Emulation History

The decompression was completely cracked on Saturday, July 19th, 2008.

[[DecompTest0.c:file]] [[DecompTest1.c:file]] [[DecompTest2.c:file]]

SPC7110 Info, Reverse Engineered by & (c) Dark Force 

New data added by The Dumper 


SPC7110 Rom Map (far east of eden zero) 
40mb total: 8mb program rom (000000-0FFFFF) + 32mb data rom (100000-4FFFFF) 
program rom mapped to $C0:0000-$CF:FFFF/$80:0000-$8F:FFFF 
data rom in 8mb chunks can be mapped to hirom areas using the bank mapping regs 
default mapping: data rom 000000-2FFFFF mapped to $D0:0000-$FF:FFFF 
data decompressed from data rom by spc7110 mapped to $50:0000-$50:FFFF 

SPC7110 Sram Map 
$006000 - $007FFF sram 8k (slow rom?) 
$306000 - $307FFF mirrored sram from $006000 - $007FFF (fast rom?) 


defval: = default power-on/reset register value 

SPC7110 Registers, banks $00/$80 
$4800   DECOMPRESSED DATA CONTINUOUS READ PORT: returns a decompressed value from bank $50 and decrements 16 bit counter value at $4809/A by 1 
$4801   COMPRESSED DATA TABLE POINTER: ($0000FF) low offset, defval:00 
$4802   COMPRESSED DATA TABLE POINTER: ($00FF00) high offset, defval:00 
$4803   COMPRESSED DATA TABLE POINTER: ($FF0000) bank, defval:00 
$4804   COMPRESSED DATA TABLE INDEX: index of 32 bit compressed data pointer (big-endian), defval:00 
$4805   DECOMPRESSED DATA OFFSET: ($00FF) low byte of offset in bank $50, defval:00 
$4806   DECOMPRESSED DATA OFFSET: ($FF00) high byte of offset in bank $50, defval:00 
$4807   DMA CHANNEL FOR DECOMPRESSION, set to match snes dma channel used for compressed data, defval:00 
$4808   C r/w option, unknown, defval:00 
$4809   COMPRESSION LENGTH COUNTER: ($00FF) low byte, defval:00 
            write: set start counter value low byte 
            read: get counter value low byte 
$480A   COMPRESSION LENGTH COUNTER: ($FF00) high byte, defval:00 
            write: set start counter value high byte 
            read: get counter value high byte 
$480B   DECOMPRESSION COMMAND MODE: see decompression command modes, defval:00 
$480C   DECOMPRESSION FINISHED STATUS: high bit set = done, high bit clear = processing, cleared after successful read, 
            high bit is cleared after writing to $4806, $4809/A is set to compressed data length, defval:00 


;---------- 

My testing leads me to believe that the direct ROM read section starts out 
as inactive. 

One of the ways to activate direct reads is to write a non-zero value to $4813. 
No other action need be taken. You can write a non-zero value and immediately 
write a zero to it and that's OK.  The order of writes to $4811/2/3 don't 
seem to matter so long as $4813 has been written to once with a non-zero 
value.  There may be a way to deactivate the direct reads again (maybe a 
decompression cycle?) but I haven't tested that. 

There appears to be another way to activate direct reads that is more complex 
but I haven't quite pinned that down yet. 

;---------- 



$4810   DATA ROM CONTINUOUS READ PORT: returns a byte from data rom at data rom pointer location, defval:00 
$4811   DATA ROM POINTER: ($0000FF) r/w low offset, defval:00   ( $4811/2/3 may increment on a $4810 read depending on data rom command mode byte ) 
$4812   DATA ROM POINTER: ($00FF00) r/w high offset, defval:00 
$4813   DATA ROM POINTER: ($FF0000) r/w bank offset, defval:00 
            bank offset is zero based from start of data rom: banks $00-$3f data rom -> $10-$4f full rom 


; The $4814/$4815 pair is sometimes incremented on $4810 reads (depending on data rom command mode byte) 

$4814   DATA ROM POINTER ADJUST: ($00FF) low byte, defval:00   (Pointer is 16-bits - wraps at 16-bits) 
$4815   DATA ROM POINTER ADJUST: ($FF00) high byte, defval:00  (Addition with $4811/2/3 is 24-bits) 


$4816   DATA ROM POINTER INCREMENT: ($00FF) low byte, defval:00 
$4817   DATA ROM POINTER INCREMENT: ($FF00) high byte, defval:00 
$4818   DATA ROM COMMAND MODE: bit field control of data rom pointer (see data rom command mode byte), defval:00 
            write: set command mode, 
            read: performs action instead of returning value, unknown purpose, 
            command mode is loaded to $4818 but only set after writing to both $4814 and $4815 in any order 
$481A   DATA ROM READ AFTER ADJUST PORT: returns a byte from data rom at data rom pointer location + adjust value ($4814/5), defval:00 
$4820   16 BIT MULTIPLICAND: ($00FF) low byte, defval:00 
        32 BIT DIVIDEND: ($000000FF) low byte of low word, defval:00 
$4821   16 BIT MULTIPLICAND: ($FF00) high byte, defval:00 
        32 BIT DIVIDEND: ($0000FF00) high byte of low word, defval:00 
$4822   32 BIT DIVIDEND: ($00FF0000) low byte of high word, defval:00 
$4823   32 BIT DIVIDEND: ($FF000000) high byte of high word, defval:00 
$4824   16 BIT MULTIPLIER: ($00FF) low byte, defval:00 
$4825   16 BIT MULTIPLIER: ($FF00) high byte, defval:00 
$4826   16 BIT DIVISOR: ($00FF), defval:00 
$4827   16 BIT DIVISOR: ($FF00), defval:00 
$4828   32 BIT PRODUCT: ($000000FF) low byte of low word, defval:00 
        32 BIT QUOTIENT:($000000FF) low byte of low word, defval:00 
$4829   32 BIT PRODUCT: ($0000FF00) high byte of low word, defval:00 
        32 BIT QUOTIENT:($0000FF00) high byte of low word, defval:00 
$482A   32 BIT PRODUCT: ($00FF0000) low byte of high word, defval:00 
        32 BIT QUOTIENT:($00FF0000) low byte of high word, defval:00 
$482B   32 BIT PRODUCT: ($FF000000) high byte of high word, defval:00 
        32 BIT QUOTIENT:($FF000000) high byte of high word, defval:00 
$482C   16 BIT REMAINDER: ($00FF) low byte, defval:00 
$482D   16 BIT REMAINDER: ($FF00) high byte, defval:00 
$482E   MUL/DIV RESET, write = reset $4820 to $482D, defval:00 
$482F   MUL/DIV FINISHED STATUS: high bit, on = processing, off = finished, 
            high bit is set after a write to multiplier or divisor regs $4825/$4827, defval:00 
$4830   SRAM CHIP ENABLE/DISABLE: high bit, on = enable, off = disable, defval:00 
$4831   ROM BANK MAPPING A $D0:0000-$DF:FFFF, see bank mapping modes, defval:00 
$4832   ROM BANK MAPPING B $E0:0000-$EF:FFFF, see bank mapping modes, defval:01 
$4833   ROM BANK MAPPING C $F0:0000-$FF:FFFF, see bank mapping modes, defval:02 
$4834   SRAM BANK MAPPING?, workings unknown, defval:00 
$4840   RTC CHIP ENABLE/DISABLE: low bit, on = enable, off = disable, defval:00 
$4841   RTC INDEX/DATA PORT: 
            first write after rtc enable: rtc command mode byte (see rtc command modes) 
            subsequent writes: index of rtc register to read/write (00-0f) 
            read: returns value of indexed rtc register 
            auto-increment of register index occurs after each subsequent read/write 
$4842   RTC READY STATUS: high bit set = ready, high bit clear = processing, tested before reading rtc data 
            high bit cleared after successful read 


Decompression Command Modes: 
00 - manual decompression, $4800 is used to read directly from the data rom 
     ( really - disable offset modes x2/x4 (x8?) ) 

02 - hardware decompression, decompressed data is mapped to $50:0000, $4800 can be used to read sequentially from bank $50 
     ( enable offset modes based on first byte in table index?  offset_mode/addr-h/addr-m/addr-l 
       offset mode: offset start by $4805/6 times value 
       00 = x1 offset 
       01 = x2 offset ? 
       02 = x4 offset ? 
       03 = ??? ) 

Note: decompression mode is activated after writing to $4806 and finishes after reading the high bit of $480C 


Note: The $4814-$4815 pair can optionally be used as an offset to the base address in $4811/$4812/$4813 
      The $4816-$4817 pair can optionally be used as an increment value 

Data Rom Command Mode Byte: 
X6543210 
|||||||| 
||||||||__ : 0 - use 1 as the increment value, add immediately after reading $4810 
|||||||    : 1 - use $4816 as increment value, add immediately after reading $4810 
|||||||___ : 0 - disable $4814/5 offset addition 
||||||     : 1 - enable $4814/5 addition as an offset to the base address in $4811/2/3 
||||||____ : 0 - unsigned calculation for $4816 
|||||        1 - signed calculation for $4816 
|||||_____ : 0 - unsigned calculation for $4814 
||||         1 - signed calculation for $4814 
||||______ : 0 - increment value gets added to $4811/2/3 
|||          1 - increment value gets added to $4814/5 
| \_______ : 00 - disable exceptions to $4814/5 offset addition (listed below) 
|          : 01 - 8 bit offset addition using $4814, immediately after writing to $4814/5 
|          : 10 - 16 bit offset addition using $4814/5, immediately after writing to $4814/5 
|          : 11 - 16 bit offset addition using $4814/5, only after reading $481A 
|_________ : unused 

Note: the data rom command mode is activated only after registers $4814 and $4815 have been written to, regardless of the order they were written to 


Bank Mapping Modes: 
00 - use data rom 000000-0FFFFF for mapping 
01 - use data rom 100000-1FFFFF for mapping 
02 - use data rom 200000-2FFFFF for mapping 
03 - use data rom 300000-3FFFFF for mapping 


RTC Command Modes: 
03 - normal sequential read/write mode 
0c - sequential read/write mode also 
other commands unknown as of yet 


RTC Registers (8 bit values):   [default values] 
00 - seconds 1's digit                 00 
01 - seconds 10's digit                00 
02 - minutes 1's digit                 00 
03 - minutes 10's digit                00 
04 - hours 1's digit                   00 
05 - hours 10's digit                  00 
06 - day of month 1's digit            01 
07 - day of month 10's digit           00 
08 - month 1's digit                   01 
09 - month 10's digit                  00 
0a - year 1's digit                    00 
0b - year 10's digit                   00 
0c - day of week                       00 
0d - control register                  01 
0e - control register                  0F 
0f - control register                  06 


RTC Control Register Bits: 
Register 0d 
XXXXXX10 
      ||_ : 0 - normal timer operation 
      |     1 - pause rtc registers updating, time still increments normally 
      |__ : 0 - disable rtc interrupts 
            1 - enable rtc interrupts 

Register 0e 
XXXX3210 
    \\\|_ : unknown 

Register 0f 
XXXXX210 
     |||_ : 0 - normal 
     ||     1 - stops timer and resets seconds to 00 (date set to 01/01/00 00:00:00 ?) 
     ||__ : 0 - normal timer operation 
     |      1 - stop timer 
     |___ : 0 - 12 hour time, bit 2 of "hours 10's digit" register contains am/pm bit (am=0,pm=1) 
            1 - 24 hour time

SPC7110F0a Chip Information

====================================================================================
SPC7110F0a Chip information 
-------------------------------------------------------------
(c) by kammedo
www.yntproject.net, yoninnotranslators@hotmail.com
-------------------------------------------------------------
====================================================================================



This file contains information about the SPC7110F0a chip, which can be found in the following game paks :



*Far East Of Eden Zero (FEoEZ)

*Super Power League 4 (SPL4)

*Momotarou Densetsu Happy (MDH)



There are two types of game pak board layouts that use the SPC7110F0a : 



SHVC-LDH3C-01 FEoEZ game pak board, type 1

SHVC-BDH3B-01 SPL4 and MDH game pak boards, type 2



The difference between the two is represented mainly by the Real Time Clock (RTC) used only in type 1. For the rest, 

both of them show two separate MASK ROMS (MROM), U1 and U2, U1 containing program data ("8M MROM" on FEoEZ, "P MROM"

on the other boards) while U2 contains compressed data ("16/32M MROM" on type 1, "D MROM" on type 2). 

U2 on type 2 is 40 pins in size, while on type 1 it has 44, which obviously points out at different memory sizes.



On both types, The SPC7110F0a uses two (data and address) interfaces, one to the SNES core and one to U2:



*the SNES interface has an 8 bit data bus  (which is labeled FB1-8 on type 1) and a 24 bit Address bus for both types.

*the U2 interface of type 1 uses a 8 bit data bus (SPC Pins 31-34 and 36-39) and a 22 bit Address bus.

*the U2 interface of type 2 uses a 8 bit data bus.



The SPC7110 provides both /WR and /RD commands. Actually, no /OE or /CS input has been located.



The SPC7110 includes the adress decoding logic for both memory chips and its own.

To sustain this theory the facts that U1 /OE (pin 2) is connected to ground, and the /CE (pin 13) come directly from

the SPC (pin 47), and the /CE (pin 34) of U2 is connected to ground, while the /OE (pin 36) comes from the pin 48 of the SPC.



The addres and data bus of U2 on both board layouts are all directly connected to the SPC7110 only. 

This makes external addressing impossible; the only way to get to the content of the U2 chip is through the 

manual decompression mode. (refer to Darkforce's doc, Spc7110r.txt).





The U2 on type 1 is 32 Mbit in size. The SPC7110 uses only the lower 8 bits of the U2 on type 1, and D15 as the 

byte swapping switch (high / low byte).



The U2 on type 2 is 32 Mbit in size. The adress lines are shifted by one left (aka SPCA0 on MROMA1) and D15 is used on A0

as the byte swapping (high / low as in type 1 board) switch.



==================================================================================================================

PINOUTS (based on type 1 Board)!

==================================================================================================================



NC stands for Not Connected.





--------------------------------------

Pinout of SPC7110F0a:

--------------------------------------



  80              ...51

81 -------------------- 50

   |                  | 

   |                  | 

   |                  | .

   |                  | .

   |*                 | 31 

100--------------------

   1...              30







A) 1-30



This side of the chip interfaces to the Address bus of the SNES and the read/write commands.

Left the pins of the chip, right the respectIve connected entity.



Pin nr  1 (A8)	: SNES-A8 (Conn  9)

Pin nr  2 	: GND

Pin nr  3 (A7)	: SNES-A7 (Conn 10)

Pin nr  4 (A6)	: SNES-A6 (Conn 11)

Pin nr  5 (A5)	: SNES-A5 (Conn 12)

Pin nr  6 (A4)	: SNES-A4 (Conn 13)

Pin nr  7 (A3)	: SNES-A3 (Conn 14)

Pin nr  8 (A2)	: SNES-A2 (Conn 15)

Pin nr  9 (A1)	: SNES-A1 (Conn 16)

Pin nr 10 (A0)	: SNES-A0 (Conn 17)

Pin nr 11 	: GND

Pin nr 12 	: Vcc

Pin nr 13 (A12)	: SNES-A12 (Conn 37)

Pin nr 14 (A13)	: SNES-A13 (Conn 38)

Pin nr 15 (A14)	: SNES-A14 (Conn 39)

Pin nr 16 (A15)	: SNES-A15 (Conn 40), Type 1 U1_19

Pin nr 17 (A16)	: SNES-BA0 (Conn 41)

Pin nr 18 (A17)	: SNES-BA1 (Conn 42), Type 1, U1_17

Pin nr 19 (A18)	: SNES-BA2 (Conn 43), Type 1, U1_18

Pin nr 20 (A19)	: SNES-BA3 (Conn 44)

Pin nr 21 (A20)	: SNES-BA4 (Conn 45)

Pin nr 22 (A21)	: SNES-BA5 (Conn 46)

Pin nr 23 (A22)	: SNES-BA6 (Conn 47)

Pin nr 24 (A23)	: SNES-BA7 (Conn 48)

Pin nr 25 (/RD)	: SNES-/RD (Conn 23)

Pin nr 26 (/WR)	: SNES-/WR (Conn 54)

Pin nr 27 (RESET):SNES-RESET (Conn 26)

Pin nr 28 (?1)	: Connected through R2 and R3 (serial) and C20 to Connector 1.



  *So far, on the picture of game pak that can be found on the net, Pin 28 and 

   Pin 29 are connected only by one resistor (R2),and then possibly to Connector 1 (this has to

   be verified)- Tension Partitioner? 



Pin nr 29 (?2)	: Connected through R3 and C20 to Connector 1 (possible low-pass filter?).

Pin nr 30 	: GND



B) 31-50



This side of the chip interfaces U2 (compressed data ROM)



Pin nr 31 : Type 1 U2_D7, Type 2 U2_D7

Pin nr 32 : Type 1 U2_D6, Type 2 U2_D6

Pin nr 33 : Type 1 U2_D5, Type 2 U2_D5

Pin nr 34 : Type 1 U2_D4, Type 2 U2_D4

Pin nr 35 : GND

Pin nr 36 : Type 1 U2_D3, Type 2 U2_D3

Pin nr 37 : Type 1 U2_D2, Type 2 U2_D2

Pin nr 38 : Type 1 U2_D1, Type 2 U2_D1

Pin nr 39 : Type 1 U2_D0, Type 2 U2_D0

Pin nr 40 : Vcc

Pin nr 41 : GND

Pin nr 42 : Type 1 U2_A21 (NC on type 2)

Pin nr 43 : Type 1 U2_A20  (NC on type 2)

Pin nr 44 : Type 1 U2_A19, Type 2 U2_A20

Pin nr 45 : Type 1 U2_A18, Type 2 U2_A19

Pin nr 46 : GND

Pin nr 47 : Type 1 U1_/CE, Type 2 U1_/CE

Pin nr 48 : Type 1 U2_/OE, Type 2 U2_/CE

Pin nr 49 : Type 1 U2_A17, Type 2 U2_A18

Pin nr 50 : Type 1 U2_A16, Type 2 U2_A17



C) 51-80



This side of the chip interfaces U2 (last Adress data lines and Co.)

Pin nr 51 : Vcc

Pin nr 52 : GND

Pin nr 53 : Type 1 U2_A15, Type 2 U2_A16

Pin nr 54 : Type 1 U2_A14, Type 2 U2_A15

Pin nr 55 : Type 1 U2_A13, Type 2 U2_A14

Pin nr 56 : Type 1 U2_A12, Type 2 U2_A13

Pin nr 57 : Type 1 U2_A11, Type 2 U2_A12

Pin nr 58 : GND

Pin nr 59 : Type 1 U2_A10, Type 2 U2_A11

Pin nr 60 : Type 1 U2_A9, Type 2 U2_A10

Pin nr 61 : Type 1 U2_A8, Type 2 U2_A9

Pin nr 62 : Type 1 U2_A7, Type 2 U2_A8

Pin nr 63 : Vcc

Pin nr 64 : GND

Pin nr 65 : Type 1 U2_A6, Type 2 U2_A7

Pin nr 66 : Type 1 U2_A5, Type 2 U2_A6

Pin nr 67 : Type 1 U2_A4, Type 2 U2_A5

Pin nr 68 : Type 1 U2_A3, Type 2 U2_A4

Pin nr 69 : GND

Pin nr 70 : Type 1 U2_A2, Type 2 U2_A3

Pin nr 71 : Type 1 U2_A1, Type 2 U2_A2

Pin nr 72 : Type 1 U2_A0, Type 2 U2_A1

Pin nr 73 : Type 1 U2_D15, Type 2 U2_A0

Pin nr 74 : Vcc

Pin nr 75 : GND

Pin nr 76 : Type 1 SRAM_RESET

Pin nr 77 : Type 1 RTC_Data

Pin nr 78 : Type 1 RTC_CLK

Pin nr 79 : Type 1 RTC_/CE

Pin nr 80 : Vcc



D)Pin 81-100



This side of the Pin interfaces to the SNES's data bus.



Pin nr  81 : Vcc

Pin nr  82 : GND

Pin nr  83 : GND

Pin nr  84 : GND

Pin nr  85 : Vcc

Pin nr  86 : GND

Pin nr  87 (D7): Type 1 FB8/D7/SRAM_D7

Pin nr  88 (D6): Type 1 FB7/D6/SRAM_D6

Pin nr  89 (D5): Type 1 FB6/D5/SRAM_D5

Pin nr  90 (D4): Type 1 FB5/D4/SRAM_D4

Pin nr  91 : GND

Pin nr  92 (D3): Type 1 FB4/D3/SRAM_D3

Pin nr  93 (D2): Type 1 FB3/D2/SRAM_D2

Pin nr  94 (D1): Type 1 FB2/D1/SRAM_D1

Pin nr  95 (D0): Type 1 FB1/D0/SRAM_D0

Pin nr  96 : GND

Pin nr  97 : Vcc

Pin nr  98 (A11): Type 1 SNES-A11 (Conn 6)

Pin nr  99 (A10): Type 1 SNES-A10 (Conn 7)

Pin nr 100 (A09): Type 1 SNES-A9 (Conn 8)





The following chips can be found on the FEoEZ board (type 1).



--------------------------------------

The RTC-4513 chip is mapped as follows. I only include it for completition, you can easily get any Datasheet about it on the net.

This chip implements the RTC for the SPC7110F0a.



  14..               8

  --------------------

  |                  | 

  |*                 | 

  --------------------

  1...               7



Note : the "/" in the pin lists is used as a separator. If the signal has a not, there will be two (as "//")



Pin 1 : NC

Pin 2 : DATA : RTC_S_DATA (SPC Pin 77)

Pin 3 : STD.P : NC

Pin 4 : NC

Pin 5 : NC

Pin 6 : Vdd  : VCC

Pin 7 : NC

Pin 8 : NC

Pin 9 : GND

Pin 10 : NC

Pin 11 : NC

Pin 12 : CE  : RTC_CE    (SPC Pin 79)

Pin 13 : CLK : RTC_CLOCK (SPC Pin 78)

Pin 14 : NC



--------------------------------------

The MM1026AF Chip (found on both board layouts)is mapped as follows. 

I only include it for completition, you can easily get any Datasheet about it on the net. It is used for battery recharging : 

power source switching for the S-RAM management. Switch to Battery power once the main power turns off.



  14..               8

  --------------------

  |                  | 

  |*                 | 

  --------------------

  1...               7





--------------------------------------

The 8M Mask ROM (U1, SHVC-AZRJ-0 P LH5389N9 9549 D) on type one is mapped as follows :



  32...             17

  --------------------

  |                  | 

  |*                 | 

  --------------------

  1...              16



Pin 1 :A17

Pin 2 :A18

Pin 3 :A15

Pin 4 :A12

Pin 5 :A7

Pin 6 :A6

Pin 7 :A5

Pin 8 :A4

Pin 9 :A3

Pin 10 :A2

Pin 11 :A1

Pin 12 :A0

Pin 13 :D0

Pin 14 :D1

Pin 15 :D2

Pin 16 :GND

Pin 17 :D3

Pin 18 :D4

Pin 19 :D5

Pin 20 :D6

Pin 21 :D7

Pin 22 :/CE

Pin 23 :A10

Pin 24 :A16

Pin 25 :A11

Pin 26 :A9

Pin 27 :A8 

Pin 28 : A13 

Pin 29 : A14 

Pin 30 : A19 

Pin 31 : /OE 

Pin 32 : VCC 





--------------------------------------

The 16/32M Mask ROM (U2, SHVC-AZRJ-0 D LH535KN2 9550 E) on type 1 is mapped as follows :



  44...             23

  --------------------

  |                  | 

  |*                 | 

  --------------------

  1...              22



Pin 1 : A21 

Pin 2 : A18 

Pin 3 : A17 

Pin 4 : A7  

Pin 5 : A6  

Pin 6 : A5  

Pin 7 : A4  

Pin 8 : A3  

Pin 9 : A2  

Pin 10 : A1  

Pin 11 : A0  

Pin 12 : /CE 

Pin 13 : GND 

Pin 14 : /OE 

Pin 15 : D0  

Pin 16 : D8  

Pin 17 : D1  

Pin 18 : D9  

Pin 19 : D2  

Pin 20 : D10 

Pin 21 : D3  

Pin 22 : D11 

Pin 23 : VCC 

Pin 24 : D4  

Pin 25 : D12 

Pin 26 : D5  

Pin 27 : D13 

Pin 28 : D6  

Pin 29 : D14 

Pin 30 : D7 

Pin 31 : D15

Pin 32 : GND

Pin 33 : +5V

Pin 34 : A16

Pin 35 : A15

Pin 36 : A14

Pin 37 : A13

Pin 38 : A12

Pin 39 : A11

Pin 40 : A10

Pin 41 : A09

Pin 42 : A08

Pin 43 : A19

Pin 44 : A20









--------------------------------------

The D and P MROM chips on type 2 have the following layout :



  40...             21

  --------------------

  |                  | 

  |*                 | 

  --------------------

  1...              20







Pin 1: D3

Pin 2: GND

Pin 3: GND

Pin 4: A20

Pin 5: A21

Pin 6: A17

Pin 7: A18

Pin 8: A15

Pin 9: A12

Pin 10: A7

Pin 11: A6

Pin 12: A5

Pin 13: A4

Pin 14: A3

Pin 15: A2

Pin 16: A1

Pin 17: A0

Pin 18: D0

Pin 19: D1

Pin 20: D2

Pin 21: GND

Pin 22: D4

Pin 23: D5

Pin 24: D6

Pin 25: D7

Pin 26: /CE

Pin 27: A10

Pin 28: A16

Pin 29: A11

Pin 30: A9

Pin 31: A8

Pin 32: A13

Pin 33: A14

Pin 34: A19

Pin 35: /OE

Pin 36: Vcc

Pin 37: A22

Pin 38: Vcc

Pin 39: Vcc

Pin 40: Vcc

 

--------------------------------------

The 64K SRAM Chip (HY6264A LLJ-10) is mapped as follows:



SRAM (8KB) 6264 Pinout:

                        __  __

                   +5V |01\/28| +5V

                   A12 |02  27| :WE

                    A7 |03  26| RESET

                    A6 |04  25| A8

                    A5 |05  24| A9

                    A4 |06  23| A11

                    A3 |07  22| :OE

                    A2 |08  21| A10

                    A1 |09  20| :CE

                    A0 |10  19| D7

                    D0 |11  18| D6

                    D1 |12  17| D5

                    D2 |13  16| D4

                   GND |14  15| D3

                        ------



pin :CE connected to Address Decoder

pin :OE connected to :CE in ROM

pin :WE connected to SNES pin #54

pin #26 connected to SNES pin #26 (RESET) and MAD-1 pin #09



==================================================================================================================

Memory Mapper $3F (courtesy of Charles MacDonald, cgfm2.emuviews.com)

==================================================================================================================



Banks

00-1F : SRAM @ 6000-7FFF, U1 ROM @ 8000-FFFF (1MB)

20-3F : SRAM @ 6000-7FFF, U2 ROM @ 8000-FFFF (banked?)

40-4F : Unused (reads return last value on data bus; e.g. bank address)

50 : 64K SPC7110 internal RAM

51-57 : Unused (as above)

58 : SPC7110 data port

59-7D : Unused (as above)

80-9F : 8K SRAM @ 6000-7FFF, U1 ROM @ 8000-FFFF (1MB)

A0-BF : 8K SRAM @ 6000-7FFF, U2 ROM @ 8000-FFFF (banked?)

C0-CF : U1 ROM (1MB)

D0-DF : U2 ROM (banked)

E0-EF : U2 ROM (banked)

F0-FF : U2 ROM (banked)





==================================================================================================================

SELF CHECK INFORMATION

==================================================================================================================

*The text of the test screens is located at ROM location $CFF022. There is no table. This bitch is coded 

in a (to me at least) orginal fashion.  The routine that loads the byte sequence starts at $CFE358.



*At $CFF150 the ROM presents the test values used for testing the SRAM (in the format SRAM_OFFSET/VALUE, 2 bytes 

each).



The SPC Check presents two modes - MODE 1 and MODE 2.



MODE 1

----------------------



MODE 1 is accessed by pressing the A button at the first boot up.



By activating the SRAM (#$80 to $4830)the SNES compares the last 16 bytes of it with the text located at ROM addr.

$C02F25 (SNES addr format) - the infamous "SPC7110 CHECK OK".  If more than 3 bytes are not matching,it starts the

self tests. 



REG INIT

Firstly it checks the SPC's registers via a simple read/compare action. The registers to test are defined in a 

table located at $CFF1B9 (Snes addr. format). The compared values are stored at offset $CFF211 (1 Byte, 4 values). 

Specifically, those values are used to check the SPC ROM Bank mapping regs ($4831-33) & SRAM ($4830).

Apparently, on boot the SRAM should result not active ($4830=$00), and the three mappings #$00, #$01, #$02 

(from A to C the same order). 



S-RAM DATA BUS

The SRAM is initialized one byte at a time to $FF (via the $00:6000 bus).



The tests firstly check the first 8 bytes of the DROM (sequence :0102040810204080) 

and then the 8 last ones (sequence :FEFDFBF7EFDFBF7F, which is the first sequence ex-ored).





MODE 2

----------------------



MODE 2 is accessed by pressing the B button at the first boot up, or at the second if test in MODE 1 has been

succesfully performed. It checks for a SRAM and RTC backup. 



The following is checked: 

*TODO'



*Does it skip the tests if a joy pad key is pressed?



==========================================================================================

CREDITS



*First Credit goes to Darkforce, mentor of DeJap, great ASM & ROM Hacker. He dumped the 

whole Graphics packs, with the great help of The Dumper - if it wasnt for those two you

still would not be playing FEoEZ & Co!



*The pinouts of the 16/32M and 8M ROM, type two MROMS's as well as the SRAM pinouts can be found here :

http://nintendoallstars.w.interia.pl/romlab/sneslab.htm - siudym@pf.pl



*neviksti, for taking the time to point out the (many) flaws 

==========================================================================================

http://nesdev.parodius.com/bbs/viewtopic.php?p=35060#35060

http://board.zsnes.com/phpBB2/viewtopic.php?p=173127#173127