0): + FLG_H = (OLD_A AND 0Fh) > 09h + FLG_C = Carry of result +Subtraction (if N was 1): + FLG_H = (NEW_A AND 0Fh) > 09h + FLG_C = OLD_CARRY OR (OLD_A>99h) +For both addition and subtraction, N remains unmodified, and S, Z, P contain +"Sign", Zero, and Parity of result (A). Undocumented flags are set to (A AND +28h) as normal. + +Mis-documented Flags +For all XOR/OR: H=N=C=0, and for all AND: H=1, N=C=0, unlike described else in +Z80 docs. Also note C,N flag description bug for I/O block commands (see +above). + +Internal MEMPTR Register +This is an internal Z80 register, modified by some instructions, and usually +completely hidden to the user, except that Bit 11 and Bit 13 can be read out at +a later time by BIT N,(HL) instructions. +The following list specifies the resulting content of the MEMPTR register +caused by the respective instructions. + Content Instruction + A*100h LD (xx),A ;xx=BC,DE,nn + xx+1 LD A,(xx) ;xx=BC,DE,nn + nn+1 LD (nn),rr; LD rr,(nn) ;rr=BC,DE,HL,IX,IY + rr EX (SP),rr ;rr=HL,IX,IY (MEMPTR=new value of rr) + rr+1 ADD/ADC/SBC rr,xx ;rr=HL,IX,IY (MEMPTR=old value of rr+1) + HL+1 RLD and RRD + dest JP nn; CALL nn; JR nn ;dest=nn + dest JP f,nn; CALL f,nn ;regardless of condition true/false + dest RET; RETI; RETN ;dest=value read from (sp) + dest RET f; JR f,nn; DJNZ nn ;only if condition=true + 00XX RST n + adr+1 IN A,(n) ;adr=A*100h+n, memptr=A*100h+n+1 + bc+1 IN r,(BC); OUT (BC),r ;adr=bc + ii+d All instructions with operand (ii+d) +Also the following might or might not affect MEMPTR, not tested yet: + OUT (N),A and block commands LDXX, CPXX, INXX, OUTXX + and probably interrupts in IM 0, 1, 2 +All other commands do not affect the MEMPTR register - this includes all +instructions with operand (HL), all PUSH and POP instructions, not executed +conditionals JR f,d, DJNZ d, RET f (ie. with condition=false), and the JP +HL/IX/IY jump instructions. + +Z80 Compatibility +----------------- + +The Z80 CPU is (almost) fully backwards compatible to older 8080 and 8085 CPUs. + +Instruction Format +The Z80 syntax simplifies the chaotic 8080/8085 syntax. For example, Z80 uses +the command "LD" for all load instructions, 8080/8085 used various different +commands depending on whether the operands are 8bit registers, 16bit registers, +memory pointers, and/or an immediates. However, these changes apply to the +source code only - the generated binary code is identical for both CPUs. + +Parity/Overflow Flag +The Z80 CPU uses Bit 2 of the flag register as Overflow flag for arithmetic +instructions, and as Parity flag for other instructions. 8080/8085 CPUs are +always using this bit as Parity flag for both arithmetic and non-arithmetic +instructions. + +Z80 Specific Instructions +The following instructions are available for Z80 CPUs only, but not for older +8080/8085 CPUs: +All CB-prefixed opcodes (most Shift/Rotate, all BIT/SET/RES commands). +All ED-prefixed opcodes (various instructions, and all block commands). +All DD/FD-prefixed opcodes (registers IX and IY). +As well as DJNZ nn; JR nn; JR f,nn; EX AF,AF; and EXX. + +8085 Specific Instructions +The 8085 instruction set includes two specific opcodes in addition to the 8080 +instruction set, used to control 8085-specifc interrupts and SID and SOD +input/output signals. These opcodes, RIM (20h) and SIM (30h), are not supported +by Z80/8080 CPUs. + +Z80 vs Z80A +Both Z80 and Z80A are including the same instruction set, the only difference +is the supported clock frequency (Z80 = max 2.5MHz, Z80A = max 4MHz). + +NEC-780 vs Zilog-Z80 +These CPUs are apparently fully compatible to each other, including for +undocumented flags and undocumented opcodes. + +Z80 Pin-Outs +------------ + + _____ _____ + | |_| | + A11 |1 40| A10 + A12 |2 39| A9 + A13 |3 38| A8 + A14 |4 37| A7 + A15 |5 36| A6 + CLK |6 35| A5 + D4 |7 34| A4 + D3 |8 33| A3 + D5 |9 32| A2 + D6 |10 Z80 31| A1 + VCC |11 CPU 30| A0 + D2 |12 29| GND + D7 |13 28| /RFSH + D0 |14 27| /M1 + D1 |15 26| /RST + /INT |16 25| /BUSRQ + /NMI |17 24| /WAIT + /HALT |18 23| /BUSAK + /MREQ |19 22| /WR + /IORQ |20 21| /RD + |_____________| + + +Z80 Local Usage +--------------- + +Playchoice 10 (Z80) +Clocked at 4.000MHz. +NMIs are triggered on Vblank start (of the Z80 video circuit). +Normal interrupts are not used. There is no DRAM (no Refresh used). +There is memory mapped I/O at E000h..FFFFh. Writes to that area are done by LD +[RR],R and LD [RR],NN and PUSH RR opcodes. Reads from that area are done by BIT +N,[HL], XOR A,[HL], and JP HL opcodes (JP HL is executing a RST NN opcode in +the memory mapped I/O area). + +FamicomBox +---------- + +Nintendo FamicomBox (SSS-CDS) aka Sharp FamicomStation. + +Info from Kevin Horton. + +--> FamicomBox Memory and I/O Maps +--> FamicomBox I/O Ports +--> FamicomBox Misc +--> FamicomBox Cartridges +--> FamicomBox ROM Header (at FFE0h) +--> FamicomBox Pinouts + +FamicomBox Memory and I/O Maps +------------------------------ + +Overall Memory Map + 0000h-1FFFh 8K RAM (with write-protect feature, see port 5002h.W) + 2000h-3FFFh PPU Registers + 4000h-4FFFh CPU/APU RP2A03E Registers + 5000h-5FFFh FamicomBox Registers + 6000h-7FFFh 8K RAM (temporary storage, used for TEST mode only) + 8000h-FFFFh Cartridge space + +RAM Usage + 0000h..07FFh Standard NES Work RAM (variables for MENU and GAME) + 0800h..08FFh FamicomBox Variables + 0900h..09FFh FamicomBox Slot Counters (Total & per-game counters) + 0A00h..0A18h FamicomBox Variables + 0A19h..0DFFh FamicomBox Unused + 0E00h..0FFFh FamicomBox Slot Directory (Game Titles with Chksum and Status) + 1000h..1FFFh FamicomBox Program Code (relocated from Menu ROM) + 6000h..7FFFh Unknown purpose (temporary storage, used for TEST mode only) +Memory at 0800h..1FFFh is write-protected during Game execution (as far as +known, it isn't battery-backed, but the Famibox doesn't have a power-switch, so +the RAM is permanently powered; unless one unplugs the power supply). +Unknown if 6000h..7FFFh is also mapped during Game execution - if so, it may +clash with (or replace and act as?) SRAM used by Game cartridges? + +I/O Map (Output) + 4016h.W - Joypad Strobe + 5000h.W - Exception Trap Enable Bits (reset to 00h on power-up only) + 5001h.W - Coin Chip Params & CATV Outputs (reset to 00h on power-up only) + 5002h.W - Slot LED and RAM protect register (reset to 00h when CPU is reset) + 5003h.W - Exception Trap Attraction Timer + 5004h.W - Slot ROM Cart control register (reset to 00h when CPU is reset) + 5005h.W - Misc Control (reset to 00h on power-up only) + 5006h.W - Test Connector DB-25 Outputs (not reset, uninitialzed at power-up) + 5007h.W - Expansion 50-pin Edge Connector, 8bit Output + +I/O Map (Input) + 4016h.R - Watchdog Reload, and Joypad 1 + 4017h.R - Watchdog Reload, and Joypad 2, and Zapper + 5000h.R - Exception Trap Flags + 5001h.R - Not used + 5002h.R - Dip Switch Register + 5003h.R - Keyswitch Position & Coin Chip Status + 5004h.R - Test Connector DB-25 Inputs + 5005h.R - Expansion 50-pin Edge Connector, 8bit Input 1 + 5006h.R - Expansion 50-pin Edge Connector, 8bit Input 2 + 5007h.R - Misc Status + +FamicomBox I/O Ports +-------------------- + +5000h.W - Exception Trap Enable Bits (reset to 00h on power-up only) + 0 6.82Hz interrupt source (0=Enable, 1=Disable) + 1 Attraction Timer (0=Disable, 1=Enable) + 2 Controller reads (0=Disable, 1=Enable) + 3 Keyswitch rotation (0=Disable, 1=Enable) + 4 Coin insertion (and/or EXPIRED?) (0=Disable, 1=Enable) + 5 Reset Button (0=Disable, 1=Enable) + 6 Not used (Watchdog is always Enabled) + 7 CATV connector Pin 1 detection (0=Disable, 1=Enable) + +5000h.R - Exception Trap Flags + 0 6.82Hz interrupt source hit (0=Trapped, 1=Normal) + 1 Attraction Timer Expired (0=Trapped, 1=Normal) + 2 Controller(s) were read (and PRESSED?) (0=Trapped, 1=Normal) + 3 Keyswitch was rotated (0=Trapped, 1=Normal) + 4 Coin was inserted (and/or EXPIRED?) (0=Trapped, 1=Normal) + 5 Reset Button was pressed (0=Trapped, 1=Normal) + 6 Watchdog Timer Expired (after 17.5s) (0=Trapped, 1=Normal) + 7 CATV connector Pin 1 went high/open (0=Trapped, 1=Normal) +When 5000h.R is read, this register is reset, and the exception trap controller +is reset. +There seems to be a 9th exception flag in 5007h.R.Bit0. If the NINE flags are +all ones, then the reset can be considered to be caused by a "PROTECT IC" (aka +CIC, presumably) (see menu error 0Fh at 9067h). +When one of the above exceptions occurs, the CPU is reset. The menu code then +reads to see which of the sources caused the reset, and acts accordingly. + +5003h.W - Exception Trap Attraction Timer + 0-7 Counter value (decremented at 6.8274Hz) (255=max=37 seconds) +When the timer wraps from 00h to FFh it triggers an exception, if it is +enabled. (See 5000h.W and 5000h.R) +This timer is used for the "attract" mode. It lets the game run for several +seconds before it brings the menu back. + +5001h.W - Coin Chip Params & CATV Outputs (reset to 00h on power-up only) + 0 Coin Chip pin 1 (1=Ten Minutes per Coin) + 1 Coin Chip pin 2 (1=Twenty Minutes per Coin) + 2 Coin Chip pin 3 (should be always 0, except in test mode) + 3 Coin Chip pin 4 (should be always 0, except in test mode) + 4 Coin Chip pin 12 (should be always 0, except in test mode) + 5 Coin Chip pin 14 (1=Apply Minutes?) + 6 CATV Connector pin 7 (0=Free-Menu/Demo, 1=Play-and-Pay; unless TV Mode?) + 7 CATV Connector pin 8 (0=High=Okay, 1=Low=Joypad/Zapper-Disconnect-Alert) + +5002h.W - Slot LED and RAM protect register (reset to 00h when CPU is reset) + 0-3 LED Select (00h=None, 01h..0Fh=Cartridge Slot LED 1..15) + 4-6 RAM Write Enable (0=None, 1=0-07FFh, 2=0-0FFFh, 3=0-17FFh, 4-7=0-1FFFh) + 7 LED Flash (3.414Hz) (high=flash, low=steady) +BIT7: err... 1=high, 0=low or what? err... flash=blinking? and steady... means +always on? err... what LED(s)... the currently selected cart-led? power-led? + +5004h.W - Slot ROM Cart control register (reset to 00h when CPU is reset) + 0-3 Cart Number select (00h=Menu, 01h..0Fh=Game Cart1-15) + 4-5 Cart Row select (00h=Menu, 01h=Cart1-5, 02h=Cart6-10, 03h=Cart11-15) + 6 Lock (0=No change, 1=Disable Port 500xh or so; until Reset) + 7 NC +Proper cart selection requires setting up BOTH the desired cart number +(00h-0Fh), AND the proper row. + +5005h.W - Misc Control (reset to 00h on power-up only) + 0 Latching Relay (1=Flip to position A) (coil on pins 1 & 10) + 1 Coin Chip pin ? ;err... which pin? (0=Operate, 1=Config/Reset?) + 2 Zapper GND (0=Disable/Low-Z; for 5007h.R connect-check, 1=Enable/GND) + 3 enable 40% input of modulator (0=Disable, 1=Enable) + 4 NC + 5 maps to 5007h.R.Bit7 (warmboot flag or so?) (and to 50-pin ??) + 6 Joypad Enable (0=Enable, 1=Disable) + 7 Joypad Swap (0=Swap, 1=Normal) swapping only swaps D0 and CLK +err... what is this register having to do with "CATV"...? maybe the relay? + +5007h.R - Misc Status + 0 TV type selection (0=TV, 1=Game) ;or... trap flag bit8... CIC, 1=trap? + 1 Keyswitch turned (0=No, 1=in middle of two positions) + 2 Zapper GND (0=Enabled or Disabled+Disconnected, 1=Disabled+Connected) + 3 Expansion 50-pin Edge Connector, Pin 21 (inverted) + 4 CATV Connector pin 8 (0=Low, 1=High) (see also: 5001h.W.Bit7) + 5 Relay Position (0=Position A, 1=Position B) (For CATV 0=Force Demo Only) + 6 Expansion 50-pin Edge Connector, Pin 22 (inverted) + 7 5005h.W.Bit5 (inverted) ;coldboot/warmboot flag? + 7 err, and/or Expansion 50-pin Edge Connector, Pin 23 + +5002h.R - Dip Switch Register + 0 DIP SW 1 Self Test (0=Off=Normal, 1=On=Do continuous selftest) + 1 DIP SW 2 Coin timeout period (0=Off=10 minutes, 1=On=20 minutes) + 2 DIP SW 3 Not used (0=Off, 1=On) + 3 DIP SW 4 Famicombox menu time (0=Off=7 seconds, 1=On=12 seconds) + 4 DIP SW 5 Attract time, bit0 ;\(0..3 = 12,17,23,7 seconds) + 5 DIP SW 6 Attract time, bit1 ;/ + 6 DIP SW 7 Mode, bit0 ;\(0=KEY MODE, 1=CATV MODE, 2=COIN MODE, 3=FREEPLAY) + 7 DIP SW 8 Mode, bit1 ;/ + N/A DIP SW 9 Feep Disable (On=Mute the Coin feep) + N/A DIP SW 10 Controller 2 D3,D4 (Off=Disable, On=Enable) (Zapper pins) +Attract time: How long each game plays while in attract mode before switching +to the next. + +5003h.R - Keyswitch Position & Coin Chip Status + 0 Key Position 0 (0=No, 1=Yes) (??? from left) ;-(demo mode?) + 1 Key Position 1 (0=No, 1=Yes) (??? from left) ;\SELECT GAME (play modes) + 2 Key Position 2 (0=No, 1=Yes) (??? from left) ;/ + 3 Key Position 3 (0=No, 1=Yes) (??? from left) ;-SELF CHECK and GAME CHECK + 4 Key Position 4 (0=No, 1=Yes) (??? from left) ;-Lockup ??? + 5 Key Position 6 (0=No, 1=Yes) (1st from left) ;-GAME TITLE & COUNT + 6 Coin Chip Pin 9 (0=Empty/Expired, 1="Money system enabled") + 7 Coin Chip Pin 10 (not used by existing software) (MAYBE expired-trap?) +Note: There are Black visitor keys, and red master keys. The visitor keys can +be probably turned to only 2 positions. +The naming for the key positions is very confusing. Obvious names would be "Nth +from Left" or "Bit0-5" (which may not be numbered straightly). Other naming +schemes include "ON-OFF" (on front panel, without markings on the other four +positions), "1 2 3 4 5 6" (used in the Menu cartridge), "0 1 2 3 4 6" (used by +kevtris, mabe pin-numbers, with 5=GND), and "1-OFF-ON-2-3" (seen on a japanese +webpage). + +5001h.R - Not used + 0-7 Not used (open bus) + +5004h.R - Test Connector DB-25 Inputs + 0-7 Input R0..R7 (DB-25 pins 2,15,3,16,4,17,5,18) (inverted; 0=High, 1=Low) + +5006h.W - Test Connector DB-25 Outputs (not reset, uninitialzed at power-up) + 0-7 Output W0..W7 (DB-25 pins 6,15,7,16,8,17,9,18) + +5005h.R - Expansion 50-pin Edge Connector, 8bit Input 1 + 0-7 Input from CPU Databus; with 5005h.Read signal on Expansion Port pin 28 + +5006h.R - Expansion 50-pin Edge Connector, 8bit Input 2 + 0-7 Input from CPU Databus; with 5006h.Read signal on Expansion Port pin 27 + +5007h.W - Expansion 50-pin Edge Connector, 8bit Output + 0-7 Output to CPU Databus; with 5007h.Write signal on Expansion Port pin 26 + +4016h.W - Joypad Strobe + 0 DB-15 pin 12 and Joypad 1/2 Strobe pin 3 + 1 DB-15 pin 11 + 2 DB-15 pin 10 + 3-7 Not used + +4016h.R - Watchdog Reload, and Joypad 1 + 0 Joypad 1 D0 pin 4 ;Joypad 1 (or joypad 2 when swapped) + 1 DB-15 pin 14 + 2 Expansion 50-pin Edge Connector, Pin 44 (would be Microphone in Famicom) + 3 Joypad 1 D3 pin 6 + 4 Joypad 1 D4 pin 7 + 5 Expansion 50-pin Edge Connector, Pin 19 + 6 Expansion 50-pin Edge Connector, Pin 45 + 7 Expansion 50-pin Edge Connector, Pin 20 +Reading 4016h or 4017h resets the 4bit Watchdog timer (this must be done at +least every 17.5 seconds; ie. every fifteen 0.853Hz steps). + +4017h.R - Watchdog Reload, and Joypad 2 and Zapper + 0 DB-15 pin 8 and Joypad 2 D0 pin 4 ;Joypad 2 (or joypad 1 when swapped) + 1 DB-15 pin 7 + 2 DB-15 pin 6 + 3 DB-15 pin 5 and Joypad 2 D3 pin 6 ;Zapper Light ;\when DIP10=Off: + 4 DB-15 pin 4 and Joypad 2 D4 pin 7 ;Zapper Trigger ;/only DB-15 pins + 5 Expansion 50-pin Edge Connector, Pin 17 + 6 Expansion 50-pin Edge Connector, Pin 43 + 7 Expansion 50-pin Edge Connector, Pin 18 +Reading 4016h or 4017h resets the 4bit Watchdog timer (this must be done at +least every 17.5 seconds; ie. every fifteen 0.853Hz steps). + +FamicomBox Misc +--------------- + +Counter chain + 21.47727MHz/3/2000h = 873.91Hz (feep tone, when coin inserted) + 21.47727MHz/3/100000h = 6.827Hz (clock for 8bit attraction timer) + 21.47727MHz/3/200000h = 3.414Hz (LED flash) + 21.47727MHz/3/800000h = 0.853Hz (clock for 4bit watchdog timer) + +Watchdog timer +A 4 bit binary up counter is used. It is clocked at 0.85Hz. When a controller +is read (either one), this timer is reset. When the count wraps from 0Fh to +00h, an exception is generated. (see 5000R and 5000W) + +Audio chain +The audio chain is kinda interesting. The audio passes from the two pins on the +CPU, through two hex inverter audio amplifiers, and then the outputs of these +go to the 50-pin expansion connector, and then through two more hex inverter +amplifiers. The outputs of those two amps is combined with external audio +(again from the 50-pin expansion connector) and the coin beep, which is finally +fed to the DB-15, DB-25, and the modulator and audio jack. +The beep is made whenever coin is inserted. + +Lockout +The 3198 lockout chip in the famicombox carts is kinda odd. The resistor +network connects 4 lines from the expansion pins (on the cart) to 4 pins on the +lockout chip. +Unlike the regular lockout chips, the 3198 is designed to work in a network of +up to 16 lockout chips. Each of the 15 cart slots on the front + the menu board +has a unique mapping of the 4 lines; pulled high or low depending on which slot +it is in. +The master lockout chip on the main board has its 4 address lines connected to +a latch which is written to by the CPU to select 1 of the 16 slaves on the +various carts. The slave lockout chip matching the desired chip sent out by the +master responds, while the other up to 15 chips do not. +This is how the system addresses each cart's lockout chip to see if a cart +exists at that address. + +FamicomBox Cartridges +--------------------- + +Software Requirements +For whatever reason, most or all game cartridges are containing PRG-ROM and +CHR-ROM stored on EPROMs rather than ROMs. The FamicomBox EPROMs are usually +(maybe always) containing exactly the same data as normal Famicom ROMs, without +any FamicomBox specific modifications. +However, as far as known, the Watchdog feature is active even in Game-mode, so +games MUST read the controller ports (either 4016h or 4017h) at least every +17.5 seconds; that might be a problem with a few games (with excessive intros +without controller input). +And, the games MUST contain a "header" with valid Checksums and Title (see +below). The only exception are older games (that were produced before the +FamicomBox was released; ie. before 1986/1987), for such games, the FamicomBox +menu cartridge contains a database with about 150 known checksums & titles. +--> FamicomBox ROM Header (at FFE0h) + +Hardware Restrictions +According to Kevin Horton, FamicomBox games cannot use IRQs, and can contain +memory and I/O ports in the 8000h-FFFFh area only (though unknown what exactly +is causing that restrictions) (in case of the SRAM area at 6000h-7FFFh: unknown +if the games are allowed to use the internal SRAM on the FamicomBox mainboard; +instead of battery-backed SRAM used in retail game cartridges). + +FamicomBox ROM Header (at FFE0h) +-------------------------------- + +Some cartridges include header information in the last 20h bytes of PRG-ROM (or +at the end of EVERY 16K PRG-ROM bank, eg. in "Derby Stallion - Zenkoku Han +(J)"). The header was inventend around 1987 for use by the FamicomBox, but it's +also present in around 30% of the existing normal retail cartridges. + +Summary + FFE0h 16 Title in ASCII, max 16 chars (right-justified, at FFExh..FFEFh) + FFF0h 2 PRG-ROM Checksum (big-endian) (ALL bytes, or only last 16Kbytes) + FFF2h 2 CHR-ROM Checksum (big-endian) (ALL bytes, 0000h if no CHR-ROM) + FFF4h 1 Unknown/Unused Cartridge Size (MSB=PRG-ROM, LSB=CHR-ROM/RAM) (or so) + FFF5h 1 Mapper Type (implies Checksum Type), and bit7=Name Table Mirroring + FFF6h 1 Unknown/Unused (00h=NoTitle?, 01h=Normal, 02h=Mapper4?) + FFF7h 1 Length of Title minus 1 (typically 02h..0Fh) (or often 10h=Corrupt) + FFF8h 1 Maker Code (same as for Gameboy and SNES) (01h=Nintendo, etc.) + FFF9h 1 Header Checksum (00h minus all bytes at [FFF2h..FFF8h]) + FFFAh 2 CPU NMI Vector + FFFCh 2 CPU RESET Vector + FFFEh 2 CPU IRQ/BRK Vector + +PRG-ROM Checksum +This is the sum of either ALL or SOME bytes of PRG-ROM added together, minus +the checksum bytes at [FFF0h,FFF1h). The FamicomBox DOES verify this value, and +works only if the checksum is correctly matched to the mapper type in +[FFF5h].Bit0-6: + 00h NROM PRG=8K,16K,32K + 01h CNROM PRG=8K,16K,32K + 02h UNROM PRG=128K (fixed size) (8 banks of 16K) chksum per whole 128K + 03h GNROM? PRG=128K (fixed size) (4 banks of 32K) chksum per 32K bank + 04h MMC's PRG=16K chksum per (any) mappable 16K bank(s) at C000h-FFFFh + 05h..7Fh Invalid +For NROM/CNROM, the FamicomBox is autodetecting PRG-ROM sizes of 8K, 16K, and +32K and computes the checksum across that region (if the PRG-ROM is smaller, +then the checksum is including mirror(s) in the 8K region). +For UNROM, the FamicomBox assumes a fixed size of 128K (aka 8 banks of 16K), +and computes ONE checksum across the whole 128K area (if the actual ROM should +be bigger/smaller, then it must be clipped/mirrored to 128K size). +For GNROM, the FamicomBox assumes a fixed size of 128K (aka 4 banks of 32K), +and computes FOUR checksums across the separate 32K areas; so the ROM must have +FOUR headers with FOUR different checksums. +For MMC's, the FamicomBox simply computes a checksum on the 16K area at +C000h-FFFFh without trying to perform any bankswitching. If that 16K area is +mappable, then all 16K blocks must contain separate headers with separate +checksums (unless maybe if the cartridge contains reset logic that does ensure +a specific initial bank number to be mapped during checksumming). + +CHR-ROM Checksum +This is simply the sum of ALL bytes in CHR-ROM added together (or 0000h if +there's is no CHR-ROM). The FamicomBox doesn't verify this value, and thus +doesn't require any mapper specific checksumming mechanisms for CHR-ROM. + +Bad Headers +The "FamicomBox" headers found in retail cartridges are often incomplete or +corrupted. For example, some carts have the title centered or left-justified +(rather than right-justified within the 16-byte region). Many carts have +16-byte title length defined as 10h (rather than 0Fh). Some have checksums in +little-endian (instead of big-endian), or completely missing or incorrect +checksums. +Unknown if the headers are also used by other consoles (such like maybe the M82 +demonstration unit). + +FamicomBox Pinouts +------------------ + +72-Pin Cartridge Slots (16 slots: for menu cart and 15 game carts) +Mostly same as 72-pin NES cartridges, see: +--> Cartridge Pin-Outs +Pin 16-19 are the 4bit SlotID; for use by the FamicomBox CIC chip (on NES +carts, these pins are unused "expansion" pins). + +26pin Front Panel connector (from Mainboard to Front Panel) + 1 - +5V + 2 - +5V + 3 - Front LED anode (cathode is grounded) (green LED "indicating TV/game") + 4 - TV/Game Button (5V on other end, connected to pin 6) + 5 - RESET Button (Low=Pressed) (used to return to Menu) + 6 - +5V + 7 - Coin Connector Pin 3 and connects to LED (err... what LED??) + 8 - Coin Connector Pin 1 and TEST Button (Low=Add credit) + 9 - Controller Pin 1 on Port 3: (5007h.R.Bit2, 5005h.W.Bit2, Zapper GND) + 10 - Controller Pin 4 on Port 1: (4016h.R.Bit0, Joypad 1 Data) ;\can be + 11 - Controller Pin 4 on Port 2: (4017h.R.Bit0, Joypad 2 Data) ;/swapped + 12 - Controller Pin 2 on Port 1: (4016h.Read, Joypad 1 Clock) ;\can be + 13 - Controller Pin 2 on Port 2-3: (4017h.Read, Joypad 2 Clock) ;/swapped + 14 - Controller Pin 3 on Port 1-2: (4016h.W.Bit0, Joypad 1/2 Strobe, OUT0) + 15 - Controller Pin 7 on Port 2-3: (4017h.R.Bit4, Zapper Trigger) ;\only when + 16 - Controller Pin 6 on Port 2-3: (4017h.R.Bit3, Zapper Light) ;/DIP10=On + 17 - Controller Pin 6 on Port 1: (4016h.R.Bit3) + 18 - Controller Pin 7 on Port 1: (4016h.R.Bit4) + 19 - Keyswitch position 0 (Low=Selected) (5003h.R.Bit0) + 20 - Keyswitch position 1 (Low=Selected) (5003h.R.Bit1) + 21 - Keyswitch position 2 (Low=Selected) (5003h.R.Bit2) + 22 - Keyswitch position 3 (Low=Selected) (5003h.R.Bit3) + 23 - Keyswitch position 4 (Low=Selected) (5003h.R.Bit4) + 24 - Keyswitch position 6 (Low=Selected) (5003h.R.Bit5) + 25 - GND + 26 - GND + +3pin Coin Mechanics connector (from Front Panel to External Coin Unit) + 1 - (pin8 of front panel PCB) (Low=Add credit) (also wired to TEST button) + 2 - GND + 3 - (pin7 of front panel PCB) "connects to LED" err.. what LED, what for? + +7pin Controller Ports (3 pieces; for 2 Joypads and 1 Zapper) + Pin Purpose Port 1 (Joy1) Port 2 (Joy2) Port 3 (Zapper) + 1 - Ground GND GND 5005h.W.Bit2/5007h.R.Bit2 + 2 - Joypad Clock 4016h.R 4017h.R 4017h.R .---------. + 3 - Joypad Strobe 4016h.W.Bit0 4016h.W.Bit0 NC | 4 3 2 1 | + 4 - Joypad Data 4016h.R.Bit0 4017h.R.Bit0 NC | 7 6 5 / + 5 - Supply +5V +5V +5V '-------' + 6 - Zapper Light 4016h.R.Bit3 4017h.R.Bit3/DIP10 4017h.R.Bit3/DIP10 + 7 - Zapper Button 4016h.R.Bit4 4017h.R.Bit4/DIP10 4017h.R.Bit4/DIP10 + +DB-15 on the back of unit (marked "15P expand"): + 1 - GND 9 - 4017h.R enable + 2 - audio output 10 - 4016h.W.2 + 3 - /IRQ 11 - 4016h.W.1 + 4 - 4017h.R.4 12 - 4016h.W.0 + 5 - 4017h.R.3 13 - 4016h.R.1 + 6 - 4017h.R.2 14 - 4016h.R enable + 7 - 4017h.R.1 15 - +5V + 8 - 4017h.R.0 +Note: The pinout is the same as the Famicom's DB-15. + +Test Connector DB-25 on the back of the unit (marked "25P expand"): + 1 - +5V 14 - /IRQ + 2 - 5004h.R.0 15 - 5004h.R.1 + 3 - 5004h.R.2 16 - 5004h.R.3 + 4 - 5004h.R.4 17 - 5004h.R.5 + 5 - 5004h.R.6 18 - 5004h.R.7 + 6 - 5006h.W.0 19 - 5006h.W.1 + 7 - 5006h.W.2 20 - 5006h.W.3 + 8 - 5006h.W.4 21 - 5006h.W.5 + 9 - 5006h.W.6 22 - 5006h.W.7 + 10 - GND 23 - GND + 11 - GND 24 - M2 + 12 - GND 25 - GND + 13 - GND +Could be used as general-purpose I/O port. Some of the Menu's selftest +functions expect the DB-25 to be strapped to the DB-15 via an external +test-adaptor (and the /IRQ pin strapped to a CATV pin?). + +8pin Screw Terminal Block (marked "CATV INTERFACE") + 1 - 5000h.RW.Bit7 Exception Trap (usually strapped to GND, ie. CATV pin4) + 2 - Unknown + 3 - Unknown + 4 - GND + 5 - +5V + 6 - Unknown + 7 - 5001h.W.Bit6 ;Play-and-Pay (unless TV mode?) + 8 - 5001h.W.Bit7 and 5007h.R.Bit4 ;Joypad/Zapper-Disconnect-Alert + +Expansion 50-pin Edge Connector (behind a small door on the back left side) + 1 - +5V 26 - 5007h.W enable + 2 - +5V 27 - 5006h.R enable + 3 - +5V 28 - 5005h.R enable + 4 - M2 29 - +5V + 5 - Audio Input 30 - +5V + 6 - +5V 31 - +5V + 7 - PRG A6 32 - PRG A7 + 8 - PRG A4 33 - PRG A5 + 9 - PRG A2 34 - PRG A3 + 10 - PRG A0 35 - PRG A1 + 11 - PRG D1 36 - PRG D0 + 12 - PRG D3 37 - PRG D2 + 13 - PRG D5 38 - PRG D4 + 14 - PRG D7 39 - PRG D6 + 15 - PRG R/W 40 - /(5000h-5FFFh) + 16 - pin #1 audio 41 - /IRQ + 17 - 4017h.R.5 42 - pin #2 audio + 18 - 4017h.R.7 43 - 4017h.R.6 + 19 - 4016h.R.5 44 - 4016h.R.2 (microphone) + 20 - 4016h.R.7 45 - 4016h.R.6 + 21 - 5007h.R.3 46 - GND + 22 - 5007h.R.6 47 - GND + 23 - 5007h.R.7 (+5005h.W.5 ?) 48 - GND + 24 - GND 49 - GND + 25 - GND 50 - GND + +3198 - 16pin Lockout Chip (CIC) (17 pieces; 1 on mainboard, 16 in carts) +Lockout chip with additional 4bit SlotID (unlike normal NES lockout chips). +--> Cartridge Cicurity Chip (CIC) (Lockout Chip) + +3199 - 16pin Coin Timer/Coin Chip (1 piece; on mainboard) +This is probably the same type of 4bit CPU which is used in CICs. + 1 P00 5001h.W.Bit0 (unknown purpose) + 2 P01 5001h.W.Bit1 (unknown purpose) + 3 P02 5001h.W.Bit2 (unknown purpose) + 4 P03 5001h.W.Bit3 (unknown purpose) + 5 CL2 whatever MHz clock (or maybe NC) + 6 CL1 whatever MHz clock (this one needed) + 7 RES whatever type of reset (maybe I/O controlled?) + 8 GND Supply GND + 9 P10 5003h.R.Bit6 (reportedly "Money system enabled") + 10 P11 5003h.R.Bit7 (unknown purpose) + 11 P12 (unknown purpose) + 12 P13 5001h.W.Bit4 (unknown purpose) + 13 P20 (unknown purpose) + 14 P21 5001h.W.Bit5 (unknown purpose) + 15 P22 (unknown purpose) + 16 VCC Supply VCC +Note: Reportedly, 5005h.W.Bit1 also connects to whatever 3199 pin. Moreover, +the 3199 chip should connect to "a LED", sound feep, 40% video dimming, and +coin-insert signal. + +Modulator 7pin connector (connection from Mainboard to Modulator) + Audio - Mono audio from amplifier+external+coin feep + Video - Comes from the usual transistor circuit on the PPU + B+ - Supply 5V + B+SW - Switch (Low=Switches the game in, High=Lets TV signal pass through) + GND - Supply Ground + 40% - Dimming (undermodulates video by 40%) (Low=Dim, High=Normal) + ? - Unknown (there are seven wires, not only six) +The 40% input is weird. When the time is about to expire on the coin mechanism, +it feeps and flashes the screen by using this 40% input. The LED on the coin +mech also flashes in time with the feeping. + +Modems +------ + +Japanese Famicom Modems +There are at least 4 different Famicom modems: + Famicom Network System HVC-050 + Famicom Network System FCNS-A + Famicom Network System Dataship 1200 (Nintendo) + TV-NET MC-1200B +All of them do connect to cartridge slot and telephone line (that seems to +include the TV-NET thing - it appears to be a regular modem; not a video text +decoder). +All four modems seem to include some kind of "cartridge" slot, whereas the +"cartridges" seem to be very flat plastic cards; they are almost looking a bit +too flat to contain any ROM, SRAM or FLASH memory; so, possibly they are only +containing some sort of ID codes for selecting specific online services; +encoded in whatever form... possibly magnets, notches, reflectors (?) +Specifically for use with the modems, there have been some numeric keypads, in +form of extended joypads, and some in form of (non-wireless) TV-style remote +controls: +--> Controllers - Keypads +Other than that, there isn't anything known about these modems. Unknown if and +how far they are compatible with each other. There don't seem to be any dumps +of the modem BIOSes. +There seems to be no external storage, so any downloaded content is probably +lost when switching off the modem - unless it contains some kind of internal +storage. As far as known, the modems have been used for reading news online, +and for JRA-PAT horse-betting. So far, for that purposes, it may not have +used/required any storage, except possibly for storing details like user names. + +US Baton Teleplay Modem +An unreleased NES modem that did exist only in prototype form. Unlike the +japanese modems, it has been intended to support multiplayer games. + +US Minnesota State Lottery Modem (Control Data Corporation) (1991) +Another unreleased NES modem, intended for online gambling. + +Unpredictable Things +-------------------- + +Reading Garbage from unused PPU Bits +Semi-stable garbage is returned for 8bit write-only PPU registers (2000h, +2001h, 2003h, 2005h, 2006h), for lower 5bits of the PPU status register (Port +2002h), and for upper 2bit of palette values (Port 2007h at PPU address +3F00h-3FFFh). That garbage value is: +1) The 8bit-value most recently written to any PPU port (2000h-2007h). +2) The 8bit-value most recently read from 2004h or 2007h, +3) The 3bit-value most recently read from 2002h (lower 5bit unchanged). +4) Zero if none of the above has "updated" the garbage for longer period. + +Reading from Palette Memory +Palette entries are 6bit values, when reading from palette memory, the upper +two bits are garbage (see above). In monochrome mode (Port 2001h/Bit0=1) the +returned lower 4bit are zero. Also, palette reads appear a bit unstable, and +occasionally return incorrect values (at least on my PAL NES console). + +Reading from empty Expansion / SRAM area at 4100h-7FFFh +Returns the most recently fetched data byte. That is: The third opcode byte +(direct 16bit addressing), or the second zero-page byte (indirect addressing). +In either case, the returned value is the MSB of 16bit BASE address, regardless +of any index value which may wrap the MSB to the next page. For example: +[4510h]=45h and [44FFh+11h]=44h are receiving different values, even though +both are reading from the same memory address. + +Reading from empty Expansion / APU area at 4000h-40FFh +Empty bits and bytes are: Write-only APU Ports 4000h-4014h, unused expansion +addresses 4018h-40FFh, and unused bits in APU/Joypad Ports: 4015h/Bit5, +4016h/Bit7-5 (NES) or Bit7-3 (Famicom), and 4017h/Bit7-5. Normally returned +garbage is 40h (base MSB, as described for 4100h-7FFFh), unless when indexing +causes a page-wrap (from 3Fxxh+yyh to 40zzh), in that case several +"unpredictable" things are happening: +The CPU adds the index to the address LSB, and reads from that address (3Fzzh) +by mistake, in a second cycle the CPU adds the carry-out to the address MSB, +and tries to read from the correct address (40zzh). The hardware doesn't output +data for 40zzh, so that the CPU receives the most recently fetched data byte, +which has been [3Fzzh], which is a mirror of PPU register [200zh]. To the +worst, most PPU registers are either write-only, or cannot be read during +rendering, see PPU Garbage above. +Cleverly used, this allows to detect the number of unused bits in 4016h, and to +separate between NES or Famicom hardware. + +CPU 65XX Microprocessor +----------------------- + +Overview +--> CPU Registers and Flags +--> CPU Memory Addressing + +Instruction Set +--> CPU Memory and Register Transfers +--> CPU Arithmetic/Logical Operations +--> CPU Rotate and Shift Instructions +--> CPU Jump and Control Instructions +--> CPU Illegal Opcodes + +Other Info +--> CPU Assembler Directives/Syntax +--> CPU Glitches +--> CPU The 65XX Family +--> CPU Local Usage + +CPU Registers and Flags +----------------------- + +The 65XX CPUs are equipped with not more than three 8bit general purpose +registers (A, X, Y). However, the limited number of registers (and complete +lack of 16bit registers other than PC) is parts of covered by comfortable +memory operations, especially page 0 of memory (address 0000h-00FFh) may be +used for relative fast and complicated operations, in so far one might say that +the CPU has about 256 8bit 'registers' (or 128 16bit 'registers') in memory. +For details see Memory Addressing chapter. + +Registers + Bits Name Expl. + 8 A Accumulator + 8 X Index Register X + 8 Y Index Register Y + 16 PC Program Counter + 8 S Stack Pointer (see below) + 8 P Processor Status Register (see below) + +Stack Pointer +The stack pointer is addressing 256 bytes in page 1 of memory, ie. values +00h-FFh will address memory at 0100h-01FFh. As for most other CPUs, the stack +pointer is decrementing when storing data. However, in the 65XX world, it +points to the first FREE byte on stack, so, when initializing stack to top set +S=(1)FFh (rather than S=(2)00h). + +Processor Status Register (Flags) + Bit Name Expl. + 0 C Carry (0=No Carry, 1=Carry) + 1 Z Zero (0=Nonzero, 1=Zero) + 2 I IRQ Disable (0=IRQ Enable, 1=IRQ Disable) + 3 D Decimal Mode (0=Normal, 1=BCD Mode for ADC/SBC opcodes) + 4 B Break Flag (0=IRQ/NMI, 1=RESET or BRK/PHP opcode) + 5 - Not used (Always 1) + 6 V Overflow (0=No Overflow, 1=Overflow) + 7 N Negative/Sign (0=Positive, 1=Negative) + +Carry Flag (C) +Caution: When used for subtractions (SBC and CMP), the carry flag is having +opposite meaning as for normal 80x86 and Z80 CPUs, ie. it is SET when +above-or-equal. For all other instructions (ADC, ASL, LSR, ROL, ROR) it works +as normal, whereas ROL/ROR are rotating carry (ie. much like 80x86 +RCL/RCR and not like ROL/ROR). + +Zero Flag (Z), Negative/Sign Flag (N), Overflow Flag (V) +Works just as everywhere, Z it is set when result (or destination register, in +case of some 'move' instructions) is zero, N is set when signed (ie. same as +Bit 7 of result/destination). V is set when an addition/subtraction exceeded +the maximum range for signed numbers (-128..+127). + +IRQ Disable Flag (I) +Disables IRQs when set. NMIs (non maskable interrupts) and BRK instructions +cannot be disabled. + +Decimal Mode Flag (D) +Packed BCD mode (range 00h..99h) for ADC and SBC opcodes. + +Break Flag (B) +The Break flag is intended to separate between IRQ and BRK which are both using +the same vector, [FFFEh]. The flag cannot be accessed directly, but there are 4 +situations which are writing the P register to stack, which are then allowing +the examine the B-bit in the pushed value: The BRK and PHP opcodes always write +"1" into the bit, IRQ/NMI execution always write "0". + +CPU Memory Addressing +--------------------- + +Opcode Addressing Modes + Name Native Nocash + Implied - A,X,Y,S,P + Immediate #nn nn + Zero Page nn [nn] + Zero Page,X nn,X [nn+X] + Zero Page,Y nn,Y [nn+Y] + Absolute nnnn [nnnn] + Absolute,X nnnn,X [nnnn+X] + Absolute,Y nnnn,Y [nnnn+Y] + (Indirect,X) (nn,X) [[nn+X]] + (Indirect),Y (nn),Y [[nn]+Y] + +Zero Page - [nn] [nn+X] [nn+Y] +Uses an 8bit parameter (one byte) to address the first 256 of memory at +0000h..00FFh. This limited range is used even for "nn+X" and "nn+Y", ie. +"C0h+60h" will access 0020h (not 0120h). + +Absolute - [nnnn] [nnnn+X] [nnnn+Y] +Uses a 16bit parameter (two bytes) to address the whole 64K of memory at +0000h..FFFFh. Because of the additional parameter bytes, this is a bit slower +than Zero Page accesses. + +Indirect - [[nn+X]] [[nn]+Y] +Uses an 8bit parameter that points to a 16bit parameter in page zero. +Even though the CPU doesn't support 16bit registers (except for the program +counter), this (double-)indirect addressing mode allows to use variable 16bit +pointers. + +On-Chip Bi-directional I/O port +Addresses (00)00h and (00)01h are occupied by an I/O port which is built-in +into 6510, 8500, 7501, 8501 CPUs (eg. used in C64 and C16), be sure not to use +the addresses as normal memory. For description read chapter about I/O ports. + +Caution +Because of the identical format, assemblers will be more or less unable to +separate between [XXh+r] and [00XXh+r], the assembler will most likely produce +[XXh+r] when address is already known to be located in page 0, and [00XXh+r] in +case of forward references. +Beside for different opcode size/time, [XXh+r] will always access page 0 memory +(even when XXh+r>FFh), while [00XXh+r] may direct to memory in page 0 or 1, to +avoid unpredictable results be sure not to use (00)XXh+r>FFh if possible. + +CPU Memory and Register Transfers +--------------------------------- + +Register/Immeditate to Register Transfer + Opcode Flags Clk Native Nocash Expl. + A8 nz---- 2 TAY MOV Y,A ;Y=A + AA nz---- 2 TAX MOV X,A ;X=A + BA nz---- 2 TSX MOV X,S ;X=S + 98 nz---- 2 TYA MOV A,Y ;A=Y + 8A nz---- 2 TXA MOV A,X ;A=X + 9A ------ 2 TXS MOV S,X ;S=X + A9 nn nz---- 2 LDA #nn MOV A,nn ;A=nn + A2 nn nz---- 2 LDX #nn MOV X,nn ;X=nn + A0 nn nz---- 2 LDY #nn MOV Y,nn ;Y=nn + +Load Register from Memory + A5 nn nz---- 3 LDA nn MOV A,[nn] ;A=[nn] + B5 nn nz---- 4 LDA nn,X MOV A,[nn+X] ;A=[nn+X] + AD nn nn nz---- 4 LDA nnnn MOV A,[nnnn] ;A=[nnnn] + BD nn nn nz---- 4* LDA nnnn,X MOV A,[nnnn+X] ;A=[nnnn+X] + B9 nn nn nz---- 4* LDA nnnn,Y MOV A,[nnnn+Y] ;A=[nnnn+Y] + A1 nn nz---- 6 LDA (nn,X) MOV A,[[nn+X]] ;A=[WORD[nn+X]] + B1 nn nz---- 5* LDA (nn),Y MOV A,[[nn]+Y] ;A=[WORD[nn]+Y] + A6 nn nz---- 3 LDX nn MOV X,[nn] ;X=[nn] + B6 nn nz---- 4 LDX nn,Y MOV X,[nn+Y] ;X=[nn+Y] + AE nn nn nz---- 4 LDX nnnn MOV X,[nnnn] ;X=[nnnn] + BE nn nn nz---- 4* LDX nnnn,Y MOV X,[nnnn+Y] ;X=[nnnn+Y] + A4 nn nz---- 3 LDY nn MOV Y,[nn] ;Y=[nn] + B4 nn nz---- 4 LDY nn,X MOV Y,[nn+X] ;Y=[nn+X] + AC nn nn nz---- 4 LDY nnnn MOV Y,[nnnn] ;Y=[nnnn] + BC nn nn nz---- 4* LDY nnnn,X MOV Y,[nnnn+X] ;Y=[nnnn+X] +* Add one cycle if indexing crosses a page boundary. + +Store Register in Memory + 85 nn ------ 3 STA nn MOV [nn],A ;[nn]=A + 95 nn ------ 4 STA nn,X MOV [nn+X],A ;[nn+X]=A + 8D nn nn ------ 4 STA nnnn MOV [nnnn],A ;[nnnn]=A + 9D nn nn ------ 5 STA nnnn,X MOV [nnnn+X],A ;[nnnn+X]=A + 99 nn nn ------ 5 STA nnnn,Y MOV [nnnn+Y],A ;[nnnn+Y]=A + 81 nn ------ 6 STA (nn,X) MOV [[nn+x]],A ;[WORD[nn+x]]=A + 91 nn ------ 6 STA (nn),Y MOV [[nn]+y],A ;[WORD[nn]+y]=A + 86 nn ------ 3 STX nn MOV [nn],X ;[nn]=X + 96 nn ------ 4 STX nn,Y MOV [nn+Y],X ;[nn+Y]=X + 8E nn nn ------ 4 STX nnnn MOV [nnnn],X ;[nnnn]=X + 84 nn ------ 3 STY nn MOV [nn],Y ;[nn]=Y + 94 nn ------ 4 STY nn,X MOV [nn+X],Y ;[nn+X]=Y + 8C nn nn ------ 4 STY nnnn MOV [nnnn],Y ;[nnnn]=Y + +Push/Pull + 48 ------ 3 PHA PUSH A ;[S]=A, S=S-1 + 08 ------ 3 PHP PUSH P ;[S]=P, S=S-1 (flags) + 68 nz---- 4 PLA POP A ;S=S+1, A=[S] + 28 nzcidv 4 PLP POP P ;S=S+1, P=[S] (flags) +Notes: PLA sets Z and N according to content of A. The B-flag and unused flags +cannot be changed by PLP, these flags are always written as "1" by PHP. + +CPU Arithmetic/Logical Operations +--------------------------------- + +Add memory to accumulator with carry + 69 nn nzc--v 2 ADC #nn ADC A,nn ;A=A+C+nn + 65 nn nzc--v 3 ADC nn ADC A,[nn] ;A=A+C+[nn] + 75 nn nzc--v 4 ADC nn,X ADC A,[nn+X] ;A=A+C+[nn+X] + 6D nn nn nzc--v 4 ADC nnnn ADC A,[nnnn] ;A=A+C+[nnnn] + 7D nn nn nzc--v 4* ADC nnnn,X ADC A,[nnnn+X] ;A=A+C+[nnnn+X] + 79 nn nn nzc--v 4* ADC nnnn,Y ADC A,[nnnn+Y] ;A=A+C+[nnnn+Y] + 61 nn nzc--v 6 ADC (nn,X) ADC A,[[nn+X]] ;A=A+C+[word[nn+X]] + 71 nn nzc--v 5* ADC (nn),Y ADC A,[[nn]+Y] ;A=A+C+[word[nn]+Y] +* Add one cycle if indexing crosses a page boundary. + +Subtract memory from accumulator with borrow + E9 nn nzc--v 2 SBC #nn SBC A,nn ;A=A+C-1-nn + E5 nn nzc--v 3 SBC nn SBC A,[nn] ;A=A+C-1-[nn] + F5 nn nzc--v 4 SBC nn,X SBC A,[nn+X] ;A=A+C-1-[nn+X] + ED nn nn nzc--v 4 SBC nnnn SBC A,[nnnn] ;A=A+C-1-[nnnn] + FD nn nn nzc--v 4* SBC nnnn,X SBC A,[nnnn+X] ;A=A+C-1-[nnnn+X] + F9 nn nn nzc--v 4* SBC nnnn,Y SBC A,[nnnn+Y] ;A=A+C-1-[nnnn+Y] + E1 nn nzc--v 6 SBC (nn,X) SBC A,[[nn+X]] ;A=A+C-1-[word[nn+X]] + F1 nn nzc--v 5* SBC (nn),Y SBC A,[[nn]+Y] ;A=A+C-1-[word[nn]+Y] +* Add one cycle if indexing crosses a page boundary. +Note: Compared with normal 80x86 and Z80 CPUs, incoming and resulting Carry +Flag are reversed. + +Logical AND memory with accumulator + 29 nn nz---- 2 AND #nn AND A,nn ;A=A AND nn + 25 nn nz---- 3 AND nn AND A,[nn] ;A=A AND [nn] + 35 nn nz---- 4 AND nn,X AND A,[nn+X] ;A=A AND [nn+X] + 2D nn nn nz---- 4 AND nnnn AND A,[nnnn] ;A=A AND [nnnn] + 3D nn nn nz---- 4* AND nnnn,X AND A,[nnnn+X] ;A=A AND [nnnn+X] + 39 nn nn nz---- 4* AND nnnn,Y AND A,[nnnn+Y] ;A=A AND [nnnn+Y] + 21 nn nz---- 6 AND (nn,X) AND A,[[nn+X]] ;A=A AND [word[nn+X]] + 31 nn nz---- 5* AND (nn),Y AND A,[[nn]+Y] ;A=A AND [word[nn]+Y] +* Add one cycle if indexing crosses a page boundary. + +Exclusive-OR memory with accumulator + 49 nn nz---- 2 EOR #nn XOR A,nn ;A=A XOR nn + 45 nn nz---- 3 EOR nn XOR A,[nn] ;A=A XOR [nn] + 55 nn nz---- 4 EOR nn,X XOR A,[nn+X] ;A=A XOR [nn+X] + 4D nn nn nz---- 4 EOR nnnn XOR A,[nnnn] ;A=A XOR [nnnn] + 5D nn nn nz---- 4* EOR nnnn,X XOR A,[nnnn+X] ;A=A XOR [nnnn+X] + 59 nn nn nz---- 4* EOR nnnn,Y XOR A,[nnnn+Y] ;A=A XOR [nnnn+Y] + 41 nn nz---- 6 EOR (nn,X) XOR A,[[nn+X]] ;A=A XOR [word[nn+X]] + 51 nn nz---- 5* EOR (nn),Y XOR A,[[nn]+Y] ;A=A XOR [word[nn]+Y] +* Add one cycle if indexing crosses a page boundary. + +Logical OR memory with accumulator + 09 nn nz---- 2 ORA #nn OR A,nn ;A=A OR nn + 05 nn nz---- 3 ORA nn OR A,[nn] ;A=A OR [nn] + 15 nn nz---- 4 ORA nn,X OR A,[nn+X] ;A=A OR [nn+X] + 0D nn nn nz---- 4 ORA nnnn OR A,[nnnn] ;A=A OR [nnnn] + 1D nn nn nz---- 4* ORA nnnn,X OR A,[nnnn+X] ;A=A OR [nnnn+X] + 19 nn nn nz---- 4* ORA nnnn,Y OR A,[nnnn+Y] ;A=A OR [nnnn+Y] + 01 nn nz---- 6 ORA (nn,X) OR A,[[nn+X]] ;A=A OR [word[nn+X]] + 11 nn nz---- 5* ORA (nn),Y OR A,[[nn]+Y] ;A=A OR [word[nn]+Y] +* Add one cycle if indexing crosses a page boundary. + +Compare + C9 nn nzc--- 2 CMP #nn CMP A,nn ;A-nn + C5 nn nzc--- 3 CMP nn CMP A,[nn] ;A-[nn] + D5 nn nzc--- 4 CMP nn,X CMP A,[nn+X] ;A-[nn+X] + CD nn nn nzc--- 4 CMP nnnn CMP A,[nnnn] ;A-[nnnn] + DD nn nn nzc--- 4* CMP nnnn,X CMP A,[nnnn+X] ;A-[nnnn+X] + D9 nn nn nzc--- 4* CMP nnnn,Y CMP A,[nnnn+Y] ;A-[nnnn+Y] + C1 nn nzc--- 6 CMP (nn,X) CMP A,[[nn+X]] ;A-[word[nn+X]] + D1 nn nzc--- 5* CMP (nn),Y CMP A,[[nn]+Y] ;A-[word[nn]+Y] + E0 nn nzc--- 2 CPX #nn CMP X,nn ;X-nn + E4 nn nzc--- 3 CPX nn CMP X,[nn] ;X-[nn] + EC nn nn nzc--- 4 CPX nnnn CMP X,[nnnn] ;X-[nnnn] + C0 nn nzc--- 2 CPY #nn CMP Y,nn ;Y-nn + C4 nn nzc--- 3 CPY nn CMP Y,[nn] ;Y-[nn] + CC nn nn nzc--- 4 CPY nnnn CMP Y,[nnnn] ;Y-[nnnn] +* Add one cycle if indexing crosses a page boundary. +Note: Compared with normal 80x86 and Z80 CPUs, resulting Carry Flag is +reversed. + +Bit Test + 24 nn xz---x 3 BIT nn TEST A,[nn] ;test and set flags + 2C nn nn xz---x 4 BIT nnnn TEST A,[nnnn] ;test and set flags +Flags are set as so: Z=((A AND [addr])=00h), N=[addr].Bit7, V=[addr].Bit6. Note +that N and V are affected only by [addr] (not by A). + +Increment by one + E6 nn nz---- 5 INC nn INC [nn] ;[nn]=[nn]+1 + F6 nn nz---- 6 INC nn,X INC [nn+X] ;[nn+X]=[nn+X]+1 + EE nn nn nz---- 6 INC nnnn INC [nnnn] ;[nnnn]=[nnnn]+1 + FE nn nn nz---- 7 INC nnnn,X INC [nnnn+X] ;[nnnn+X]=[nnnn+X]+1 + E8 nz---- 2 INX INC X ;X=X+1 + C8 nz---- 2 INY INC Y ;Y=Y+1 + +Decrement by one + C6 nn nz---- 5 DEC nn DEC [nn] ;[nn]=[nn]-1 + D6 nn nz---- 6 DEC nn,X DEC [nn+X] ;[nn+X]=[nn+X]-1 + CE nn nn nz---- 6 DEC nnnn DEC [nnnn] ;[nnnn]=[nnnn]-1 + DE nn nn nz---- 7 DEC nnnn,X DEC [nnnn+X] ;[nnnn+X]=[nnnn+X]-1 + CA nz---- 2 DEX DEC X ;X=X-1 + 88 nz---- 2 DEY DEC Y ;Y=Y-1 + +CPU Rotate and Shift Instructions +--------------------------------- + +Shift Left Logical/Arithmetic + 0A nzc--- 2 ASL A SHL A ;SHL A + 06 nn nzc--- 5 ASL nn SHL [nn] ;SHL [nn] + 16 nn nzc--- 6 ASL nn,X SHL [nn+X] ;SHL [nn+X] + 0E nn nn nzc--- 6 ASL nnnn SHL [nnnn] ;SHL [nnnn] + 1E nn nn nzc--- 7 ASL nnnn,X SHL [nnnn+X] ;SHL [nnnn+X] + +Shift Right Logical + 4A 0zc--- 2 LSR A SHR A ;SHR A + 46 nn 0zc--- 5 LSR nn SHR [nn] ;SHR [nn] + 56 nn 0zc--- 6 LSR nn,X SHR [nn+X] ;SHR [nn+X] + 4E nn nn 0zc--- 6 LSR nnnn SHR [nnnn] ;SHR [nnnn] + 5E nn nn 0zc--- 7 LSR nnnn,X SHR [nnnn+X] ;SHR [nnnn+X] + +Rotate Left through Carry + 2A nzc--- 2 ROL A RCL A ;RCL A + 26 nn nzc--- 5 ROL nn RCL [nn] ;RCL [nn] + 36 nn nzc--- 6 ROL nn,X RCL [nn+X] ;RCL [nn+X] + 2E nn nn nzc--- 6 ROL nnnn RCL [nnnn] ;RCL [nnnn] + 3E nn nn nzc--- 7 ROL nnnn,X RCL [nnnn+X] ;RCL [nnnn+X] + +Rotate Right through Carry + 6A nzc--- 2 ROR A RCR A ;RCR A + 66 nn nzc--- 5 ROR nn RCR [nn] ;RCR [nn] + 76 nn nzc--- 6 ROR nn,X RCR [nn+X] ;RCR [nn+X] + 6E nn nn nzc--- 6 ROR nnnn RCR [nnnn] ;RCR [nnnn] + 7E nn nn nzc--- 7 ROR nnnn,X RCR [nnnn+X] ;RCR [nnnn+X] + +Notes: +ROR instruction is available on MCS650X microprocessors after June, 1976. +ROL and ROR rotate an 8bit value through carry (rotates 9bits in total). + +CPU Jump and Control Instructions +--------------------------------- + +Normal Jumps & Subroutine Calls/Returns + 4C nn nn ------ 3 JMP nnnn JMP nnnn ;PC=nnnn + 6C nn nn ------ 5 JMP (nnnn) JMP [nnnn] ;PC=WORD[nnnn] + 20 nn nn ------ 6 JSR nnnn CALL nnnn ;[S]=PC+2,PC=nnnn + 40 nzcidv 6 RTI RETI ;(from BRK/IRQ/NMI) ;P=[S], PC=[S] + 60 ------ 6 RTS RET ;(from CALL) ;PC=[S]+1 +Note: RTI cannot modify the B-Flag or the unused flag. +Glitch: For JMP [nnnn] the operand word cannot cross page boundaries, ie. JMP +[03FFh] would fetch the MSB from [0300h] instead of [0400h]. Very simple +workaround would be to place a ALIGN 2 before the data word. + +Conditional Branches (conditional jump to PC=PC+/-dd) + 10 dd ------ 2** BPL nnn JNS nnn ;N=0 plus/positive + 30 dd ------ 2** BMI nnn JS nnn ;N=1 minus/negative/signed + 50 dd ------ 2** BVC nnn JNO nnn ;V=0 no overflow + 70 dd ------ 2** BVS nnn JO nnn ;V=1 overflow + 90 dd ------ 2** BCC/BLT nnn JNC/JB nnn ;C=0 less/below/no carry + B0 dd ------ 2** BCS/BGE nnn JC/JAE nnn ;C=1 above/greater/equal/carry + D0 dd ------ 2** BNE/BZC nnn JNZ/JNE nnn ;Z=0 not zero/not equal + F0 dd ------ 2** BEQ/BZS nnn JZ/JE nnn ;Z=1 zero/equal +** The execution time is 2 cycles if the condition is false (no branch +executed). Otherwise, 3 cycles if the destination is in the same memory page, +or 4 cycles if it crosses a page boundary (see below for exact info). +Note: After subtractions (SBC or CMP) carry=set indicates above-or-equal, +unlike as for 80x86 and Z80 CPUs. + +Interrupts, Exceptions, Breakpoints + 00 ---1-- 7 BRK Force Break B=1,[S]=PC+1,[S]=P,I=1,PC=[FFFE] + -- ---1-- 7 /IRQ Interrupt B=0,[S]=PC, [S]=P,I=1,PC=[FFFE] + -- ---1-- 7 /NMI NMI B=0,[S]=PC, [S]=P,I=1,PC=[FFFA] + -- ---1-- T+6? /RESET Reset B=1,S=S-3, I=1,PC=[FFFC] +Notes: IRQs can be disabled by setting the I-flag. BRK command, /NMI signal, +and /RESET signal cannot be masked by setting I. +BRK/IRQ/NMI first change the B-flag, then write P to stack, and then set the +I-flag, the D-flag is NOT changed and should be cleared by software. +The same vector is shared for BRK and IRQ, software can separate between BRK +and IRQ by examining the pushed B-flag only. +The RTI opcode can be used to return from BRK/IRQ/NMI, note that using the +return address from BRK skips one dummy/parameter byte following after the BRK +opcode. +Software or hardware must take care to acknowledge or reset /IRQ or /NMI +signals after processing it. + IRQs are executed whenever "/IRQ=LOW AND I=0". + NMIs are executed whenever "/NMI changes from HIGH to LOW". +If /IRQ is kept LOW then same (old) interrupt is executed again as soon as +setting I=0. If /NMI is kept LOW then no further NMIs can be executed. + +CPU Control + 18 --0--- 2 CLC CLC ;Clear carry flag C=0 + 58 ---0-- 2 CLI EI ;Clear interrupt disable bit I=0 + D8 ----0- 2 CLD CLD ;Clear decimal mode D=0 + B8 -----0 2 CLV CLV ;Clear overflow flag V=0 + 38 --1--- 2 SEC STC ;Set carry flag C=1 + 78 ---1-- 2 SEI DI ;Set interrupt disable bit I=1 + F8 ----1- 2 SED STD ;Set decimal mode D=1 + +No Operation + EA ------ 2 NOP NOP ;No operation + +Conditional Branch Page Crossing +The branch opcode with parameter takes up two bytes, causing the PC to get +incremented twice (PC=PC+2), without any extra boundary cycle. The signed +parameter is then added to the PC (PC+disp), the extra clock cycle occurs if +the addition crosses a page boundary (next or previous 100h-page). + +CPU Illegal Opcodes +------------------- + +SAX and LAX + 87 nn ------ 3 SAX nn STA+STX [nn]=A AND X + 97 nn ------ 4 SAX nn,Y STA+STX [nn+Y]=A AND X + 8F nn nn ------ 4 SAX nnnn STA+STX [nnnn]=A AND X + 83 nn ------ 6 SAX (nn,X) STA+STX [WORD[nn+X]]=A AND X + A7 nn nz---- 3 LAX nn LDA+LDX A,X=[nn] + B7 nn nz---- 4 LAX nn,Y LDA+LDX A,X=[nn+Y] + AF nn nn nz---- 4 LAX nnnn LDA+LDX A,X=[nnnn] + A3 nn nz---- 6 LAX (nn,X) LDA+LDX A,X=[WORD[nn+X]] + B3 nn nz---- 5* LAX (nn),Y LDA+LDX A,X=[WORD[nn]+Y] +For SAX, both A and X are output to databus, LOW-bits are stronger than +HIGH-bits, resulting in a "forceful" AND operation. +For LAX, the same value is written to both A and X. + +Combined ALU-Opcodes +Opcode high-bits, flags, commands: + 00+yy nzc--- SLO op ASL+ORA op=op SHL 1 // A=A OR op + 20+yy nzc--- RLA op ROL+AND op=op RCL 1 // A=A AND op + 40+yy nzc--- SRE op LSR+EOR op=op SHR 1 // A=A XOR op + 60+yy nzc--v RRA op ROR+ADC op=op RCR 1 // A=A+op+cy + C0+yy nzc--- DCP op DEC+CMP op=op-1 // A-op + E0+yy nzc--v ISC op INC+SBC op=op+1 // A=A-op-(1-cy) +Opcode low-bits, clock cycles, operands: + 07+xx nn 5 nn [nn] + 17+xx nn 6 nn,X [nn+X] + 03+xx nn 8 (nn,X) [WORD[nn+X]] + 13+xx nn 8 (nn),Y [WORD[nn]+Y] + 0F+xx nn nn 6 nnnn [nnnn] + 1F+xx nn nn 7 nnnn,X [nnnn+X] + 1B+xx nn nn 7 nnnn,Y [nnnn+Y] + +Other Illegal Opcodes + 0B nn nzc--- 2 ANC #nn AND+ASL A=A AND nn, C=N ;bit7 to carry + 2B nn nzc--- 2 ANC #nn AND+ROL A=A AND nn, C=N ;same as above + 4B nn nzc--- 2 ALR #nn AND+LSR A=(A AND nn) SHR 1 + 6B nn nzc--v 2 ARR #nn AND+ROR A=(A AND nn), V=Overflow(A+A), + A=A/2+C*80h, C=A.Bit6 + CB nn nzc--- 2 AXS #nn CMP+DEX X=(X AND A)-nn + EB nn nzc--v 2 SBC #nn SBC+NOP A=A-nn cy? + BB nn nn nz---- 4* LAS nnnn,Y LDA+TSX A,X,S = [nnnn+Y] AND S + +NUL/NOP and KIL/JAM/HLT + xx ------ 2 NOP (xx=1A,3A,5A,7A,DA,FA) + xx nn ------ 2 NOP #nn (xx=80,82,89,C2,E2) + xx nn ------ 3 NOP nn (xx=04,44,64) + xx nn ------ 4 NOP nn,X (xx=14,34,54,74,D4,F4) + xx nn nn ------ 4 NOP nnnn (xx=0C) + xx nn nn ------ 4* NOP nnnn,X (xx=1C,3C,5C,7C,DC,FC) + xx ------ - KIL (xx=02,12,22,32,42,52,62,72,92,B2,D2,F2) +NOP doesn't change any registers or flags, the operand (if any) is fetched, +which may be useful for delays, patches, or for read-sensitive I/O ports. KIL +halts the CPU, the data bus will be set to #$FF, KIL can be suspended by /RESET +signal (not sure if also by /IRQ or /NMI ???). + +Unstable Illegal Opcodes + 8B nn nz---- 2 XAA #nn ((2)) TXA+AND A=X AND nn + AB nn nz---- 2 LAX #nn ((2)) LDA+TAX A,X=nn + BF nn nn nz---- 4* LAX nnnn,X LDA+LDX A,X=[nnnn+X] + 93 nn ------ 6 AHX (nn),Y ((1)) [WORD[nn]+Y] = A AND X AND H + 9F nn nn ------ 5 AHX nnnn,Y ((1)) [nnnn+Y] = A AND X AND H + 9C nn nn ------ 5 SHY nnnn,X ((1)) [nnnn+X] = Y AND H + 9E nn nn ------ 5 SHX nnnn,Y ((1)) [nnnn+Y] = X AND H + 9B nn nn ------ 5 TAS nnnn,Y ((1)) STA+TXS S=A AND X // [nnnn+Y]=S AND H +note to XAA: DO NOT USE!!! Highly unstable!!! +note to LAX: DO NOT USE!!! On my C128, this opcode is stable, but on my C64-II +it loses bits so that the operation looks like this: ORA #? AND #{imm} TAX. +note to AXS: performs CMP and DEX at the same time, so that the MINUS sets +the flag like CMP, not SBC. +Combinations of STA/STX/STY: + AHX {adr} = stores A&X&H into {adr} + SHX {adr} = stores X&H into {adr} + SHY {adr} = stores Y&H into {adr} +note: sometimes the &H drops off. Also page boundary crossing will not work as +expected (the bank where the value is stored may be equal to the value stored). +["H" probably meant to be the MSB aka Highbyte of the 16bit memory address?] + +CPU Assembler Directives/Syntax +------------------------------- + +Below are some common 65XX assembler directives, and the corresponding +expressions in 80XX-style language. + + 65XX-style 80XX-style Expl. + .native .nocash select native or nocash syntax + *=$c100 org 0c100h sets the assumed origin in memory + *=*+8 org $+8 increments origin, does NOT produce data + label label: sets a label equal to the current address + label=$dc00 label equ 0dc00h assigns a value or address to label + .by $00 db 00h defines a (list of) byte(s) in memory + .byt $00 defb 00h same as .by and db + .wd $0000 dw 0000h defines a (list of) word(s) in memory + .end end indicates end of source code file + |nn [|nn] force 16bit "00NN" instead 8bit "NN" + #nnnn nnnn DIV 100h isolate upper 8bits of 16bit value + N/A (?) fast label ensure relative jump without page crossing + N/A (?) slow label ensure relative jump with page crossing + +Special Directives + .65xx Select 6502 Instruction Set + .nes Create NES ROM-Image with .NES extension + .c64_prg Create C64 file with .PRG extension/stub/fixed entry + .c64_p00 Create C64 file with .P00 extension/stub/fixed entry/header + .vic20_prg Create VIC20/C64 file with .PRG extension/stub/relocated entry + end entry End of Source, the parameter specifies the entrypoint +The C64 files contain Basic Stub "10 SYS" with default ORG 80Eh. + +VIC20 Stub +The VIC20 Stub is "10 SYSPEEK(44)*256+" with default ORG 1218h, this +relocates the entryoint relative to the LOAD address (for C64: 818h, for VIC20: +1018h (Unexpanded), 0418h (3K Expanded), 1218h (8K and more Expansion). It does +NOT relocate absolute addresses in the program, if the program wishes to run at +a specific memory location, then it must de-relocate itself from the LOAD +address to the desired address. + +CPU Glitches +------------ + +Dummy Read Cycles at Page-Wraps +Dummy reads occur when reads from [nnnn+X] or [nnnn+Y] or [WORD[nn]+Y] are +crossing page boundaries, this applies only to raw read-opcodes, not for write +or read-and-modify opcodes (ie. only for opcodes that include an extra clock +cycle on page boundaries, such as LDA, CMP, etc.) +For above reads, the CPU adds the index register to the lower 8bits of the +16bit memory address, and does then read from the resulting memory address, if +the addition caused a carry-out, then an extra clock cycle is used to increment +the upper 8bits of the address, and to read from the correct memory location. +For example, a read from [1280h+X] with X=C0h produces a dummy read from +[1240h], followed by the actual read from [1340h]. +Dummy reads cause no problems with normal ROM or RAM, but may cause problems +with read-sensitive I/O ports (eg. IRQ flags that are automatically cleared +after reading, or data-registers that are automatically incrementing associated +memory pointers, etc.) + +Dummy Write Cycles in Read-Modify-Opcodes +Dummy writes occur in all read-modify opcodes, ie. all INC, DEC, Shift, Rotate +opcodes with memory operands. The opcodes consist of three memory accesses: +read original value, write dummy value, write result value. +Dummy writes cause no problems with normal RAM, but may cause problems (or may +be useful) with write-sensitive I/O ports (eg. IRQ flags that are cleared by +writing certain values, or data-registers that are automatically incrementing +associated memory pointers, etc.) +On the C64 and C16, the written dummy value appears to be equal to the original +value, a couple of programs are using this to acknowledge IRQs. +On the NES, the dummy value appears to be equal to the result value, though +more or less unstable ANDed with a random number. Presumably 00h is output +during the first half of the write cycle, and the result only during the second +half, not leaving enough time to raise all bits from LOW to high. Also, dummy +writes to [2007h] aren't always recognized (ie. the VRAM address register isn't +always incremented twice), presumably because the PPU isn't fast enough to +realize two write-signals immediately after each other, that maybe because it +is attempting to synchronize CPU bus writes with the PPU bus. + +CPU The 65XX Family +------------------- + +Different versions of the 6502: + +All of these processors are the same concerning the software-side: + 6501 Some sort of 6502 prototype + 6502 Used in the CBM floppies and some other 8 bit computers. + 6507 Used in Atari 2600, 28pins (only 13 address lines, no /IRQ, no /NMI). + 6510 Used in C64, with built-in 6bit I/O port. + 7501 Used in C16,C116,Plus/4, with built-in 7bit I/O Port, without /NMI pin. + 8500 Used in C64-II, with different pin-outs. + 8501 Same as 7501 + 8502 Used in C128s. + +Some processors of the family which are not 100% compatible: + 65C02 Extension of the 6502 + 65SC02 Small version of the 65C02 which lost a few opcodes again. + 65CE02 Extension of the 65C02, used in the C65. + 65816 Extended 6502 with new opcodes and 16 bit operation modes. + 2A03 Nintendo NES/Famicom, modified 6502 with built-in sound controller. + + +CPU Local Usage +--------------- + +CPU +The NES uses a customized NMOS 6502 CPU, engineered and produced by Ricoh. It's +primary customization adds audio. Audio registers are mapped internal to the +CPU; all waveform generation is done internal to the CPU as well. +The NES's 6502 does not contain support for decimal mode. Both the CLD and SED +opcodes function normally, but the 'd' bit of P is unused in both ADC and SBC. +It is common practice for games to CLD prior to code execution, as the status +of 'd' is unknown on power-on and on reset. +NMIs may be generated by PPU each VBlank. +IRQs may be generated by APU and by external hardware. +The CPU does include undocumented opcodes, just like normal 6502 CPUs. +The NTSC NES runs at 1.7897725MHz, and 1.662607MHz for PAL. Which is pretty +fast for a 6502 compatible CPU, for example C64 used only 1MHz, and Atari 2600 +only 1.2MHz. + +Hardware Pin-Outs +----------------- + +Pin-Outs +--> Cartridge Pin-Outs +--> Cartridge Shell Dimensions +--> Controllers - Pin-Outs +--> Chipset Pin-Outs +--> NES Expansion Port + +Upgrading +--> Nocash SRAM Circuit + +Chipset Pin-Outs +---------------- + +2A03 Pin-Outs & Signal Description (CPU and APU) + Pin Name Dir Expl. + 1 ROUT Out Sound channel 1+2 output + 2 COUT Out Sound channel 3+4+5 output + 3 /RES In Resets several internal 2A03 registers, and the 6502. + 4-19 A0-15 Out Address Bus + 20 GND - Supply Ground + 21-28 D7-0 I/O Data Bus + 29 CLK In Master clock input (236,250/11 MHz), clocks an internal + divide-by-12 counter. + 30 ? In Normally grounded in NES/FC consoles, this pin has unknown + functionality. Might be an input controlling something, + since the pin does draw a little current. Or might be + simply some kind of shielding for the CLK signal? + 31 PHI2 Out Divide-by-12 result of the CLK signal (1.79 MHz). + The internal 6502 along with function generating hardware, + is clocked off this frequency, and is available externally + here so that it can be used as a data bus enable signal + (when at logic level 1) for external 6502 address decoder + logic. The signal has a 62.5% duty cycle. + 32 /IRQ In Interrupt Request (Low) + 33 /NMI In Non-Maskable Interrupt (on High-to-Low Transition) + 34 R/W Out Direction of 6502's data bus (0=Write/Out, 1=Read/In) + 35 /JOY2 Out Low if A0-A15=4017h, R/W=0, PHI2=1 + 36 /JOY1 Out Low if A0-A15=4016h, R/W=0, PHI2=1 + 37-39 J2-0 Out Bit2-0 of internal register 4016h (Bit0 = Joystick strobe) + 40 VCC - Supply +5VDC +On Playchoice 10, Pin 30 is called "/SPECIAL" (seems to be related to pausing +the CPU). On VS System, Pin 30 is called "NC" and is wired to GND. + +2C02 Pin-Outs & Signal Descriptions (PPU) + Pin Dir Name Expl + 1 In CPU R/W Direction when /CS=LOW + 2-9 I/O CPU D0-D7 Data when /CS=LOW + 10-12 In CPU A2-A0 Register Select when /CS=LOW + 13 In CPU /CS CPU read/write to/from PPU Registers + 14-17 I/O EXT0-EXT3 External Master/Slave Video signal (not used) + 18 In CLK 21.47727MHz NTSC, 26.601712MHz PAL + 19 Out /VBL NMI VBlank, LOW max 20 scanlines or until acknowledged + 20 In VEE GND Supply Ground + 21 Out VOUT Composite Video output + 22 In /SYNC EXT External Master /VBL for use by slave (not used) (*) + 23,24 Out PPU /W,/R Video memory Write/Read requests + 25-30 Out PPU A13-A8 Video memory MSB-address lines + 31-38 I/O PPU AD7-AD0 Video memory LSB-address and data lines + 39 Out PPU ALE Address Latch Enable, HIGH when A0-A7 output at AD0-AD7 + 40 In VCC +5VDC Supply +(*) On Famicom consoles, /SYNC EXT is always tied to logical one. On the NES +however, this pin is tied in with the 2A03's reset input, and as a result, the +picture is always disabled while the reset switch is held in on an NES. +On RGB PPUS (both Playchoice 10 and VS System ones), Pin 14-17,21,22 are +R,G,B,GND,/SYNC,/RST. + +NES Expansion Port +------------------ + +NES Expansion Port, 48-pins, (at bottom of console, rarely used) + Pin Dir Expl. + 1,48,2,47 Out VCC,VCC,GND,GND (Supply +5VDC and Ground) + 23 Out VDD voltage from external power supply (usually +10VDC) + 3 In AIN (Audio Input) + 21,22,23,24 Out VOUT, AOUT (Video and Audio Outputs) + 4,14,25-32 I/O CPU /NMI,/IRQ,D7,D6,D5,D4,D3,D2,D1,D0 + 5,24 Out CPU A15, CIC 4MHz + 6-10,38-42 I/O Cart Pin 51-55,20-16 + 43,44,45 Out OUT0, OUT1, OUT2 (Port 4016h Bit0-2 Outputs) + 34 and 37 Out PORT0-CLK (both pins) (CPU Read from Port 4016h) + 11 and 17 Out PORT1-CLK (both pins) (CPU Read from Port 4017h) + 35,12,33,13,36 In PORT0-0,1,2,3,4 (Port 4016h Bit0-3 Inverted Inputs) + 19,20,15,16,18 In PORT1-0,1,2,3,4 (Port 4017h Bit0-3 Inverted Inputs) + 46 - Unused + +Nocash SRAM Circuit +------------------- + +Step 1 - Basic Connection, NROM support (32K+8K), Horizontal Mirroring + ________ ________ ________ + VCC ---------|A13-A19 | VCC ------tmp-|A15-A18 | VCC -----tmp-|A13-A18 | + CPU A0-A12 --|A0-A12 | CPU A0-A14 ---|A0-A14 | PPU A0-A12 --|A0-A12 | + CPU D0-D7 ---|D0-D7 | CPU D0-D7 ----|D0-D7 | PPU D0-D7 ---|D0-D7 | + CPU /PRG ----|/CS | CPU /PRG -----|/CS | PPU A13 -tmp-|/CS | + LPT /LF -tmp-|/OE BIOS| LPT /SEL -----|/OE WRAM| PPU /R ------|/OE VRAM| + |________| CPU R/W ------|/WE | PPU /W ------|/WE | + ___ |________| |________| + VCC -|___|- CPU /RESET + CIC /RESET --cut-- CPU /RESET FLOPPY 5VDC ------- VCC (supply) + CIC /RESET --|<|-- CPU /RESET LPT GND ------- GND + LPT /INIT --|<|-- CPU /RESET PPU /A13 --tmp-- NES /VCS + LPT /STROBE --|<|-- CPU /NMI PPU A10 --tmp-- NES VA10 + CIC MODE --cut-- VCC (lockout) LPT BUSY ------- CPU OUT2 + CIC MODE ------- GND (no lockout) LPT D7 ------- EXP PORT0-1 + +At this stage, the console won't work if an external cartridge is inserted. + +Step 2 - Horizontal or Vertical Mirroring Control + ____ ____ + LPT D0 ----|OR \__|AND |_______ NES VA10 (out) PPU A10 --undo-- NES VA10 + PPU A10 ---|____/ |7411| + LPT D1 ----|OR \__| |__tmp__ VCC (third AND-input, used in Step 3) + PPU A11 ---|____/ |____| + +Step 3 - Internal Circuit Disable (Required for Internal Circuit only) + ____ ____ ___ + CPU /PRG --|OR \__ SLOT /PRG LPT /LF --|AND \__ CART VCC -|___|- LPT /LF + /CART -----|____/ LPT /SEL -|____/ VCC -|___|- LPT /SEL + PPU /R ----|OR \__ SLOT /R CART -----|NAND\__ /CART VCC -|___|- LPT D0 + /CART -----|____/ CART -----|____/ VCC -|___|- LPT D1 + CART ------|OR \__ VRAM /CS CPU A14 --|AND \__ SLOT A14 + PPU A13 ---|____/ CART -----|____/ NES /VCS --cut-- SLOT /VCS + /CART -----|OR \__ AND (Step 2) NES VA10 --cut-- SLOT VA10 + SLOT VA10 -|____/ CPU A14 --cut-- SLOT A14 + CART ------|OR \__ ____ CPU /PRG --cut-- SLOT /PRG + PPU /A13 --|____/ |AND \__ NES /VCS PPU /R --cut-- SLOT /R + SLOT /VCS -|OR \__|____/ VCC --undo-- AND (Step 2) + /CART -----|____/ PPU A13 -undo- VRAM /CS PPU /A13 --undo- NES /VCS + +Also allows to disable the internal circuit so that external cartridges can be +used when LPT cable is disconnected (or when LPT signals are all HIGH). + +Step 4 - UNROM (N*16K+8K) and CNROM (32K+N*8K) Bank Switching + __________ __________ ____ + LPT /LF ----|/CLKEN1 | LPT LF -----|/CLKEN1 | WRAM A14 --|____|-- VCC + CPU R/W ----|/CLKEN2 | CPU R/W ----|/CLKEN2 | WRAM A15 --|____|-- VCC + CPU /PRG ---|CLK | CPU /PRG ---|CLK | WRAM A16 --|____|-- VCC + CPU D0..3 --|D0..3 | CPU D0..3 --|D0..3 | LPT /LF ---|NAND\_ LPT LF + GND --------|/OE1 | CPU A14 ----|/OE1 | LPT /LF ---|____/ + GND --------|/OE2 74173| GND --------|/OE2 74173| LPT /SEL --|NAND\_ BIOS + GND --------|RST CNROM| GND --------|RST UNROM| LPT LF ----|____/ /OE + VRAM A13-16-|Q0..3 | WRAM A14-16-|Q0..2 | WRAM A15-A16 --undo-- VCC + |__________| |__________| VRAM A13-A16 --undo-- VCC + LPT /LF --undo-- BIOS /OE WRAM A14 --undo-- CPU A14 + +Step 5 - Optional 8bit high-speed upload connection + ____ ____ __________ + CPU A13 --|AND | CPU /PRG -|AND | ____ CPU D0-7--|Q0-7 D0-7|--LPT D0-7 + CPU A14 --|7411| CPU R/W --|7411| VCC-|NAND\__________|/OE1 /OE2|--LPT /SEL + CPU PHI2 -|____|-----------|____|-----|____/ 74541 |__________| + +The 1bit PORT0-1 connection is no longer used (may be disconnected if desired). + +Compatibility Notes +WRAM and VRAM are not write-protected, and may get overwritten by accidental +writes to ROM/VROM area, that applies also for writes to bank selection ports +(no problem for cartridges that handle bus-conflicts, it will simply replace +the value in RAM by the (same) written value). In NROM mode, bank selection +ports are not protected against accidental ROM-area writes. + +Soldering Notes +To reduce the amount of wires, the WRAM/VRAM chips can be stacked on top of the +internal 2K SRAMs with 1:1 connection for most pins, also the BIOS EPROM socket +can be stacked on the WRAM chip. +Optionally, the circuit could be connected externally to the cartridge slot +(with /RESET and /NMI connected to unused cartridge/expansion port pins), the +/CART and CART signals would be not required, Step 3 could be left out. + +Parts List + 2 SRAM WRAM/VRAM, min 32K/8K, recommended 128K/32K, max 128K/128K + 1 EPROM BIOS, 27C64 or similar, min 8K + 2 74LS32 quad 2-input OR gates + 1 74LS08 quad 2-input AND gates + 1 74LS00 quad 2-input NAND gates + 1 74LS11 triple 3-input AND gates + 2 74LS173 4-bit 3-state flip-flops + 1 74LS541 8-bit 3-state buffer/line driver + 8 10K pull-up resitors + 3 1N4148 diodes for /RESET and /NMI +Plus, eprom socket, optionally also sockets for all other chips, 100nF +capacitors for power supply of all chips, centronics printer cable, centronics +socket, wire, board, solder, eprom burner, etc. + +BIOS ROM-Image + 0000 85 04 48 8A 48 A9 19 8D FA FF A9 04 8D FB FF A2 + 0010 08 E0 00 D0 FC 68 AA 68 60 A9 00 06 04 69 03 8D + 0020 16 40 CA 40 8A 48 A9 3B 8D FA FF A9 04 8D FB FF + 0030 A2 08 E0 00 D0 FC 68 AA A5 04 60 24 0D 30 09 AD + 0040 16 40 4A 4A 26 04 CA 40 AD 00 60 85 04 A2 00 40 + 0050 20 24 04 A2 7E A0 04 24 0D 30 04 A2 8D A0 04 8E + 0060 FA FF 8C FB FF 8D FF FF A9 00 8D 01 20 8D 06 20 + 0070 8D 06 20 A2 00 A0 20 A9 01 85 04 4C 7B 04 AD 00 + 0080 60 8D 07 20 CA D0 FE 88 D0 FE 4C 1C 06 AD 16 40 + 0090 4A 4A 26 04 90 FE A5 04 8D 07 20 A9 01 85 04 CA + 00A0 D0 FE 88 D0 FE 4C 1C 06 20 24 04 A2 DC A0 04 24 + 00B0 0D 30 04 A2 EE A0 04 8E FA FF 8C FB FF 8D FF FF + 00C0 A0 BF A2 FF C9 FF D0 04 A0 FF A2 F9 8C FC 04 8C + 00D0 E2 04 E8 A0 40 A9 01 85 04 4C D9 04 AD 00 60 CA + 00E0 9D 00 FF D0 FE CE E2 04 88 D0 FE 4C 1C 06 AD 16 + 00F0 40 4A 4A 26 04 90 FE A5 04 CA 9D 00 FF A9 01 85 + 0100 04 E0 00 D0 FE CE FC 04 88 D0 FE 4C 1C 06 A2 00 + 0110 20 24 04 95 05 E8 E0 08 D0 F6 A2 00 B5 05 9D FA + 0120 FF E8 E0 06 D0 F6 A1 05 81 05 4C 2A 05 A2 55 A0 + 0130 AA 8E FE FF 8C FF FF EC FE FF D0 F5 CC FF FF D0 + 0140 F0 8C FE FF 8E FF FF CC FE FF D0 E5 EC FF FF D0 + 0150 E0 60 A2 00 BD 61 05 20 00 04 E8 BD 61 05 D0 F4 + 0160 60 4E 4F 24 4E 45 53 20 42 49 4F 53 20 56 31 2E + 0170 30 00 A9 00 85 0D 20 87 05 A9 80 85 0D 20 87 05 + 0180 F0 04 A9 00 85 0D 60 A2 00 A0 2B 20 24 04 DD A1 + 0190 05 F0 02 A0 2D E8 E0 08 D0 F1 98 20 00 04 C9 2B + 01A0 60 00 FF 55 AA 0F F0 3C C3 A9 57 20 00 04 A2 FF + 01B0 8D FF FF E8 8E 00 80 8E FF BF EC FF FF F0 06 E0 + 01C0 1F D0 F0 A2 01 E8 8A 20 00 04 60 A9 56 20 00 04 + 01D0 A2 40 A0 56 A9 00 8D 01 20 CA 8E FF FF 8D 06 20 + 01E0 8D 06 20 8C 07 20 8E 07 20 D0 EE A2 00 8E FF FF + 01F0 8D 06 20 8D 06 20 CD 07 20 CC 07 20 D0 0A EC 07 + 0200 20 D0 05 E8 E0 40 D0 E5 8A 20 00 04 60 20 2D 05 + 0210 20 52 05 20 72 05 20 A9 05 20 CB 05 A9 52 20 00 + 0220 04 20 24 04 C9 57 D0 03 4C A8 04 C9 56 D0 03 4C + 0230 50 04 C9 46 D0 03 4C 0E 05 4C 39 06 A2 00 BD 00 + 0240 E0 9D 00 04 BD 00 E1 9D 00 05 BD 00 E2 9D 00 06 + 0250 BD 00 E3 9D 00 07 E8 D0 E5 60 78 D8 A9 00 8D 00 + 0260 20 AD 02 20 A2 FF 9A 20 3C E2 4C 0D 06 FF FF FF + 0270 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF + .... FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF + 1FF0 FF FF FF FF FF FF FF FF FF FF 00 00 5A E2 00 00 +To be copied to the highest memory location, ie. E000h-FFFFh for a 64K EPROM. + +About Everynes +-------------- + +Everynes +Everything about NES and Famicom. +Nocash Technical Specifications written 2004 by Martin Korth. +Everynes Text and Html and Debugger versions and updates available at: + http://problemkaputt.de/nes.htm +I've originally written Everynes when collecting and sorting-out relevant info +for making the no$nes emulator/debugger. I've included a copy of the resulting +document in the debuggers help text, and also released raw txt/htm versions, +which may be eventually of some use to NES/Famicom programmers. + +Help welcome +Please let me know if you come across anything that is incomplete, incorrect, +or unclear. A couple of details (marked by question marks) are definetly +unclear to me - additional info would be very welcome! +My email address hides in no$nes.exe about box (for anti-spam reasons). + +Thanks & Credits +Most of the Everynes document is based on information from many other documents +found at nesdev.parodius.com - hoping that nobody gets angry about picking info +from his/her docs - I'd like to send many thanks to the authors of that great +documents, and to all people whom have contributed information to those docs, +complete list as far as known to me - many thangs to: + +(Feedback) +Thanks to Joe Lennox, and #nesdev on EFnet for Everynes corrections. + +MAPPERS.NFO +Comprehensive NES Mapper Document v0.80 by \Firebug\ +Thanks to FanWen, Y0SHi, D, Jim Geffre, Goroh, Paul Robson, Mark Knibbs. + +2A03TECH.TXT +2A03 technical reference by Brad Taylor +Thanks to Matthew Conte, Kentaro Ishihara, Goroh, Memblers, FluBBa, Izumi, +Chibi-Tech, Quietust, SnowBro, Bananmos, Kevin Horton, and many others for +their time and help on and off the NESdev mailing list, and the Membled +Messageboards. + +2C02TECH.TXT +NTSC 2C02 technical reference by Brad Taylor +Thanks to the NES community. http://nesdev.parodius.com. +Special thanks to Neal Tew for scrolling information. + +FDSTECH.TXT +Famicom Disk System Technical Reference by Brad Taylor. Special thanks to Nori, +Goroh, Ki, Sgt. Bowhack and "D". + +NESTECH2.TXT +Nintendo Entertainment System Documentation, Version: 2.00 +Alex Krasivsky +Andrew Davie +Avatar Z +Barubary +Bluefoot +CiXeL +Chi-Wen Yang +Chris Hickman +D +Dan Boris +David de Regt +Donald Moore +Fredrik Olsson +Icer Addis +Jon Merkel +Kevin Horton +Loopy +Marat Fayzullin +Mark Knibbs +Martin Nielsen +Matt Conte +Matthew Richey +Memblers +MiKael Iushin +Mike Perry +Morgan Johansson +Neill Corlett +Pat Mccomack +Patrik Alexandersson +Paul Robson +Ryan Auge +Stumble +Tennessee Carmel-Veilleux +Thomas Steen +Tony Young +Vince Indriolo +\FireBug\ + +FFPA.TXT +Famicom Four-Player Adapters Technical Document by Richard Hoelscher + +NES4PLAY.TXT +NES 4player-adapter documentation by Fredrik Olsson +Special thanks to: +Juan Antonio Gomez Galvarez +Yoshi +Marat Fayzulin +Morgan Johansson + +Pin-Outs +drk421 +Siudym'2001 + +6205BUGS.TXT +Ivo van Poorten + +NLOCKOUT.TXT +by Mark (Knipps?) + +VSDOC.TXT +VS Unisystem information version 1.0, by Fx3 + +PC10DOC.TXT +Nintendo Playchoice 10 Hardware Description by Oliver Achten + +NESGG.TXT +NES Game Genie Code Format DOC v0.71 by Benzene of Digital Emutations +Special thanks to Sardu, Opcode, Deuce, DrSplat, KingPin + +NESFQ.HTM +NES Tech FAQ by Chris Covell + +NES.HTM +Nintendo Entertainment System Architecture by Marat Fayzullin + Pascal Felber Patrick Lesaard Tink + Goroh Pan of Anthrox Bas Vijfwinkel + Kawasedo Paul Robson + Marcel de Kogel Serge Skorobogatov + Alex Krasivsky John Stiles + +KEYBOARD.TXT +Reverse Engineering the Keyboard of Family Computer +by goroh, english translation by Ki + +LIGHTGUN.TXT +Family Computer Gun +by goroh, english translation by Ki + +POWERPAD.TXT +Power Pad information Version: 1.2 (03/12/00) by Tennessee Carmel-Veilleux +Thanks to Jeremy D. Chadwick, Kevin Horton + +CPU +Project64, Graham + +The weird and wonderful CIC +Segher's rev-engineered instruction set for the CIC CPU. + +Index +----- + +--> Contents +--> No$nes Controls +--> XED Editor +--> XED About +--> XED Hotkeys +--> XED Assembler/Debugger Interface +--> XED Commandline based standalone version +--> No$nes Emulation Files +--> Tech Data +--> Memory Maps +--> I/O Map +--> Picture Processing Unit (PPU) +--> PPU Reset +--> PPU Control and Status Registers +--> PPU SPR-RAM Access Registers +--> PPU VRAM Access Registers +--> PPU Scrolling +--> PPU Tile Memory +--> PPU Background +--> PPU Sprites +--> PPU Palettes +--> PPU Dimensions & Timings +--> PPU 2C02 Timings +--> 3D Glasses +--> Audio Processing Unit (APU) +--> APU Channel 1-4 Register 0 (Volume/Decay) +--> APU Channel 1-4 Register 1 (Sweep) +--> APU Channel 1-4 Register 2 (Frequency) +--> APU Channel 1-4 Register 3 (Length) +--> APU Channel 5 - DMC Sound +--> APU Control and Status Registers +--> APU 4-bit DAC +--> APU Various +--> APU DMC-DMA Glitch +--> APU External Sound Channels +--> Controllers +--> Controllers - I/O Ports +--> Controllers - Pin-Outs +--> Controllers - Summary of Controller Types +--> Controllers - Summary of Controller Signals +--> Controllers - Detection +--> Controllers - Joypads +--> Controllers - Four-Player Adaptors +--> Controllers - Lightguns (Zapper) +--> Controllers - Paddles +--> Controllers - Push Buttons +--> Controllers - Typewriter Keyboards +--> Controllers - Piano Keyboards +--> Controllers - Piano - Miracle Piano Controller Port +--> Controllers - Piano - Miracle Piano MIDI Commands +--> Controllers - Piano - Miracle Piano Instruments +--> Controllers - Piano - Miracle Pinouts and Component List +--> Controllers - Keypads +--> Controllers - Mats +--> Controllers - Inflatable Controllers +--> Controllers - RacerMate Bicycle Training System +--> Controllers - Tablets +--> Controllers - Trackball and Mouse +--> Controllers - Power Glove +--> Controllers - Power Glove Transmission Protocol (RX/TX) +--> Controllers - Power Glove TX Packets (Configuration Opcodes) +--> Controllers - Power Glove RX Packets (Position/Sensor Data) +--> Controllers - Power Glove Games and Compatibilty Modes +--> Controllers - Power Glove Drawings +--> Controllers - Power Glove Pinouts +--> Controllers - UForce +--> Controllers - UForce I/O +--> Controllers - UForce Drawings +--> Controllers - UForce Games and Game Switches +--> Controllers - Barcode Readers +--> Controllers - Barcode Battler (barcode reader) +--> Controllers - Barcode Battler Transmission I/O +--> Controllers - Barcode Battler Drawings +--> Controllers - Barcode Formats +--> Controllers - Pachinko +--> Controllers - Microphones +--> Controllers - Reset Button +--> Controllers - Arcade Machines +--> Storage Data Recorder +--> Storage Turbo File +--> Storage Battle Box +--> Storage Battle Box I/O Access +--> Storage Battle Box Filesystem +--> Hori Game Repeater +--> Headphones +--> R.O.B. (Robotic Operating Buddy) +--> R.O.B. Technical Drawings +--> Cartridges and Mappers +--> Cartridge Overview +--> Cartridge ROM-Image File Formats +--> Cartridge IRQ Counters +--> Cartridge Bus Conflicts +--> Cartridge Cicurity Chip (CIC) (Lockout Chip) +--> Cartridge CIC Pseudo Code +--> Cartridge CIC Instruction Set +--> Cartridge CIC Notes +--> Cartridge CIC Versions +--> Cartridge CIC Pinouts +--> Cartridge CIC Tengen Clone +--> Cartridge Cheat Devices +--> Cartridge Pin-Outs +--> Cartridge Shell Dimensions +--> Mapper 0: NROM - No Mapper (or unknown mapper) +--> Mapper 1: MMC1 - PRG/32K/16K, VROM/8K/4K, NT +--> Mapper 2: UNROM - PRG/16K +--> Mapper 3: CNROM - VROM/8K +--> Mapper 4: MMC3 - PRG/8K, VROM/2K/1K, NT, SRAM, IRQ +--> Mapper 5: MMC5 - BANKING, IRQ, SOUND, VIDEO, MULTIPLY, etc. +--> Mapper 5: MMC5 - I/O Map +--> Mapper 5: MMC5 - CPU Memory Control +--> Mapper 5: MMC5 - Video Name Table +--> Mapper 5: MMC5 - Video Pattern Table +--> Mapper 5: MMC5 - Video Split and IRQ and Multiply Unit +--> Mapper 5: MMC5 - Video EXRAM +--> Mapper 5: MMC5 - Sound Control +--> Mapper 6,8,12,17: Front Far East (FFE) Configuration, IRQs, Patches +--> Mapper 6: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +--> Mapper ?: FFE F4xxx - PRG/16K, VROM/8K, NT, IRQ +--> Mapper 7: AOROM - PRG/32K, Name Table Select +--> Mapper 8: FFE F3xxx - PRG/32K, VROM/8K, NT, IRQ +--> Mapper 9: MMC2 - PRG/24K/8K, VROM/4K, NT, LATCH +--> Mapper 10: MMC4 - PRG/16K, VROM/4K, NT, LATCH +--> Mapper 11: Color Dreams - PRG/32K, VROM/8K +--> Mapper 12: FFE F6xxx - Not specified, NT, IRQ +--> Mapper 13: CPROM - 16K VRAM +--> Mapper 15: X-in-1 - PRG/32K/16K, NT +--> Mapper 16: Bandai - PRG/16K, VROM/1K, IRQ, EPROM +--> Mapper 17: FFE F8xxx - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 18: Jaleco SS8806 - PRG/8K, VROM/1K, NT, IRQ, EXT +--> Mapper 19: Namcot 106 - PRG/8K, VROM/1K/VRAM, IRQ, SOUND +--> Mapper 20: Disk System - PRG RAM, BIOS, DISK, IRQ, SOUND +--> Mapper 21: Konami VRC4A/VRC4C - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 22: Konami VRC2A - PRG/8K, VROM/1K, NT +--> Mapper 23: Konami VRC2B/VRC4E - PRG/8K, VROM/1K, NT, (IRQ) +--> Mapper 24: Konami VRC6A - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 25: Konami VRC4B/VRC4D - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 26: Konami VRC6B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 21-26,73,75,85: Konami VRC Mappers +--> Mapper 28: Action 53 homebrew X-in-1 +--> Mapper 32: Irem G-101 - PRG/8K, VROM/1K, NT +--> Mapper 33: Taito TC0190/TC0350 - PRG/8K, VROM/1K/2K, NT, IRQ +--> Mapper 34: Nina-1 - PRG/32K, VROM/4K +--> Mapper 40: FDS-Port - Lost Levels +--> Mapper 41: Caltron 6-in-1 +--> Mapper 42: FDS-Port - Mario Baby +--> Mapper 43: X-in-1 +--> Mapper 44: 7-in-1 MMC3 Port A001h +--> Mapper 45: X-in-1 MMC3 Port 6000hx4 +--> Mapper 46: 15-in-1 Color Dreams +--> Mapper 47: 2-in-1 MMC3 Port 6000h +--> Mapper 48: Taito TC190V +--> Mapper 49: 4-in-1 MMC3 Port 6xxxh +--> Mapper 50: FDS-Port - Alt. Levels +--> Mapper 51: 11-in-1 +--> Mapper 52: 7-in-1 MMC3 Port 6800h with SRAM +--> Mapper 56: Pirate SMB3 +--> Mapper 57: 6-in-1 +--> Mapper 58: X-in-1 +--> Mapper 61: 20-in-1 +--> Mapper 62: X-in-1 +--> Mapper 64: Tengen RAMBO-1 - PRG/8K, VROM/2K/1K, NT, IRQ +--> Mapper 65: Irem H-3001 - PRG/8K, VROM/1K, NT, IRQ +--> Mapper 66: GNROM - PRG/32K, VROM/8K +--> Mapper 67: Sunsoft3 - PRG/16K, VROM/2K, IRQ +--> Mapper 68: Sunsoft4 - PRG/16K, VROM/2K, NT-VROM +--> Mapper 69: Sunsoft5 FME-7 - PRG/8K, VROM/1K, NT ctrl, SRAM, IRQ +--> Mapper 70: Bandai - PRG/16K, VROM/8K, NT +--> Mapper 71: Camerica - PRG/16K +--> Mapper 72: Jaleco Early Mapper 0 - PRG-LO, VROM/8K +--> Mapper 73: Konami VRC3 - PRG/16K, IRQ +--> Mapper 74: Whatever MMC3-style +--> Mapper 75: Jaleco SS8805/Konami VRC1 - PRG/8K, VROM/4K, NT +--> Mapper 76: Namco 109 - PRG/8K, VROM/2K +--> Mapper 77: Irem - PRG/32K, VROM/2K, VRAM 6K+2K +--> Mapper 78: Irem 74HC161/32 - PRG/16K, VROM/8K +--> Mapper 79: AVE Nina-3 - VROM/8K +--> Mapper 80: Taito X-005 - PRG/8K, VROM/2K/1K, NT +--> Mapper 81: AVE Nina-6 +--> Mapper 82: Taito X1-17 - PRG/8K, VROM/2K/1K +--> Mapper 83: Cony +--> Mapper 84: Whatever +--> Mapper 85: Konami VRC7A/B - PRG/16K/8K, VROM/1K, NT, IRQ, SOUND +--> Mapper 86: Jaleco Early Mapper 2 - PRG/32K, VROM/8K +--> Mapper 87: Jaleco/Konami 16K VROM - VROM/8K +--> Mapper 88: Namco 118 +--> Mapper 89: Sunsoft Early - PRG/16K, VROM/8K +--> Mapper 90: Pirate MMC5-style +--> Mapper 91: HK-SF3 - PRG/8K, VROM/2K, IRQ +--> Mapper 92: Jaleco Early Mapper 1 - PRG-HI, VROM/8K +--> Mapper 93: 74161/32 - PRG/16K +--> Mapper 94: 74161/32 - PRG/16K +--> Mapper 95: Namcot MMC3-Style +--> Mapper 96: 74161/32 - PRG/32K, CHR/16K/4K, LATCH +--> Mapper 97: Irem - PRG HI +--> Mapper 99: VS Unisystem Port 4016h - VROM/8K, (PRG/8K) +--> Mapper 100: Whatever +--> Mapper 105: X-in-1 MMC1 +--> Mapper 112: Asder - PRG/8K, VROM/2K/1K +--> Mapper 113: Sachen/Hacker/Nina +--> Mapper 114: Super Games +--> Mapper 115: MMC3 Cart Saint +--> Mapper 116: Whatever +--> Mapper 117: Future +--> Mapper 118: MMC3 TLSROM - PRG/8K, VROM/2K/1K, Banked-NT, SRAM, IRQ +--> Mapper 119: MMC3 TQROM - PRG/8K, VROM/VRAM/2K/1K, NT, SRAM, IRQ +--> Mapper 122: Whatever +--> Mapper 133: Sachen +--> Mapper 151: VS Unisystem VRC1 or MMC3 Daughterboards +--> Mapper 152: Whatever +--> Mapper 160: Same as Mapper 90 +--> Mapper 161: Same as Mapper 1 +--> Mapper 168: RacerMate PRG/16K, VRAM/4K, IRQ +--> Mapper 180: Nihon Bussan - PRG HI +--> Mapper 182: Same as Mapper 114 +--> Mapper 184: Sunsoft - VROM/4K +--> Mapper 185: VROM-disable +--> Mapper 188: UNROM-reversed +--> Mapper 189: MMC3 Variant +--> Mapper 218: Nocash Single-Chip +--> Mapper 222: Dragon Ninja +--> Mapper 225: X-in-1 +--> Mapper 226: X-in-1 +--> Mapper 227: X-in-1 +--> Mapper 228: X-in-1 Homebrewn +--> Mapper 229: 31-in-1 +--> Mapper 230: X-in-1 plus Contra +--> Mapper 231: 20-in-1 +--> Mapper 232: 4-in-1 Quattro Camerica +--> Mapper 233: X-in-1 plus Reset +--> Mapper 234: Maxi-15 +--> Mapper 240: C&E/Supertone - PRG/32K, VROM/8K +--> Mapper 241: X-in-1 Education +--> Mapper 242: Waixing - PRG/32K, NT +--> Mapper 243: Sachen Poker - PRG/32K, VROM/8K +--> Mapper 244: C&E - PRG/32K, VROM/8K +--> Mapper 246: C&E - PRG/8K, VROM/2K, SRAM +--> Mapper 255: X-in-1 - (Same as Mapper 225) +--> Famicom Disk System (FDS) +--> FDS Memory and I/O Maps +--> FDS I/O Ports - Timer +--> FDS I/O Ports - Disk +--> FDS I/O Ports - Sound +--> FDS BIOS Disk Format +--> FDS BIOS Disk Functions +--> FDS BIOS Disk Errors +--> FDS BIOS Data Areas in WRAM +--> FDS Disk Drive Operation +--> VS System +--> VS System Controllers +--> VS System Games +--> VS System PPUs and Palettes +--> VS System Protections +--> Nintendo Playchoice 10 +--> PC10 Memory Map and I/O Ports +--> PC10 Video Circuit +--> PC10 Title/Instructions (INST ROM) +--> PC10 NES-Side +--> PC10 Games and Cartridge PCBs +--> PC10 Cabinet and BIOS Versions +--> PC10 Pin-Outs +--> Z80 CPU Specifications +--> Z80 Register Set +--> Z80 Flags +--> Z80 Instruction Format +--> Z80 Load Commands +--> Z80 Arithmetic/Logical Commands +--> Z80 Rotate/Shift and Singlebit Operations +--> Z80 Jumpcommands & Interrupts +--> Z80 I/O Commands +--> Z80 Interrupts +--> Z80 Meaningless and Duplicated Opcodes +--> Z80 Garbage in Flag Register +--> Z80 Compatibility +--> Z80 Pin-Outs +--> Z80 Local Usage +--> FamicomBox +--> FamicomBox Memory and I/O Maps +--> FamicomBox I/O Ports +--> FamicomBox Misc +--> FamicomBox Cartridges +--> FamicomBox ROM Header (at FFE0h) +--> FamicomBox Pinouts +--> Modems +--> Unpredictable Things +--> CPU 65XX Microprocessor +--> CPU Registers and Flags +--> CPU Memory Addressing +--> CPU Memory and Register Transfers +--> CPU Arithmetic/Logical Operations +--> CPU Rotate and Shift Instructions +--> CPU Jump and Control Instructions +--> CPU Illegal Opcodes +--> CPU Assembler Directives/Syntax +--> CPU Glitches +--> CPU The 65XX Family +--> CPU Local Usage +--> Hardware Pin-Outs +--> Chipset Pin-Outs +--> NES Expansion Port +--> Nocash SRAM Circuit +--> About Everynes diff --git a/retro-core/components/nofrendo/docs/nes-test-roms-master.zip b/retro-core/components/nofrendo/docs/nes-test-roms-master.zip new file mode 100644 index 000000000..643c8d40d Binary files /dev/null and b/retro-core/components/nofrendo/docs/nes-test-roms-master.zip differ diff --git a/retro-core/components/nofrendo/docs/nesmapper.txt b/retro-core/components/nofrendo/docs/nesmapper.txt new file mode 100644 index 000000000..d3891dc00 --- /dev/null +++ b/retro-core/components/nofrendo/docs/nesmapper.txt @@ -0,0 +1,1696 @@ +Bigass NES Mapper List 0.1 - This document is intended to serve as some sort +of master list for ROMs. For example, say you find something set to the +wrong mapper, but you have no idea where it should be - check here and save +yourself time. + +What it is - A damn near complete list of all the .NES format ROMs out there, + with a proverbial buttload of entries (don't feel like counting) + and mapper info for each. + +What it's not - Entirely complete. There's a rather large number of Japanese + ROMs missing from this list (Hi, Keropi!) but I don't feel + that their absence is that big of a deal, considering that + those particular ROMs are only in the hands of a -very- few + people. Consider this a complete list for "findable" ROMs. + Also, the mirroring info given isn't always to be trusted. + These just happen to be what mine are set on, so if one doesn't + work, flip it. + +Suggestions - If you have some suggestions for the list, mail me at the address + below. Should I divide these up into US/Japanese/Euro, or leave + it like it is? Also, what about FDS games - any use in adding + those? + +If you have any questions or whatnot, you can mail me at lugnut@hotmail.com + + +- + +Title Size Mirroring Mapper + +10 Yard Fight 32k PRG / 8k CHR H ---- (0) +10 Yard Fight (J) 16k PRG / 8k CHR H ---- (0) +100 In 1 - Contra Function 16 1024k PRG / 0k CHR V (15) +100 Kiyagyou 128k PRG / 128k CHR H MMC1 (1) +100 Man Doru Kid 256k PRG / 0k CHR H UNROM (2) +110 in 1 Menu 16k PRG / 8k CHR V ---- (0) +1200 In 1 512k PRG / 0k CHR H (227) +1942 (J) 32k PRG / 8k CHR H ---- (0) +1943 128k PRG / 0k CHR H UNROM (2) +1943 (J) 128k PRG / 0k CHR H UNROM (2) +1944 128k PRG / 0k CHR H UNROM (2) +1999 Hore Mitakotoka Sekimatsu 256k PRG / 128k CHR V MMC3 (4) +3D Worldrunner 256k PRG / 0k CHR V Nina-1 (34) +58 In 1 1024k PRG / 512k CHR H (225) +58 In 1 Menu 16k PRG / 8k CHR V ---- (0) +72 In 1 1024k PRG / 512k CHR H (225) +720 128k PRG / 0k CHR V MMC1 (1) +76 In 1 Menu 32k PRG / 0k CHR H ---- (0) +8 Eyes 128k PRG / 128k CHR H MMC3 (4) +8 Eyes (J) 128k PRG / 128k CHR H MMC3 (4) +'89 Dennou Hosi Uranai 256k PRG / 0k CHR H MMC1 (1) + + +A-Ressya De Ikou 128k PRG / 16k CHR H MMC1 (1) +Abadox 128k PRG / 128k CHR H MMC1 (1) +Abadox (J) 128k PRG / 128k CHR H MMC1 (1) +Abarenbou Tengu 128k PRG / 128k CHR H MMC3 (4) +Acchi Kocchi Socchi 128k PRG / 128k CHR H MMC1 (1) +Action 52 1536k PRG / 512k CHR H (228) +Addams Family, The 128k PRG / 128k CHR H MMC1 (1) +Addams Family 2, The (Pugsley) 128k PRG / 128k CHR H MMC1 (1) +Adventure Island 32k PRG / 32k CHR H CNROM (3) +Adventure Island 2 128k PRG / 128k CHR H MMC3 (4) +Adventure Island 3 128k PRG / 128k CHR H MMC3 (4) +Adventures in the Magic Kingdom 128k PRG / 128k CHR H MMC1 (1) +Adventures of Bayou Billy 128k PRG / 128k CHR V MMC1 (1) +Adventures of Bayou Billy (PAL) 128k PRG / 128k CHR H MMC1 (1) +Adventures of Captain Comic 64k PRG / 64k CHR V Colour Dreams (11) +Adventures of Dino-Riki 32k PRG / 32k CHR V CNROM (3) +Adventures of Lolo 32k PRG / 32k CHR H MMC1 (1) +Adventures of Lolo (J) 32k PRG / 32k CHR H MMC3 (4) +Adventures of Lolo 2 32k PRG / 32k CHR H MMC3 (4) +Adventures of Lolo 3 128k PRG / 128k CHR H MMC1 (1) +Adventures of Rad Gravity, The 128k PRG / 128k CHR H MMC1 (1) +Adventures of Rad Gravity (PAL) 128k PRG / 128k CHR H MMC1 (1) +Adventures of Rocky & Bullwinkle128k PRG / 120k CHR H MMC3 (4) <--missing 8k +Adventures of Tom Sawyer, The 128k PRG / 128k CHR V MMC1 (1) +Afterburner 2 (J) 128k PRG / 256k CHR V Sunsoft 4 (68) +Ai Sensei no Oshiete Watashi no Hosi 256k PRG / 128k CHR H Irem G-101 (32) +Aigiina no Yogen 128k PRG / 0k CHR V UNROM (2) +Air Fortress 128k PRG / 32k CHR H MMC1 (1) +Air Fortress (J) 128k PRG / 128k CHR H MMC1 (1) +Airwolf 32k PRG / 128k CHR H MMC1 (1) +Airwolf (PAL) 32k PRG / 128k CHR H MMC1 (1) +Akira 128k PRG / 256k CHR V MMC3 (4) +Akuma Kun 128k PRG / 128k CHR H Bandai (16) +Akuma no Shoutaijou 128k PRG / 128k CHR H MMC3 (4) +Akumajo Dracula 128k PRG / 0k CHR V UNROM (2) +Akumajo Dracula 3 256k PRG / 128k CHR V VRC6 (24) +Akumajo Dracula 3 [Hacked] 256k PRG / 128k CHR V Bandai (16) +Al Unser Jr's Turbo Racing 128k PRG / 128k CHR V MMC1 (1) +Alfred Chicken 128k PRG / 0k CHR H UNROM (2) +Algos no Senshi 128k PRG / 0k CHR V UNROM (2) +Alien 3 128k PRG / 128k CHR H MMC3 (4) +Alien Syndrome (J) 128k PRG / 128k CHR H MMC1 (1) +All Pro Basketball 128k PRG / 128k CHR V MMC1 (1) +Alpha Mission 32k PRG / 32k CHR H CNROM (3) +Altered Beast 128k PRG / 128k CHR H MMC3 (4) +Amagon 128k PRG / 0k CHR V UNROM (2) +America Oudan no Ultra Quiz 512k PRG / 0k CHR V MMC3 (4) +American Dream 128k PRG / 128k CHR H MMC1 (1) +American Gladiators 128k PRG / 128k CHR H MMC1 (1) +Ankoku Sinwa 256k PRG / 0k CHR H MMC1 (1) +Anpan Man no Hiragana Daisuki 128k PRG / 128k CHR H MMC3 (4) +Antarctic Adventure 16k PRG / 8k CHR H ---- (0) +Anticipation 32k PRG / 32k CHR H MMC1 (1) +Arabian Dream Sharezerd [hacked]256k PRG / 0k CHR V FFE F4xxx (6) +Arch Rivals 128k PRG / 0k CHR H AOROM (7) +Archon 128k PRG / 0k CHR H UNROM (2) +Arctic 128k PRG / 0k CHR V UNROM (2) +Argus 32k PRG / 16k CHR V CNROM (3) +Arkanoid 32k PRG / 8k CHR V ---- (0) +Armored Scrum Object 32k PRG / 32k CHR H CNROM (3) +Artelius 128k PRG / 32k CHR H MMC1 (1) +Asmikkun Land 128k PRG / 128k CHR V MMC3 (4) +Asterix (PAL) 128k PRG / 0k CHR V UNROM (2) +Astro Robo Sasa 32k PRG / 8k CHR V ---- (0) +Astyanax 128k PRG / 128k CHR H MMC3 (4) +Athena 128k PRG / 0k CHR V UNROM (2) +Athena (J) 128k PRG / 0k CHR V UNROM (2) +Athletic World 32k PRG / 32k CHR H CNROM (3) +Atlantis no Nazo 32k PRG / 24k CHR V MMC1 (1) +Attack Animal Gakuen 128k PRG / 0k CHR V UNROM (2) +Attack of the Killer Tomatoes 128k PRG / 128k CHR H MMC1 (1) +AV Pachi Slot 32k PRG / 64k CHR H CNROM (3) + + +B-Wings 32k PRG / 8k CHR H ---- (0) +Babel no Tou 32k PRG / 32k CHR H MMC3 (4) +Baby Boomer 64k PRG / 16k CHR V Colour Dreams (11) +Back to the Future 32k PRG / 8k CHR V ---- (0) <--bad dump +Back to the Future 2/3 128k PRG / 128k CHR V MMC1 (1) +Bad Dudes 128k PRG / 128k CHR H MMC3 (4) +Bad News Baseball 128k PRG / 128k CHR V MMC1 (1) +Bad Street Brawler 128k PRG / 0k CHR V MMC1 (1) +Baken Hissyougaku Gate-In 256k PRG / 0k CHR H MMC1 (1) +Bakusyou Jinsei Gekijyou 256k PRG / 128k CHR H TC0190 / TC0350 (33) +Bakusyou Jinsei Gekijyou 3 256k PRG / 256k CHR H MMC3 (4) +Ballblazer 128k PRG / 0k CHR V UNROM (2) +Balloon Fight 16k PRG / 8k CHR V ---- (0) +Balloon Fight (PAL) 16k PRG / 8k CHR H ---- (0) +Baltron 32k PRG / 8k CHR V ---- (0) +Banana 32k PRG / 32k CHR V CNROM (3) +Bananan no Ouiji Daibouken 128k PRG / 128k CHR H MMC3 (4) +Bandit Kings of Ancient China 256k PRG / 128k CHR H MMC5 (5) +Barbie 128k PRG / 128k CHR H MMC1 (1) +Bard's Tale, The 128k PRG / 0k CHR H MMC1 (1) <-- Possible bad dump? +Bard's Tale, The (J) 256k PRG / 0k CHR H MMC1 (1) +Bard's Tale 2, The 256k PRG / 0k CHR H MMC1 (1) +Barker Bill's Trick Shooting 64k PRG / 112k CHR H MMC1 (1) +Bart vs. the Space Mutants 128k PRG / 128k CHR V MMC1 (1) <-- perhaps missing 128k in the PRG +Bart vs. the World 256k PRG / 128k CHR H MMC3 (4) +Bartman Meets Radioactive Man 256k PRG / 128k CHR H MMC3 (4) +Base Wars 128k PRG / 128k CHR H MMC3 (4) +Baseball 16k PRG / 8k CHR H ---- (0) +Baseball (J) 16k PRG / 8k CHR H ---- (0) +Baseball Simulator 1000 128k PRG / 128k CHR V MMC1 (1) +Baseball Stars 128k PRG / 128k CHR V MMC1 (1) +Baseball Stars (J) 128k PRG / 128k CHR V MMC1 (1) +Baseball Stars 2 256k PRG / 128k CHR H MMC3 (4) +Bases Loaded 256k PRG / 64k CHR H MMC1 (1) +Bases Loaded 2 256k PRG / 128k CHR H MMC1 (1) +Bases Loaded 3 256k PRG / 128k CHR H MMC3 (4) +Bases Loaded 4 256k PRG / 128k CHR H MMC3 (4) +Batman 128k PRG / 128k CHR H MMC3 (4) +Batman (J) 128k PRG / 128k CHR H Sunsoft 5 (69) +Batman (PAL) 128k PRG / 128k CHR H MMC3 (4) +Batman - Return of the Joker 128k PRG / 256k CHR H Sunsoft 5 (69) +Batman Returns 128k PRG / 256k CHR V MMC3 (4) +Battle Chess 256k PRG / 0k CHR H MMC1 (1) +Battle City 16k PRG / 8k CHR H ---- (0) +Battle of Olympus, The 128k PRG / 0k CHR V MMC1 (1) +Battle Stadium 128k PRG / 128k CHR V MMC1 (1) +Battle Storm 128k PRG / 128k CHR V MMC1 (1) +Battletoads 256k PRG / 0k CHR H AOROM (7) +Battletoads (PAL) 256k PRG / 0k CHR H AOROM (7) +Battletoads / Double Dragon 256k PRG / 0k CHR H AOROM (7) +Batu and Teree 128k PRG / 0k CHR V UNROM (2) +Be-Bop High School 128k PRG / 128k CHR H MMC1 (1) +Bee 52 65k PRG / 0k CHR V Camerica (71) <-- Bad dump? +Beetlejuice 128k PRG / 0k CHR H AOROM (7) +Best of the Best 256k PRG / 0k CHR V UNROM (2) +Best Play Pro Yakyuu 128k PRG / 32k CHR V MMC1 (1) +Best Play Pro Yakyuu 2 256k PRG / 0k CHR H MMC1 (1) +Best Play Pro Yakyuu Special 256k PRG / 0k CHR H MMC1 (1) +Bible Adventures 64k PRG / 64k CHR V Colour Dreams (11) +Big Bird's Hide and Speak 256k PRG / 128k CHR H MMC1 (1) +Big Nose Freaks Out 256k PRG / 0k CHR V Camerica (71) +Bigfoot 128k PRG / 128k CHR H MMC1 (1) +Bikkuri Man World Gekitotu Sei Sensi 256k PRG / 0k CHR V MMC1 (1) +Bill and Ted's Excellent Adventure 128k PRG / 128k CHR H MMC1 (1) +Bill Elliot's NASCAR Challenge 128k PRG / 256k CHR H MMC3 (4) +Binary Land 16k PRG / 8k CHR H ---- (0) +Bio Senshi Dan 128k PRG / 128k CHR H 74161/32 (66) +Bionic Commando 256k PRG / 0k CHR V MMC1 (1) +Bird Week 16k PRG / 0k CHR V CNROM (3) +Birdy Rush 128k PRG / 128k CHR H MMC1 (1) +Black Bass, The 128k PRG / 0k CHR H UNROM (2) +Black Bass, The (J) 128k PRG / 0k CHR H UNROM (2) +Black Bass 2, The 128k PRG / 0k CHR H UNROM (2) +Blades of Steel 128k PRG / 0k CHR V UNROM (2) +Blades of Steel (PAL) 128k PRG / 0k CHR V UNROM (2) +Blaster Master 128k PRG / 128k CHR H MMC1 (1) +Blaster Master (PAL) 128k PRG / 128k CHR H MMC1 (1) +Bloody Warriors 256k PRG / 0k CHR V MMC1 (1) +Blue Marlin, The 128k PRG / 128k CHR H MMC3 (4) +Blue Shadow 128k PRG / 128k CHR H MMC3 (4) +Blue Train Satsujin Jiken 128k PRG / 256k CHR H Bandai (16) <--this is possibly + a hacked version, + since Irem made + the game. +Blues Brothers, The 128k PRG / 0k CHR V UNROM (2) +Bo Jackson Baseball 128k PRG / 184k CHR H MMC3 (4) +Bokosuka Wars 32k PRG / 8k CHR V ---- (0) +Boku Dracula Kun 128k PRG / 128k CHR V VRC2B (23) +Bomber King 128k PRG / 0k CHR V UNROM (2) +Bomberman (J) 16k PRG / 8k CHR V ---- (0) +Bomberman 2 (J) 128k PRG / 0k CHR V UNROM (2) +Booby Kids 128k PRG / 0k CHR H UNROM (2) +Boulder Dash 128k PRG / 128k CHR H MMC1 (1) +Boulder Dash (J) 32k PRG / 32k CHR H MMC1 (1) +Boy and His Blob, A 128k PRG / 128k CHR H MMC1 (1) +Breakthru 128k PRG / 128k CHR H MMC1 (1) +Brush Roller 16k PRG / 8k CHR V CNROM (3) +Bubble Bobble 128k PRG / 32k CHR H MMC1 (1) +Bubble Bobble (PAL) 128k PRG / 32k CHR H MMC1 (1) +Bubble Bobble 2 128k PRG / 128k CHR H MMC3 (4) +Bucky O' Hare 128k PRG / 128k CHR H MMC3 (4) +Bucky O' Hare (J) 128k PRG / 128k CHR H MMC3 (4) +Bucky O' Hare (PAL) 128k PRG / 128k CHR H MMC3 (4) +Buggy Popper 32k PRG / 32k CHR V CNROM (3) +Bugs Bunny's Crazy Castle 64k PRG / 32k CHR H MMC1 (1) +Bugs Bunny's Birthday Blowout 128k PRG / 128k CHR H MMC3 (4) +Bump N' Jump 32k PRG / 32k CHR H CNROM (3) +Burai Fighter 32k PRG / 32k CHR H MMC3 (4) +Burgertime (J) 16k PRG / 8k CHR H ---- (0) + + +Cabal 128k PRG / 0k CHR H AOROM (7) +Cadillac 32k PRG / 32k CHR H CNROM (3) +Caesar's Palace 256k PRG / 0k CHR H AOROM (7) +California Games 128k PRG / 0k CHR V UNROM (2) +Capcom Barcelona '92 128k PRG / 128k CHR H MMC3 (4) +Captain America and the Avengers128k PRG / 128k CHR H MMC3 (4) +Captain Ed 256k PRG / 0k CHR V MMC1 (1) +Captain Planet 128k PRG / 128k CHR H MMC3 (4) +Captain Silver 128k PRG / 128k CHR H MMC1 (1) +Captain Skyhawk 128k PRG / 0k CHR H AOROM (7) +Captain Tsubasa 128k PRG / 128k CHR V MMC1 (1) +Captain Tsubasa 2 256k PRG / 128k CHR V MMC3 (4) +Casino Kid 128k PRG / 0k CHR H UNROM (2) +Castelian 128k PRG / 0k CHR V UNROM (2) +Castelian (PAL) 128k PRG / 0k CHR V UNROM (2) +Castle Excellent 32k PRG / 32k CHR H CNROM (3) +Castle of Deceit 64k PRG / 64k CHR H Colour Dreams (11) +Castle of Dragon 128k PRG / 0k CHR V UNROM (2) +Castlequest (J) 128k PRG / 128k CHR H MMC3 (4) +Castlevania 128k PRG / 0k CHR V UNROM (2) +Castlevania 2 128k PRG / 128k CHR H MMC1 (1) +Castlevania 2 (PAL) 128k PRG / 128k CHR H MMC1 (1) +Castlevania 3 256k PRG / 128k CHR V MMC5 (5) +Catts Nintouden Teyandey 128k PRG / 128k CHR V MMC3 (4) +Caveman Games 128k PRG / 128k CHR H MMC1 (1) +Caveman Ninja 128k PRG / 128k CHR H MMC3 (4) +Chack N' Pop 16k PRG / 8k CHR H ---- (0) +Challenger 32k PRG / 8k CHR V ---- (0) +Championship Bowling (J) 32k PRG / 32k CHR H CNROM (3) +Championship Lode Runner 16k PRG / 8k CHR V ---- (0) +Championship Pool 128k PRG / 0k CHR V UNROM (2) +Chaos World 256k PRG / 128k CHR H MMC1 (1) +Chase HQ 128k PRG / 128k CHR H MMC3 (4) +Chester Field 128k PRG / 0k CHR V UNROM (2) +Chibi Marukochan Uki Uki Shopping 128k PRG / 128k CHR H MMC3 (4) +Chiller 32k PRG / 32k CHR V MMC1 (1) +Chip N' Dale - Rescue Rangers 128k PRG / 128k CHR H MMC1 (1) +Chip N' Dale - Rescue Rangers 2 128k PRG / 128k CHR H MMC1 (1) +Chip to Dale no Daisakusen 128k PRG / 128k CHR H MMC1 (1) +Chip to Dale no Daisakusen 2 128k PRG / 128k CHR H MMC1 (1) +Chiyo no Fuji 128k PRG / 128k CHR H MMC3 (4) +Choplifter 32k PRG / 16k CHR V CNROM (3) +Choujin Sentai Jetman 128k PRG / 128k CHR H MMC1 (1) +Choujin Ultra Baseball 128k PRG / 128k CHR V MMC1 (1) +Chubby Cherub 32k PRG / 16k CHR H CNROM (3) +Chugoku Jyansi Story Tonpuu 128k PRG / 128k CHR H MMC1 (1) +Chugoku Sensei Jyuutu 128k PRG / 0k CHR H UNROM (2) +Chuka Taisen 128k PRG / 128k CHR V MMC1 (1) +Circus Caper 128k PRG / 128k CHR V MMC1 (1) +Circus Charlie 16k PRG / 8k CHR V CNROM (3) +City Connection 32k PRG / 32k CHR V CNROM (3) +City Connection (J) 16k PRG / 16k CHR V CNROM (3) +Clash at Demonhead 128k PRG / 128k CHR H MMC1 (1) +Cliffhanger 128k PRG / 128k CHR H MMC3 (4) +Clu Clu Land 16k PRG / 16k CHR H CNROM (3) +Clu Clu Land disk-to-nes conv. 32k PRG / 8k CHR H -- (0) [uses .sav file to load] +Cobra Command 128k PRG / 128k CHR H MMC1 (1) +Cobra Command (J) 128k PRG / 128k CHR H MMC1 (1) +Cobra Triangle 128k PRG / 0k CHR H AOROM (7) +Cobra Triangle (PAL) 128k PRG / 0k CHR H AOROM (7) +Cocoron 256k PRG / 0k CHR V MMC1 (1) +Code Name Viper 128k PRG / 128k CHR H MMC3 (4) +Columbus Ougon no Yoake 128k PRG / 128k CHR V MMC3 (4) +Commando 256k PRG / 0k CHR H AOROM (7) +Conan 128k PRG / 0k CHR H UNROM (2) +Conflict 128k PRG / 128k CHR H MMC1 (1) <--bad dump +Conquest of the Crystal Palace 128k PRG / 128k CHR H MMC3 (4) +Contra 128k PRG / 0k CHR V UNROM (2) +Contra (J) 128k PRG / 128k CHR H VRC2b (23) +Contra Force 128k PRG / 128k CHR V MMC3 (4) +Cool World 128k PRG / 128k CHR H MMC1 (1) +Cosmic Epsilon 128k PRG / 256k CHR H MMC3 (4) +Cosmic Wars 128k PRG / 128k CHR H MMC1 (1) +Cosmo Genesis 32k PRG / 32k CHR H CNROM (3) +Cosmo Police Galivan 128k PRG / 128k CHR H MMC1 (1) +Crackout 128k PRG / 0k CHR H UNROM (2) +Crash N' The Boys 128k PRG / 128k CHR H MMC3 (4) +Crazy Climber 256k PRG / 0k CHR H Irem 74161/32 (97) +Crazy Climber [hacked] 256k PRG / 0k CHR H (15) +Crisis Force [hacked] 128k PRG / 128k CHR H MMC3 (4) +Crossfire 128k PRG / 128k CHR H MMC3 (4) +Crystal Mines 2 64k PRG / 16k CHR V Colour Dreams (11) +Crystalis 256k PRG / 128k CHR H MMC3 (4) +Cyberball 128k PRG / 128k CHR H MMC3 (4) +Cybernoid 32k PRG / 32k CHR V CNROM (3) + + +Dai Meiro 128k PRG / 128k CHR H MMC1 (1) +Dai Senryaku 128k PRG / 32k CHR V MMC1 (1) +Daikaijyuu Deburas 128k PRG / 256k CHR V MMC3 (4) +Daiku no Gensan 128k PRG / 128k CHR H MMC3 (4) +Daiku no Gensan 2 128k PRG / 128k CHR H Irem H3001 (65) +Daiva 128k PRG / 0k CHR V UNROM (2) +Dance Aerobics 64k PRG / 32k CHR H MMC1 (1) +Danny Sullivan's Indy Heat 128k PRG / 0k CHR H AOROM (7) +Dark Lord 256k PRG / 128k CHR V MMC3 (4) +Darkman 128k PRG / 128k CHR H MMC1 (1) +Darkwing Duck 128k PRG / 128k CHR V MMC1 (1) +Dash Galaxy in the Alien Asylum 32k PRG / 32k CHR H CNROM (3) +Dash Yarou 128k PRG / 0k CHR V UNROM (2) +Days of Thunder 128k PRG / 256k CHR H MMC3 (4) +Datach Dragonball Z 256k PRG / 0k CHR H Bandai (16) +Datsugoku 128k PRG / 128k CHR H MMC1 (1) +Day Dreamin' Davey 256k PRG / 128k CHR H MMC1 (1) +Deadly Towers 128k PRG / 0k CHR H Nina-1 (34) +Deblock 32k PRG / 32k CHR V CNROM (3) +Deep Dungeon 3 256k PRG / 0k CHR V MMC1 (1) +Deep Dungeon 4 256k PRG / 0k CHR V MMC1 (1) +Defender 2 16k PRG / 8k CHR V ---- (0) +Defender of the Crown 256k PRG / 0k CHR V MMC1 (1) +Defenders of Dynatron City 128k PRG / 128k CHR H MMC3 (4) +Deja Vu 128k PRG / 256k CHR H MMC3 (4) +Demon Sword 128k PRG / 128k CHR H MMC1 (1) +Dengeki Big Bang 128k PRG / 128k CHR H MMC1 (1) +Densetsu no Kisi Elrond 128k PRG / 0k CHR V AOROM (7) +Derby Stallion 128k PRG / 128k CHR V MMC1 (1) +Derby Stallion Zenkokuban 128k PRG / 128k CHR H MMC1 (1) +Desert Commander 128k PRG / 128k CHR V MMC1 (1) +Destiny of an Emperor 256k PRG / 0k CHR V MMC1 (1) +Devil World 16k PRG / 8k CHR H ---- (0) +Dezaemon 128k PRG / 0k CHR H MMC1 (1) +Dick Tracy 128k PRG / 0k CHR V UNROM (2) +Die Hard (J) 128k PRG / 128k CHR H MMC1 (1) +Dig Dug 16k PRG / 8k CHR H ---- (0) +Dig Dug 2 (J) 32k PRG / 8k CHR V ---- (0) +Digger T. Rock 128k PRG / 0k CHR H AOROM (7) +Dirty Harry 256k PRG / 128k CHR H MMC3 (4) +Dizzy The Adventurer 128k PRG / 0k CHR V Camerica (71) +Dodge Danpei 2 256k PRG / 256k CHR H Sunsoft 5 (69) +Donkey Kong 16k PRG / 8k CHR V ---- (0) +Donkey Kong 3 16k PRG / 8k CHR V ---- (0) +Donkey Kong Classics 32k PRG / 32k CHR V CNROM (3) +Donkey Kong Jr. 16k PRG / 8k CHR V ---- (0) +Donkey Kong Jr. Math 16k PRG / 8k CHR V ---- (0) +Donkey Kong Jr. Sansuu Asobi 16k PRG / 8k CHR V ---- (0) +Doki Doki Yuenchi 128k PRG / 128k CHR H MMC3 (4) +Dokugan Masamune [hacked] 256k PRG / 0k CHR V FFE F4xxx (6) +Don Doko Don 128k PRG / 256k CHR H TC0190/TC0350 (33) +Don Doko Don 2 128k PRG / 256k CHR V TC0190/TC0350 (33) +Donald Duck 128k PRG / 128k CHR H MMC1 (1) +Donald Land 128k PRG / 128k CHR H MMC1 (1) +Door Door 16k PRG / 8k CHR V ---- (0) +Doraemon Gigzombi no Gyakusyuu 256k PRG / 0k CHR H MMC1 (1) +Doraemon Kaitakuhen [hacked] 128k PRG / 32k CHR V FFE F3xxx (8) +Double Dare 256k PRG / 0k CHR H AOROM (7) +Double Dragon 128k PRG / 128k CHR H MMC1 (1) +Double Dragon (J) 128k PRG / 128k CHR H MMC1 (1) +Double Dragon (PAL) 128k PRG / 128k CHR H MMC1 (1) +Double Dragon 2 128k PRG / 128k CHR H MMC3 (4) +Double Dragon 2 (J) 128k PRG / 128k CHR V MMC3 (4) +Double Dragon 3 128k PRG / 128k CHR H MMC3 (4) +Double Dragon 3 (J) 128k PRG / 128k CHR V MMC3 (4) +Double Dragon 3 (PAL) 128k PRG / 128k CHR H MMC3 (4) +Double Dribble 128k PRG / 0k CHR V UNROM (2) +Double Strike 32k PRG / 32k CHR H AVE (79) +Doublemoon Densetsu 512k PRG / 0k CHR H MMC3 (4) +Dough Boy 32k PRG / 8k CHR V ---- (0) +Downtown Nekketsu Jidaigekidayo 128k PRG / 128k CHR H MMC3 (4) +Downtown Nekketsu Kousinkyoko 128k PRG / 128k CHR H MMC3 (4) +Downtown Nekketsu Monogatari 128k PRG / 128k CHR V MMC3 (4) +Dr. Chaos 128k PRG / 0k CHR V UNROM (2) +Dr. Jekyll and Mr. Hyde 128k PRG / 32k CHR H MMC1 (1) +Dr. Mario 32k PRG / 32k CHR H MMC1 (1) +Dr. Mario (PAL) 32k PRG / 32k CHR H MMC1 (1) +Dracula 128k PRG / 128k CHR H MMC3 (4) +Dracula (PAL) 128k PRG / 128k CHR H MMC3 (4) +Dragon Buster 128k PRG / 32k CHR H Namco 1xx (95) +Dragon Buster [hacked] 128k PRG / 32k CHR V MMC3 (4) +Dragon Buster 2 128k PRG / 64k CHR V MMC3 (4) +Dragon Fighter 128k PRG / 128k CHR H MMC1 (1) +Dragon Power 128k PRG / 32k CHR H 74161/32 (66) +Dragon Quest 32k PRG / 32k CHR V CNROM (3) +Dragon Quest 2 128k PRG / 0k CHR V UNROM (2) +Dragon Quest 3 256k PRG / 0k CHR V UNROM (2) +Dragon Quest 4 1024k PRG / 0k CHR V MMC1 (1) +Dragon Scroll [hacked] 256k PRG / 0k CHR V FFE F4xxx (6) +Dragon Slayer 4 128k PRG / 64k CHR V MMC3 (4) +Dragon Spirit 128k PRG / 128k CHR H MMC3 (4) +Dragon Spirit (J) 128k PRG / 128k CHR H Namco 118 (88) +Dragon Strike 256k PRG / 256k CHR H MMC3 (4) +Dragon Unit 128k PRG / 0k CHR V UNROM (2) +Dragon Warrior 64k PRG / 16k CHR H MMC1 (1) +Dragon Warrior 2 256k PRG / 0k CHR V MMC1 (1) +Dragon Warrior 3 512k PRG / 0k CHR H MMC1 (1) +Dragon Warrior 4 1024k PRG / 0k CHR H MMC1 (1) +Dragon Wars 256k PRG / 128k CHR V MMC3 (4) +Dragon's Lair 128k PRG / 0k CHR V UNROM (2) +Dragonball 128k PRG / 32k CHR V 74161/32 (66) +Dragonball [hacked] 128k PRG / 32k CHR V Nina-1 (34) +Dragonball 2 128k PRG / 128k CHR H Bandai (16) +Dragonball 3 128k PRG / 256k CHR H Bandai (16) +Dragonball Z 256k PRG / 256k CHR H Bandai (16) +Dragonball Z 2 256k PRG / 256k CHR V Bandai (16) +Dragonball Z 2 [hacked] 256k PRG / 256k CHR V FFE F8xxx (17) +Dragonball Z 3 256k PRG / 256k CHR V Bandai (16) +Dragonball Z 3 [hacked] 256k PRG / 256k CHR V FFE F8xxx (17) +Dragonball Z Gaiden 256k PRG / 256k CHR H Bandai (16) +Dragons of Flame 128k PRG / 128k CHR H MMC1 (1) +Dream Master 256k PRG / 256k CHR H Namcot 106 (19) +Drop Zone 32k PRG / 32k CHR V CNROM (3) +Duck 32k PRG / 8k CHR H ---- (0) +Duck Hunt 16k PRG / 8k CHR V ---- (0) +Ducktales 128k PRG / 0k CHR V UNROM (2) +Ducktales 2 128k PRG / 0k CHR V UNROM (2) +Dudes With Attitudes 32k PRG / 32k CHR V AVE (79) +Dungeon and Magic 128k PRG / 128k CHR V MMC1 (1) +Dungeon Kid 128k PRG / 0k CHR H MMC1 (1) +Dungeon Magic 128k PRG / 128k CHR V MMC1 (1) +Dusty Diamond All-Star Softball 128k PRG / 128k CHR H MMC1 (1) +Dynablaster 128k PRG / 0k CHR H MMC1 (1) +Dynamite Batman 2 128k PRG / 256k CHR H Sunsoft 5 (69) +Dynamite Batman 2 [Hacked] 128k PRG / 256k CHR H FFE F8xxx (17) +Dynamite Bowl 32k PRG / 32k CHR V CNROM (3) +Dynowarz 128k PRG / 128k CHR H MMC1 (1) + + +Earthbound 256k PRG / 256k CHR V MMC3 (4) +Eggerland 128k PRG / 32k CHR V MMC1 (1) +Egypt 32k PRG / 32k CHR H CNROM (3) +Elevator Action 32k PRG / 8k CHR H ---- (0) +Eliminator Boat Duel 128k PRG / 128k CHR V MMC1 (1) +Elite 128k PRG / 0k CHR H MMC1 (1) +Elysion 128k PRG / 128k CHR H MMC1 (1) +Emo Yan no 10 Bai Pro Yakyuu 128k PRG / 128k CHR V MMC1 (1) +Empire Strikes Back, The 256k PRG / 256k CHR H MMC3 (4) +Erika to Satoru no Yume Bouken 128k PRG / 128k CHR H MMC3 (4) +Erunaaku no Zaihou 128k PRG / 0k CHR V UNROM (2) +Esupa Boukentai 256k PRG / 0k CHR V UNROM (2) +Excitebike 16k PRG / 8k CHR V ---- (0) +Excitebike (PAL) 16k PRG / 8k CHR V ---- (0) +Exciting Rally 128k PRG / 128k CHR H MMC1 (1) +Exed Exes 32k PRG / 8k CHR H ---- (0) +Exerion 16k PRG / 8k CHR H ---- (0) +Exodus 128k PRG / 128k CHR V Colour Dreams (11) + + +F1 Built to Win 128k PRG / 128k CHR H MMC1 (1) +F1 Circus 256k PRG / 128k CHR H MMC3 (4) +F1 Hero 128k PRG / 128k CHR H MMC3 (4) +F1 Hero 2 128k PRG / 128k CHR H MMC3 (4) +F1 Race 16k PRG / 8k CHR V ---- (0) +F117A Stealth Fighter 256k PRG / 256k CHR H MMC3 (4) +F15 City War 32k PRG / 32k CHR V AVE (79) +Faibird 128k PRG / 128k CHR V MMC3 (4) +Famicom Jump 256k PRG / 128k CHR H Bandai (16) +Famicom Typing Tutor (Dr PC Jr) 32k PRG / 0k CHR H ---- (0) +Famicom Typing Tutor 2 32k PRG / 0k CHR H ---- (0) +Famicom Wars 128k PRG / 128k CHR H MMC4 (10) +Famicom Yakyuuban 128k PRG / 128k CHR V MMC1 (1) +Family BASIC 32k PRG / 16k CHR V CNROM (3) +Family Block 128k PRG / 32k CHR H 74161/32 (66) +Family Boxing 64k PRG / 64k CHR V MMC3 (4) +Family Circuit 128k PRG / 32k CHR V MMC3 (4) +Family Circuit '91 512k PRG / 256k CHR V Namcot 106 (19) +Family Fued 32k PRG / 128k CHR H MMC1 (1) +Family Jockey 32k PRG / 32k CHR H MMC3 (4) +Family Majyan 128k PRG / 64k CHR H MMC3 (4) +Family Majyan 2 128k PRG / 64k CHR H MMC3 (4) +Family Pinball 128k PRG / 64k CHR H MMC3 (4) +Family Quiz 128k PRG / 0k CHR V UNROM (2) +Family Stadium 64k PRG / 32k CHR V MMC3 (4) +Family Stadium '87 64k PRG / 32k CHR V MMC3 (4) +Family Stadium '88 128k PRG / 64k CHR V MMC3 (4) +Family Stadium '89 128k PRG / 64k CHR V MMC3 (4) +Family Stadium '90 128k PRG / 128k CHR H Namcot 106 (19) +Family Stadium '91 128k PRG / 128k CHR V MMC3 (4) +Family Stadium '92 128k PRG / 128k CHR V MMC3 (4) +Family Stadium '93 128k PRG / 128k CHR V MMC3 (4) +Family Stadium '94 128k PRG / 128k CHR V MMC3 (4) +Family Tennis 64k PRG / 64k CHR V MMC3 (4) +Family Trainer Running Stadium 32k PRG / 32k CHR H CNROM (3) +Fantastic Adventures of Dizzy, The [Aladdin vers.] 256k PRG / 0k CHR V Camerica (71) +Fantasy Zone (J) 128k PRG / 0k CHR H UNROM (2) +Faria 128k PRG / 128k CHR H MMC1 (1) +Faria (J) 128k PRG / 128k CHR V MMC1 (1) +Faxanadu 256k PRG / 0k CHR V MMC1 (1) +Faxanadu (J) 256k PRG / 0k CHR H UNROM (2) +FC Genjin 256k PRG / 128k CHR H MMC3 (4) +Felix the Cat 128k PRG / 128k CHR V MMC3 (4) +Fester's Quest 128k PRG / 128k CHR H MMC1 (1) +Field Combat 16k PRG / 8k CHR V ---- (0) +Fighting Golf 128k PRG / 128k CHR H MMC1 (1) +Final Fantasy 256k PRG / 0k CHR V MMC1 (1) +Final Fantasy (J) 256k PRG / 0k CHR V UNROM (2) +Final Fantasy 2 256k PRG / 0k CHR V UNROM (2) +Final Fantasy 3 512k PRG / 0k CHR V MMC3 (4) +Final Fantasy I/II 256k PRG / 0k CHR H MMC1 (1) <--should be 512k +Final Lap 128k PRG / 128k CHR V Namcot 106 (19) +Final Mission 128k PRG / 128k CHR H MMC1 (1) +Fire Emblem 256k PRG / 128k CHR H MMC2 (10) +Fire Emblem [hacked] 256k PRG / 128k CHR V MMC3 (4) +Fire Emblem Gaiden [hacked] 256k PRG / 128k CHR H MMC3 (4) +Firehawk 128k PRG / 0k CHR H Camerica (71) +Fist of the North Star 128k PRG / 0k CHR V UNROM (2) +Flappy 32k PRG / 8k CHR V ---- (0) +Fleet Commander 32k PRG / 32k CHR H CNROM (3) +Flintstones, The 128k PRG / 256k CHR H MMC3 (3) +Flintstones, The (PAL) 128k PRG / 256k CHR H MMC3 (3) +Flipull 32k PRG / 32k CHR V CNROM (3) +Flying Dragon 128k PRG / 0k CHR V UNROM (2) +Flying Hero 128k PRG / 0k CHR V UNROM (2) +Flying Warriors 128k PRG / 128k CHR H MMC1 (1) +Formation Z 16k PRG / 8k CHR H ---- (0) +Foton 128k PRG / 0k CHR H UNROM (2) +Four Card Games 32k PRG / 8k CHR V ---- (0) +Frankenstein 128k PRG / 128k CHR V MMC1 (1) +Freedom Force 128k PRG / 128k CHR H MMC1 (1) +Friday The 13th 32k PRG / 32k CHR V CNROM (3) +Front Line 16k PRG / 8k CHR H ---- (0) +Fusigi no Umi no Nadia 128k PRG / 128k CHR H MMC3 (4) +Fuzzical Fighter 128k PRG / 128k CHR V MMC3 (4) + + +Galaga (J) 16k PRG / 8k CHR H ---- (0) +Galaxian 16k PRG / 8k CHR H ---- (0) +Galaxy 5000 128k PRG / 128k CHR V MMC3 (4) +Galg 32k PRG / 8k CHR H ---- (0) +Gambler Jikochusin Ha 256k PRG / 0k CHR H MMC1 (1) +Gambler Jikochusin Ha 2 256k PRG / 0k CHR V MMC1 (1) +Game Genie 16k PRG / 8k CHR H ---- (0) +Ganbare Goemon [hacked] 256k PRG / 0k CHR V FFE F4xxx (6) +Ganbare Goemon 2 [hacked?] 128k PRG / 128k CHR V MMC3 (4) +Ganbare Goemon Gaiden 256k PRG / 256k CHR V VRC4 (25) +Ganbare Goemon Gaiden 2 256k PRG / 256k CHR V VRC4-2A (21) +Garfield 128k PRG / 32k CHR H MMC1 (1) +Gargoyle's Quest 2 128k PRG / 128k CHR H MMC3 (4) +Garou Densetsu Special 256k PRG / 256k CHR H PC-Cony (83) +Garou Densetsu Special [hacked] 256k PRG / 256k CHR H MMC3 (4) +Gauntlet 128k PRG / 64k CHR V MMC3 (4) +Gauntlet 2 128k PRG / 128k CHR H MMC3 (4) +Gauntlet 2 (PAL) 128k PRG / 128k CHR H MMC3 (4) +Gaurdian Legend, The 128k PRG / 0k CHR V UNROM (2) +Gaurdic Gaiden 128k PRG / 0k CHR V UNROM (2) +Gegege no Kitarou 32k PRG / 32k CHR V CNROM (3) +Gegege no Kitarou 2 128k PRG / 128k CHR H 74161/32 (70) +Gegege no Kitarou 2 [Hacked] 256k PRG / 0k CHR V FFE F4xxx (6) +Gekikame Ninjaden 128k PRG / 128k CHR H MMC1 (1) +Gekitotu 4 Kubattle 128k PRG / 0k CHR H UNROM (2) +Gekitou Pro Wrestling 128k PRG / 128k CHR V MMC1 (1) +Gekitou Stadium 128k PRG / 128k CHR V MMC1 (1) +Geimos 32k PRG / 8k CHR H ---- (0) +Gemfire 256k PRG / 256k CHR H MMC5 (5) +Genghis Khan 256k PRG / 0k CHR H MMC1 (1) +Genghis Khan (J) 256k PRG / 0k CHR V MMC1 (1) +Genpei Toumaden 128k PRG / 64k CHR H MMC3 (4) +George Foreman's KO Boxing 128k PRG / 256k CHR H MMC3 (4) +Getsufuu Maden 128k PRG / 128k CHR H VRC2b (23) +Ghostbusters 32k PRG / 32k CHR H CNROM (3) +Ghostbusters (J) 32k PRG / 32k CHR H CNROM (3) +Ghostbusters 2 128k PRG / 128k CHR H MMC1 (1) +Ghosts N' Goblins 128k PRG / 0k CHR V UNROM (2) +Ghoul School 128k PRG / 128k CHR V MMC1 (1) +GI Joe 128k PRG / 256k CHR H MMC3 (4) +GI Joe - The Atlantis Factor 128k PRG / 256k CHR H MMC3 (4) +Gilligan's Island 128k PRG / 0k CHR H UNROM (2) +Gimmick! 256k PRG / 128k CHR V Sunsoft 5 (69) +Ginga Eiyuu Densetsu 128k PRG / 128k CHR V MMC1 (1) +Ginga no Sannin 128k PRG / 0k CHR V UNROM (2) +Goal 256k PRG / 128k CHR H MMC1 (1) +God Slayer 256k PRG / 128k CHR H MMC3 (4) +Godzilla 128k PRG / 128k CHR H MMC1 (1) +Godzilla (J) 128k PRG / 128k CHR V MMC1 (1) +Godzilla 2 128k PRG / 128k CHR H MMC1 (1) +Gold Medal Challenge '92 128k PRG / 128k CHR H MMC3 (4) +Golf 16k PRG / 8k CHR V ---- (0) +Golf '92, The 128k PRG / 128k CHR H MMC1 (1) +Golf Grand Slam 128k PRG / 128k CHR H MMC1 (1) +Golf Open 128k PRG / 256k CHR H TC0190/TC0350 (33) +Golgo 13 128k PRG / 128k CHR H MMC1 (1) +Golgo 13 (J) 128k PRG / 128k CHR H MMC1 (1) +Golgo 13 - The Mafat Conspiracy 128k PRG / 128k CHR H MMC3 (4) +Golgo 13 - The Riddle of Icarus 128k PRG / 128k CHR H MMC3 (4) +Gomoku Narabe 16k PRG / 8k CHR V ---- (0) +Goonies, The 32k PRG / 16k CHR V CNROM (3) +Goonies 2, The 128k PRG / 0k CHR V UNROM (2) +Goonies 2, The (J) 128k PRG / 0k CHR V UNROM (2) +Gorby no Pipeline Daisakusen 32k PRG / 32k CHR H CNROM (3) +Gotcha 32k PRG / 32k CHR V CNROM (3) +Gozonji Yajikita Tindouchu 256k PRG / 128k CHR H MMC1 (1) +Gradius (J) 32k PRG / 32k CHR V CNROM (3) +Gradius 2 128k PRG / 128k CHR V VRC4 (25) +Grand Master 256k PRG / 128k CHR H MMC1 (1) +Great Deal 128k PRG / 0k CHR V MMC1 (1) +Great Tank 128k PRG / 128k CHR V MMC1 (1) +Gremlins 2 128k PRG / 256k CHR H MMC3 (4) +Guerilla War 128k PRG / 128k CHR H MMC1 (1) +Gumshoe 128k PRG / 32k CHR H 74161/32 (66) +Gunhed 128k PRG / 128k CHR V MMC1 (1) +Gunnac 128k PRG / 128k CHR V MMC3 (4) +Gunnac (J) 128k PRG / 128k CHR V MMC3 (4) +Gunsight 128k PRG / 128k CHR H MMC5 (5) +Gunsmoke 128k PRG / 0k CHR H UNROM (2) +Gunsmoke (PAL) 128k PRG / 0k CHR H UNROM (2) +Gyrodine 32k PRG / 8k CHR V ---- (0) +Gyruss 32k PRG / 32k CHR V CNROM (3) + + +Haja no Fuuin 128k PRG / 128k CHR V MMC1 (1) +Hana no Star Kaidou 128k PRG / 0k CHR V UNROM (2) +Hanjuku Hero 128k PRG / 0k CHR H UNROM (2) +Harlem Globetrotters 128k PRG / 128k CHR H MMC1 (1) +Hatris 128k PRG / 0k CHR H MMC1 (1) +Hatris (J) 128k PRG / 0k CHR V UNROM (2) +Heavy Barrel 128k PRG / 128k CHR H MMC3 (4) +Heavy Shreddin' 128k PRG / 128k CHR V MMC1 (1) +Hebereke 128k PRG / 128k CHR V Sunsoft 5 (69) +Hector '87 128k PRG / 0k CHR V UNROM (2) +Hello Kitty no Ohana Batake 32k PRG / 32k CHR V CNROM (3) +Hello Kitty World 128k PRG / 0k CHR V UNROM (2) +Hercules no Eikou 128k PRG / 0k CHR V UNROM (2) +Hercules no Eikou 2 256k PRG / 0k CHR V MMC1 (1) +Heroes of the Lance 128k PRG / 128k CHR H MMC1 (1) +Heroes of the Lance (J) 128k PRG / 128k CHR H MMC1 (1) +Hi no Tori 128k PRG / 0k CHR V UNROM (2) +Higemaru Makaijima 128k PRG / 0k CHR V UNROM (2) +High Speed 128k PRG / 64k CHR H TQROM (119) +High Speed (PAL) 128k PRG / 64k CHR H TQROM (119) +Highway Star 128k PRG / 0k CHR V UNROM (2) +Hillsfar (J) 256k PRG / 0k CHR H MMC1 (1) +Hirake Ponkikki 32k PRG / 32k CHR V MMC1 (1) +Hiryuu no Ken 128k PRG / 0k CHR V UNROM (2) +Hiryuu no Ken 2 128k PRG / 128k CHR H MMC1 (1) +Hiryuu no Ken 3 128k PRG / 128k CHR V MMC3 (4) +Hiryuu no Ken SP Fighting Wars 128k PRG / 128k CHR V MMC1 (1) +Hissatu Dojo Yaburi 256k PRG / 0k CHR H MMC1 (1) +Hissatu Sigotonin 256k PRG / 128k CHR H MMC3 (4) +Hittra no Fukkatu 256k PRG / 0k CHR H MMC1 (1) +Hogan's Alley 16k PRG / 8k CHR H ---- (0) +Hokuto no Ken 32k PRG / 32k CHR V CNROM (3) +Hokuto no Ken 2 128k PRG / 0k CHR V UNROM (2) +Hokuto no Ken 3 256k PRG / 0k CHR H MMC1 (1) +Hokuto no Ken 4 256k PRG / 0k CHR V MMC1 (1) +Hollywood Squares 256k PRG / 0k CHR H AOROM (7) +Holy Diver 128k PRG / 128k CHR H 74161/32 (78) +Home Alone 128k PRG / 104k CHR H MMC3 (4) <--Probably a bad dump. +Home Alone 2 128k PRG / 128k CHR H MMC3 (4) +Home Run Nighter 128k PRG / 128k CHR V MMC1 (1) +Home Run Nighter '90 128k PRG / 128k CHR V MMC3 (4) +Hook 128k PRG / 128k CHR H MMC1 (1) +Hook (J) 128k PRG / 128k CHR H MMC1 (1) +Hoops 128k PRG / 128k CHR V MMC1 (1) +Hosi no Kirby 512k PRG / 256k CHR H MMC3 (4) +Hosi wo Miruhito 128k PRG / 0k CHR V UNROM (2) +Hostages 128k PRG / 128k CHR V MMC1 (1) +Hot Slots 32k PRG / 64k CHR H CNROM (3) +Hototogisu 256k PRG / 0k CHR V MMC1 (1) +Hottaman no Titeitanken 32k PRG / 32k CHR V CNROM (3) +Houmaga Toki 128k PRG / 0k CHR V UNROM (2) +Hudson Hawk 128k PRG / 128k CHR V MMC1 (1) +Hunt For Red October, The 128k PRG / 128k CHR H MMC3 (4) +Hyaku no Sekai no Monogatari 128k PRG / 128k CHR V MMC1 (1) +Hyauti Super Igo 32k PRG / 32k CHR V CNROM (3) +Hydlide 32k PRG / 8k CHR H ---- (0) +Hydlide (J) 32k PRG / 8k CHR H ---- (0) +Hydlide 3 256k PRG / 128k CHR H Namcot 106 (19) +Hyokkori Hyoutan Jima 128k PRG / 128k CHR H MMC1 (1) +Hyper Olympic 16k PRG / 8k CHR V ---- (0) +Hyper Olympic - Tonosoma Edition32k PRG / 8k CHR V ---- (0) +Hyper Sports 16k PRG / 8k CHR V ---- (0) + + +I Love Softball 128k PRG / 128k CHR V MMC1 (1) +Ice Climber 16k PRG / 8k CHR H ---- (0) +Ice Climber (disk conversion) 32k PRG / 0k CHR H ---- (0) - (uses .sav file to load) +Ice Hockey 32k PRG / 8k CHR V ---- (0) +Ice Hockey (disk coversion) 32k PRG / 8k CHR V ---- (0) - (uses .sav file to load) +Idol Hakkenden 128k PRG / 128k CHR H MMC1 (1) +Idol Shisen Mahjongg 32k PRG / 64k CHR V CNROM (3) +Igo Sinan 32k PRG / 8k CHR H ---- (0) +Igo Sinan '91 128k PRG / 32k CHR H MMC1 (1) +Igo Sinan '93 128k PRG / 32k CHR H MMC1 (1) +Ikari Warriors 128k PRG / 0k CHR H UNROM (2) +Ikari Warriors (J) 128k PRG / 0k CHR H UNROM (2) +Ikari Warriors 2 256k PRG / 0k CHR V MMC1 (1) +Ikari Warriors 2 (J) 256k PRG / 0k CHR H UNROM (2) +Ikari Warriors 3 128k PRG / 128k CHR H MMC1 (1) +Ikari Warriors 3 (J) 128k PRG / 128k CHR H MMC1 (1) +Ike Ike Nekketsu Hockey 128k PRG / 128k CHR H MMC3 (4) +Ikinari Musician 32k PRG / 16k CHR V CNROM (3) +Ikki 16k PRG / 8k CHR V ---- (0) +Image Fight 128k PRG / 128k CHR H MMC3 (4) +Image Fight (J) 128k PRG / 128k CHR H Irem G101 (32) +Immortal, The 128k PRG / 256k CHR H MMC3 (4) +Impossible Mission 2 64k PRG / 64k CHR H Nina-1 (34) +Incredible Crash Dummies, The 128k PRG / 256k CHR H MMC3 (4) +Indiana Jones / Last Crusade 256k PRG / 0k CHR V MMC1 (1) +Indiana Jones / Temple of Doom 128k PRG / 128k CHR V MMC3 (4) +Indra no Hikari 128k PRG / 0k CHR H UNROM (2) +Infiltrator 128k PRG / 128k CHR H MMC3 (4) +Insector X 128k PRG / 128k CHR V TC0190/TC0350 (33) +International Cricket 128k PRG / 128k CHR H MMC1 (1) +Iron Tank 128k PRG / 128k CHR H MMC1 (1) +Isolated Warrior 128k PRG / 128k CHR H MMC3 (4) +Itadaki Street 128k PRG / 128k CHR H MMC1 (1) + + +J League - King of Ace Strikers 128k PRG / 128k CHR H MMC3 (4) +Jack Nicklaus Golf 128k PRG / 0k CHR V UNROM (2) +Jackal 128k PRG / 0k CHR V UNROM (2) +Jackie Chan 128k PRG / 128k CHR V MMC3 (4) +Jackie Chan's Action Kung-Fu 128k PRG / 128k CHR H MMC3 (4) +Jajamaru no Daibouken 32k PRG / 32k CHR V CNROM (3) +Jajamaru no Gekimaden 128k PRG / 128k CHR H SS8806 (18) +Jajamaru no Ginga Daisakusen 128k PRG / 128k CHR H SS8806 (18) +James Bond Jr. 128k PRG / 128k CHR H MMC3 (4) +James Bond Jr. (PAL) 128k PRG / 128k CHR H MMC3 (4) +Jarinko Chie 128k PRG / 256k CHR H VRC2b (23) +Jarvas 128k PRG / 128k CHR V MMC3 (4) +Jaws 32k PRG / 32k CHR H CNROM (3) +Jeopardy 128k PRG / 0k CHR V AOROM (7) +Jeopardy 25th Anniversary Ed. 128k PRG / 0k CHR H AOROM (7) +Jeopardy Jr. 128k PRG / 0k CHR H AOROM (7) +Jesus 256k PRG / 0k CHR V UNROM (2) +Jetsons, The 128k PRG / 256k CHR H MMC3 (4) +Jewelry 16k PRG / 8k CHR V ---- (0) +Jikuuyuuden Debias 128k PRG / 64k CHR V MMC3 (4) +Jimmy Connors Tennis 128k PRG / 0k CHR V UNROM (2) +Jimmy Connors Tennis (PAL) 128k PRG / 0k CHR V UNROM (2) +Joe and Mac 128k PRG / 128k CHR H MMC3 (4) +John Elway's Quarterback 32k PRG / 32k CHR V CNROM (3) +Jongbou 128k PRG / 0k CHR V UNROM (2) +Jordan vs Bird 128k PRG / 0k CHR V UNROM (2) +Journey to Silius 128k PRG / 128k CHR H MMC1 (1) +Joust 16k PRG / 8k CHR V ---- (0) +Jovei Quest 256k PRG / 256k CHR H Namcot 106 (19) +Joy Mecha Fight 256k PRG / 256k CHR V MMC3 (4) +Jumpin' Kid 128k PRG / 128k CHR H MMC3 (4) +Jungle Book, The 128k PRG / 128k CHR H MMC3 (4) +Jurassic Park 128k PRG / 128k CHR H MMC3 (4) +Just Breed 512k PRG / 256k CHR V MMC5 (5) +Jyanbou Ozaki no Hole-in-One 128k PRG / 32k CHR V MMC1 (1) + + +Kabuki Quantum Fighter 128k PRG / 128k CHR V MMC3 (4) +Kabusiki Doujyou 256k PRG / 0k CHR V MMC1 (1) +Kage 128k PRG / 128k CHR H MMC3 (4) +Kagerou Densetsu 128k PRG / 128k CHR V MMC3 (4) +Kaguya Hime Densetsu 256k PRG / 0k CHR H UNROM (2) +Kaijyu Monogatari [hacked] 128k PRG / 128k CHR H MMC3 (4) +Kaiketsu Yanchamaru Karakuri Land 2 [hacked] 128k PRG / 128k CHR V FFE F8xxx (17) +Kaiketsu Yanchamaru Karakuri Land 3 128k PRG / 128k CHR H Irem H3001 (65) +Kakefu-kun no Jump Tengoku 128k PRG / 0k CHR V UNROM (2) +Kame no Ongaesi 128k PRG / 128k CHR H MMC1 (1) +Kamen no Ninja Akakage 128k PRG / 0k CHR V UNROM (2) +Kamen no Ninja Hanamaru 128k PRG / 128k CHR H MMC1 (1) +Kamen Rider Club 128k PRG / 128k CHR H 74161/32 (70) +Kamen Rider SD 128k PRG / 128k CHR V MMC3 (4) +Karate Champ 32k PRG / 32k CHR H CNROM (3) +Karate Kid, The 32k PRG / 32k CHR V CNROM (3) +Karateka 16k PRG / 8k CHR V ---- (0) +Karnov 128k PRG / 128k CHR H MMC3 (4) +Karnov (J) 128k PRG / 64k CHR H MMC3 (4) +Kart Fighter 128k PRG / 256k CHR H MMC3 (4) +Katteni Sirokuma 128k PRG / 128k CHR H MMC1 (1) +Kawa no Nushi Tsuri 128k PRG / 128k CHR H MMC3 (4) +Keiba Honmei 128k PRG / 128k CHR H MMC3 (4) +Keisan Game Sansuu 2 32k PRG / 32k CHR V CNROM (3) +Keisan Game Sansuu 3 32k PRG / 16k CHR V CNROM (3) +Keisan Game Sansuu 4 32k PRG / 32k CHR V CNROM (3) +Keisan Game Sansuu 5/6 Nen 32k PRG / 32k CHR V CNROM (3) +Kero Kero Keroppi 32k PRG / 32k CHR H CNROM (3) +Kero Kero Keroppi 2 128k PRG / 128k CHR H MMC1 (1) +Keru Naguru 128k PRG / 128k CHR V MMC3 (4) +Kick Master 128k PRG / 128k CHR H MMC3 (4) +Kick Off 128k PRG / 0k CHR V UNROM (2) +Kickle Cubicle 128k PRG / 128k CHR H MMC3 (4) +Kid Icarus 128k PRG / 0k CHR V MMC1 (1) +Kid Klown 128k PRG / 128k CHR H MMC3 (4) +Kid Kool 128k PRG / 0k CHR V UNROM (2) +Kid Niki 256k PRG / 0k CHR H MMC1 (1) +King Kong 2 128k PRG / 128k CHR V MMC3 (4) +King of Kings 128k PRG / 128k CHR V Colour Dreams (11) +King of Kings (J - diff. game) 128k PRG / 128k CHR H MMC3 (4) +King's Knight 32k PRG / 32k CHR H CNROM (3) +King's Knight (J) 32k PRG / 32k CHR H CNROM (3) +King's Quest 5 256k PRG / 256k CHR V MMC3 (4) +Kings of the Beach 32k PRG / 32k CHR H CNROM (3) +Kinniku Man 16k PRG / 8k CHR V ---- (0) +Kirby's Adventure 512k PRG / 256k CHR H MMC3 (4) +Kiri no London Satsujin Jiken 256k PRG / 0k CHR H MMC1 (1) +Kiteretsu Daihyakka 128k PRG / 128k CHR H MMC1 (1) +Kiwi Kraze 128k PRG / 128k CHR H MMC3 (4) +Klash Ball 128k PRG / 0k CHR H UNROM (2) +Klax 64k PRG / 64k CHR H Rambo-1 (64) +Klax (J) 128K PRG / 64k CHR H MMC3 (4) +Knight Rider 64k PRG / 128k CHR H MMC1 (1) +Konami Sport in Soul 128k PRG / 128k CHR V MMC3 (4) +Koushien 128k PRG / 128k CHR V MMC1 (1) +Krazy Kreatures 32k PRG / 32k CHR V AVE (79) +Krion Conquest, The 128k PRG / 128k CHR H MMC3 (4) +Krusty's Fun House 256k PRG / 128k CHR H MMC3 (4) +Krusty's Fun House (PAL) 256k PRG / 128k CHR H MMC3 (4) +Kuja Kuou 256k PRG / 0k CHR V MMC1 (1) +Kuja Kuou 2 128k PRG / 128k CHR H MMC1 (1) +Kung-Fu 32k PRG / 8k CHR V ---- (0) +Kung-Fu Heroes 32k PRG / 32k CHR H CNROM (3) +Kureyon Shinchan 128k PRG / 128k CHR H Bandai (16) +Kurogane Hirosi no Keiba Densetu128k PRG / 128k CHR H MMC3 (4) +Kyoro-chan Land 128k PRG / 0k CHR H UNROM (2) +Kyoto Hana no Missutu Satsujin Jiken 128k PRG / 128k CHR V MMC3 (4) +Kyoto Sesupensu Misa Yamamura Satsujin Jiken 128k PRG / 128k CHR V MMC3 (4) +Kyuukyoku Stadium 128k PRG / 128k CHR H Taito X117 (82) +Kyuukyoko Harikiri Stadium 128k PRG / 256k CHR H Taito X117 (82) +Kyuukyoku Harikiri Stadium 3 128k PRG / 256k CHR H Taito X117 (82) +Kyuukyoku Tiger 128k PRG / 128k CHR V MMC3 (1) + + +L'Emperuer 256k PRG / 128k CHR H MMC5 (5) +Labyrinth 128k PRG / 0k CHR V UNROM (2) +Lagrange Point 512k PRG / 0k CHR H VRC7 (85) +Laser Invasion 128k PRG / 128k CHR H MMC5 (5) +Last Armageddon 512k PRG / 0k CHR V MMC3 (4) +Last Ninja, The 128k PRG / 128k CHR H MMC3 (4) +Last Starfighter, The 32k PRG / 32k CHR H CNROM (3) +Law of the West 128k PRG / 0k CHR H UNROM (2) +Layla 128k PRG / 0k CHR V UNROM (2) +Lee Trevino's Fighting Golf 128k PRG / 128k CHR H MMC1 (1) +Legacy of the Wizard 128k PRG / 64k CHR H MMC3 (4) +Legend of Kage, The (J) 32k PRG / 16k CHR H CNROM (3) +Legend of the Ghost Lion, The 128k PRG / 128k CHR H MMC1 (1) +Legend of Zelda, The 128k PRG / 0k CHR H MMC1 (1) +Legend of Zelda (-1 PRG Rev.) 128k PRG / 0k CHR H MMC1 (1) +Legendary Wings 128k PRG / 0k CHR V UNROM (2) +Legends of the Diamond 128k PRG / 256k CHR H MMC3 (4) +Lemmings 128k PRG / 128k CHR H MMC1 (1) +Life Force 128k PRG / 0k CHR V UNROM (2) +Linus Spacehead 256k PRG / 0k CHR V Camerica (71) +Linus Spacehead [Aladdin Ver.] 256k PRG / 0k CHR V Camerica (71) +Lion King, The 256k PRG / 0k CHR H AOROM (7) +Lipple Island 128k PRG / 0k CHR V UNROM (2) +Little League Baseball 128k PRG / 128k CHR H MMC1 (1) +Little Mermaid, The 128k PRG / 0k CHR V UNROM (2) +Little Mermaid, The (J) 128k PRG / 0k CHR V UNROM (2) +Little Nemo The Dream Master 128k PRG / 128k CHR H MMC3 (4) +Little Ninja Brothers 128k PRG / 128k CHR H MMC3 (4) +Lode Runner (J) 16k PRG / 8k CHR V ---- (0) +Lone Ranger, The 256k PRG / 128k CHR H MMC3 (4) +Loopz 128k PRG / 0k CHR H UNROM (2) +Lord of King, The 128k PRG / 128k CHR H SS8806 (18) +Lost Word of Jenny, The 128k PRG / 0k CHR V UNROM (2) +Lot Lot 32k PRG / 8k CHR H ---- (0) +Low G Man 128k PRG / 128k CHR H MMC3 (4) +Lunar Ball 16k PRG / 8k CHR V ---- (0) +Lupin 3rd Pandra Nolsan 128k PRG / 64k CHR V MMC3 (4) + + +Mach Rider 32k PRG / 8k CHR H ---- (0) +Macross 16k PRG / 8k CHR V ---- (0) +Mad City 128k PRG / 128k CHR H MMC1 (1) +Mad Max 128k PRG / 96k CHR H MMC3 (4) <--probably a bad dump +Mag Max 32k PRG / 32k CHR V CNROM (3) +Mag Max (J) 32k PRG / 8k CHR H ---- (0) +Magic Darts 128k PRG / 128k CHR H MMC1 (1) +Magic John 128k PRG / 128k CHR H SS8806 (18) +Magic Johnson's Fast Break 128k PRG / 128k CHR H MMC1 (1) +Magic of Scherezade, The 128k PRG / 128k CHR V MMC1 (1) +Magical Doropie 128k PRG / 128k CHR V MMC3 (4) +Magical Taruruto-Kun 128k PRG / 128k CHR H Bandai (16) +Magical Taruruto-Kun 2 128k PRG / 128k CHR H Bandai (16) +Magician 128k PRG / 128k CHR H MMC3 (4) +Magunamu Kikiipatu 128k PRG / 0k CHR V UNROM (2) +Maharaja 128k PRG / 128k CHR H Sunsoft 4 (68) +Mahou no Princess Minky Momo 128k PRG / 128k CHR V MMC1 (1) +Maijin Eiyuuden Wataru Gaiden 256k PRG / 0k CHR H MMC1 (1) +Maison Ikkoku 256k PRG / 0k CHR H UNROM (2) +Majaventure 128k PRG / 128k CHR H MMC1 (1) +Major League 128k PRG / 128k CHR V TC0190 / TC0350 (33) +Major League Baseball 32k PRG / 32k CHR V CNROM (3) +Majyan RPG Dora Dora Dora 128k PRG / 128k CHR H MMC1 (1) +Majyou Densetsu 2 128k PRG / 0k CHR V UNROM (2) +Makaimura 128k PRG / 0k CHR H UNROM (2) +Maniac Mansion 256k PRG / 0k CHR V MMC1 (1) +Maniac Mansion (J) 256k PRG / 0k CHR V UNROM (2) +Maniac Mansion (PAL) 256k PRG / 0k CHR H MMC1 (1) +Mappy 16k PRG / 8k CHR V ---- (0) +Mappy Kids 128k PRG / 128k CHR H Namcot 106 (19) +Mappy Land 128k PRG / 32k CHR H MMC3 (4) +Mappy Land (J) 128k PRG / 32k CHR V MMC3 (4) +Marble Madness 128k PRG / 0k CHR V AOROM (7) +Marble Madness (PAL) 128k PRG / 0k CHR H AOROM (7) +Mario Bros 16k PRG / 8k CHR V ---- (0) +Mario China 32k PRG / 32k CHR V CNROM (3) +Mario is Missing 128k PRG / 128k CHR H MMC3 (4) +Mario Open Golf 256k PRG / 0k CHR H MMC1 (1) +Mario's Time Machine 128k PRG / 128k CHR H MMC3 (4) +Marusa no Onna 128k PRG / 128k CHR H MMC1 (1) +Master Chu and the Drunkard Hu 32k PRG / 32k CHR H Colour Dreams (11) +Masuzoe Youiti no Asamade 512k PRG / 0k CHR H MMC3 (4) +Masyou 128k PRG / 0k CHR H Nina-1 (34) +Maten Douji 128k PRG / 128k CHR V MMC3 (4) +Matsumoto Tooru no Kabusiki Hissyougaku 256k PRG / 0k CHR V UNROM (2) +Matsumoto Tooru no Kabusiki Hissyougaku 2 256K PRG / 0k CHR V MMC1 (1) +Max Warrior 128k PRG / 128k CHR V MMC3 (4) +McKids 128k PRG / 128k CHR H MMC3 (4) +Mechanized Attack 64k PRG / 128k CHR H MMC1 (1) +Mega Man 128k PRG / 0k CHR V UNROM (2) +Mega Man 2 256k PRG / 0k CHR V MMC1 (1) +Mega Man 3 256k PRG / 128k CHR H MMC3 (4) +Mega Man 4 512k PRG / 0k CHR H MMC3 (4) +Mega Man 4 (PAL) 512k PRG / 0k CHR H MMC3 (4) +Mega Man 5 256k PRG / 256k CHR H MMC3 (4) +Mega Man 6 512k PRG / 0k CHR H MMC3 (4) +Megami Tensei 128k PRG / 128k CHR V MMC3 (4) +Megami Tensei 2 256k PRG / 256k CHR V Namcot 106 (19) +Meiji Ishin 256k PRG / 0k CHR H MMC1 (1) +Meikyu Jima 128k PRG / 128k CHR H Irem G101 (32) +Meikyu Kumikyoko 32k PRG / 32k CHR V CNROM (3) +Meimom Takonishi Ouendan 128k PRG / 128k CHR H MMC3 (4) +Meitantei Holmes 256k PRG / 0k CHR H MMC1 (1) +Meitantei Holmes Kori no London Satsujin Jiken 256k PRG / 0k CHR H UNROM (2) +Melville's Flame 128k PRG / 128k CHR V MMC1 (1) +Mendel Palace 128k PRG / 128k CHR V MMC3 (4) +Metal Fighter 32k PRG / 32k CHR H Colour Dreams (11) +Metal Flame Psybuster 128k PRG / 128k CHR V MMC1 (1) +Metal Gear 128k PRG / 0k CHR V UNROM (2) +Metal Gear (J) 128k PRG / 0k CHR H UNROM (2) +Metal Max 256k PRG / 256k CHR H MMC3 (4) +Metal Mech 128k PRG / 128k CHR V MMC1 (1) +Metal Slader Glory 512k PRG / 512k CHR V MMC5 (5) +Metal Storm 128k PRG / 256k CHR H MMC3 (4) +Metal Storm (J) 128k PRG / 256k CHR V MMC3 (4) +Metro Cross 32k PRG / 32k CHR V MMC3 (4) +Metroid 128k PRG / 0k CHR V MMC1 (1) +Mezase Top Pro 256k PRG / 128k CHR H SS8806 (18) +Mickey Mouse 32k PRG / 32k CHR V CNROM (3) +Mickey Mousecapade 32k PRG / 32k CHR V CNROM (3) +Micro Machines 256k PRG / 0k CHR V Camerica (71) +Micro Machines [Aladdin Ver.] 256k PRG / 0k CHR V Camerica (71) +Might and Magic 256k PRG / 256k CHR H MMC3 (4) +Might and Magic (J) 256k PRG / 256k CHR H MMC3 (4) +Mighty Bomb Jack (J) 32k PRG / 8k CHR H ---- (0) +Mighty Final Fight 128k PRG / 128k CHR H MMC3 (4) +Mighty Final Fight (J) 128k PRG / 128k CHR H MMC3 (4) +Mike Tyson's Punch-Out 128k PRG / 128k CHR V MMC2 (9) +Millipede 16k PRG / 8k CHR H ---- (0) +Milon's Secret Castle 32k PRG / 32k CHR V CNROM (3) +Mindseeker 128k PRG / 144k CHR H Namcot 106 (19) <--bad dump? +Minelvation Saga 128k PRG / 128k CHR H MMC3 (4) +Mini-Putt 128k PRG / 128k CHR H MMC1 (1) +Minnie no Talabou Nakayosi Daisakusen 32k PRG / 32k CHR H CNROM (3) +Miracle Piano System 256k PRG / 64k CHR H MMC1 (1) +Miracle Ropit's Adventure in 2100 128k PRG / 0k CHR V UNROM (2) +Mirai Sensei Lios 256k PRG / 0k CHR V MMC1 (1) +Mission Cobra 32k PRG / 16k CHR V Colour Dreams (11) +Mission Impossible 128k PRG / 128k CHR H MMC3 (4) +Mission Impossible (PAL) 128k PRG / 128k CHR H MMC3 (4) +Mitsume ga Tooru 128k PRG / 128k CHR V MMC3 (4) +Mizusima Senji no Dai Koushien 256k PRG / 0k CHR V MMC1 (1) +Moai Kun 32k PRG / 32k CHR V CNROM (3) +Mobile Suit Gundam Z (hacked) 256k PRG / 0k CHR H (15) +Moeru Oniisan 128k PRG / 128k CHR V MMC1 (1) +Moeru Pro Baseball '90 256k PRG / 128k CHR H SS8806 (18) +Momotarou Densetsu 256k PRG / 0k CHR H MMC1 (1) +Momotarou Densetsu Gaiden 512k PRG / 0k CHR H MMC3 (4) +Momotarou Dentetsu 256k PRG / 0k CHR V UNROM (2) +Money Game, The [Hacked] 256k PRG / 0k CHR H FFE F4xxx (6) +Money Game 2, The 128k PRG / 128k CHR H MMC1 (1) +Monopoly 128k PRG / 128k CHR H MMC1 (1) +Monopoly (J) 256k PRG / 0k CHR H MMC1 (1) +Monster In My Pocket 128k PRG / 128k CHR H MMC3 (4) +Monster In My Pocket (PAL) 128k PRG / 128k CHR H MMC3 (4) +Monster Maker 256k PRG / 0k CHR H MMC1 (1) +Monster Party 128k PRG / 128k CHR H MMC1 (1) +Moon Crystal 256k PRG / 256k CHR H MMC3 (4) +Morita no Shogi 128k PRG / 8k CHR H MMC1 (1) +Mortal Kombat 3 128k PRG / 512k CHR V PCJY?? (90) +Mother 256k PRG / 128k CHR H MMC3 (4) +Motocross Champion 128k PRG / 128k CHR H MMC1 (1) +Motor City Patrol 128k PRG / 128k CHR H MMC1 (1) +Mottono Abunai Deka 128k PRG / 0k CHR H UNROM (2) +Mouryou Senki Madara 256k PRG / 256k CHR V VRC6v (26) +Ms. Pac-Man 32k PRG / 8k CHR H ---- (0) +Mule 128k PRG / 0k CHR V MMC1 (1) +Muppets Adventure 128k PRG / 0k CHR V MMC1 (1) +Murder Club 128k PRG / 128k CHR V MMC3 (4) +Musashi no Bouken 128k PRG / 128k CHR V MMC1 (1) +Musashi no Ken 32k PRG / 32k CHR V CNROM (3) +MUSCLE 16k PRG / 32k CHR V CNROM (3) +My Life, My Love 256k PRG / 256k CHR H MMC3 (4) +Mystery Quest 32k PRG / 32k CHR V CNROM (3) + + +Nagagutu wo Haita Neko 32k PRG / 32k CHR V CNROM (3) +Naitou 9 Dan Shogi Hiden 16k PRG / 8k CHR H ---- (0) +Namco Classic 256k PRG / 256k CHR H Namcot 106 (19) +Nangoku Seirei Spy vs Spy 128k PRG / 0k CHR V UNROM (2) +Nantteta Baseball 128k PRG / 128k CHR H Sunsoft 4 (68) +NARC 128k PRG / 0k CHR H AOROM (7) +Navy Blue 128k PRG / 0k CHR H MMC1 (1) +Nekketsu Kakutou Densetsu 128k PRG / 128k CHR V MMC3 (4) +Nekketsu Kouha Kunio Kun 128k PRG / 0k CHR V UNROM (2) +Nekketsu Koukou Dodgeball 128k PRG / 128k CHR H MMC1 (1) +Nekketsu Koukou Soccer 128k PRG / 128k CHR V MMC3 (4) +NES Open Tournament Golf 256k PRG / 0k CHR H MMC1 (1) +NES Play Action Football 128k PRG / 128k CHR H MMC3 (4) +New Zealand Story, The 128k PRG / 128k CHR H MMC3 (4) +NFL Football 128k PRG / 0k CHR V UNROM (2) +Nightmare on Elm Street, A 128k PRG / 0k CHR H AOROM (7) +Nightshade 256k PRG / 256k CHR H MMC3 (4) +Niji no Silkroad 256k PRG / 128k CHR V MMC3 (4) +Ningen Heiki Dead Fox 128k PRG / 128k CHR V MMC3 (4) +Ninja Cop Saizou 128k PRG / 128k CHR H MMC1 (1) +Ninja Gaiden 128k PRG / 128k CHR H MMC1 (1) +Ninja Gaiden 2 128k PRG / 128k CHR H MMC3 (4) +Ninja Gaiden 3 128k PRG / 128k CHR H MMC3 (4) +Ninja Jajamaru Kun 32k PRG / 16k CHR V CNROM (3) +Ninja Kid 32k PRG / 32k CHR V CNROM (3) +Ninja Kun 16k PRG / 8k CHR V ---- (0) +Ninja Kun Asyura no Saiyou 128k PRG / 0k CHR V UNROM (2) +Ninja Rahoi 512k PRG / 0k CHR V MMC1 (1) +Ninja Ryukenden 128k PRG / 128k CHR V MMC1 (1) +Ninja Ryukenden 2 128k PRG / 128k CHR V MMC3 (4) +Ninja Ryukenden 3 128k PRG / 128k CHR H MMC3 (4) +Nintendo World Cup 128k PRG / 128k CHR H MMC3 (4) +Nintendo World Cup (PAL) 128k PRG / 128k CHR H MMC3 (4) +Noah's Ark 128k PRG / 128k CHR H MMC3 (4) +Nobunaga no Yabou Zenkokuban 256k PRG / 0k CHR V MMC1 (1) +Nobunaga's Ambition 256k PRG / 0k CHR H MMC1 (1) +Nobunaga's Ambition 2 256k PRG / 128k CHR H MMC5 (5) +North and South 128k PRG / 128k CHR H MMC3 (4) +Nuts and Milk 16k PRG / 8k CHR H ---- (0) +Nyankies 128k PRG / 128k CHR H MMC3 (4) + + +Obake no Qtarou 32k PRG / 8k CHR V ---- (0) +Obochama Kun 128k PRG / 128k CHR H MMC1 (1) +Ohotuku Ni Kiyu 256k PRG / 0k CHR V MMC1 (1) +Oishinbo 128k PRG / 128k CHR V MMC1 (1) +Olympus no Tatakai 128k PRG / 0k CHR V UNROM (2) +Onyanko Town 32k PRG / 8k CHR V ---- (0) +Operation Wolf 128k PRG / 128k CHR V MMC1 (1) +Orb 3D 64k PRG / 128k CHR V MMC1 (1) +Oryu San 32k PRG / 32k CHR H CNROM (3) +Osomatsu Kun 128k PRG / 128k CHR V MMC1 (1) +Otaku no Seiza 256k PRG / 128k CHR H MMC3 (4) +Othello (J) 32k PRG / 8k CHR V ---- (0) +Othello (Disk conversion) 32k PRG / 8k CHR H ---- (0) (Loads using .sav file) +Outlanders 128k PRG / 0k CHR V UNROM (2) +Over Horizon 128k PRG / 128k CHR H MMC3 (4) +Overlord 256k PRG / 0k CHR H MMC1 (1) + + +Pac-Land 32k PRG / 8k CHR V ---- (0) +Pac-Man 16k PRG / 8k CHR H ---- (0) +Pac-Man (Unlicensed Version) 16k PRG / 8k CHR J ---- (0) +Pac-Man (J) 16k PRG / 8k CHR H ---- (0) +Pachi Slot Adventure 2 128k PRG / 128k CHR V MMC3 (4) +Pachi Slot Adventure 3 128k PRG / 128k CHR H MMC3 (4) +Pachicom 32k PRG / 8k CHR H ---- (0) +Pachinko Daisakusen 128k PRG / 128k CHR V MMC1 (1) +Pachinko Daisakusen 2 128k PRG / 128k CHR H MMC1 (1) +Pachio Kun 2 256k PRG / 0k CHR V MMC1 (1) +Pachio Kun 3 256k PRG / 128k CHR H MMC3 (4) +Pachio Kun 4 512k PRG / 0k CHR H MMC3 (4) +Pachio Kun 5 (Pachio Kun Jr) 256k PRG / 128k CHR H MMC3 (4) +Palamedes (J) 32k PRG / 32k CHR H MMC1 (1) +Palamedes 2 32k PRG / 32k CHR V MMC1 (1) +Panic Restaurant 128k PRG / 128k CHR H MMC3 (4) +Paperboy 32k PRG / 32k CHR H CNROM (3) +Paperboy 2 256k PRG / 0k CHR H UNROM (2) +Parallel World 128k PRG / 128k CHR H MMC3 (4) +Parasol Henbei 128k PRG / 128k CHR H MMC3 (4) +Paris Dakar Rally [Hacked] 128k PRG / 32k CHR V FFE F3xxx (8) +Parman 128k PRG / 128k CHR H Irem G101 (32) +Parodius [Hacked] 128k PRG / 128k CHR H FFE F8xxx (17) +Parodius (PAL) 128k PRG / 128k CHR H MMC3 (4) +Parutena no Kagami 128k PRG / 0k CHR V MMC1 (1) +Peepar Time 32k PRG / 16k CHR H CNROM (3) +Penguin Kun Wars 32k PRG / 8k CHR V ---- (0) +Perfect Bowl 128k PRG / 32k CHR H MMC1 (1) +Pesterminator 64k PRG / 64k CHR V Colour Dreams (11) +Peter Pan and the Pirates 128k PRG / 128k CHR H MMC1 (1) +Phantom Fighter 256k PRG / 0k CHR V MMC1 (1) +Pictionary 128k PRG / 128k CHR V MMC1 (1) +Pinball 16k PRG / 8k CHR H ---- (0) +Pinball Quest 128k PRG / 128k CHR H MMC1 (1) +Pinbot 128k PRG / 56k CHR V TQROM (119) <--bad dump +Pinbot (PAL) 128k PRG / 64k CHR H TQROM (119) +Pipe Dream 32k PRG / 32k CHR V CNROM (3) +Pirates 128k PRG / 128k CHR H MMC1 (1) +Pizza Pop 128k PRG / 128k CHR H SS8806 (18) +Platoon 128k PRG / 128k CHR H MMC1 (1) +Plazma Ball 128k PRG / 128k CHR H SS8806 (18) +Pole to Finish 128k PRG / 128k CHR V MMC1 (1) +Poo-Yan 16k PRG / 8k CHR V ---- (0) +Pool of Radiance 512k PRG / 128k CHR V MMC3 (4) +Pool of Radiance (J) 512k PRG / 128k CHR V MMC3 (4) +Popeye 16k PRG / 8K CHR V ---- (0) +Popeye Eigo Asobi 16k PRG / 8k CHR V ---- (0) +Portpia Renzoku Satsujin Jiken 32k PRG / 8k CHR V ---- (0) +POW 128k PRG / 128k CHR H MMC1 (1) +Power Blade 128k PRG / 128k CHR H MMC3 (4) +Power Blade 2 128k PRG / 128k CHR H MMC3 (4) +Power Punch 2 128k PRG / 256k CHR H MMC3 (4) +Predator 128k PRG / 128k CHR V MMC1 (1) +President no Sentaku 256k PRG / 0k CHR H MMC1 (1) +Prince of Persia 128k PRG / 0k CHR V UNROM (2) +Prince Valiant 128k PRG / 128k CHR H MMC1 (1) +Princess Tomato in Salad Kingdom256k PRG / 0k CHR H MMC1 (1) +Pro Wrestling 128k PRG / 0k CHR V UNROM (2) +Pro Yakyuu Satsujin Jiken 256k PRG / 0k CHR V UNROM (2) +Probotector 128k PRG / 0k CHR V UNROM (2) +Probotector 2 128k PRG / 128k CHR H MMC3 (4) +Project Q 256k PRG / 0k CHR V MMC3 (4) +Punch-Out 128k PRG / 128k CHR V MMC2 (9) +Punch-Out Shohinban 128k PRG / 128k CHR H MMC2 (9) +Punisher, The 128k PRG / 128k CHR H MMC3 (4) +Puss N' Boots 128k PRG / 0k CHR V UNROM (2) +Puznic 32k PRG / 32k CHR V CNROM (3) +Puzslot 128k PRG / 128k CHR H MMC1 (1) +Puzzle 32k PRG / 32k CHR H CNROM (3) +Pyramid 32k PRG / 8k CHR V ---- (0) + + +Q-Bert 32k PRG / 32k CHR H CNROM (3) +Quarth 32k PRG / 32k CHR H CNROM (3) +Quattro Adventure 256k PRG / 0k CHR V Camerica (71) +Quattro Sports 256k PRG / 0k CHR V Camerica (71) +Quest of Kai, The 128k PRG / 64k CHR V MMC3 (4) +Quinty 128k PRG / 128k CHR H MMC3 (4) + + +Racket Attack 256k PRG / 128k CHR H MMC1 (1) +Race America 128k PRG / 128k CHR H MMC1 (1) +Rad Racer 128k PRG / 0k CHR H MMC1 (1) +Rad Racer (PAL) 128k PRG / 0k CHR H MMC1 (1) +Rad Racer 2 64k PRG / 64k CHR H MMC3 (4) +Radia Senki 256k PRG / 128k CHR V MMC3 (4) +Raf World 128k PRG / 128k CHR V MMC1 (1) +Raid 2020 64k PRG / 32k CHR V Colour Dreams (11) +Raid on Bungling Bay 16k PRG / 8k CHR V ---- (0) +Raid on Bungling Bay (J) 16k PRG / 8k CHR V ---- (0) +Rainbow Island 128k PRG / 0k CHR H UNROM (2) +Rambo 128k PRG / 0k CHR V UNROM (2) +Rambo (J) 128k PRG / 0k CHR V UNROM (2) +Rampage 128k PRG / 64k CHR H MMC3 (4) +Rampart 128k PRG / 128k CHR H MMC3 (4) +Rampart (J) 128k PRG / 0k CHR H UNROM (2) +Rasarulsii no Child's Quest 128k PRG / 64k CHR V MMC3 (4) +RBI Baseball 64k PRG / 128k CHR V MMC3 (4) +RBI Baseball 2 128k PRG / 128k CHR V MMC3 (4) +RBI Baseball 3 128k PRG / 64k CHR H MMC3 (4) +RC Pro-Am 32k PRG / 32k CHR H MMC1 (1) +RC Pro-Am (PAL) 32k PRG / 32k CHR H MMC1 (1) +RC Pro-Am 2 256k PRG / 0k CHR H AOROM (7) +Recca: Summer Carnival '92 128k PRG / 128k CHR H MMC3 (4) +Redalerma 2 128k PRG / 128k CHR V MMC3 (4) +Reigen Dousi 256k PRG / 0k CHR V MMC1 (1) +Remote Control 128k PRG / 128k CHR V MMC1 (1) +Ren and Stimpy: Buckaroo$ 128k PRG / 128k CHR H MMC3 (4) +Renegade 128k PRG / 0k CHR V UNROM (2) +Rescue: The Embassy Mission 128k PRG / 128k CHR H MMC1 (1) +Ring King 64k PRG / 128k CHR V MMC3 (4) +River City Ransom 128k PRG / 128k CHR H MMC3 (4) +Road Fighter 16k PRG / 8k CHR H ---- (0) +Road Man 128k PRG / 128k CHR V MMC1 (1) +Road Runner 64k PRG / 128k CHR H MMC3 (4) +Roadblasters 128k PRG / 128k CHR H MMC1 (1) +Robin Hood 256k PRG / 0k CHR H MMC1 (1) +Robocco Wars 256k PRG / 128k CHR H MMC3 (4) +Robocop 128k PRG / 128k CHR H MMC3 (4) +Robocop 2 128k PRG / 128k CHR V MMC1 (1) +Robocop 3 128k PRG / 128k CHR V MMC1 (1) +Robocop Vs Terminator 128k PRG / 128k CHR H MMC3 (4) +Robot Block (Stack-Up) 32k PRG / 8k CHR H ---- (0) +Robot Gyro (Gyromite) 32k PRG / 8k CHR V ---- (0) +Robowarrior 128k PRG / 0k CHR H UNROM (2) +Rock N' Ball 128k PRG / 64k CHR H MMC3 (4) +Rocket Ranger 256k PRG / 0k CHR H MMC1 (1) +Rocketeer, The 256k PRG / 0k CHR V MMC1 (1) +Rockin' Kats 128k PRG / 128k CHR H MMC3 (4) +Rockman 128k PRG / 0k CHR V UNROM (2) +Rockman 2 256k PRG / 0k CHR V MMC1 (1) +Rockman 3 256k PRG / 128k CHR V MMC3 (4) +Rockman 4 512k PRG / 0k CHR V MMC3 (4) +Rockman 5 256k PRG / 256k CHR H MMC3 (4) +Rockman 6 512k PRG / 0k CHR V MMC3 (4) +Roger Clemens MVP Baseball 128k PRG / 256k CHR H MMC3 (4) +Rollerball 128k PRG / 128k CHR H MMC1 (1) +Rollergames 128k PRG / 128k CHR H MMC3 (4) +Rolling Thunder 128k PRG / 128k CHR H MMC3 (4) +Rolling Thunder (J) 128k PRG / 256k CHR H Namcot 106 (19) +Romance of the Three Kingdoms 256k PRG / 0k CHR V MMC1 (1) +Romance of the Three Kingdoms 2 256k PRG / 256k CHR H MMC5 (5) +Romancia 128k PRG / 0k CHR V MMC1 (1) +Roundball 128k PRG / 128k CHR H MMC3 (4) +Route 16 Turbo 32k PRG / 8k CHR H ---- (0) +RPG Life Game 256k PRG / 128k CHR H MMC3 (4) +Rush N' Attack 128k PRG / 0k CHR V UNROM (2) +Rush N' Attack (PAL) 128k PRG / 0k CHR V UNROM (2) +Rygar 128k PRG / 0k CHR V UNROM (2) + + +Sabaku no Kitune 128k PRG / 128k CHR V MMC1 (1) +Saint Seiya [hacked] 256k PRG / 0k CHR V FFE F4xxx (6) +Saint Seiya 2 [hacked?] 128k PRG / 128k CHR H MMC1 (1) +Saiyuuki World 128k PRG / 0k CHR V UNROM (2) +Saiyuuki World 2 [Hacked] 128k PRG / 128k CHR V FFE F8xxx (17) +Sakigake Otoko Jyuku 128k PRG / 128k CHR H Bandai (16) +Salamander 128k PRG / 0k CHR V UNROM (2) +Sanada Jyuuyuusi 128k PRG / 128k CHR H MMC1 (1) +Sangokusi 256k PRG / 0k CHR V MMC1 (1) +Sangokusi Chugen no Hasya 128k PRG / 128k CHR V Namcot 106 (19) +Sangokusi Chugen no Hasya 2 [Hacked] 256k PRG / 256k CHR H TC190V (48) +Sanma no Meitantei 128k PRG / 64k CHR H MMC3 (4) +Sanrio Carnival 32k PRG / 32k CHR V CNROM (3) +Sanrio Cup Ponpon Bare 32k PRG / 32k CHR V CNROM (3) +Sansa-Rana-Ga 256k PRG / 128k CHR V MMC3 (4) +Sarada no Kuni no Tomato Hime 256k PRG / 0k CHR V MMC1 (1) +Satomi Hakkenden 128k PRG / 128k CHR V MMC1 (1) +SCAT 128k PRG / 128k CHR H MMC1 (1) +SD Gundam Gachapon Senshi 2 128k PRG / 128k CHR V MMC3 (4) +SD Gundam Gachapon Senshi 3 128k PRG / 128k CHR H MMC3 (4) +SD Gundam Gachapon Senshi 4 256k PRG / 256k CHR V MMC3 (4) +SD Gundam Gachapon Senshi 5 128k PRG / 128k CHR V MMC3 (4) +SD Gundam Knight Story 256k PRG / 128k CHR H Bandai (16) +SD Gundam Knight Story 2 256k PRG / 256k CHR H Bandai (16) +SD Gundam Knight Story 3 256k PRG / 256k CHR V Bandai (16) +SD Hatori Daisakusen 128k PRG / 128k CHR H MMC3 (4) +SD Hero Soukessen 128k PRG / 128k CHR H MMC3 (4) +SD Keiji Blader 128k PRG / 128k CHR H Taito X117 (82) +SD Sengoku Busyou Retsuden 128k PRG / 128k CHR H MMC3 (4) +Section Z 128k PRG / 0k CHR V UNROM (2) +Seicross 32k PRG / 8k CHR V ---- (0) +Seicross (J) 32k PRG / 8k CHR V ---- (0) +Seikima 2 32k PRG / 32k CHR H CNROM (3) +Seirei Densetsu Lickle 256k PRG / 128k CHR H MMC3 (4) +Seirei Gari 256k PRG / 0k CHR V UNROM (2) +Sekiryuu Ou 128k PRG / 128k CHR H MMC1 (1) +Senjou no Ookami 128k PRG / 0k CHR H UNROM (2) +Sesame Street 123/ABC 128k PRG / 128k CHR H MMC1 (1) +Sesame Street ABC 32k PRG / 32k CHR H MMC1 (1) +Shadow Brain 128k PRG / 256k CHR V MMC3 (4) +Shadow of the Ninja 128k PRG / 128k CHR H MMC3 (4) +Shadow Warrior 128k PRG / 128k CHR H MMC1 (1) +Shadowgate 128k PRG / 128k CHR H MMC3 (4) +Shadowgate (J) 128k PRG / 128k CHR H MMC3 (4) +Shadowgate (Swedish) 128k PRG / 128k CHR H MMC3 (4) +Shaffle Fight 256k PRG / 0k CHR H MMC3 (4) +Shancara 128k PRG / 128k CHR V MMC3 (4) +Shanghai 128k PRG / 0k CHR H UNROM (2) +Shanghai 2 128k PRG / 0k CHR V UNROM (2) +Shatterhand 128k PRG / 128K CHR H MMC3 (4) +Sherlock Holmes 128k PRG / 0k CHR H UNROM (2) +Shikin Jyou 128k PRG / 0k CHR H MMC1 (1) +Shin Satomi Hakkenden 256k PRG / 0k CHR H MMC1 (1) +Shingen The Ruler 256k PRG / 0k CHR H MMC1 (1) +Shinobi 128k PRG / 128k CHR H Rambo-1 (64) +Shinsenden 256k PRG / 0k CHR V MMC1 (1) +Shisen Mahjong Seifukuhen 32k PRG / 64k CHR H CNROM (3) +Shogun 128k PRG / 0k CHR H MMC1 (1) +Shonen Ashibe 128k PRG / 128k CHR V MMC3 (4) +Shufflepuck Cafe 128k PRG / 0k CHR H UNROM (2) +Side Pocket 128k PRG / 0k CHR H UNROM (2) +Side Pocket (J) 128k PRG / 32k CHR H MMC3 (4) +Sijyou Saidai Quiz ou Ketteisen 128k PRG / 0k CHR V MMC1 (1) +Silent Assault 64k PRG / 64k CHR H Colour Dreams (11) +Silent Service 128k PRG / 0k CHR V UNROM (2) +Silent Service (PAL) 128k PRG / 0k CHR V UNROM (2) +Silkworm 128k PRG / 128k CHR V MMC1 (1) +Silva Saga 256k PRG / 256k CHR H MMC3 (4) +Silver Surfer 128k PRG / 256k CHR H MMC3 (4) +Sinjinrui 32k PRG / 32k CHR V CNROM (3) +Skate or Die 128k PRG / 0k CHR V UNROM (2) +Skate or Die 2 256k PRG / 128k CHR V MMC1 (1) +Ski or Die 128k PRG / 128k CHR H MMC1 (1) +Sky Destroyer 16k PRG / 8k CHR H ---- (0) +Sky Kid 32k PRG / 64k CHR H MMC1 (1) +Sky Kid (J) 32k PRG / 32k CHR V MMC3 (4) +Sky Shark 64k PRG / 128k CHR H MMC1 (1) +Slalom 32k PRG / 8k CHR H ---- (0) +Slalom (PAL) 32k PRG / 8k CHR H ---- (0) +Smash Ping Pong (Disk Conv.) 32k PRG / 16k CHR H CNROM (3) (uses .sav file to load) +Smash TV 128k PRG / 112k CHR H MMC3 (4) <--probably an incomplete dump +SMB / Duck Hunt / WC Track Meet 128k PRG / 64k CHR H MMC1 (1) +SMB / Tetris / Nint. World Cup 64k PRG / 128k CHR H MMC3 (4) +Snake Rattle N' Roll 32k PRG / 32k CHR H MMC1 (1) +Snake Rattle N' Roll (PAL) 32k PRG / 32k CHR H MMC1 (1) +Snake's Revenge 128k PRG / 128k CHR H MMC1 (1) +Snoopy's Magic Show 128k PRG / 128k CHR V MMC1 (1) +Snow Bros 128k PRG / 128k CHR H MMC1 (1) +Soap Panic 32k PRG / 32k CHR V CNROM (3) +Soccer 32k PRG / 8k CHR H ---- (0) +Soccer (Disk Conversion) 32k PRG / 8k CHR H ---- (0) (uses a .sav to load) +Softball Tengoku 128k PRG / 128k CHR H MMC1 (1) +Solar Jetman 256k PRG / 0k CHR H AOROM (7) +Solar Jetman (PAL) 256k PRG / 0k CHR H AOROM (7) +Solomon no Kagi 32k PRG / 32k CHR H CNROM (3) +Solomon no Kagi 2 128k PRG / 128k CHR V MMC3 (4) +Solomon's Key 32k PRG / 32k CHR H CNROM (3) +Solstice 128k PRG / 0k CHR H AOROM (7) +Solstice (J) 128k PRG / 0k CHR H AOROM (7) +SoMari 256k PRG / 256k CHR H MMC3 (4) +Son Son 32k PRG / 8k CHR H ---- (0) +Space Harrier 128k PRG / 0k CHR V UNROM (2) +Space Hunter 32k PRG / 32k CHR H CNROM (3) +Space Invaders 16k PRG / 8k CHR V ---- (0) +Space Shuttle Project 256k PRG / 0k CHR V MMC1 (1) +Spartan X 32k PRG / 8k CHR V ---- (0) +Spartan X2 [Hacked] 128k PRG / 128k CHR V FFE F8xxx (17) +Spelunker (J) 32k PRG / 8k CHR V ---- (0) +Spelunker 2 128k PRG / 0k CHR V UNROM (2) +Spider-Man 128k PRG / 208k CHR H MMC3 (4) <--probable bad dump +Spiritual Warfare 128k PRG / 128k CHR V Colour Dreams (11) +Splatterhouse 128k PRG / 128k CHR H Namcot 106 (19) +Spot 128k PRG / 0k CHR V MMC1 (1) +Spy Hunter 32k PRG / 32k CHR V CNROM (3) +Spy Vs. Spy (J) 32k PRG / 8k CHR V ---- (0) +Sqoon 32k PRG / 16k CHR V CNROM (3) +Sqoon (J) 32k PRG / 8k CHR V ---- (0) +Square no Tom Sawyer 256k PRG / 0k CHR H MMC1 (1) +Stanley 128k PRG / 128k CHR H MMC3 (4) +Star Force 32k PRG / 32k CHR V CNROM (3) +Star Force (J) 16k PRG / 8k CHR V ---- (0) +Star Gate 16k PRG / 8k CHR V ---- (0) +Star Luster 32k PRG / 8k CHR H ---- (0) +Star Soldier (J) 32k PRG / 16k CHR V CNROM (3) +Star Trek 256k PRG / 256k CHR H MMC3 (4) +Star Trek - The Next Generation 128k PRG / 0k CHR H UNROM (2) +Star Voyager 32k PRG / 32k CHR H CNROM (3) +Star Wars 128k PRG / 128k CHR H MMC3 (4) +Star Wars (J - Namco version) 128k PRG / 128k CHR H MMC3 (4) +Star Wars (PAL) 128k PRG / 128k CHR H MMC3 (4) +Starship Hector 128k PRG / 0k CHR V UNROM (2) +Startropics 256k PRG / 256k CHR V MMC3 (4) <--proper chip (MMC6) unsupported +Startropics 2 256k PRG / 256k CHR H MMC3 (4) <--proper chip (MMC6) unsupported +Stealth ATF 128k PRG / 128k CHR H MMC1 (1) +Stealth ATF (PAL) 128k PRG / 128k CHR H MMC1 (1) +Sted Iseki Wakusei no Yabou 128k PRG / 128k CHR H MMC1 (1) +Stick Hunter 128k PRG / 0k CHR V UNROM (2) +Stinger 128k PRG / 0k CHR V UNROM (2) +Street Cop 128k PRG / 128k CHR H MMC1 (1) +Street Fighter 2010 128k PRG / 128k CHR H MMC3 (4) +Street Fighter 3 128k PRG / 512k CHR V HK-SF3 (91) +Strider 256k PRG / 0k CHR V MMC1 (1) +Sugoro Quest 128k PRG / 128k CHR V MMC3 (4) +Sukeban Deka 3 128k PRG / 0k CHR H UNROM (2) +Super Arabian 16k PRG / 8k CHR H ---- (0) +Super Black Onyx 256k PRG / 0k CHR V MMC1 (1) +Super Chinese Land 32k PRG / 16k CHR H MMC3 (4) +Super Chinese Land 2 128k PRG / 128k CHR H MMC3 (4) +Super Chinese Land 3 128k PRG / 128k CHR H MMC1 (1) +Super C 128k PRG / 120k CHR H MMC3 (4) <--missing another 8k CHR page +Super Cars 128k PRG / 0k CHR H UNROM (2) +Super Contra 128k PRG / 128k CHR V MMC3 (4) +Super Dodge Ball 128k PRG / 128k CHR H MMC1 (1) +Super Donkey Kong 2 128k PRG / 256k CHR V MMC3 (4) +Super Dynamix Badminton 32k PRG / 8k CHR V ---- (0) +Super Express Satsujin Jiken 128k PRG / 128k CHR V MMC3 (4) +Super Glove Ball 128k PRG / 0k CHR V UNROM (2) +Super Mario Bros 32k PRG / 8k CHR V ---- (0) +Super Mario Bros (PAL) 32k PRG / 8k CHR V ---- (0) +Super Mario Bros (Disk Conv.) 32k PRG / 8k CHR H ---- (0) (loads using a .sav) +Super Mario Bros / Duck Hunt 64k PRG / 16K CHR H 74161/32 (66) +Super Mario Bros 2 128k PRG / 128k CHR H MMC3 (4) +Super Mario Bros 2 (-1 PRG rev.)128k PRG / 128k CHR H MMC3 (4) +Super Mario Bros 3 256k PRG / 128k CHR H MMC3 (4) +Super Mario Bros 3 (-1 PRG Rev.)256k PRG / 128k CHR H MMC3 (4) +Super Mario Bros 3 (J) 256k PRG / 128k CHR H MMC3 (4) +Super Mario Bros 3 (PAL) 256k PRG / 128k CHR H MMC3 (4) +Super Mario USA 128k PRG / 128k CHR V MMC3 (4) +Super Momotarou Densetsu 256k PRG / 0k CHR H MMC1 (1) +Super Monkey Daibouken 32k PRG / 32k CHR V CNROM (3) +Super Off Road 128k PRG / 0k CHR V AOROM (7) +Super Pinball 128k PRG / 0k CHR H UNROM (2) +Super Pitfall 128k PRG / 0k CHR V UNROM (2) +Super Pitfall (J) 128k PRG / 0k CHR V UNROM (2) +Super Real Baseball 128k PRG / 128k CHR H MMC1 (1) +Super Robot Taisen 2 256k PRG / 256k CHR H MMC3 (4) +Super Spike V'Ball 128k PRG / 128k CHR H MMC3 (4) +Super Spike V'Ball/Nintendo World Cup 128k PRG / 128k CHR H MMC3 (4) <--missing about 256k? +Super Sprint 128k PRG / 128k CHR V MMC3 (4) +Super Spy Hunter 128k PRG / 128k CHR H MMC3 (4) +Super Star Force 128k PRG / 0k CHR V UNROM (2) +Super Team Games 32k PRG / 32k CHR H CNROM (3) +Super Turrican (PAL) 128k PRG / 128k CHR H MMC3 (4) +Super Xevious 128k PRG / 32k CHR H MMC3 (4) +Superman 128k PRG / 128k CHR V MMC1 (1) +Superman (J) 128k PRG / 128k CHR H MMC1 (1) +Swamp Thing 128k PRG / 128k CHR H MMC1 (1) +Swat 128k PRG / 0k CHR V UNROM (2) +Sweet Home 256k PRG / 0k CHR H MMC1 (1) +Sword Master 128k PRG / 128k CHR H MMC3 (4) +Sword Master (J) 128k PRG / 128k CHR H MMC3 (4) +Swords and Serpents 128k PRG / 0k CHR V UNROM (2) +Syoukousi Sedy 256k PRG / 0k CHR V MMC1 (1) + + +T&C Surf Design 32k PRG / 32k CHR V CNROM (3) +T&C Surf Design 2 128k PRG / 128k CHR H MMC3 (4) +Taboo 32k PRG / 32k CHR H MMC1 (1) +Tag Team Pro Wrestling 32k PRG / 8k CHR H ---- (0) +Tag Team Wrestling 32k PRG / 8k CHR H ---- (0) +Tagin' Dragon 32k PRG / 16k CHR V Colour Dreams (11) +Taito Grand Prix 128k PRG / 128k CHR H Taito X005 (80) +Taiyou no Sinden 256k PRG / 0k CHR V MMC1 (1) +Takahasi Meijin no Boukenjima 32k PRG / 32k CHR V CNROM (3) +Takahasi Meijin no Boukenjima 2 128k PRG / 128k CHR H MMC3 (4) +Takahasi Meijin no Boukenjima 3 128k PRG / 128k CHR H MMC3 (4) +Takahasi Meijin no Boukenjima 4 256k PRG / 128k CHR H MMC3 (4) +Takahasi Meijin no Bug Hunny 128k PRG / 32k CHR H Nina-1 (34) <--probably a mapper hack +Takeda Shingen 128k PRG / 0k CHR V UNROM (2) +Takeda Shingen 2 256k PRG / 0k CHR V MMC1 (1) +Takeshi no Chousen Jyou 128k PRG / 0k CHR V UNROM (2) +Takeshi no Sengoku Fuunji 128k PRG / 128k CHR H MMC3 (4) +Tale Spin 128k PRG / 128k CHR H MMC1 (1) +Tanikawa Kouji no Shogi Sinan 3 128k PRG / 0k CHR H MMC1 (1) +Tantei Jingujii Saburou Tokino Sugiyukumamani 128k PRG / 0k CHR H UNROM (2) +Tao 128k PRG / 128k CHR V MMC1 (1) +Target Renegade 128k PRG / 128k CHR V MMC1 (1) +Tashiro Musasi no Princess Galppai 128k PRG / 128k CHR V MMC1 (1) +Tatakae Ramen Man 128k PRG / 128k CHR V MMC1 (1) +Tatakai no Banka 128k PRG / 0k CHR V UNROM (2) +Tecmo Baseball 128k PRG / 0k CHR V MMC1 (1) +Tecmo Bowl 128k PRG / 128k CHR V MMC1 (1) +Tecmo Cup Soccer 128k PRG / 128k CHR H MMC1 (1) +Tecmo NBA Basketball 128k PRG / 256k CHR H MMC3 (4) +Tecmo Super Bowl 256k PRG / 128k CHR H MMC3 (4) +Tecmo World Wrestling 128k PRG / 128k CHR H MMC1 (1) +Tecmo World Wrestling (PAL) 128k PRG / 128k CHR H MMC1 (1) +Teenage Mutant Hero Turtles 128k PRG / 128k CHR H MMC1 (1) +Teenage Mutant Ninja Turtles 128k PRG / 128k CHR H MMC1 (1) +Teenage Mutant Ninja Turtles PAL128k PRG / 128k CHR H MMC1 (1) +Teenage Mutant Ninja Turtles 2 256k PRG / 256k CHR H MMC3 (4) +Teenage Mutant Ninja Turtles 3 256k PRG / 256k CHR H MMC3 (4) +Tekken 2 128k PRG / 512k CHR V PCJY?? (90) +Tenchi wo Kurau 256k PRG / 0k CHR V MMC1 (1) +Tenchi wo Kurau 2 512k PRG / 0k CHR V MMC3 (4) +Tennis 16k PRG / 8k CHR V ---- (0) +Terminator, The 128k PRG / 128k CHR H MMC3 (4) +Terminator 2 128k PRG / 128k CHR H MMC3 (4) +Terminator 2 (Beta Version) 128k PRG / 128k CHR H MMC3 (4) +Terminator 2 (J) 128k PRG / 128k CHR H MMC3 (4) +Terra Cresta (J) 128k PRG / 0k CHR H UNROM (2) +Tetrastar 256k PRG / 256k CHR V MMC3 (4) +Tetris 32k PRG / 128k CHR V MMC1 (1) +Tetris (Tengen) 32k PRG / 16K CHR V CNROM (3) +Tetris (J) 32k PRG / 32k CHR V CNROM (3) +Tetris 2 128k PRG / 104k CHR H MMC3 (4) <--missing 24k +Tetris 2 (PAL) 128k PRG / 128k CHR H MMC3 (4) +Tetris 2 + Bombliss 128k PRG / 0k CHR H MMC1 (1) +Tetris Flash 128k PRG / 128k CHR H MMC3 (4) +Tetsuwan Atom 128k PRG / 128k CHR H MMC3 (4) +Tetudouou 32k PRG / 32k CHR V CNROM (3) +Thexder 32k PRG / 8k CHR H ---- (0) +Three Stooges, The 128k PRG / 128k CHR H MMC1 (1) +Thunder and Lightning 128k PRG / 128k CHR V MMC1 (1) <--bad dump +Thunderbirds 128k PRG / 128k CHR H MMC1 (1) +Thunderbirds (J) 128k PRG / 128k CHR V MMC1 (1) +Thundercade 128k PRG / 0k CHR H UNROM (2) +Tiger-Heli (J) 32k PRG / 32k CHR H CNROM (3) +Time Lord 128k PRG / 0k CHR H AOROM (7) +Time Lord (PAL) 128k PRG / 0k CHR H AOROM (7) +Time Stranger 128k PRG / 0k CHR V UNROM (2) +Time Zone 128k PRG / 128k CHR H MMC3 (4) +Times of Lore 128k PRG / 0k CHR V UNROM (2) +Tiny Toon Adventures 128k PRG / 128k CHR H MMC3 (4) +Tiny Toon Adventures 2 128k PRG / 128k CHR H MMC3 (4) +Tiny Toons Cartoon Workshop 128k PRG / 128k CHR H MMC3 (4) +Titan 128k PRG / 0k CHR V MMC1 (1) +Titei Senkuu Bazoruda 128k PRG / 128k CHR V MMC3 (4) +TM Network Live At Power Bowl 128k PRG / 128k CHR H MMC3 (4) +Tobidase Daisakusen 2 128k PRG / 0k CHR V UNROM (2) +Toki 128k PRG / 256k CHR H MMC3 (4) +Tokorosan no Mamoru 32k PRG / 32k CHR V CNROM (3) +Tokyukyuu Seirei Solbrain 128k PRG / 128k CHR H MMC3 (4) +Tom and Jerry 128k PRG / 128k CHR H MMC3 (4) +Tombs and Treasure 256k PRG / 0k CHR V MMC1 (1) +Tonjan 128k PRG / 128k CHR H MMC1 (1) +Toobin' 128k PRG / 64k CHR H MMC3 (4) +Top Gun 128k PRG / 0k CHR H UNROM (2) +Top Gun - The Second Mission 128k PRG / 128k CHR H MMC3 (4) +Top Players Tennis 128k PRG / 128k CHR V MMC1 (1) +Total Recall 128k PRG / 0k CHR V UNROM (2) +Totally Rad 128k PRG / 128k CHR H MMC3 (4) +Totsuzen Macyoman 128k PRG / 0k CHR V UNROM (2) +Touch 128k PRG / 0k CHR V UNROM (2) +Touchdown Fever 128k PRG / 32k CHR H MMC1 (1) +Touchdown Fever (J) 128k PRG / 32k CHR H MMC1 (1) +Touhou Kenbunroku 128k PRG / 128k CHR H MMC1 (1) +Toukaidou 53 Tugi 32k PRG / 32k CHR V CNROM (3) +Tower of Druaga, The 32k PRG / 8k CHR V ---- (0) +Toxic Crusaders 128k PRG / 128k CHR H MMC3 (4) +Track and Field 2 128k PRG / 128k CHR H MMC1 (1) +Track and Field 2 (PAL) 128k PRG / 128k CHR H MMC1 (1) +Transformers Combo 32k PRG / 32k CHR V CNROM (3) +Triathron, The 128k PRG / 128k CHR V MMC1 (1) +Trog 128k PRG / 0k CHR V UNROM (2) +Trojan 128k PRG / 0k CHR V UNROM (2) +Trojan (PAL) 128k PRG / 0k CHR V UNROM (2) +Trolls on Treasure Island 32k PRG / 32k CHR V AVE (79) +Tsuppari Oozomou 32k PRG / 32k CHR V CNROM (3) +Tsuppari Wars 128k PRG / 128k CHR H MMC1 (1) +Turbo Racing 128k PRG / 128k CHR H MMC1 (1) +Turikiti Sanpei Blue 128k PRG / 0k CHR V UNROM (2) +Turupika Higemaru 128k PRG / 128k CHR H SS8806 (18) +Twin Cobra 128k PRG / 128k CHR H MMC3 (4) +Twinbee 32k PRG / 16k CHR H CNROM (3) +Twinbee (Disk Conversion) 32k PRG / 0k CHR H ---- (0) (loads using .sav file) +Twinbee 3 128k PRG / 128k CHR H VRC4-1B (22) + + +Uddy Poko 128k PRG / 0k CHR V UNROM (2) +Ultima - Exodus 256k PRG / 0k CHR V MMC1 (1) +Ultima - Exodus (J) 256k PRG / 0k CHR H MMC1 (1) +Ultima - Quest of the Avatar 256k PRG / 0k CHR V MMC1 (1) +Ultima - Quest of the Avatar (J)256k PRG / 0k CHR H MMC1 (1) +Ultima - Warriors of Destiny 256k PRG / 0k CHR H MMC1 (1) +Ultimate Air Combat 256k PRG / 256k CHR H MMC3 (4) +Ultimate Basketball 128k PRG / 128k CHR H MMC3 (4) +Ultimate League Soccer 32k PRG / 64k CHR H AVE (79) +Ultimate Stuntman 256k PRG / 0k CHR V Camerica (71) +Ultraman Club 2 128k PRG / 128k CHR H MMC3 (4) +Ultraman Club 3 256k PRG / 128k CHR H MMC3 (4) +Uncharted Waters 512k PRG / 128k CHR H MMC5 (5) +Uninvited 128k PRG / 128k CHR H MMC3 (4) +Untouchables, The 128k PRG / 128k CHR H MMC1 (1) +Urban Champion 16k PRG / 8k CHR V ---- (0) +Urusei Yatsura 32k PRG / 32k CHR V CNROM (3) +US Championship V'Ball 128k PRG / 128k CHR V MMC3 (4) +Uturun Desu 128k PRG / 128k CHR V MMC3 (4) + + +Valis 128k PRG / 0k CHR V UNROM (2) +Valkyure no Bouken 32k PRG / 32k CHR H MMC3 (4) +Vegas Connection 256k PRG / 0k CHR V MMC1 (1) +Vegas Dream 128k PRG / 128k CHR H MMC1 (1) +Venice Beach Volleyball 32k PRG / 32k CHR V AVE (79) +Venus Wars, The 128k PRG / 128k CHR V MMC1 (1) +Vice - Project Doom 128k PRG / 128k CHR H MMC3 (4) +Villgust Gaiden 128k PRG / 256k CHR V MMC3 (4) +Vindicators 64k PRG / 32k CHR V MMC3 (4) +Viva Las Vegas 128k PRG / 128k CHR V MMC1 (1) +Volguard 2 32k PRG / 8k CHR V ---- (0) +Volleyball 32k PRG / 16k CHR V CNROM (3) +Volleyball (Disk Conversion) 32k PRG / 8k CHR H ---- (0) (loads with .sav) +Vs. Castlevania 128k PRG / 0k CHR V Unisystem (99) +Vs. Ice Climber 32k PRG / 16k CHR V Unisystem (99) +Vs. Super Mario Bros 32k PRG / 16k CHR V Unisystem (99) + + +Wacky Races 128k PRG / 128k CHR H MMC3 (4) +Wagyan Land 128k PRG / 64k CHR V MMC3 (4) +Wagyan Land 2 256k PRG / 128k CHR H Namcot 106 (19) +Wagyan Land 3 256k PRG / 256k CHR H Namcot 106 (19) +Wai Wai World 128k PRG / 128k CHR H VRC2b (23) +Wai Wai World (Hacked) 128k PRG / 128k CHR H FFE F8xxx (17) +Wai Wai World 2 256k PRG / 128k CHR H VRC4-2a (21) +Wairi no Write Rockboard 256k PRG / 0k CHR H MMC3 (4) +Wall Street Kid 128k PRG / 0k CHR H UNROM (2) +Wanpaku Duck Yumebouken 128k PRG / 0k CHR V UNROM (2) +Wanpaku Kokkun no Gurume World 128k PRG / 128k CHR H MMC3 (4) +Wario no Mori 256k PRG / 256k CHR V MMC3 (4) +Wario's Woods 256k PRG / 256k CHR H MMC3 (4) +Warpman 16k PRG / 8k CHR H ---- (0) +Warwolf 128k PRG / 128k CHR V MMC3 (4) +Wayne Gretzky Hockey 128k PRG / 0k CHR V UNROM (2) +Wayne's World 128k PRG / 128k CHR H MMC3 (4) +WCW Championship Wrestling 128k PRG / 128k CHR H MMC3 (4) +Werewolf 128k PRG / 128k CHR H MMC3 (4) +Western Kids 256k PRG / 256k CHR V MMC3 (4) +Wheel of Fortune 128k PRG / 0k CHR H AOROM (7) +Wheel of Fortune Family Edition 128k PRG / 0k CHR H AOROM (7) +Wheel of Fortune W/ Vanna White 128k PRG / 0k CHR H AOROM (7) +Where in Time is Carmen Sandiego128k PRG / 256k CHR H MMC3 (4) +Where's Waldo? 128k PRG / 128k CHR H MMC3 (4) +White Lion Densetsu 128k PRG / 128k CHR V MMC1 (1) +Who Framed Roger Rabbit? 128k PRG / 0k CHR H AOROM (7) +Whomp 'Em 128k PRG / 128k CHR H MMC3 (4) +Widget 128k PRG / 128k CHR H MMC3 (4) +Wild Gunman 16k PRG / 8k CHR V ---- (0) +Willow 128k PRG / 128k CHR H MMC1 (1) +Willow (J) 128k PRG / 128k CHR H MMC1 (1) +Win, Lose, or Draw 128k PRG / 0k CHR H MMC1 (1) +Wing of Madoola, The 32k PRG / 128k CHR V CNROM (3) +Winter Games 128k PRG / 0k CHR H UNROM (2) +Wits 128k PRG / 0k CHR V UNROM (2) +Wizardry - Knight of Diamonds 128k PRG / 128k CHR H MMC3 (4) +Wizardry - Knight of Diamonds(J)128k PRG / 128k CHR V MMC3 (4) +Wizardry - Legacy of Lyllgamyn 128k PRG / 128k CHR H MMC3 (4) +Wizardry - Proving Grounds 128k PRG / 128k CHR V MMC1 (1) +Wizardry - Proving Grounds (J) 128k PRG / 128k CHR V MMC1 (1) +Wizards and Warriors 128k PRG / 0k CHR H AOROM (7) +Wizards and Warriors (PAL) 128k PRG / 0k CHR H AOROM (7) +Wizards and Warriors 2 256k PRG / 0k CHR H AOROM (7) +Wizards and Warriors 3 256k PRG / 0k CHR H AOROM (7) +Wolverine 128k PRG / 128k CHR H MMC3 (4) +World Boxing 128k PRG / 128k CHR H MMC1 (1) +World Games 128k PRG / 0k CHR H AOROM (7) +World Super Tennis 128k PRG / 128k CHR V MMC1 (1) +Wrath of the Black Manta 128k PRG / 128k CHR V MMC1 (1) +Wrecking Crew 32k PRG / 8k CHR H ---- (0) +Wurm 128k PRG / 128k CHR H MMC3 (4) +WWF King of the Ring 128k PRG / 256k CHR H MMC3 (4) +WWF Steel Cage Challenge 128k PRG / 256k CHR H MMC3 (4) +WWF Steel Cage Challenge (PAL) 128k PRG / 256k CHR H MMC3 (4) +WWF Wrestlemania 128k PRG / 0k CHR H AOROM (7) +WWF Wrestlemania Challenge 256k PRG / 0k CHR H AOROM (7) + + +X-Men 128k PRG / 0k CHR H UNROM (2) +Xenophobe 128k PRG / 128k CHR H MMC1 (1) +Xevious (J) 32k PRG / 8k CHR H ---- (0) +Xexyz 128k PRG / 128k CHR H MMC1 (1) + + +Y's 256k PRG / 0k CHR H MMC1 (1) +Y's 2 256k PRG / 128k CHR V MMC3 (4) +Y's 3 256k PRG / 128k CHR H MMC3 (4) +Yie-Ar Kung-Fu 16k PRG / 8k CHR V ---- (0) +Yo Nin Uti Majyan 16k PRG / 8k CHR V ---- (0) +Yo Noid 128k PRG / 128k CHR H MMC1 (1) +Yokohama Renzoku Satsujin Jiken 128k PRG / 128k CHR V MMC1 (1) +Yoshi 128k PRG / 128k CHR H MMC1 (1) +Yoshi no Cookie 128k PRG / 64k CHR V MMC3 (4) +Yoshi no Tamago 128k PRG / 32k CHR H MMC1 (1) +Yoshi's Cookie 128k PRG / 64k CHR H MMC3 (4) +Youkai Club 128k PRG / 32k CHR V 74161/32 (66) +Youkai Douchuki 128k PRG / 128k CHR V Namcot 106 (19) +Young Indiana Jones Chronicles 128k PRG / 128k CHR H MMC3 (4) +Yousike Ide's Battle Mahjongg 128k PRG / 0k CHR V UNROM (2) +Yousike Ide's Battle Mahjongg 2 256k PRG / 0k CHR H MMC1 (1) +Yume Penguin Monogatari (Hacked)128k PRG / 128k CHR V MMC3 (4) + + +Zaiteku Satsujin Jiken 128k PRG / 128k CHR H MMC3 (4) +Zanac 128k PRG / 0k CHR H UNROM (2) +Zelda no Densetsu 128k PRG / 0k CHR V MMC1 (1) +Zelda 2 - The Adventure of Link 128k PRG / 112k CHR H MMC1 (1) <--missing 16k +Zelda 2 (PAL) 128k PRG / 128k CHR H MMC1 (1) +Zen - Intergalactic Ninja 128k PRG / 128k CHR H MMC3 (4) +Zenbei Pro Basket 128k PRG / 128k CHR V MMC1 (1) +Zippy Race 16k PRG / 8k CHR V ---- (0) +Zoids 128k PRG / 0k CHR V UNROM (2) +Zoids 2 256k PRG / 0k CHR V MMC1 (1) +Zoids 3 128k PRG / 128k CHR H MMC3 (4) +Zombie Hunter 128k PRG / 32k CHR V MMC1 (1) +Zombie Nation 128k PRG / 128k CHR H MMC3 (4) + + +--MISC STUFF-- + +These are just a few games that I have lying around that don't work because +they're either currently unsupported or just a regular bad dump. This section +is totally useless. + + +76-in-1 2048k PRG / 0k CHR H -none assigned- +110-in-1 2048k PRG / 1024k CHR H -none assigned- +Cheetahmen 2 32k PRG / 8k CHR V -none assigned- (probably a bad dump, too) +Deathbots 64k PRG / 64k CHR H AVE (79) +Galactic Crusader 32k PRG / 32k CHR H Colour Dreams (11) +Saint Seiya 64k PRG / 128k CHR H 74161/32 (70) +Skull and Crossbones 128k PRG / 64k CHR H Rambo-1 (64) +Super Jeopardy 128k PRG / 256k CHR H MMC1 (1) +Tiles of Fate 32k PRG / 32k CHR H AVE (79) + + diff --git a/retro-core/components/nofrendo/docs/nestech.txt b/retro-core/components/nofrendo/docs/nestech.txt new file mode 100644 index 000000000..f47882ae3 --- /dev/null +++ b/retro-core/components/nofrendo/docs/nestech.txt @@ -0,0 +1,1482 @@ ++---------------------------------------------+ +| Nintendo Entertainment System Documentation | +| | +| Version: 2.00 | ++---------------------------------------------+ + ++-------------------+ +| Table of Contents | ++-------------------+ + + 1. Introduction + A. Disclaimer + B. Why? + C. Mission + D. Dedications + E. "Thank You"s + 2. Acronymns + A. Internals + B. Hardware + 3. CPU + A. General Information + B. Memory Map + C. Interrupts + D. NES-specific Customizations + E. Notes + 4. PPU + A. General Information + B. PPU Map + C. Name Tables + D. Pattern Tables + E. Attribute Tables + F. Palettes + G. Name Table Mirroring + H. Palette Mirroring + I. Background Scrolling + J. Screen and Sprite Layering + K. Sprites and SPR-RAM + L. Sprite #0 Hit Flag + M. Horizontal and Vertical Blanking + N. $2005/2006 Magic + O. VRAM Read/Writes + P. Notes + 5. pAPU + 6. Joypads, paddles, expansion ports + A. General Information + B. The Zapper + C. Four-player devices + D. Paddles + E. Power Pad + F. R.O.B. (Robot Operated Buddy) + G. Signatures + H. Expansion ports + I. Notes + 7. Memory Mapping Hardware + 8. Registers + 9. File Formats + A. iNES Format (.NES) + 10. Programming the NES + A. General Information + B. CPU Notes + C. PPU Notes + 11. Emulation + A. General Information + B. CPU Notes + C. PPU Notes + D. APU Notes + 12. Reference Material + A. CPU Information + B. PPU Information + C. APU Information + D. Memory Mapper Information + E. Mailing Lists + F. WWW Sites + G. Hardware Information + + + ++-----------------+ +| 1. Introduction | ++-----------------+ + + A. Disclaimer + ------------- + I am in no way held responsible for the results of this information. + This is public-domain information, and should not be used for commercial + purposes. If you wish to use this document for commercial purposes, + please contact me prior to development, so that I may discuss the outline + of your project with you. I am not trying to hinder anyone financially: + if you wish to do real Nintendo Entertainment System development, con- + tacting either Nintendo of America or Nintendo Company, Ltd. would be + wise. Their addresses are listed here: + + Nintendo of America Nintendo Company, Ltd. + P.O. Box 957 60 Fukuine + Redmond, WA 98073 Kamitakamatsu-cho, + USA Higashiyama-ku, + Koyoto 602, Japan + + All titles of cartridges and console systems are registered trademarks + of their respective owners. (I just don't deem it necessary to list + every single one by hand). + + + B. Why? + ------- + At the time this document was created, there was only one piece of lit- + erature covering the internals to the NES: Marat Fayzullin's documen- + tation, otherwise known as "NES.DOC". + + While Fayzullin's documentation was lacking in many areas, it provided a + strong base for the basics, and in itself truly stated how complex the + little grey box was. + + I took the opportunity to expand on "NES.DOC," basing other people's + findings, as well as my own, on experience; experience which has helped + make this document what it has become today. The beginning stages of this + document looked almost like a replica of Fayzullin's documentation, with + both minor and severe changes. Marat Fayzullin himself later picked up a + copy of my documentation, and later began referring people to it. + + Keep in mind, without Marat's "NES.DOC" document, I would have never had + any incentive to write this one. + + + C. Mission + ---------- + The goal of this document is simplistic: to provide accurate and up-to- + date information regarding the Nintendo Entertainment System, and it's + Famicom counterpart. + + + D. Dedications + -------------- + I'd like to dedicate this document to Alex Krasivsky. Alex has been a + great friend, and in my eyes, truly started the ball of emulation + rolling. During the good times, and the bad times, Alex was there. + Spasibo, Alex; umnyj Russki... + + + E. "Thank You"s + --------------- + I'd like to take the time and thank all the people who helped make this + document what it is today. I couldn't have done it without all of you. + + Alex Krasivsky - bcat@lapkin.rosprint.ru + Andrew Davie + Avatar Z - swahlen@nfinity.com + Barubary - barubary@mailexcite.com + Bluefoot - danmcc@injersey.com + CiXeL + Chi-Wen Yang - yangfanw@ms4.hinet.net + Chris Hickman - typhoonz@parodius.com + D - slf05@cc.usu.edu + Dan Boris - dan.boris@coat.com + David de Regt - akilla@earthlink.net + Donald Moore - moore@futureone.com + Fredrik Olsson - flubba@hem2.passagen.se + Icer Addis - bldlust@maelstrom.net + Jon Merkel - jpm5974@omega.uta.edu + Kevin Horton - khorton@iquest.net + Loopy - zxcvzxcv@netzero.net + Marat Fayzullin - fms@cs.umd.edu + Mark Knibbs - mark_k@iname.com + Martin Nielsen - mnielsen@get2net.dk + Matt Conte - itsbroke@classicgaming.com + Matthew Richey - mr6v@andrew.cmu.edu + Memblers - 5010.0951@tcon.net + MiKael Iushin - acc@tulatelecom.ru + Mike Perry - mj-perry@uiuc.edu + Morgan Johansson - morgan.johansson@mbox301.swipnet.se + Neill Corlett - corlett@elwha.nrrc.ncsu.edu + Pat Mccomack - splat@primenet.com + Patrik Alexandersson - patrikus@hem2.passagen.se + Paul Robson - AutismUK@aol.com + Ryan Auge - rauge@hay.net + Stumble - stumble@alpha.pulsar.net + Tennessee Carmel-Veilleux - veilleux@ameth.org + Thomas Steen - Thomas.Steen@no.jotankers.com + Tony Young - KBAAA@aol.com + Vince Indriolo - indriolo@nm.picker.com + \FireBug\ - lavos999@aol.com + + Special thanks goes out to Stumble, for providing a myriad of infor- + mation over IRC, while avoiding sleep to do so. + + ++--------------+ +| 2. Acronymns | ++--------------+ + + A. Internals + ------------ + CPU - Central Processing Unit: Self-explanitory. The NES uses a + standard 6502 (NMOS). + PPU - Picture Processing Unit: Used to control graphics, sprites, + and other video-oriented features. + pAPU - pseuedo-Audio Processing Unit: Native to the CPU; generates + waveforms via (5) audio channels:: four (4) analogue, and + one (1) digital. There is no physical IC for audio process- + ing nor generation inside the NES. + MMC - Multi-Memory Controller: Micro-controllers used in NES games + to access memory beyond the 6502 64Kbyte boundary. They can + also be used to access extra CHR-ROM, and may be used for + "special effects" such as forcing and IRQ, and other things. + VRAM - Video RAM: The RAM which is internal to the PPU. There is + 16kbits of VRAM installed in the NES. + SPR-RAM - Sprite RAM: 256 bytes of RAM which is used for sprites. It is + not part of VRAM nor ROM, though it's local to the PPU. + PRG-ROM - Program ROM: The actual program-code area of memory. Also can + be used to describe areas of code which are external to the + actual code area and are swapped in via an MMC. + PRG-RAM - Program RAM: Synonymous with PRG-ROM, except that it's RAM. + CHR-ROM - Character ROM: The VRAM data which is kept external to the PPU, + swapped in and out via an MMC, or "loaded" into VRAM during the + power-on sequence. + VROM - Synonymous with CHR-ROM. + SRAM - Save RAM: RAM which is commonly used in RPGs such as "Cry- + stalis," the Final Fantasy series, and "The Legend of Zelda." + WRAM - Synonymous with SRAM. + DMC - Delta Modulation Channel: The channel of the APU which handles + digital data. Commonly referred to as the PCM (Pulse Code + Modulation) channel. + EX-RAM - Expansion RAM: This is the memory used within Nintendo's MMC5, + allowing games to extend the capabilities of VRAM. + + + B. Hardware + ----------- + NES - Nintendo Entertainment System: Self-explanitory. + Dandy - Synonymous (hardware-wise) with the Famicom. + Famicom - Synonymous with the NES, except for not supporting the RAW + method of DMC digital audio playback. + FDS - Famicom Disk System: Unit which sits atop the Famicom, support- + ing the use of 3" double-sided floppy disks for games. + + + ++--------+ +| 3. CPU | ++--------+ + + A. General Information + ---------------------- + The NES uses a customized NMOS 6502 CPU, engineered and produced by + Ricoh. It's primary customization adds audio. + + The NTSC NES runs at 1.7897725MHz, and 1.773447MHz for PAL. + + + B. Memory Map + ------------- + +---------+-------+-------+-----------------------+ + | Address | Size | Flags | Description | + +---------+-------+-------+-----------------------+ + | $0000 | $800 | | RAM | + | $0800 | $800 | M | RAM | + | $1000 | $800 | M | RAM | + | $1800 | $800 | M | RAM | + | $2000 | 8 | | Registers | + | $2008 | $1FF8 | R | Registers | + | $4000 | $20 | | Registers | + | $4020 | $1FDF | | Expansion ROM | + | $6000 | $2000 | | SRAM | + | $8000 | $4000 | | PRG-ROM | + | $C000 | $4000 | | PRG-ROM | + +---------+-------+-------+-----------------------+ + Flag Legend: M = Mirror of $0000 + R = Mirror of $2000-2008 every 8 bytes + (e.g. $2008=$2000, $2018=$2000, etc.) + + + C. Interrupts + ------------- + The 6502 has three (3) interrupts: IRQ/BRK, NMI, and RESET. + + Each interrupt has a vector. A vector is a 16-bit address which spec- + ifies a location to "jump to" when the interrupt is triggered. + + IRQ/BRK is triggered under two circumstances, hence it's split name: + when a software IRQ is executed (the BRK instruction), or when a + hardware IRQ is executed (via the IRQ line). + + RESET is triggered on power-up. The ROM is loaded into memory, and + the 6502 jumps to the address specified in the RESET vector. No registers + are modified, and no memory is cleared; these only occur during power-up. + + NMI stands for Non-Maskable Interrupt, and is generated by each refresh + (VBlank), which occurs at different intervals depending upon the system + used (PAL/NTSC). + + NMI is updated 60 times/sec. on NTSC consoles, and 50 times/sec on PAL. + Interrupt latency on the 6502 is seven (7) cycles; this means it takes + seven (7) cycles to move in and out of an interrupt. + + Most interrupts should return using the RTI instruction. Some NES carts + do not use this method, such as SquareSoft's "Final Fantasy 1" title. + These carts return from interrupts in a very odd fashion: by manipul- + ating the stack by hand, and then doing an RTS. This is technically + valid, but morally shunned. + + The aforementioned nterrupts have the following vector addresses, + mapped to areas of ROM: + + $FFFA = NMI + $FFFC = RESET + $FFFE = IRQ/BRK + + Interrupt priorities are as follows: + + Highest = RESET + NMI + Lowest = IRQ/BRK + + + D. NES-specific Customizations + ------------------------------ + The NES's 6502 does not contain support for decimal mode. Both the + CLD and SED opcodes function normally, but the 'd' bit of P is unused + in both ADC and SBC. It is common practice for games to CLD prior to + code execution, as the status of 'd' is unknown on power-on and on + reset. + + Audio registers are mapped internal to the CPU; all waveform gener- + ation is done internal to the CPU as well. + + + E. Notes + -------- + Please note the two separate 16K PRG-ROM segments; they may be linear, + but they play separate roles depending upon the size of the cartridge. + Some games only hold one (1) 16K bank of PRG-ROM, which should be + loaded into both $C000 and $8000. + + Most games load themselves into $8000, using 32K of PRG-ROM space. The + first game to use this method is Super Mario Brothers. However, all + games wit more than one (1) 16K bank of PRG-ROM load themselves into + $8000 as well. These games use Memory Mappers to swap in and out PRG-ROM + data, as well as CHR-ROM. + + When a BRK is encountered, the NES's 6502 pushes the CPU status flag + onto the stack with the 'b' CPU bit set. On an IRQ or NMI, the CPU + pushes the status flag onto the stack with the 'b' bit clear. This is + done because of the fact that a hardware IRQ (IRQ) and a software + IRQ (BRK) both share the same vector. For example, one could use the + following code to distinguish the difference between the two: + + C134: PLA ; Copy CPU status flag + C135: PHA ; Return status flag to stack + C136: AND #$10 ; Check D4 ('b' CPU bit) + C138: BNE is_BRK_opcode ; If set then it is a software IRQ (BRK) + + Executing BRK inside of NMI will result in the pushed 'b' bit being + set. + + The 6502 has a bug in opcode $6C (jump absolute indirect). The CPU does + not correctly calculate the effective address if the low-byte is $FF. + Example: + + C100: 4F + C1FF: 00 + C200: 23 + .. + D000: 6C FF C1 - JMP ($C1FF) + + Logically, this will jump to address $2300. However, due to the fact + that the high-byte of the calculate address is *NOT* increased on a + page-wrap, this will actually jump to $4F00. + + It should be noted that page wrapping does *NOT* occur in indexed- + indirect addressing modes. Due to limitations of zero-page, all + indexed-indirect read/writes should apply a logical AND #$FF to + the effective address after calculation. Example: + + C000: LDX #3 ; Reads indirect address from $0002+$0003, + C002: LDA ($FF,X) ; not $0102+$0103. + + + ++--------+ +| 4. PPU | ++--------+ + + A. General Information + ---------------------- + Mirroring (also referred to as "shadowing") is the process of mapping + particular addresses or address ranges to other addresses/ranges via + hardware. + + + B. Memory Map + ------------- + Included here are two (2) memory maps. The first is a "RAM Memory + Map," which despite being less verbose describes the actual regions + which point to physical RAM in the NES itself. The second is a + "Programmer Memory Map" which is quite verbose and describes the + entire memory region of the NES and how it's used/manipulated. + + RAM Memory Map + +---------+-------+--------------------+ + | Address | Size | Description | + +---------+-------+--------------------+ + | $0000 | $1000 | Pattern Table #0 | + | $1000 | $1000 | Pattern Table #1 | + | $2000 | $800 | Name Tables | + | $3F00 | $20 | Palettes | + +---------+-------+--------------------+ + + + Programmer Memory Map + +---------+-------+-------+--------------------+ + | Address | Size | Flags | Description | + +---------+-------+-------+--------------------+ + | $0000 | $1000 | C | Pattern Table #0 | + | $1000 | $1000 | C | Pattern Table #1 | + | $2000 | $3C0 | | Name Table #0 | + | $23C0 | $40 | N | Attribute Table #0 | + | $2400 | $3C0 | N | Name Table #1 | + | $27C0 | $40 | N | Attribute Table #1 | + | $2800 | $3C0 | N | Name Table #2 | + | $2BC0 | $40 | N | Attribute Table #2 | + | $2C00 | $3C0 | N | Name Table #3 | + | $2FC0 | $40 | N | Attribute Table #3 | + | $3000 | $F00 | R | | + | $3F00 | $10 | | Image Palette #1 | + | $3F10 | $10 | | Sprite Palette #1 | + | $3F20 | $E0 | P | | + | $4000 | $C000 | F | | + +---------+-------+-------+--------------------+ + C = Possibly CHR-ROM + N = Mirrored (see Subsection G) + P = Mirrored (see Subsection H) + R = Mirror of $2000-2EFF (VRAM) + F = Mirror of $0000-3FFF (VRAM) + + + C. Name Tables + -------------- + The NES displays graphics using a matrix of "tiles"; this grid is called + a Name Table. Tiles themselves are 8x8 pixels. The entire Name Table + itself is 32x30 tiles (256x240 pixels). Keep in mind that the displayed + resolution differs between NTSC and PAL units. + + The Name Tables holds the tile number of the data kept in the Pattern + Table (continue on). + + + D. Pattern Tables + ----------------- + The Pattern Table contains the actual 8x8 tiles which the Name Table + refers to. It also holds the lower two (2) bits of the 4-bit colour + matrix needed to access all 16 colours of the NES palette. Example: + + VRAM Contents of Colour + Addr Pattern Table Result + ------ --------------- -------- + $0000: %00010000 = $10 --+ ...1.... Periods are used to + .. %00000000 = $00 | ..2.2... represent colour 0. + .. %01000100 = $44 | .3...3.. Numbers represent + .. %00000000 = $00 +-- Bit 0 2.....2. the actual palette + .. %11111110 = $FE | 1111111. colour #. + .. %00000000 = $00 | 2.....2. + .. %10000010 = $82 | 3.....3. + $0007: %00000000 = $00 --+ ........ + + $0008: %00000000 = $00 --+ + .. %00101000 = $28 | + .. %01000100 = $44 | + .. %10000010 = $82 +-- Bit 1 + .. %00000000 = $00 | + .. %10000010 = $82 | + .. %10000010 = $82 | + $000F: %00000000 = $00 --+ + + The result of the above Pattern Table is the character 'A', as shown + in the "Colour Result" section in the upper right. + + + E. Attribute Tables + ------------------- + Each byte in an Attribute Table represents a 4x4 group of tiles on the + screen. There's multiple ways to describe what the function of one (1) + byte in the Attribute Table is: + + * Holds the upper two (2) bits of a 32x32 pixel grid, per 16x16 pixels. + * Holds the upper two (2) bits of sixteen (16) 8x8 tiles. + * Holds the upper two (2) bits of four (4) 4x4 tile grids. + + It's quite confusing; two graphical diagrams may help: + + +------------+------------+ + | Square 0 | Square 1 | #0-F represents an 8x8 tile + | #0 #1 | #4 #5 | + | #2 #3 | #6 #7 | Square [x] represents four (4) 8x8 tiles + +------------+------------+ (i.e. a 16x16 pixel grid) + | Square 2 | Square 3 | + | #8 #9 | #C #D | + | #A #B | #E #F | + +------------+------------+ + + The actual format of the attribute byte is the following (and corris- + ponds to the above example): + + Attribute Byte + (Square #) + ---------------- + 33221100 + ||||||+--- Upper two (2) colour bits for Square 0 (Tiles #0,1,2,3) + ||||+----- Upper two (2) colour bits for Square 1 (Tiles #4,5,6,7) + ||+------- Upper two (2) colour bits for Square 2 (Tiles #8,9,A,B) + +--------- Upper two (2) colour bits for Square 3 (Tiles #C,D,E,F) + + + F. Palettes + ----------- + The NES has two 16-colour "palettes": the Image Palette and the Sprite + Palette. These palettes are more of a "lookup table" than an actual + palette, since they do not hold physical RGB values. + + D7-D6 of bytes written to $3F00-3FFF are ignored. + + + G. Name Table Mirroring + ----------------------- + One should keep in mind that there are many forms of mirroring when + understanding the NES. Some methods even use CHR-ROM-mapped Name + Tables (mapper-specific). + + The NES itself only contains 2048 ($800) bytes of RAM used for Name + Tables. However, as shown in Subsection B, the NES has the capability + of addressing up to four (4) Name Tables. + + By default, many carts come with "horizontal" and "vertical" mirroring, + allowing you to change where the Name Tables point into the NES's PPU + RAM. This form of mirroring affects two (2) Name Tables simultaneously; + you cannot switch Name Tables independently. + + The following chart should assist in understanding all the types of + mirroring encountered on the NES. Please note that the addresses + shown (12-bit in size) refer to the Name Table portion of the NES's + PPU RAM; one may consider these synonymous with "$2xxx" in the VRAM + region: + + Name NT#0 NT#1 NT#2 NT#3 Flags + +--------------------------+------+------+------+------+-------+ + | Horizontal | $000 | $000 | $400 | $400 | | + | Vertical | $000 | $400 | $000 | $400 | | + | Four-screen | $000 | $400 | $800 | $C00 | F | + | Single-screen | | | | | S | + | CHR-ROM mirroring | | | | | C | + +--------------------------+------+------+------+------+-------+ + F = Four-screen mirroring relies on an extra 2048 ($800) of RAM + (kept on the cart), resulting in four (4) physical independent + Name Tables. + S = Single-screen games have mappers which allow you to select + which PPU RAM area you want to use ($000, $400, $800, or + $C00); all the NTs point to the same PPU RAM address. + C = Mapper #68 (Afterburner 2) allows you to map CHR-ROM to the + Name Table region of the NES's PPU RAM area. Naturally this + makes the Name Table ROM-based, and one cannot write to it. + However, this feature can be controlled via the mapper itself, + allowing you to enable or disable this feature. + + + H. Palette Mirroring + -------------------- + Mirroring occurs between the Image Palette and the Sprite Palette. + Any data which is written to $3F00 is mirrored to $3F10. Any data + written to $3F04 is mirrored to $3F14, etc. etc... + + Colour #0 in the upper three (3) palettes of both the Image and Sprite + palette defines transparency (the actual colour stored there is not + drawn on-screen). + + The PPU uses the value in $3F00 to define background colour. + + For a more verbose explanation, assume the following: + + * $0D has been written to $3F00 (mirrored to $3F10) + * $03 has been written to $3F08 (mirrored to $3F18) + * $1A has been written to $3F18 + * $3F08 is read into the accumulator + + The PPU will use $0D as the background colour, despite $3F08 holding + a value of $03 (since colour #0 in all the palette entries defines + transparency, it is not drawn). Finally, the accumulator will hold + a value of $1A, which is mirrored from $3F18. Again, the value of $1A + is not drawn, since colour #0 defines transparency. + + The entire Image and Sprite Palettes are both mirrored to other areas + of VRAM as well; $3F20-3FFF are mirrors of both palettes, respectively. + + D7-D6 of bytes written to $3F00-3FFF are ignored. + + + I. Background Scrolling + ----------------------- + The NES can scroll the background (pre-rendered Name Table + Pattern + Table + Attribute Table) independently of the sprites which are over- + layed on top of it. The background can be scrolled horizontally and + vertically. + + Scrolling works as follows: + + Horizontal Scrolling Vertical Scrolling + 0 512 + +-----+-----+ +-----+ 0 + | | | | | + | A | B | | A | + | | | | | + +-----+-----+ +-----+ + | | + | B | + | | + +-----+ 480 + + Name Table "A" is specified via Bits D1-D0 in register $2000, and "B" is + the Name Table after (due to mirroring, this is dynamic). This doesn't + work for game which use Horizontal & Vertical scrolling simultaneously. + + The background will span across multiple Name Tables, as shown here: + + +---------------+---------------+ + | Name Table #2 | Name Table #3 | + | ($2800) | ($2C00) | + +---------------+---------------+ + | Name Table #0 | Name Table #1 | + | ($2000) | ($2400) | + +---------------+---------------+ + + Writes to the Horizontal Scroll value in $2005 range from 0 to 256. + Writes to the Vertical Scroll value range from 0-239; values above 239 + are considered negative (e.g. a write of 248 is really -8). + + + J. Screen and Sprite Layering + ----------------------------- + There is a particular order in which the NES draws it's contents: + + FRONT BACK + +----+-----------+----+-----------+-----+ + | CI | OBJs 0-63 | BG | OBJs 0-63 | EXT | + +----+-----------+----+-----------+-----+ + | SPR-RAM | | SPR-RAM | + | BGPRI==0 | | BGPRI==1 | + +-----------+ +-----------+ + + CI stands for 'Colour Intensity', which is synonmous with D7-D5 of + $2001. BG is the BackGround, and EXT is for the EXTension port video + signal. + + 'BGPRI' represents the 'Background Priority' bit in SPR-RAM, on a + per-sprite basis (D5, Byte 2). + + OBJ numbers represent actual Sprite numbers, not Tile Index values. + + FRONT is considered what is seen atop all other layers (drawn last), + and BACK is deemed what is below most other layers (drawn first). + + + K. Sprites and SPR-RAM + ---------------------- + The NES supports 64 sprites, which can be either 8x8 or 8x16 pixels in + size. The sprite data is kept within the Pattern Table region of VRAM. + + Sprite attributes such as flipping and priority, are stored in SPR-RAM, + which is a separate 256 byte area of memory, independent of ROM and + VRAM. The format of SPR-RAM is as follows: + + +-----------+-----------+-----+------------+ + | Sprite #0 | Sprite #1 | ... | Sprite #63 | + +-+------+--+-----------+-----+------------+ + | | + +------+----------+--------------------------------------+ + + Byte | Bits | Description | + +------+----------+--------------------------------------+ + | 0 | YYYYYYYY | Y Coordinate - 1. Consider the coor- | + | | | dinate the upper-left corner of the | + | | | sprite itself. | + | 1 | IIIIIIII | Tile Index # | + | 2 | vhp000cc | Attributes | + | | | v = Vertical Flip (1=Flip) | + | | | h = Horizontal Flip (1=Flip) | + | | | p = Background Priority | + | | | 0 = In front | + | | | 1 = Behind | + | | | c = Upper two (2) bits of colour | + | 3 | XXXXXXXX | X Coordinate (upper-left corner) | + +------+----------+--------------------------------------+ + + The Tile Index # is obtained the same way as Name Table data. + + Sprites which are 8x16 in size function a little bit differently. A + 8x16 sprite which has an even-numbered Tile Index # use the Pattern + Table at $0000 in VRAM; odd-numbered Tile Index #s use $1000. + *NOTE*: Register $2000 has no effect on 8x16 sprites. + + All 64 sprites contain an internal priority; sprite #0 is of a higher + priority than sprites #63 (sprite #0 should be drawn last, etc.). + + Only eight (8) sprites can be displayed per scan-line. Each entry in + SPR-RAM is checked to see if it's in a horizontal range with the other + sprites. Remember, this is done on a per scan-line basis, not on a per + sprite basis (e.g. done 256 times, not 256/8 or 256/16 times). + + (NOTE: On a real NES unit, if sprites are disabled (D4 of $2001 is 0) + for a long period of time, SPR-RAM will gradually degrade. A proposed + concept is that SPR-RAM is actually DRAM, and D4 controls the DRAM + refresh cycle). + + + L. Sprite #0 Hit Flag + --------------------- + The PPU is capable of figuring out where Sprite #0 is, and stores + it's findings in D6 of $2002. The way this works is as follows: + + The PPU scans for the first actual non-transparent "sprite pixel" and + the first non-transparent "background pixel." A "background pixel" is + a tile which is in use by the Name Table. Remember that colour #0 + defines transparency. + + The pixel which causes D6 to be set *IS* drawn. + + The following example should help. The following are two tiles. + Transparent colours (colour #0) are defined via the underscore ('_') + character. An asterisk ('*') represents when D6 will be set. + + Sprite BG Result + ------ -- ------ + __1111__ ________ __1111__ + _111111_ _______2 _1111112 + 11222211 ______21 11222211 + 112__211 + _____211 = 112__*11 '*' will be drawn as colour #2 + 112__211 ____2111 112_2211 + 11222211 ___21111 11222211 + _111111_ __211111 _1111111 + __1111__ _2111111 _2111111 + + This also applies to sprites that are underneathe the BG (via the + 'Background Priority' SPR-RAM bit), though the above example would + be 'BG+Sprite'. + + Also, D6 is cleared (set to 0) after each VBlank. + + + M. Horizontal and Vertical Blanking + ----------------------------------- + The NES, like every console, has a refresh: where the display device + relocates the electron gun to display visible data. The most common + display device is a television set. The refresh occurs 60 times a + second on an NTSC device, and 50 on a PAL device. + + The gun itself draws pixels left to right: this process results in + one (1) horizontal scanline being drawn. After the gun is done drawing + the entire scanline, the gun must return to the left side of the + display device, becoming ready to draw the next scanline. The process + of the gun returning to the left side of the display is the Horizontal + Blank period (HBlank). + + When the gun has completed drawing all of the scanlines, it must return + to the top of the display device; the time it takes for the gun to + re-position itself atop the device is called the Vertical Blank period + (VBlank). + + As you can see from the below diagram, the gun more or less works in + a zig-zag pattern until VBlank is reached, then the process repeats: + + +-----------+ + +--->|***********| <-- Scanline 0 + | | ___---~~~ | <-- HBlank + V |***********| <-- Scanline 1 + B | ___---~~~ | <-- HBlank + l | ... | ... + a | ... | ... + n |***********| <-- Scanline 239 + k +-----+-----+ + | | + +--VBlank--+ + + An NTSC NES has the following refresh and screen layout: + + +--------+ 0 ----+ + | | | + | | | + | Screen | +-- (0-239) 256x240 on-screen results + | | | + | | | + +--------+ 240 --+ + | ?? | +-- (240-242) Unknown + +--------+ 243 --+ + | | | + | VBlank | +-- (243-262) VBlank + | | | + +--------+ 262 --+ + + The Vertical Blank (VBlank) flag is contained in D7 of $2002. It + indicates whether PPU is in VBlank or not. A program can reset D7 by + reading $2002. + + + N. $2005/2006 Magic + ------------------- + For detailed information pertaining to the $2005 and $2006 registers, + refer to Loopy's $2005/2006 document. His document provides entirely + accurate information regarding how these registers work. Contact + Loopy for more information. + + + O. PPU Quirks + ------------- + The first read from VRAM is invalid. Due to this aspect, the NES will + returned pseudo-buffered values from VRAM rather than linear as expec- + ted. See the below example: + + VRAM $2000 contains $AA $BB $CC $DD. + VRAM incrementation value is 1. + The result of execution is printed in the comment field. + + LDA #$20 + STA $2006 + LDA #$00 + STA $2006 ; VRAM address now set at $2000 + LDA $2007 ; A=?? VRAM Buffer=$AA + LDA $2007 ; A=$AA VRAM Buffer=$BB + LDA $2007 ; A=$BB VRAM Buffer=$CC + LDA #$20 + STA $2006 + LDA #$00 + STA $2006 ; VRAM address now set at $2000 + LDA $2007 ; A=$CC VRAM Buffer=$AA + LDA $2007 ; A=$AA VRAM Buffer=$BB + + As shown, the PPU will post-increment it's internal address data after + the first read is performed. This *ONLY APPLIES* to VRAM $0000-3EFF + (e.g. Palette data and their respective mirrors do not suffer from + this phenomenon). + + + P. Notes + -------- + The PPU will auto-increment the VRAM address by 1 or 32 (based on D2 + of $2000) after accessing $2007. + + + ++---------+ +| 5. pAPU | ++---------+ + To be written. Prior information was inaccurate or incorrect. No one + has 100% accurate sound information at this time. This section will + be completed when someone decides to reverse engineer the pAPU section + of the NES, and provide me with information (or a reference to infor- + mation). + + + ++--------------------------------------+ +| 6. Joypads, paddles, expansion ports | ++--------------------------------------+ + + A. General Information + ---------------------- + The NES supports a myriad of input devices, including joypads, Zappers + (light guns), and four-player devices. + + Joypad #1 and #2 are accessed via $4016 and $4017, respectively. + + The joypads are reset via a strobing-method: writing 1, then 0, to + $4016. See Subsection H for information regarding "half-strobing." + + On a full strobe, the joypad's button status will be returned in a + single-bit stream (D0). Multiple reads need to be made to read all the + information about the controller. + + 1 = A 9 = Ignored 17 = +--+ + 2 = B 10 = Ignored 18 = +-- Signature + 3 = SELECT 11 = Ignored 19 = | + 4 = START 12 = Ignored 20 = +--+ + 5 = UP 13 = Ignored 21 = 0 + 6 = DOWN 14 = Ignored 22 = 0 + 7 = LEFT 15 = Ignored 23 = 0 + 8 = RIGHT 16 = Ignored 24 = 0 + + See Subsection G for information about Signatures. + + + B. The Zapper + ------------- + The Zapper (otherwise known as the "Light Gun") simply uses bits + within $4016 and $4017, described in Section 8. See bits D4, D3, and + D0. + + It is possible to have two Zapper units connected to both joypad + ports simultaneously. + + + C. Four-player devices + ---------------------- + Some NES games allow the use of a four-player adapter, extending the + number of usable joypads from two (2) to four (4). Carts which use + the quad-player device are Tengen's "Gauntlet II," and Nintendo's + "RC Pro Am 2." + + All four (4) controllers read their status-bits from D0 of $4016 or + $4017, as Subsection A states. + + For register $4016, reads #1-8 control joypad #1, and reads #9-16 + control joypad #3. For $4017, it is respective for joypad #2 and #4. + + The following is a list of read #s and their results. + + 1 = A 9 = A 17 = +--+ + 2 = B 10 = B 18 = +-- Signature + 3 = SELECT 11 = SELECT 19 = | + 4 = START 12 = START 20 = +--+ + 5 = UP 13 = UP 21 = 0 + 6 = DOWN 14 = DOWN 22 = 0 + 7 = LEFT 15 = LEFT 23 = 0 + 8 = RIGHT 16 = RIGHT 24 = 0 + + See Subsection G for information about Signatures. + + + D. Paddles + ---------- + Taito's "Arkanoid" uses a paddle as it's primary controller. + + The paddle position is read via D1 of $4017; the read data is inverted + (0=1, 1=0). The first value read is the MSB, and the 8th value read is + (obviously) the LSB. Valid value ranges are 98 to 242, where 98 rep- + resents the paddle being turned completely counter-clockwise. + + For example, if %01101011 is read, the value would be NOT'd, making + %10010100 which is 146. + + The paddle also contains one button, which is read via D1 of $4016. A + value of 1 specifies that the button is being pressed. + + + E. Power Pad + ------------ + No information is currently available. + + + F. R.O.B. (Robot Operated Buddy) + -------------------------------- + No information is currently available. + + + G. Signatures + ------------- + A signature allows the programmer to detect if a device is connected + to one of the four (4) ports or not, and if so, what type of device it + is. Valid/known signatures are: + + %0000 = Disconnected + %0001 = Joypad ($4016 only) + %0010 = Joypad ($4017 only) + + + H. Expansion ports + ------------------ + The joypad strobing process requires dual writes: 1, then 0. If the + strobing process is not completed, or occurs in a non-standard order, + the joypads are no longer the item of communication: the expansion + port is. + + For NES users, the expansion port is located on the bottom of the unit, + covered by a small grey piece of plastic. Famicom users have a limited + expansion port on the front of their unit, which was commonly used for + joypads or turbo-joypads. + + Such an example of communicating with the expansion port would be the + following code: + + LDA #%00000001 + STA $4016 + STA $4017 ; Begin read mode of expansion port + LDA #%00000011 ; Write %110 to the expansion port + STA $4016 + + I have yet to encounter a cart which actually uses this method of + communication. + + + I. Notes + -------- + None. + + + ++----------------------------+ +| 7. Memory Mapping Hardware | ++----------------------------+ + + Due to the large number of mappers used (over 64), the "MMC" section + which was once fluid in v0.53 of this document, has now been removed. + + All is not lost, as another document by \FireBug\ of Vertigo 2099 con- + tains accurate information about nearly every mapper in existence. You + can retrieve a copy via one of the following URLs: + + http://free.prohosting.com/~nintendo/mappers.nfo + + Please note I take no responsibility for the information contained in the + aforementioned document. Contact lavos999@aol.com for more information. + + + ++--------------+ +| 8. Registers | ++--------------+ + Programmers communicate with the PPU and pAPU via registers, which are + nothing more than pre-set memory locations which allow the coder to make + changes to the NES. Without registers, programs wouldn't work: period. + + Each register is a 16-bit address. Each register has a statistics field + in parentheses located immediately after its description. The legend: + + R = Readable W = Writable + 2 = Double-write register 16 = 16-bit register + + NOTE: 16-bit registers actually consist of two linear 8-bit registers, + which can (and will be) *INDEPENDANTLY* assigned. The reason for + specifying them as 16-bit is for ease of documentation. For + instance, "$4002+$4003" would mean that D15-D8 would be in $4003, + and D7-D0 would be in $4002. + NOTE: Bits not listed are to be considered unused. + + +---------+----------------------------------------------------------+ + | Address | Description | + +---------+----------------------------------------------------------+ + | $2000 | PPU Control Register #1 (W) | + | | | + | | D7: Execute NMI on VBlank | + | | 0 = Disabled | + | | 1 = Enabled | + | | D6: PPU Master/Slave Selection --+ | + | | 0 = Master +-- UNUSED | + | | 1 = Slave --+ | + | | D5: Sprite Size | + | | 0 = 8x8 | + | | 1 = 8x16 | + | | D4: Background Pattern Table Address | + | | 0 = $0000 (VRAM) | + | | 1 = $1000 (VRAM) | + | | D3: Sprite Pattern Table Address | + | | 0 = $0000 (VRAM) | + | | 1 = $1000 (VRAM) | + | | D2: PPU Address Increment | + | | 0 = Increment by 1 | + | | 1 = Increment by 32 | + | | D1-D0: Name Table Address | + | | 00 = $2000 (VRAM) | + | | 01 = $2400 (VRAM) | + | | 10 = $2800 (VRAM) | + | | 11 = $2C00 (VRAM) | + +---------+----------------------------------------------------------+ + | $2001 | PPU Control Register #2 (W) | + | | | + | | D7-D5: Full Background Colour (when D0 == 1) | + | | 000 = None +------------+ | + | | 001 = Green | NOTE: Do not use more | + | | 010 = Blue | than one type | + | | 100 = Red +------------+ | + | | D7-D5: Colour Intensity (when D0 == 0) | + | | 000 = None +--+ | + | | 001 = Intensify green | NOTE: Do not use more | + | | 010 = Intensify blue | than one type | + | | 100 = Intensify red +--+ | + | | D4: Sprite Visibility | + | | 0 = Sprites not displayed | + | | 1 = Sprites visible | + | | D3: Background Visibility | + | | 0 = Background not displayed | + | | 1 = Background visible | + | | D2: Sprite Clipping | + | | 0 = Sprites invisible in left 8-pixel column | + | | 1 = No clipping | + | | D1: Background Clipping | + | | 0 = BG invisible in left 8-pixel column | + | | 1 = No clipping | + | | D0: Display Type | + | | 0 = Colour display | + | | 1 = Monochrome display | + +---------+----------------------------------------------------------+ + | $2002 | PPU Status Register (R) | + | | | + | | D7: VBlank Occurance | + | | 0 = Not occuring | + | | 1 = In VBlank | + | | D6: Sprite #0 Occurance | + | | 0 = Sprite #0 not found | + | | 1 = PPU has hit Sprite #0 | + | | D5: Scanline Sprite Count | + | | 0 = Eight (8) sprites or less on current scan- | + | | line | + | | 1 = More than 8 sprites on current scanline | + | | D4: VRAM Write Flag | + | | 0 = Writes to VRAM are respected | + | | 1 = Writes to VRAM are ignored | + | | | + | | NOTE: D7 is set to 0 after read occurs. | + | | NOTE: After a read occurs, $2005 is reset, hence the | + | | next write to $2005 will be Horizontal. | + | | NOTE: After a read occurs, $2006 is reset, hence the | + | | next write to $2006 will be the high byte portion. | + | | | + | | For detailed information regarding D6, see Section 4, | + | | Subsection L. | + +---------+----------------------------------------------------------+ + | $2003 | SPR-RAM Address Register (W) | + | | | + | | D7-D0: 8-bit address in SPR-RAM to access via $2004. | + +---------+----------------------------------------------------------+ + | $2004 | SPR-RAM I/O Register (W) | + | | | + | | D7-D0: 8-bit data written to SPR-RAM. | + +---------+----------------------------------------------------------+ + | $2005 | VRAM Address Register #1 (W2) | + | | | + | | Commonly used used to "pan/scroll" the screen (sprites | + | | excluded) horizontally and vertically. However, there | + | | is no actual panning hardware inside the NES. This | + | | register controls VRAM addressing lines. | + | | | + | | Refer to Section 4, Subsection N, for more information. | + +---------+----------------------------------------------------------+ + | $2006 | VRAM Address Register #2 (W2) | + | | | + | | Commonly used to specify the 16-bit address in VRAM to | + | | access via $2007. However, this register controls VRAM | + | | addressing bits, and therefore should be used with | + | | knowledge of how it works, and when it works. | + | | | + | | Refer to Section 4, Subsection N, for more information. | + +---------+----------------------------------------------------------+ + | $2007 | VRAM I/O Register (RW) | + | | | + | | D7-D0: 8-bit data read/written from/to VRAM. | + +---------+----------------------------------------------------------+ + | $4000 | pAPU Pulse #1 Control Register (W) | + | $4001 | pAPU Pulse #1 Ramp Control Register (W) | + | $4002 | pAPU Pulse #1 Fine Tune (FT) Register (W) | + | $4003 | pAPU Pulse #1 Coarse Tune (CT) Register (W) | + | $4004 | pAPU Pulse #2 Control Register (W) | + | $4005 | pAPU Pulse #2 Ramp Control Register (W) | + | $4006 | pAPU Pulse #2 Fine Tune Register (W) | + | $4007 | pAPU Pulse #2 Coarse Tune Register (W) | + | $4008 | pAPU Triangle Control Register #1 (W) | + | $4009 | pAPU Triangle Control Register #2 (?) | + | $400A | pAPU Triangle Frequency Register #1 (W) | + | $400B | pAPU Triangle Frequency Register #2 (W) | + | $400C | pAPU Noise Control Register #1 (W) | + | $400D | Unused (???) | + | $400E | pAPU Noise Frequency Register #1 (W) | + | $400F | pAPU Noise Frequency Register #2 (W) | + | $4010 | pAPU Delta Modulation Control Register (W) | + | $4011 | pAPU Delta Modulation D/A Register (W) | + | $4012 | pAPU Delta Modulation Address Register (W) | + | $4013 | pAPU Delta Modulation Data Length Register (W) | + +---------+----------------------------------------------------------+ + | $4014 | Sprite DMA Register (W) | + | | | + | | Transfers 256 bytes of memory into SPR-RAM. The address | + | | read from is $100*N, where N is the value written. | + +---------+----------------------------------------------------------+ + | $4015 | pAPU Sound/Vertical Clock Signal Register (R) | + | | | + | | D6: Vertical Clock Signal IRQ Availability | + | | 0 = One (1) frame occuring, hence IRQ cannot | + | | occur | + | | 1 = One (1) frame is being interrupted via IRQ | + | | D4: Delta Modulation | + | | D3: Noise | + | | D2: Triangle | + | | D1: Pulse #2 | + | | D0: Pulse #1 | + | | 0 = Not in use | + | | 1 = In use | + | +----------------------------------------------------------+ + | | pAPU Channel Control (W) | + | | | + | | D4: Delta Modulation | + | | D3: Noise | + | | D2: Triangle | + | | D1: Pulse #2 | + | | D0: Pulse #1 | + | | 0 = Channel disabled | + | | 1 = Channel enabled | + +---------+----------------------------------------------------------+ + | $4016 | Joypad #1 (RW) | + | | | + | | READING: | + | | D4: Zapper Trigger | + | | 0 = Pulled | + | | 1 = Released (not held) | + | | D3: Zapper Sprite Detection | + | | 0 = Sprite not in position | + | | 1 = Sprite in front of cross-hair | + | | D0: Joypad Data | + | +----------------------------------------------------------+ + | | WRITING: | + | | Joypad Strobe (W) | + | | | + | | D0: Joypad Strobe | + | | 0 = Clear joypad strobe | + | | 1 = Reset joypad strobe | + | +----------------------------------------------------------+ + | | WRITING: | + | | Expansion Port Latch (W) | + | | | + | | D0: Expansion Port Method | + | | 0 = Write | + | | 1 = Read | + +---------+----------------------------------------------------------+ + | $4017 | Joypad #2/SOFTCLK (RW) | + | | | + | | READING: | + | | D7: Vertical Clock Signal (External) | + | | 0 = Not occuring | + | | 1 = Occuring | + | | D6: Vertical Clock Signal (Internal) | + | | 0 = Occuring (D6 of $4016 affected) | + | | 1 = Not occuring (D6 of $4016 untouchable) | + | | D4: Zapper Trigger | + | | 0 = Pulled | + | | 1 = Released (not held) | + | | D3: Zapper Sprite Detection | + | | 0 = Sprite not in position | + | | 1 = Sprite in front of cross-hair | + | | D0: Joypad Data | + | +----------------------------------------------------------+ + | | WRITING: | + | | Expansion Port Latch (W) | + | | | + | | D0: Expansion Port Method | + | | 0 = ??? | + | | 1 = Read | + +---------+----------------------------------------------------------+ + + + ++-----------------+ +| 9. File Formats | ++-----------------+ + + A. iNES Format (.NES) + --------------------- + +--------+------+------------------------------------------+ + | Offset | Size | Content(s) | + +--------+------+------------------------------------------+ + | 0 | 3 | 'NES' | + | 3 | 1 | $1A | + | 4 | 1 | 16K PRG-ROM page count | + | 5 | 1 | 8K CHR-ROM page count | + | 6 | 1 | ROM Control Byte #1 | + | | | %####vTsM | + | | | | ||||+- 0=Horizontal mirroring | + | | | | |||| 1=Vertical mirroring | + | | | | |||+-- 1=SRAM enabled | + | | | | ||+--- 1=512-byte trainer present | + | | | | |+---- 1=Four-screen mirroring | + | | | | | | + | | | +--+----- Mapper # (lower 4-bits) | + | 7 | 1 | ROM Control Byte #2 | + | | | %####0000 | + | | | | | | + | | | +--+----- Mapper # (upper 4-bits) | + | 8-15 | 8 | $00 | + | 16-.. | | Actual 16K PRG-ROM pages (in linear | + | ... | | order). If a trainer exists, it precedes | + | ... | | the first PRG-ROM page. | + | ..-EOF | | CHR-ROM pages (in ascending order). | + +--------+------+------------------------------------------+ + + + ++-------------------------+ +| 10. Programming the NES | ++-------------------------+ + + A. General Information + ---------------------- + None. + + + B. CPU Notes + ------------ + None. See Section 11, Subsection B for more possible information. + + + C. PPU Notes + ------------ + Reading and writing to VRAM consists of a multi-step process: + + Writing to VRAM Reading from VRAM + --------------- ----------------- + 1) Wait for VBlank 1) Wait for VBlank + 2) Write upper VRAM address 2) Write upper VRAM address + byte into $2006 byte into $2006 + 3) Write lower VRAM address 3) Write lower VRAM address + byte into $2006 byte into $2006 + 4) Write data to $2007 4) Read $2007 (invalid data once) + 5) Read data from $2007 + + NOTE: Step #4 when reading VRAM is only necessary when reading + VRAM data not in the $3F00-3FFF range. + + NOTE: Accessing VRAM should only be performed during VBlank. Attempts + to access VRAM outside of VBlank will usually result in garbage + showing up on the screen. See Section 4, Subsection N for more + information regarding why this occurs. + + Waiting for VBlank is quite simple: + + 8000: LDA $2002 + BPL $8000 + + Reading $2002 will result in all bits being returned; however, D7 + will be reset to 0 after the read is performed. + + The actual on-screen palette used by the NES, as stated prior, is not + RGB. However, a near-exact replica can be found in common NES emulators + today. Contact the appropriate authors of these emulators to obtain + a valid RGB palette. + + Be sure to clear the internal VRAM address via $2006 semi-often. You + will often encounter a situation where a palette fade or a VRAM update + will cause the screen "to be trashed" (squares on the screen, or what + seem to be graphical "glitches"). The reason for this is that your code + took longer than a VBlank. When the VBlank goes to refresh the screen + with the data in the PPU, it takes whatever value is in the internal + VRAM address and uses that as the starting base for Name Table #0. + The solution is to fix your code by re-assigning the VRAM address to + $0000 (or $2000), so that the refresh may occur successfully. Such + code would be: + + LDA #$00 + STA $2006 + STA $2006 + + You will find code like this in commercial games quite often. + + + ++---------------+ +| 11. Emulation | ++---------------+ + + A. General Information + ---------------------- + If you're going to be programming an emulator in C or C++, please be + familiar with pointers. Being familiar with pointers will help you + out severely when it comes to handling mirroring and VRAM addressing. + For you assembly buffs out there, obviously pointers are nothing more + than indirect addressing -- it's easier to change a 32-bit value than + to swap in and out an entire 64K of data. + + When SRAM ($6000-7FFF) is disabled, writes to the memory area should + be ignored. Reads will possibly return data previously left on the + bus, and therefore when emulated should return 0 (or should be trap- + ped). + + RAM-based memory areas ($0000-07FF) should *NOT* be zeroed on RESET; + they should be zeroed on power on/off. (Technically, the RAM is not + zeroed on power on/off either: the RAM will slowly dissapate over + time when the unit it off. However, for emulation purposes, please + make sure that a cold boot and a warm boot do different things). + + See Section 12, Subsection E for Mailing List information. + + + B. CPU Notes + ------------ + The NES does not use a 65c02 (CMOS) CPU as rumored. + + Ignore opcodes which are bad (or support the option of trapping them). + Some ROM images out there, such as "Adventures of Lolo" contain bad + opcodes, due to dirty connectors on the cartridge during the extract- + ion process (or other reasons). + + There are 154 valid opcodes (out of 256 total) on the NES. + + + C. PPU Notes + ------------ + The formulae to calculate the base address of a Name Table tile number + is: + + (TILENUM * 16) + PATTERNTABLE + + Where TILENUM is the tile number in the Name Table, and PATTERNTABLE + is the Pattern Table Address defined via register $2000. + + It's recommended that DOS programmers use what is known as "MODE-Q," + a 256x256x256 "tweaked" video mode, for writing their emulator. Try to + avoid Mode-X modes, as they are non-chained, and result in painfully + slow graphics. Chained modes (like MODE-13h) are linear, and work + best for speedy graphics. Since the NES's resolution is 256x240, the + aforementioned "MODE-Q" should meet all necessary requirements. + + Most emulators do not limit the number of sprites which can be displayed + per scanline, while the actual NES will show flicker as a result of more + than eight (8). {Put some more garbage here; it's early...} + + Emulators should _NOT_ mask out unused bits within registers; doing so + may result in a cart not working. + + + D. APU Notes + ------------ + To be written. + + + ++------------------------+ +| 12. Reference Material | ++------------------------+ + + A. CPU Information + ------------------ + None. + + + B. PPU Information + ------------------ + None. + + + C. APU Information + ------------------ + None. + + + D. MMC Information + ------------------ + None. + + + E. Mailing Lists + ---------------- + There is a NES Development Mailing List in existence. Contact Mark Knibbs + for more information. This list is for anyone who wishes to discuss tech- + nical issues about the NES; it is not a list for picking up the latest + and greatest information about NES emulators or what not. + + + F. WWW Sites + ------------ + The following are a list of WWW sites which contain NES-oriented + material. If you encounter errors, bad links, or other anomolies + while visiting these sites, contact the site authors/owners, NOT + me. Thanks. + + http://nesdev.parodius.com/ + + Contains a verbose amount of documentation regarding anything + NES-oriented, including hard-to-find mapper documentation. Seems + to be a decent NES information depository. + + http://www.ameth.org/~veilleux/NES_info.html + + Currently only contains hardware-oriented material, such as + overviews of cart and unit ASICs, mappers, and MMCs. Many + pinout diagrams for mappers and NES units are available here. + Also provides documentation on NES repair, modifying your NES + to give stereo output, applying stereo mixing to your NES, and + much much more. + + + G. Hardware Information + ----------------------- + The following security bits may be purchased from MCM Electronics + (http://www.mcmelectronics.com/): + + For NES carts: 22-1145 (3.8mm security bit) + For NES units: 22-1150 (4.5mm security bit) + + The 4.5mm security screw is also used for the Super Nintendo Enter- + tainment System (SNES), and Nintendo 64. + +