Super Flash Cart 64M for NTSC/PAL SNES
The Super Flash Cart 64M (SFC) is an 8MB SNES cartridge with flash memory and battery RAM. It comes with a separate programmer. I obtained the following information by hot-swapping the cartridge into an already-powered SNES running probing programs, and making minor modifications to its mapping scheme.
Memory Mapping
The SNES has a 24-bit address bus, with almost 12MB of address space devoted to the cartridge:
008000-00FFFF Lower 32K banks: 2MB
...
3F8000-3FFFFF
400000-40FFFF Lower 64K banks: 4MB minus 128K
...
7D0000-7DFFFF
808000-80FFFF Upper 32K banks: 2MB
...
BF8000-BFFFFF
C00000-C0FFFF Upper 64K banks: 4MB
...
FF0000-FFFFFF
When the SNES accesses within these areas, it asserts the /CART line. The SFC does not respond unless the /CART line is asserted.
The SFC has 8MB of flash ($800000 bytes). The SFC adds a settable two-bit value to the top two flash address lines, allowing multiple games at 2MB offsets.
Flash can be mapped to SNES addresses in four ways:
SNES Flash address
Address LoROM HiROM ExLoROM ExHiROM
- - - - - - - - - - - - - - - - - - - -
000000 - - - -
008000 000000 008000 400000 408000
010000 - - - -
018000 008000 018000 408000 418000
...
3F0000 - - - -
3F8000 1F8000 3F8000 5F8000 7F8000
400000 200000 000000 600000 400000
408000 200000 008000 600000 408000
410000 208000 010000 608000 410000
...
7D0000 3E8000 3D0000 7E8000 7D0000
7D8000 3E8000 3D8000 7E8000 7D8000
7E0000 - - - -
...
7F8000 - - - -
800000 - - - -
808000 000000 008000 400000 408000
810000 - - - -
818000 008000 018000 408000 418000
...
BF0000 - - - -
BF8000 1F8000 3F8000 5F8000 7F8000
C00000 200000 000000 200000 000000
C08000 200000 008000 200000 008000
C10000 208000 010000 208000 010000
...
FF0000 3F8000 3F0000 3F8000 3F0000
FF8000 3F8000 3F8000 3F8000 3F8000
Essentially, LoROM mode shifts the upper 9 bits of the address right by one bit, and ExROM modes add 400000 when the address < C00000.
Note how LoROM maps to 4MB of flash, rather than just 2MB. Since most (all?) LoROM cartridges are only 2MB, for maximum compatibility, the second 2MB of flash should be written with a copy of the first 2MB, so that it mirrors as the original cartridge does.
The SFC supports battery RAM with selectable 2K, 8K, and 32K sizes. When enabled, it is mapped to 700000-77FFFF, mirrored over the entire range. Even though it has a 128K RAM chip, and A15 and A16 are wired to outputs of the CPLD mapper, it unfortunately doesn't seem to support multiple battery RAM banks.
The SFC can also leave 300000-3FFFFF unmapped, to support a custom chip mapped to this area via the T connector.
Play and Program Modes
The SFC has two main modes: play and program. These are selected by edge connection 36, the ground next to A12. Grounding this selects play mode, as occurs when it's plugged into the SNES since it's normally a ground line. Leaving it open selects program mode.
In program mode, flash is mapped to SNES addresses 0-7FFFFF, and writes go to it normally. Nothing is mapped to 800000-FDFFFF, not even a mirror of flash. SRAM is mapped to FE0000-FFFFFF. For flash, See Intel's 28F640 flash documentation for information on how to write to it. With suitable modifications to enable program mode while plugged into a SNES, it is possible to write to flash from the SNES.
When first powered up in play mode, the SFC mirrors 7F8000-7FFFFF (Boot Loader) of flash to all cartridge space, enables 2K battery RAM, and recognizes three writable registers:
E08000 VABHxxxx Flash mapping:
BA Flash address inversions (A=bit 21, B=bit 22). When set, the corresponding flash address bit is inverted.
H HiROM mode
V First write with this set saves above two values, all other writes are ignored.
E88000 xxxCxxxx Custom chip mapping:
C If set, 300000-3FFFFF is left unmapped. Defaults to clear if never written.
F08000 EDRRxxxx ROM size, battery RAM configure:
E ExROM mode. Adds 400000 to flash address if SNES address < C00000.
RR Battery RAM size, 00=2K, 01=8K, 10=32K, 11=32K.
D Disable battery RAM.
If E08000 hasn't yet been written, write is ignored.
F88000 xDRRxxxx Battery RAM configure
RR Battery RAM size, 00=2K, 01=8K, 10=32K, 11=32K.
D Disable battery RAM.
Nothing is changed until E08000 is written with V set, and then F08000 is written. After that, register writes are ignored. Battery RAM is configured by either F08000 or F88000; either the first non-zero value written to F88000, or F08000.
Only address bit 15 and bits 19-23 are relevant for selecting a register, and the lower 4 bits written are ignored. For example, writing $15 to E7BCDE has the same effect as writing $10 to E080000.
The standard menu program writes E88000, E08000, and then F08000 after a game is selected. It does this from code copied to WRAM, since the bank switching would otherwise switch the very code that's doing the switching.
Discovered by Shay Green aka blargg (gblargg at gmail period com). edits and updates from bazz (mbazzinotti at gmail period com)