Emulation History
The decompression was completely cracked on Saturday, July 19th, 2008.
DecompTest0.c DecompTest1.c DecompTest2.c
SPC7110 Info, Reverse Engineered by & (c) Dark Force
New data added by The Dumper
SPC7110 Rom Map (far east of eden zero)
40mb total: 8mb program rom (000000-0FFFFF) + 32mb data rom (100000-4FFFFF)
program rom mapped to $C0:0000-$CF:FFFF/$80:0000-$8F:FFFF
data rom in 8mb chunks can be mapped to hirom areas using the bank mapping regs
default mapping: data rom 000000-2FFFFF mapped to $D0:0000-$FF:FFFF
data decompressed from data rom by spc7110 mapped to $50:0000-$50:FFFF
SPC7110 Sram Map
$006000 - $007FFF sram 8k (slow rom?)
$306000 - $307FFF mirrored sram from $006000 - $007FFF (fast rom?)
defval: = default power-on/reset register value
SPC7110 Registers, banks $00/$80
$4800 DECOMPRESSED DATA CONTINUOUS READ PORT: returns a decompressed value from bank $50 and decrements 16 bit counter value at $4809/A by 1
$4801 COMPRESSED DATA TABLE POINTER: ($0000FF) low offset, defval:00
$4802 COMPRESSED DATA TABLE POINTER: ($00FF00) high offset, defval:00
$4803 COMPRESSED DATA TABLE POINTER: ($FF0000) bank, defval:00
$4804 COMPRESSED DATA TABLE INDEX: index of 32 bit compressed data pointer (big-endian), defval:00
$4805 DECOMPRESSED DATA OFFSET: ($00FF) low byte of offset in bank $50, defval:00
$4806 DECOMPRESSED DATA OFFSET: ($FF00) high byte of offset in bank $50, defval:00
$4807 DMA CHANNEL FOR DECOMPRESSION, set to match snes dma channel used for compressed data, defval:00
$4808 C r/w option, unknown, defval:00
$4809 COMPRESSION LENGTH COUNTER: ($00FF) low byte, defval:00
write: set start counter value low byte
read: get counter value low byte
$480A COMPRESSION LENGTH COUNTER: ($FF00) high byte, defval:00
write: set start counter value high byte
read: get counter value high byte
$480B DECOMPRESSION COMMAND MODE: see decompression command modes, defval:00
$480C DECOMPRESSION FINISHED STATUS: high bit set = done, high bit clear = processing, cleared after successful read,
high bit is cleared after writing to $4806, $4809/A is set to compressed data length, defval:00
;----------
My testing leads me to believe that the direct ROM read section starts out
as inactive.
One of the ways to activate direct reads is to write a non-zero value to $4813.
No other action need be taken. You can write a non-zero value and immediately
write a zero to it and that's OK. The order of writes to $4811/2/3 don't
seem to matter so long as $4813 has been written to once with a non-zero
value. There may be a way to deactivate the direct reads again (maybe a
decompression cycle?) but I haven't tested that.
There appears to be another way to activate direct reads that is more complex
but I haven't quite pinned that down yet.
;----------
$4810 DATA ROM CONTINUOUS READ PORT: returns a byte from data rom at data rom pointer location, defval:00
$4811 DATA ROM POINTER: ($0000FF) r/w low offset, defval:00 ( $4811/2/3 may increment on a $4810 read depending on data rom command mode byte )
$4812 DATA ROM POINTER: ($00FF00) r/w high offset, defval:00
$4813 DATA ROM POINTER: ($FF0000) r/w bank offset, defval:00
bank offset is zero based from start of data rom: banks $00-$3f data rom -> $10-$4f full rom
; The $4814/$4815 pair is sometimes incremented on $4810 reads (depending on data rom command mode byte)
$4814 DATA ROM POINTER ADJUST: ($00FF) low byte, defval:00 (Pointer is 16-bits - wraps at 16-bits)
$4815 DATA ROM POINTER ADJUST: ($FF00) high byte, defval:00 (Addition with $4811/2/3 is 24-bits)
$4816 DATA ROM POINTER INCREMENT: ($00FF) low byte, defval:00
$4817 DATA ROM POINTER INCREMENT: ($FF00) high byte, defval:00
$4818 DATA ROM COMMAND MODE: bit field control of data rom pointer (see data rom command mode byte), defval:00
write: set command mode,
read: performs action instead of returning value, unknown purpose,
command mode is loaded to $4818 but only set after writing to both $4814 and $4815 in any order
$481A DATA ROM READ AFTER ADJUST PORT: returns a byte from data rom at data rom pointer location + adjust value ($4814/5), defval:00
$4820 16 BIT MULTIPLICAND: ($00FF) low byte, defval:00
32 BIT DIVIDEND: ($000000FF) low byte of low word, defval:00
$4821 16 BIT MULTIPLICAND: ($FF00) high byte, defval:00
32 BIT DIVIDEND: ($0000FF00) high byte of low word, defval:00
$4822 32 BIT DIVIDEND: ($00FF0000) low byte of high word, defval:00
$4823 32 BIT DIVIDEND: ($FF000000) high byte of high word, defval:00
$4824 16 BIT MULTIPLIER: ($00FF) low byte, defval:00
$4825 16 BIT MULTIPLIER: ($FF00) high byte, defval:00
$4826 16 BIT DIVISOR: ($00FF), defval:00
$4827 16 BIT DIVISOR: ($FF00), defval:00
$4828 32 BIT PRODUCT: ($000000FF) low byte of low word, defval:00
32 BIT QUOTIENT:($000000FF) low byte of low word, defval:00
$4829 32 BIT PRODUCT: ($0000FF00) high byte of low word, defval:00
32 BIT QUOTIENT:($0000FF00) high byte of low word, defval:00
$482A 32 BIT PRODUCT: ($00FF0000) low byte of high word, defval:00
32 BIT QUOTIENT:($00FF0000) low byte of high word, defval:00
$482B 32 BIT PRODUCT: ($FF000000) high byte of high word, defval:00
32 BIT QUOTIENT:($FF000000) high byte of high word, defval:00
$482C 16 BIT REMAINDER: ($00FF) low byte, defval:00
$482D 16 BIT REMAINDER: ($FF00) high byte, defval:00
$482E MUL/DIV RESET, write = reset $4820 to $482D, defval:00
$482F MUL/DIV FINISHED STATUS: high bit, on = processing, off = finished,
high bit is set after a write to multiplier or divisor regs $4825/$4827, defval:00
$4830 SRAM CHIP ENABLE/DISABLE: high bit, on = enable, off = disable, defval:00
$4831 ROM BANK MAPPING A $D0:0000-$DF:FFFF, see bank mapping modes, defval:00
$4832 ROM BANK MAPPING B $E0:0000-$EF:FFFF, see bank mapping modes, defval:01
$4833 ROM BANK MAPPING C $F0:0000-$FF:FFFF, see bank mapping modes, defval:02
$4834 SRAM BANK MAPPING?, workings unknown, defval:00
$4840 RTC CHIP ENABLE/DISABLE: low bit, on = enable, off = disable, defval:00
$4841 RTC INDEX/DATA PORT:
first write after rtc enable: rtc command mode byte (see rtc command modes)
subsequent writes: index of rtc register to read/write (00-0f)
read: returns value of indexed rtc register
auto-increment of register index occurs after each subsequent read/write
$4842 RTC READY STATUS: high bit set = ready, high bit clear = processing, tested before reading rtc data
high bit cleared after successful read
Decompression Command Modes:
00 - manual decompression, $4800 is used to read directly from the data rom
( really - disable offset modes x2/x4 (x8?) )
02 - hardware decompression, decompressed data is mapped to $50:0000, $4800 can be used to read sequentially from bank $50
( enable offset modes based on first byte in table index? offset_mode/addr-h/addr-m/addr-l
offset mode: offset start by $4805/6 times value
00 = x1 offset
01 = x2 offset ?
02 = x4 offset ?
03 = ??? )
Note: decompression mode is activated after writing to $4806 and finishes after reading the high bit of $480C
Note: The $4814-$4815 pair can optionally be used as an offset to the base address in $4811/$4812/$4813
The $4816-$4817 pair can optionally be used as an increment value
Data Rom Command Mode Byte:
X6543210
||||||||
||||||||__ : 0 - use 1 as the increment value, add immediately after reading $4810
||||||| : 1 - use $4816 as increment value, add immediately after reading $4810
|||||||___ : 0 - disable $4814/5 offset addition
|||||| : 1 - enable $4814/5 addition as an offset to the base address in $4811/2/3
||||||____ : 0 - unsigned calculation for $4816
||||| 1 - signed calculation for $4816
|||||_____ : 0 - unsigned calculation for $4814
|||| 1 - signed calculation for $4814
||||______ : 0 - increment value gets added to $4811/2/3
||| 1 - increment value gets added to $4814/5
| \_______ : 00 - disable exceptions to $4814/5 offset addition (listed below)
| : 01 - 8 bit offset addition using $4814, immediately after writing to $4814/5
| : 10 - 16 bit offset addition using $4814/5, immediately after writing to $4814/5
| : 11 - 16 bit offset addition using $4814/5, only after reading $481A
|_________ : unused
Note: the data rom command mode is activated only after registers $4814 and $4815 have been written to, regardless of the order they were written to
Bank Mapping Modes:
00 - use data rom 000000-0FFFFF for mapping
01 - use data rom 100000-1FFFFF for mapping
02 - use data rom 200000-2FFFFF for mapping
03 - use data rom 300000-3FFFFF for mapping
RTC Command Modes:
03 - normal sequential read/write mode
0c - sequential read/write mode also
other commands unknown as of yet
RTC Registers (8 bit values): [default values]
00 - seconds 1's digit 00
01 - seconds 10's digit 00
02 - minutes 1's digit 00
03 - minutes 10's digit 00
04 - hours 1's digit 00
05 - hours 10's digit 00
06 - day of month 1's digit 01
07 - day of month 10's digit 00
08 - month 1's digit 01
09 - month 10's digit 00
0a - year 1's digit 00
0b - year 10's digit 00
0c - day of week 00
0d - control register 01
0e - control register 0F
0f - control register 06
RTC Control Register Bits:
Register 0d
XXXXXX10
||_ : 0 - normal timer operation
| 1 - pause rtc registers updating, time still increments normally
|__ : 0 - disable rtc interrupts
1 - enable rtc interrupts
Register 0e
XXXX3210
\\\|_ : unknown
Register 0f
XXXXX210
|||_ : 0 - normal
|| 1 - stops timer and resets seconds to 00 (date set to 01/01/00 00:00:00 ?)
||__ : 0 - normal timer operation
| 1 - stop timer
|___ : 0 - 12 hour time, bit 2 of "hours 10's digit" register contains am/pm bit (am=0,pm=1)
1 - 24 hour time
SPC7110F0a Chip Information
====================================================================================
SPC7110F0a Chip information
-------------------------------------------------------------
(c) by kammedo
www.yntproject.net, yoninnotranslators@hotmail.com
-------------------------------------------------------------
====================================================================================
This file contains information about the SPC7110F0a chip, which can be found in the following game paks :
*Far East Of Eden Zero (FEoEZ)
*Super Power League 4 (SPL4)
*Momotarou Densetsu Happy (MDH)
There are two types of game pak board layouts that use the SPC7110F0a :
SHVC-LDH3C-01 FEoEZ game pak board, type 1
SHVC-BDH3B-01 SPL4 and MDH game pak boards, type 2
The difference between the two is represented mainly by the Real Time Clock (RTC) used only in type 1. For the rest,
both of them show two separate MASK ROMS (MROM), U1 and U2, U1 containing program data ("8M MROM" on FEoEZ, "P MROM"
on the other boards) while U2 contains compressed data ("16/32M MROM" on type 1, "D MROM" on type 2).
U2 on type 2 is 40 pins in size, while on type 1 it has 44, which obviously points out at different memory sizes.
On both types, The SPC7110F0a uses two (data and address) interfaces, one to the SNES core and one to U2:
*the SNES interface has an 8 bit data bus (which is labeled FB1-8 on type 1) and a 24 bit Address bus for both types.
*the U2 interface of type 1 uses a 8 bit data bus (SPC Pins 31-34 and 36-39) and a 22 bit Address bus.
*the U2 interface of type 2 uses a 8 bit data bus.
The SPC7110 provides both /WR and /RD commands. Actually, no /OE or /CS input has been located.
The SPC7110 includes the adress decoding logic for both memory chips and its own.
To sustain this theory the facts that U1 /OE (pin 2) is connected to ground, and the /CE (pin 13) come directly from
the SPC (pin 47), and the /CE (pin 34) of U2 is connected to ground, while the /OE (pin 36) comes from the pin 48 of the SPC.
The addres and data bus of U2 on both board layouts are all directly connected to the SPC7110 only.
This makes external addressing impossible; the only way to get to the content of the U2 chip is through the
manual decompression mode. (refer to Darkforce's doc, Spc7110r.txt).
The U2 on type 1 is 32 Mbit in size. The SPC7110 uses only the lower 8 bits of the U2 on type 1, and D15 as the
byte swapping switch (high / low byte).
The U2 on type 2 is 32 Mbit in size. The adress lines are shifted by one left (aka SPCA0 on MROMA1) and D15 is used on A0
as the byte swapping (high / low as in type 1 board) switch.
==================================================================================================================
PINOUTS (based on type 1 Board)!
==================================================================================================================
NC stands for Not Connected.
--------------------------------------
Pinout of SPC7110F0a:
--------------------------------------
80 ...51
81 -------------------- 50
| |
| |
| | .
| | .
|* | 31
100--------------------
1... 30
A) 1-30
This side of the chip interfaces to the Address bus of the SNES and the read/write commands.
Left the pins of the chip, right the respectIve connected entity.
Pin nr 1 (A8) : SNES-A8 (Conn 9)
Pin nr 2 : GND
Pin nr 3 (A7) : SNES-A7 (Conn 10)
Pin nr 4 (A6) : SNES-A6 (Conn 11)
Pin nr 5 (A5) : SNES-A5 (Conn 12)
Pin nr 6 (A4) : SNES-A4 (Conn 13)
Pin nr 7 (A3) : SNES-A3 (Conn 14)
Pin nr 8 (A2) : SNES-A2 (Conn 15)
Pin nr 9 (A1) : SNES-A1 (Conn 16)
Pin nr 10 (A0) : SNES-A0 (Conn 17)
Pin nr 11 : GND
Pin nr 12 : Vcc
Pin nr 13 (A12) : SNES-A12 (Conn 37)
Pin nr 14 (A13) : SNES-A13 (Conn 38)
Pin nr 15 (A14) : SNES-A14 (Conn 39)
Pin nr 16 (A15) : SNES-A15 (Conn 40), Type 1 U1_19
Pin nr 17 (A16) : SNES-BA0 (Conn 41)
Pin nr 18 (A17) : SNES-BA1 (Conn 42), Type 1, U1_17
Pin nr 19 (A18) : SNES-BA2 (Conn 43), Type 1, U1_18
Pin nr 20 (A19) : SNES-BA3 (Conn 44)
Pin nr 21 (A20) : SNES-BA4 (Conn 45)
Pin nr 22 (A21) : SNES-BA5 (Conn 46)
Pin nr 23 (A22) : SNES-BA6 (Conn 47)
Pin nr 24 (A23) : SNES-BA7 (Conn 48)
Pin nr 25 (/RD) : SNES-/RD (Conn 23)
Pin nr 26 (/WR) : SNES-/WR (Conn 54)
Pin nr 27 (RESET):SNES-RESET (Conn 26)
Pin nr 28 (?1) : Connected through R2 and R3 (serial) and C20 to Connector 1.
*So far, on the picture of game pak that can be found on the net, Pin 28 and
Pin 29 are connected only by one resistor (R2),and then possibly to Connector 1 (this has to
be verified)- Tension Partitioner?
Pin nr 29 (?2) : Connected through R3 and C20 to Connector 1 (possible low-pass filter?).
Pin nr 30 : GND
B) 31-50
This side of the chip interfaces U2 (compressed data ROM)
Pin nr 31 : Type 1 U2_D7, Type 2 U2_D7
Pin nr 32 : Type 1 U2_D6, Type 2 U2_D6
Pin nr 33 : Type 1 U2_D5, Type 2 U2_D5
Pin nr 34 : Type 1 U2_D4, Type 2 U2_D4
Pin nr 35 : GND
Pin nr 36 : Type 1 U2_D3, Type 2 U2_D3
Pin nr 37 : Type 1 U2_D2, Type 2 U2_D2
Pin nr 38 : Type 1 U2_D1, Type 2 U2_D1
Pin nr 39 : Type 1 U2_D0, Type 2 U2_D0
Pin nr 40 : Vcc
Pin nr 41 : GND
Pin nr 42 : Type 1 U2_A21 (NC on type 2)
Pin nr 43 : Type 1 U2_A20 (NC on type 2)
Pin nr 44 : Type 1 U2_A19, Type 2 U2_A20
Pin nr 45 : Type 1 U2_A18, Type 2 U2_A19
Pin nr 46 : GND
Pin nr 47 : Type 1 U1_/CE, Type 2 U1_/CE
Pin nr 48 : Type 1 U2_/OE, Type 2 U2_/CE
Pin nr 49 : Type 1 U2_A17, Type 2 U2_A18
Pin nr 50 : Type 1 U2_A16, Type 2 U2_A17
C) 51-80
This side of the chip interfaces U2 (last Adress data lines and Co.)
Pin nr 51 : Vcc
Pin nr 52 : GND
Pin nr 53 : Type 1 U2_A15, Type 2 U2_A16
Pin nr 54 : Type 1 U2_A14, Type 2 U2_A15
Pin nr 55 : Type 1 U2_A13, Type 2 U2_A14
Pin nr 56 : Type 1 U2_A12, Type 2 U2_A13
Pin nr 57 : Type 1 U2_A11, Type 2 U2_A12
Pin nr 58 : GND
Pin nr 59 : Type 1 U2_A10, Type 2 U2_A11
Pin nr 60 : Type 1 U2_A9, Type 2 U2_A10
Pin nr 61 : Type 1 U2_A8, Type 2 U2_A9
Pin nr 62 : Type 1 U2_A7, Type 2 U2_A8
Pin nr 63 : Vcc
Pin nr 64 : GND
Pin nr 65 : Type 1 U2_A6, Type 2 U2_A7
Pin nr 66 : Type 1 U2_A5, Type 2 U2_A6
Pin nr 67 : Type 1 U2_A4, Type 2 U2_A5
Pin nr 68 : Type 1 U2_A3, Type 2 U2_A4
Pin nr 69 : GND
Pin nr 70 : Type 1 U2_A2, Type 2 U2_A3
Pin nr 71 : Type 1 U2_A1, Type 2 U2_A2
Pin nr 72 : Type 1 U2_A0, Type 2 U2_A1
Pin nr 73 : Type 1 U2_D15, Type 2 U2_A0
Pin nr 74 : Vcc
Pin nr 75 : GND
Pin nr 76 : Type 1 SRAM_RESET
Pin nr 77 : Type 1 RTC_Data
Pin nr 78 : Type 1 RTC_CLK
Pin nr 79 : Type 1 RTC_/CE
Pin nr 80 : Vcc
D)Pin 81-100
This side of the Pin interfaces to the SNES's data bus.
Pin nr 81 : Vcc
Pin nr 82 : GND
Pin nr 83 : GND
Pin nr 84 : GND
Pin nr 85 : Vcc
Pin nr 86 : GND
Pin nr 87 (D7): Type 1 FB8/D7/SRAM_D7
Pin nr 88 (D6): Type 1 FB7/D6/SRAM_D6
Pin nr 89 (D5): Type 1 FB6/D5/SRAM_D5
Pin nr 90 (D4): Type 1 FB5/D4/SRAM_D4
Pin nr 91 : GND
Pin nr 92 (D3): Type 1 FB4/D3/SRAM_D3
Pin nr 93 (D2): Type 1 FB3/D2/SRAM_D2
Pin nr 94 (D1): Type 1 FB2/D1/SRAM_D1
Pin nr 95 (D0): Type 1 FB1/D0/SRAM_D0
Pin nr 96 : GND
Pin nr 97 : Vcc
Pin nr 98 (A11): Type 1 SNES-A11 (Conn 6)
Pin nr 99 (A10): Type 1 SNES-A10 (Conn 7)
Pin nr 100 (A09): Type 1 SNES-A9 (Conn 8)
The following chips can be found on the FEoEZ board (type 1).
--------------------------------------
The RTC-4513 chip is mapped as follows. I only include it for completition, you can easily get any Datasheet about it on the net.
This chip implements the RTC for the SPC7110F0a.
14.. 8
--------------------
| |
|* |
--------------------
1... 7
Note : the "/" in the pin lists is used as a separator. If the signal has a not, there will be two (as "//")
Pin 1 : NC
Pin 2 : DATA : RTC_S_DATA (SPC Pin 77)
Pin 3 : STD.P : NC
Pin 4 : NC
Pin 5 : NC
Pin 6 : Vdd : VCC
Pin 7 : NC
Pin 8 : NC
Pin 9 : GND
Pin 10 : NC
Pin 11 : NC
Pin 12 : CE : RTC_CE (SPC Pin 79)
Pin 13 : CLK : RTC_CLOCK (SPC Pin 78)
Pin 14 : NC
--------------------------------------
The MM1026AF Chip (found on both board layouts)is mapped as follows.
I only include it for completition, you can easily get any Datasheet about it on the net. It is used for battery recharging :
power source switching for the S-RAM management. Switch to Battery power once the main power turns off.
14.. 8
--------------------
| |
|* |
--------------------
1... 7
--------------------------------------
The 8M Mask ROM (U1, SHVC-AZRJ-0 P LH5389N9 9549 D) on type one is mapped as follows :
32... 17
--------------------
| |
|* |
--------------------
1... 16
Pin 1 :A17
Pin 2 :A18
Pin 3 :A15
Pin 4 :A12
Pin 5 :A7
Pin 6 :A6
Pin 7 :A5
Pin 8 :A4
Pin 9 :A3
Pin 10 :A2
Pin 11 :A1
Pin 12 :A0
Pin 13 :D0
Pin 14 :D1
Pin 15 :D2
Pin 16 :GND
Pin 17 :D3
Pin 18 :D4
Pin 19 :D5
Pin 20 :D6
Pin 21 :D7
Pin 22 :/CE
Pin 23 :A10
Pin 24 :A16
Pin 25 :A11
Pin 26 :A9
Pin 27 :A8
Pin 28 : A13
Pin 29 : A14
Pin 30 : A19
Pin 31 : /OE
Pin 32 : VCC
--------------------------------------
The 16/32M Mask ROM (U2, SHVC-AZRJ-0 D LH535KN2 9550 E) on type 1 is mapped as follows :
44... 23
--------------------
| |
|* |
--------------------
1... 22
Pin 1 : A21
Pin 2 : A18
Pin 3 : A17
Pin 4 : A7
Pin 5 : A6
Pin 6 : A5
Pin 7 : A4
Pin 8 : A3
Pin 9 : A2
Pin 10 : A1
Pin 11 : A0
Pin 12 : /CE
Pin 13 : GND
Pin 14 : /OE
Pin 15 : D0
Pin 16 : D8
Pin 17 : D1
Pin 18 : D9
Pin 19 : D2
Pin 20 : D10
Pin 21 : D3
Pin 22 : D11
Pin 23 : VCC
Pin 24 : D4
Pin 25 : D12
Pin 26 : D5
Pin 27 : D13
Pin 28 : D6
Pin 29 : D14
Pin 30 : D7
Pin 31 : D15
Pin 32 : GND
Pin 33 : +5V
Pin 34 : A16
Pin 35 : A15
Pin 36 : A14
Pin 37 : A13
Pin 38 : A12
Pin 39 : A11
Pin 40 : A10
Pin 41 : A09
Pin 42 : A08
Pin 43 : A19
Pin 44 : A20
--------------------------------------
The D and P MROM chips on type 2 have the following layout :
40... 21
--------------------
| |
|* |
--------------------
1... 20
Pin 1: D3
Pin 2: GND
Pin 3: GND
Pin 4: A20
Pin 5: A21
Pin 6: A17
Pin 7: A18
Pin 8: A15
Pin 9: A12
Pin 10: A7
Pin 11: A6
Pin 12: A5
Pin 13: A4
Pin 14: A3
Pin 15: A2
Pin 16: A1
Pin 17: A0
Pin 18: D0
Pin 19: D1
Pin 20: D2
Pin 21: GND
Pin 22: D4
Pin 23: D5
Pin 24: D6
Pin 25: D7
Pin 26: /CE
Pin 27: A10
Pin 28: A16
Pin 29: A11
Pin 30: A9
Pin 31: A8
Pin 32: A13
Pin 33: A14
Pin 34: A19
Pin 35: /OE
Pin 36: Vcc
Pin 37: A22
Pin 38: Vcc
Pin 39: Vcc
Pin 40: Vcc
--------------------------------------
The 64K SRAM Chip (HY6264A LLJ-10) is mapped as follows:
SRAM (8KB) 6264 Pinout:
__ __
+5V |01\/28| +5V
A12 |02 27| :WE
A7 |03 26| RESET
A6 |04 25| A8
A5 |05 24| A9
A4 |06 23| A11
A3 |07 22| :OE
A2 |08 21| A10
A1 |09 20| :CE
A0 |10 19| D7
D0 |11 18| D6
D1 |12 17| D5
D2 |13 16| D4
GND |14 15| D3
------
pin :CE connected to Address Decoder
pin :OE connected to :CE in ROM
pin :WE connected to SNES pin #54
pin #26 connected to SNES pin #26 (RESET) and MAD-1 pin #09
==================================================================================================================
Memory Mapper $3F (courtesy of Charles MacDonald, cgfm2.emuviews.com)
==================================================================================================================
Banks
00-1F : SRAM @ 6000-7FFF, U1 ROM @ 8000-FFFF (1MB)
20-3F : SRAM @ 6000-7FFF, U2 ROM @ 8000-FFFF (banked?)
40-4F : Unused (reads return last value on data bus; e.g. bank address)
50 : 64K SPC7110 internal RAM
51-57 : Unused (as above)
58 : SPC7110 data port
59-7D : Unused (as above)
80-9F : 8K SRAM @ 6000-7FFF, U1 ROM @ 8000-FFFF (1MB)
A0-BF : 8K SRAM @ 6000-7FFF, U2 ROM @ 8000-FFFF (banked?)
C0-CF : U1 ROM (1MB)
D0-DF : U2 ROM (banked)
E0-EF : U2 ROM (banked)
F0-FF : U2 ROM (banked)
==================================================================================================================
SELF CHECK INFORMATION
==================================================================================================================
*The text of the test screens is located at ROM location $CFF022. There is no table. This bitch is coded
in a (to me at least) orginal fashion. The routine that loads the byte sequence starts at $CFE358.
*At $CFF150 the ROM presents the test values used for testing the SRAM (in the format SRAM_OFFSET/VALUE, 2 bytes
each).
The SPC Check presents two modes - MODE 1 and MODE 2.
MODE 1
----------------------
MODE 1 is accessed by pressing the A button at the first boot up.
By activating the SRAM (#$80 to $4830)the SNES compares the last 16 bytes of it with the text located at ROM addr.
$C02F25 (SNES addr format) - the infamous "SPC7110 CHECK OK". If more than 3 bytes are not matching,it starts the
self tests.
REG INIT
Firstly it checks the SPC's registers via a simple read/compare action. The registers to test are defined in a
table located at $CFF1B9 (Snes addr. format). The compared values are stored at offset $CFF211 (1 Byte, 4 values).
Specifically, those values are used to check the SPC ROM Bank mapping regs ($4831-33) & SRAM ($4830).
Apparently, on boot the SRAM should result not active ($4830=$00), and the three mappings #$00, #$01, #$02
(from A to C the same order).
S-RAM DATA BUS
The SRAM is initialized one byte at a time to $FF (via the $00:6000 bus).
The tests firstly check the first 8 bytes of the DROM (sequence :0102040810204080)
and then the 8 last ones (sequence :FEFDFBF7EFDFBF7F, which is the first sequence ex-ored).
MODE 2
----------------------
MODE 2 is accessed by pressing the B button at the first boot up, or at the second if test in MODE 1 has been
succesfully performed. It checks for a SRAM and RTC backup.
The following is checked:
*TODO'
*Does it skip the tests if a joy pad key is pressed?
==========================================================================================
CREDITS
*First Credit goes to Darkforce, mentor of DeJap, great ASM & ROM Hacker. He dumped the
whole Graphics packs, with the great help of The Dumper - if it wasnt for those two you
still would not be playing FEoEZ & Co!
*The pinouts of the 16/32M and 8M ROM, type two MROMS's as well as the SRAM pinouts can be found here :
http://nintendoallstars.w.interia.pl/romlab/sneslab.htm - siudym@pf.pl
*neviksti, for taking the time to point out the (many) flaws
==========================================================================================
Source: http://forums.nesdev.com/viewtopic.php?p=35060#35060, previously http://nesdev.parodius.com/bbs/viewtopic.php?p=35060#35060
Source: http://board.zsnes.com/phpBB3/viewtopic.php?p=173127#173127