Super Flash Cart 64M for NTSC/PAL SNES

The Super Flash Cart 64M (SFC) is an 8MB SNES cartridge with flash memory and battery RAM. It comes with a separate programmer. I obtained the following information by hot-swapping the cartridge into an already-powered SNES running probing programs, and making minor modifications to its mapping scheme.

Memory Mapping

The SNES has a 24-bit address bus, with almost 12MB of address space devoted to the cartridge:

008000-00FFFF   Lower 32K banks: 2MB

400000-40FFFF   Lower 64K banks: 4MB minus 128K

808000-80FFFF   Upper 32K banks: 2MB

C00000-C0FFFF   Upper 64K banks: 4MB

When the SNES accesses within these areas, it asserts the /CART line. The SFC does not respond unless the /CART line is asserted.

The SFC has 8MB of flash ($800000 bytes). The SFC adds a settable two-bit value to the top two flash address lines, allowing multiple games at 2MB offsets.

Flash can be mapped to SNES addresses in four ways:

SNES        Flash address
Address LoROM   HiROM   ExLoROM ExHiROM
- - - - - - - - - - - - - - - - - - - -
000000  -       -       -       -       
008000  000000  008000  400000  408000  
010000  -       -       -       -       
018000  008000  018000  408000  418000  
3F0000  -       -       -       -       
3F8000  1F8000  3F8000  5F8000  7F8000  
400000  200000  000000  600000  400000  
408000  200000  008000  600000  408000  
410000  208000  010000  608000  410000  
7D0000  3E8000  3D0000  7E8000  7D0000  
7D8000  3E8000  3D8000  7E8000  7D8000  
7E0000  -       -       -       -       
7F8000  -       -       -       -       
800000  -       -       -       -       
808000  000000  008000  400000  408000  
810000  -       -       -       -       
818000  008000  018000  408000  418000  
BF0000  -       -       -       -       
BF8000  1F8000  3F8000  5F8000  7F8000  
C00000  200000  000000  200000  000000  
C08000  200000  008000  200000  008000  
C10000  208000  010000  208000  010000  
FF0000  3F8000  3F0000  3F8000  3F0000  
FF8000  3F8000  3F8000  3F8000  3F8000  

Essentially, LoROM mode shifts the upper 9 bits of the address right by one bit, and ExROM modes add 400000 when the address < C00000.

Note how LoROM maps to 4MB of flash, rather than just 2MB. Since most (all?) LoROM cartridges are only 2MB, for maximum compatibility, the second 2MB of flash should be written with a copy of the first 2MB, so that it mirrors as the original cartridge does.

The SFC supports battery RAM with selectable 2K, 8K, and 32K sizes. When enabled, it is mapped to 700000-77FFFF, mirrored over the entire range. Even though it has a 128K RAM chip, and A15 and A16 are wired to outputs of the CPLD mapper, it unfortunately doesn't seem to support multiple battery RAM banks.

The SFC can also leave 300000-3FFFFF unmapped, to support a custom chip mapped to this area via the T connector.

Play and Program Modes

The SFC has two main modes: play and program. These are selected by edge connection 36, the ground next to A12. Grounding this selects play mode, as occurs when it's plugged into the SNES since it's normally a ground line. Leaving it open selects program mode.

In program mode, flash is mapped to SNES addresses 0-7FFFFF, and writes go to it normally. Nothing is mapped to 800000-FDFFFF, not even a mirror of flash. SRAM is mapped to FE0000-FFFFFF. For flash, See Intel's 28F640 flash documentation for information on how to write to it. With suitable modifications to enable program mode while plugged into a SNES, it is possible to write to flash from the SNES.

When first powered up in play mode, the SFC mirrors 7F8000-7FFFFF (Boot Loader) of flash to all cartridge space, enables 2K battery RAM, and recognizes three writable registers:

E08000 VABHxxxx Flash mapping:
        BA      Flash address inversions (A=bit 21, B=bit 22). When set, the corresponding flash address bit is inverted.
          H     HiROM mode
       V        First write with this set saves above two values, all other writes are ignored.

E88000 xxxCxxxx Custom chip mapping:
          C     If set, 300000-3FFFFF is left unmapped. Defaults to clear if never written.

F08000 EDRRxxxx ROM size, battery RAM configure:
       E        ExROM mode. Adds 400000 to flash address if SNES address < C00000.
         RR     Battery RAM size, 00=2K, 01=8K, 10=32K, 11=32K.
        D       Disable battery RAM.
                If E08000 hasn't yet been written, write is ignored.

F88000 xDRRxxxx Battery RAM configure
         RR     Battery RAM size, 00=2K, 01=8K, 10=32K, 11=32K.
        D       Disable battery RAM.

Nothing is changed until E08000 is written with V set, and then F08000 is written. After that, register writes are ignored. Battery RAM is configured by either F08000 or F88000; either the first non-zero value written to F88000, or F08000.

Only address bit 15 and bits 19-23 are relevant for selecting a register, and the lower 4 bits written are ignored. For example, writing $15 to E7BCDE has the same effect as writing $10 to E080000.

The standard menu program writes E88000, E08000, and then F08000 after a game is selected. It does this from code copied to WRAM, since the bank switching would otherwise switch the very code that's doing the switching.

Discovered by Shay Green aka blargg (gblargg at gmail period com). edits and updates from bazz (mbazzinotti at gmail period com)