Memory Pack Commands

Those commands were figured out and tested on real hardware by ikari_01.

All references to Memory Map are based on the HiROM memory map from BS-X. There are also Memory Packs that are only ROM and does not support those commands as the content will always be fixed.

To send commands, you need to write bytes to the FLASH memory: To do $C00000 = 0x38D0, you must write 0x38 first, then 0xD0.

These are based on Sharp Flash Memory commands: http://pdf.datasheetcatalog.com/datasheet/Sharp/mXvqssy.pdf

Type 1/3/4 commands:

$C00000 = If equal to :
          0x00   = Return to reading array data(? seems to be unreliable, 0xFF works better)
          0x0807 = copy vendor information block to current page
          0x10   = Program Byte (write $10 to $C00000; then write data to desired address)
          0x20D0 = Page Erase (write to $C10000 -> erase C10000-C1FFFF, etc.)
          0x38D0 = Reset Vendor Info to defaults.
          0x40   = Program Byte (same thing as above)
          0x50   = Clear Status Register
          0x70   = "finalize", must be used after flashing with command 0x10.
                   Otherwise an error 41 will occur.
                   It's also a Read CSR command.
          0x71   = Read Extended Status Registers (GSR and PSR)
          0x72   = Toggle Page Buffers (toggles $C00004 between $x7 and $x6
                   and influences which data is shown on command 0x75)
          0x74   = Write to Page Buffer. Followed by one write to the desired address.
                   Changes are persistent until command 0x38D0 is issued (see above).
          0x75   = Show Page Buffer. Vendor info as we know it is only shown when $C00004 is $x6.
                   Otherwise some other (unknown) data is shown.
          0x77D0 = Lock Page
          0x90   = Intelligent Identifier (Read two times to access to ID codes)
          0x97D0 = Upload Status Bits
          0x99D0 = Upload Device Info
          0xA7D0 = Chip Erase (NOT SUPPORTED in Type 3)
          0xB0D0 = Suspend/Resume Erase Process
          0xFF   = Return to reading array data

Type 2 commands:

$C02AAA = Written after first command for $C05555.
          xx = 55
$C05555 = If equal to :
          0xAAxx10 = Unknown
          0xAAxx30 = Unknown
          0xAAxx70 = Write Disabled
          0xAAxx80 = Unknown
          0xAAxxA0 = Page Buffer Access + Write Enabled
          0xAAxxF0 = Page Buffer Access, Read and Write disabled.

Reading flash area while any operation is pending will return a status byte in every address. e.g. after writing 0x20, flash data will read back "0x80" (or sometimes "0xB0"). Then, when writing 0xD0, flash data will read back "0x00" (or sometimes "0x30") until the process is completed (so until the page is erased in this example).

Writing Byte on FLASH Memory only ANDs the byte you're addressing. You may need to erase the page/chip to 0xFFs first.

Page Buffer / Vendor Info

Memory Pack that uses ROM chips have this data on the ROM itself. It does not appear on Flash Memory Packs by default!

It appears at $C0FF00 :

$00 = Always 0x4D 'M'
$01 = 
$02 = Always 0x50 'P'
$03 = 
$04 = bit0 & 7 = 0
$05 = 
$06 = Memory Pack Information
      Type: 0x1?= Type1, 0x2?=Type 2, 0x3?=Type 3, 0x4?=Type 4
      Size: 0x?8=2Mb, 0x?9=4Mb, 0x?A= 8Mb (released), 0x?B=16Mb, 0x?C=32Mb
      The other sizes are supported but were never released.
$07 = 
$08 = 
$09 = 
$0A = 
$0B = 
$0C = 
$0D = 
$0E = 
$0F =

Status Registers

Compatible Status Register (CSR)

Appears at any reads after using Read CSR command.

Bit(s) - Description
0-2 - Reserved
3   - Vpp Status
       1 = Vpp Low Detect, Operation Abort
       0 = Vpp OK
4   - Data Write Status
       1 = Error
       0 = Success
5   - Page Erase Status
       1 = Error
       0 = Success
6   - Erase Suspend Check
       1 = Suspended
       0 = In Progress/Done
7   - Write State Status
       1 = Ready to Write
       0 = Busy

Extended Status Registers

Global Status Register (GSR)

This register appears at $C0-FF:0004.

0   - Page Buffer (Vendor Info) Select Status
       1 = Page Buffer 1
       0 = Page Buffer 0
1   - Page Buffer Status
       1 = Selected Page Buffer Ready
       0 = Selected Page Buffer Busy
2   - Page Buffer Available Status
       1 = Available
       0 = Not Available
3   - Queue Status
       1 = Full
       0 = Available
4   - Device Sleep Status
       1 = In Sleep
       0 = Not in Sleep
5   - Device Operation Status
       1 = Unsuccessful
       0 = Successful
6   - Operation Suspend Status
       1 = Suspended
       0 = In Progress/Done
7   - Write State Machine Status
       1 = Ready
       0 = Busy

Page Status Register (PSR)

This register appears at $C0-FF:0002. (Depends of the page)

The size of a page is 0x10000 bytes, a full HiROM bank.

0-1 - Reserved
2   - Vpp Status
       1 = Vpp Low Detect, Operation Abort
       0 = Vpp OK
3   - Queue Status
       1 = Full
       0 = Available
4   - Page Operation Abort Status
       1 = Aborted
       0 = Not Aborted
5   - Page Operation Status
       1 = Unsuccessful
       0 = In Progress/Done
6   - Page Lock Status
       1 = Unlocked for Erase/Write
       0 = Locked for Erase/Write
7   - Page Status
       1 = Ready
       0 = Busy

SFC Development Wiki