Famicom Network System

Memory Map

+================+ $0000 - NES internal RAM
| NES internal   |
| RAM            |
+----------------+ $0800
|   (Mirrors of  |
|   $0000-$07FF) |
+================+ $2000 - NES PPU Registers
| NES PPU        |
| Registers      |
+----------------+ $2008
|   (Mirrors of  |
|   $2000-$2007) |
+================+ $4000 - NES APU, IO, and Test Registers
| NES APU and IO |
| Registers      |
+----------------+ $4018
| NES Test Mode  |
| Registers      |
+----------------+ $4020
|   (Open Bus)   |
+================+ $40A0 - Famicom Modem Registers
| Famicom Modem  |
| RF5C66         |
| Registers      |
+----------------+ $40D0
| Famicom Modem  |
| RF5A18         |
| Registers      |
+----------------+ $40D8
|   (Mirror of   |
|   $40D0-$40D7) |
+----------------+ $40E0
|   (Open Bus)   |
+----------------+ $4100
|   (Open Bus)   |
+----------------+ $41A0
|   (Mirror of   |
|   $40A0-$40FF) |
+----------------+ $4200
|   (Mirrors of  |
|   $4100-$41FF) |
+================+ $5000 - Famicom Modem Kanji ROM
| Famicom Modem  |
| LH5323M1       |
| Kanji ROM      |
+================+ $6000 - Famicom Modem Internal RAM
| Famicom Modem  |
| Internal RAM   |
+================+ $8000 - Famicom Modem Card Space
|                |
| Card Space     |
|                |
+================+ $10000

Known Registers

Address	Read Has Effect	Read Has Data	Write	Owner	Function
$40A1	Unknown	Yes	Unknown	RF5C66	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown Bench test observed value $FF with pull-downs. Test code writing values $01,02,04,08,10,20,40,80 always read back $FF after each write.
$40A2	Yes	Yes	Unknown	RF5C66	IRQ Acknowledge, similar to FDS register $4030 Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Timer Interrupt (1: an IRQ occurred) ||||||+--- Bit exists but function is unknown ||||++---- Bits not shown to exist ++++------ Bits exist but function is unknown Reading this register acknowledges /IRQ. Observed inconsistent behavior acknowledging, possibly suggesting multiple IRQ sources. Bench test observed value $20 with pull-downs, $2C with pull-ups. Test code writing values $01,02,04,08,10,20,40,80 always read back $20 after each write. JRA-PAT: Reads this register with a BIT op-code right before CLI op-code. Reads this register and makes a decision based on D7. Super Mario Club reads this register with BIT op-code.
$40A3	Unknown	No	Yes	RF5C66	Unknown Function. Write 76543210 |||||||+-- EXP 6 = $40A3.0 +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Bench test found open bus when reading this register. JRA-PAT writes $2F to this register and appears to keep a RAM copy at $15. Super Mario Club writes $2F to this register and appears to keep a RAM copy at $15.
$40A4	Unknown	No	Yes	RF5C66	Expansion Port Control Write 76543210 |||||||+-- (unknown) ||||||+--- EXP 5 = !($40A4.1) |||||+---- EXP 4 = !($40A4.2) +++++----- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Bench test found open bus when reading this register. Note: Reading test should be repeated with pull-ups and pull-downs on expansion pins. This register has not been observed read or written to by any commercial software.
$40A5	Unknown	Yes	Unknown	RF5C66	Expansion Port Input Data Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Input value of EXP 9 ||||||+--- Input value of EXP 8 |||||+---- Input value of EXP 7 |++++----- Bits not shown to exist +--------- Input value of EXP 11 Bench test observed value $00 with pull-downs, $78 with pull-ups.
$40A6	Unknown	Yes	Yes	RF5C66	M2 Cycle Counter LSB, similar to FDS register $4020 Write 76543210 ++++++++-- Cycle counter reload value (LSB) Read 76543210 ++++++++-- Cycle counter present value (LSB) Writing to this register writes to the cycle counter reload value. Reading this register gives the present value of the counter. Writing any value to $40A8 resets the counter to the reload value. This value counts down. When the value reaches $0000, the next count rolls over to $FFFF or auto-reloads depending on $40A8.0.
$40A7	Unknown	Yes	Yes	RF5C66	M2 Cycle Counter MSB, similar to FDS register $4021 Write 76543210 ++++++++-- Cycle counter reload value (MSB) Read 76543210 ++++++++-- Cycle counter present value (MSB) Refer to description in $40A6, this register being the MSB portion of the counter.
$40A8	Unknown	No	Yes	RF5C66	IRQ Control, similar to FDS register $4022 Write 76543210 |||||||+-- IRQ Repeat Flag ||||||+--- IRQ Enable ++++++---- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Writing anything to this register resets the cycle counter to the reload value. Observed writing $02 makes /IRQ go low, $00 makes /IRQ go high. Reading $40A2 with /IRQ low acknowledges it back high. Acknowledging with $40A2 first before writing $02 here prevents IRQ immediately going low. Observed rollover of cycle counter to $FFFF with repeat flag = 0 and auto-reload when flag = 1. Bench test found open bus when reading this register. JRA-PAT: Writes $00 to this register. Writes $00 again later, potentially connected to RAM $4F. Later, right after having written $25 to $40A7 and $20 to $40A6, writes $02 to this register. Has these various sequences hard-coded: $25->$40A7, $20->$40A6, $02->$40A8 $1C->$40A7, $10->$40A6, $02->$40A8 $03->$40A7, $19->$40A6, $02->$40A8 $06->$40A7, $F1->$40A6, $02->$40A8 Super Mario Club: Writes $00 to this register. Later, right after having written $24 to $40A7 and $F8 to $40A6, writes $02 to this register.
$40A9	Yes	Yes	Unknown	RF5C66	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown Bench test observed value $00 with pull-ups. When driving RF5C66 pin 45 high, this 8-bit value changes. Pin 45 high causes the value to change continuously, as if counting cycles. The value does not appear to match $40A7 or $40A6, though further testing is required to say that for sure. Reading this register causes its contents to be loaded into register $40AA.
$40AA	No	Yes	Unknown	RF5C66	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown Bench test observed value $00 with pull-ups. This register maintains the most recent value that was read from $40A9.
$40AB	Yes	No	Yes	RF5C66	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Bench test found open bus when reading this register. Reading this register resets the value of $40A9 back to $00. JRA-PAT writes $00 to this register. Super Mario Club writes $00 to this register.
$40AC	Yes	No	Unknown	RF5C66	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Bench test: Observed $00 with pull-downs and $FF with pull-ups (totally open bus). Reading this register prevents timed toggle on RF5C66-69 (see notes in pinout). JRA-PAT reads this register with a BIT op-code and throws away the result. Super Mario Club reads this register with a BIT op-code.
$40AD	Unknown	Yes	Yes	RF5C66	Mirroring Control Write 76543210 |+++++++-- (unknown) +--------- Mirroring: 0 = Vertical Mirroring (CIRAM A10 = PPU A10) 1 = Horizontal Mirroring (CIRAM A10 = PPU A11) Read 76543210 |+++++++-- Bits not shown to exist +--------- Present value of CIRAM A10 Bench test observed $00 with pull-downs, $7F with pull-ups. JRA-PAT writes $00 to this register. Super Mario Club writes $80 to this register.
$40AE	Unknown	No	Yes	RF5C66	Unknown Function. Write 76543210 |||||||+-- Built-in RAM /CE control: ||||||| 1 = Built-in RAM /CE enabled to go low for reads and writes in the range $6000-7FFF. ||||||| Pin 5C66.28 = 1 at all address ranges. (This pin normally n/c.) ||||||| 0 = Built-in RAM /CE is always high, preventing all reads and writes of the built-in RAM. ||||||| Pin 5C66.28 = 0 at all address ranges. (This pin normally n/c.) +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist Refer also to $40C0.0 for built-in RAM enabling. Bench test found open bus when reading this register. JRA-PAT: Writes $00 to this register. Later writes $01 to this register. Super Mario Club: Writes $00 to this register. Later writes $01 to this register.
$40B0	Yes	No	Yes	RF5C66	Kanji Graphic ROM Control Write 76543210 |||||||+-- Kanji ROM Bank Select +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist All reads reset the Kanji auto-increment counter Bench test found open bus when reading this register. D0 is written with 0 or 1 in kanji graphics-loading code depending on the kanji character index, possibly changing the kanji bank, but this hasn't yet worked in experiments. Is read with BIT and results discarded before reading kanji data out of $5000-5FFF. Super Mario Club: Stores X to this register after incrementing X (observed value $20). Reads this register and throws away the value read. Theory: bit 0 controls 5C66 pin 57 (LH5323M1 Kanji ROM bankswitch bit). Theory: reads reset the kanji data position to the first byte.
$40B1	Unknown	Yes	Yes	RF5C66	Modem Control Write 76543210 |||||||+-- Modem Module pin 29 = $40B1.0, rises slowly, goes low fast ||||||+--- Modem Module pin 32 = $40B1.1, rises slowly, goes low fast |||||+---- Modem Module pin 31 = $40B1.2, rises slowly, goes low fast ||||+----- 5C66-68 to 5A18-27 = !($40B1.3) |||| When set to 1, Exp 18, 19 go high fast, Exp 17 rises slowly |||| Exp 17, 18, 19 do not go low when this bit is cleared. |||+------ Exp 15 = $40B1.4, rises slowly, goes low fast ||+------- Exp 14 = $40B1.5, rises slowly, goes low fast |+-------- Exp 13 = $40B1.6, rises slowly, goes low fast +--------- Exp 12 = $40B1.7, rises slowly, goes low fast Read 76543210 |||||||+-- Input value of Modem Module pin 29 ||||||+--- Input value of Modem Module pin 32 |||||+---- Input value of Modem Module pin 31 ||||+----- Input value of 5C66 pin 63 (normally n/c) |||+------ Input value of EXP 15 ||+------- Input value of EXP 14 |+-------- Input value of EXP 13 +--------- Input value of EXP 12 Bench test observed value $FF with pull-downs. JRA-PAT: Writes $F7 to this register and appears to keep a RAM copy at $17. Later writes the value from $17, ORed with #$08. (Bit 3 being set to 1.) Also writes the value from $17, ANDed with #$F7. (Bit 3 being set to 0.) Super Mario Club: Writes $F7 to this register and appears to keep a RAM copy at $17. Later writes the value from $17, ORed with #$08. (Bit 3 being set to 1.)
$40C0	Unknown	Yes	Yes	RF5C66	CIC Status, CHR Bank, and RAM Control Write 76543210 |||||||+-- Pin 5C66.35 = $40C0.0: ||||||| RAM +CE Enable (1 = enabled, 0 = disabled) ||||||+--- Pin 5C66.36 = $40C0.1: |||||| (This pin normally n/c) |||||+---- Pin 5C66.37 = $40C0.2: ||||| (This pin normally n/c) ||||+----- Pin 5C66.38 = $40C0.3: |||| CHR-RAM Bank Select ++++------ (unknown) Read 76543210 |||||||+-- Input value of pin 5C66.31: ||||||| Host CIC /Reset ||||||+--- Input value of pin 5C66.32: |||||| Host CIC /Fail |||||+---- Input value of pin 5C66.33: ||||| Pin 5C66.68 feeds into this pin and into 5A18.27. ||||+----- Input value of pin 5C66.34: |||| Selected CHR RAM Bank |+++------ Bits not shown to exist +--------- Input value of pin 5C66.29: Filtered Host CIC +Start RAM +CE always reflects bit 0 of this register regardless of address space. Refer also to $40AE.0 for built-in RAM enabling. Bench test observed value $00 with pull-downs, $70 with pull-ups. All examined software waits for D7 = 1 at initialization. D7 is normally 1, but becomes and stays 0 if the cartridge is removed or is not present on power-on. JRA-PAT: Writes to this register from what appears to be a RAM copy at $18 ORed with #$01. Also writes from $18 ANDed with #$FE. Super Mario Club: Writes $00 to this register and appears to keep a RAM copy at $18. Later writes the value from $18, ANDed with #$FB. (Bit 2 being set to 0.) Reads this register and makes a decision using D7.
$40D0	Unknown	Yes	Yes	RF5A18	Unknown Function. Super Mario Club: Does multiple writes of various values to this register when opening a connection. Reads this register when closing a modem connection, which reports value $80 and stores it at $701.
$40D1	Unknown	Yes	Yes	RF5A18	Unknown Function. Super Mario Club: Does multiple writes of various values to this register when opening a connection. Reads this register when closing a modem connection, which reports value $01 and stores it at $702.
$40D2	Unknown	Yes	Yes	RF5A18	Unknown Function. Super Mario Club: Does multiple writes of various values to this register when opening a connection. Reads this register when closing a modem connection, which reports value $00 and stores it at $703.
$40D3	Unknown	Yes	Yes	RF5A18	Unknown Function. JRA-PAT writes $FF to this register and appears to keep a RAM copy at $19. Super Mario Club: Writes $FF to this register and appears to keep a RAM copy at $19. Does a BIT operation on this register and makes decisions based on D7 and D6. Probably the same: Reads this register once per frame, which reports value $E0. Also writes value $BF to this register, not in connection with $19. Does multiple writes of various values to this register when opening and closing a connection.
$40D4	Unknown	Unknown	Yes	RF5A18	Unknown Function. Write 76543210 |||||||+-- Exp 17 = $40D4.0 (See also $40B1.3) ||||||+--- Exp 19 = $40D4.1 (See also $40B1.3) |||||+---- Exp 18 = $40D4.2 (See also $40B1.3) +++++----- (unknown) Read 76543210 ++++++++-- (unknown) JRA-PAT writes $FF to this register and appears to keep a RAM copy at $1A. Super Mario Club writes $FF to this register and appears to keep a RAM copy at $1A.

LH5323M1 ROM

The LH5323M1 is a 256 KB graphics ROM containing primarily kanji data that is mapped at $5000-5FFF. Each index in this range is a 32-byte space containing 16x16 1bpp graphics, usually for a single character, and each read automatically advances to the next byte in the sequence. The space only covers 128 KB and it is suspected that the other 128 KB can be swapped in for additional characters. Writing to $4xB0.0 might control this bankswap behavior. Reading from $4xB0 might reset to the beginning of the 32-byte sequence.

Expansion Audio

The Famicom Network System does have expansion audio capabilities. The Famicom audio is routed through the modem module, but nowhere directly to either of the large ASICs. Dial tones have been observed through the television speakers. It is unlikely but unknown if there are other possible sources of sound.

Pinouts

RF5C66 Memory Controller

                                                       _____
                                                      /     \
                                           CPU A0 -> / 1 100 \ -- +5Vcc
                                          CPU A1 -> / 2    99 \ -- n/c
                                         CPU A2 -> / 3      98 \ <> CPU D0
                                        CPU A3 -> / 4        97 \ <> CPU D1
                                       CPU A4 -> / 5          96 \ <> CPU D2
                                      CPU A5 -> / 6            95 \ <> CPU D3
                                     CPU A6 -> / 7              94 \ <> CPU D4
                                    CPU A7 -> / 8                93 \ <> CPU D5
                                  CPU A12 -> / 9                  92 \ <> CPU D6
                                 CPU A13 -> / 10                   91 \ <> CPU D7
                                CPU A14 -> / 11                     90 \ -- GND
                               /ROMSEL -> / 12                       89 \ <> Card D0
                              CPU R/W -> / 13                         88 \ <> Card D1
                                  M2 -> / 14                           87 \ <> Card D2
          P6-1 Lid Switch, Card R/W <- / 15                             86 \ <> Card D3
          (20k resistor to 5Vcc) ? -> / 16                               85 \ <> Card D4
                             /IRQ <- / 17                                 84 \ <> Card D5
                           +5Vcc -- / 18                                   83 \ <> Card D6
                            n/c -- / 19                                     82 \ <> Card D7
              21.47727MHz Xtal -- / 20                                       81 \ -- +5Vcc
                         Xtal -- / 21                                            \
                         n/c -- / 22                                     O       /
                        GND -- / 23                                          80 / -- n/c
        (n/c) Xtal Osc Out <- / 24                                          79 / -> Exp P3-2
                      n/c -- / 25                                          78 / <- Exp P3-3
   ToneRx Xin, CIC Clock <- / 26             Nintendo RF5C66              77 / -> Exp P3-4
                    n/c -- / 27      Package QFP-100, 0.65mm pitch       76 / -> Exp P3-5
         (n/c) $40AE.0 <- / 28                                          75 / -> Exp P3-6
Filt'd HostCIC +Start -> / 29             Memory Controller            74 / <- Exp P3-7
         Host CIC-12 <- / 30                                          73 / <- Exp P3-8
                       /       O                                     72 / <- Exp P3-9
                       \                                            71 / <- Exp P3-11
     Host CIC /Reset -> \ 31                                       70 / -- GND
       Host CIC /Fail -> \ 32                                     69 / -> 5A18-49
      5A18-27, 5C66-68 -> \ 33                                   68 / -> 5A18-27, 5C66-33   Orientation:
    CHR RAM /CE (input) -> \ 34                                 67 / <> Exp P3-12           --------------------
                 RAM +CE <- \ 35                               66 / <> Exp P3-13                80         51
            (n/c) $40C0.1 <- \ 36                             65 / <> Exp P3-14                  |         |
             (n/c) $40C0.2 <- \ 37                           64 / <> Exp P3-15                  .-----------.
                CHR RAM /CE <- \ 38                         63 / <- $40B1.3 (n/c)            81-|O Nintendo |-50
                         GND -- \ 39                       62 / <> Modem P4-31                  |  RF5C66   |
Built-in RAM /CE ($6000-7FFF) <- \ 40                     61 / <> Modem P4-32               100-|  GCD 4R  O|-31
      (n/c) ? /CE ($4xE0-4xEF) <- \ 41                   60 / <> Modem P4-29                    \-----------'
       5A18-85 /CE ($4xD0-4xDF) <- \ 42                 59 / -- +5Vcc                            |         |
                         (GND) ? -> \ 43               58 / -- n/c                              01         30
                          (GND) ? -> \ 44             57 / -> Kanji ROM A17
                           (GND) ? -> \ 45           56 / -> Kanji ROM A4         Legend:
                            (GND) ? -> \ 46         55 / -> Kanji ROM A3          ------------------------------
                           CIRAM A10 <- \ 47       54 / -> Kanji ROM A2           --[RF5C66]-- Power
                              PPU A11 -> \ 48     53 / -> Kanji ROM A1            ->[RF5C66]<- RF5C66 input
                               PPU A10 -> \ 49   52 / -> Kanji ROM A0             <-[RF5C66]-> RF5C66 output
             Kanji ROM /CE ($5000-5FFF) <- \ 50 51 / -- n/c                       <>[RF5C66]<> Bidirectional
                                            \     /                               ??[RF5C66]?? Unknown
                                             \   /                                    f      Famicom connection
                                              \ /                                     r      ROM chip connection
                                               V                                      R      RAM chip connection
Notes:
- +5Vcc pins 18, 59, 81, 100 are all connected together internally.
- GND pins 23, 39, 70, 90 are all connected together internally.
- 43, 44, 45, 46 are GND on the PCB, but have internal protection diodes from GND, suggesting they are logic pins.
- 24, 28, 36, 37, 41, 63 are n/c on the PCB, but have protection diodes from GND, suggesting they may have a function.
- Pins 41 and 42 ranges shown are duplicated at $Cxxx (i.e. ignores /ROMSEL).
  - It is unknown how the 5A18 prevents bus conflict at $Cxxx range when it has no known access to /ROMSEL.
- Pins 45-46, when pulled high, causes oscillation on pin 56.
- Pin 29 (CIC-11) observed only high (with or without card inserted).
  - Seems to be a /reset because it sets pins 52-57 low when this pin is low, and possibly lots of other things.
- Pin 31 (CIC-10) observed only high (with or without card inserted).
- Pin 32 (CIC-15) observed high with card inserted and low with no card inserted or when hot-removed.
  - Does not go high when hot-inserted or Famicom reset in low state, only high when card is present at power-on.
- Pin 16 Pull-up of 20k to 5V is also required in order to avoid triggering reset.
- Pin 16 seems to be related to pin 29.  With pin 29 floating and pin 16 pulled high at power on, the chip runs for 5 seconds, then enters reset.
- Tested 10k instead of 20k (per original PCB) on pin 16, found no difference in time or function.
- Pin 69 has a high pulse of 11.9085 usec at any time that register $4xAC has not been read for 12.4892 seconds.
  - Each additional 12.4892 seconds generates another pulse.
  - It has very repeatable precision, at least 6 figures on each.
  - It is not synchronized to M2 or any other inputs.
  - Note that 12.4892 sec * 21.47727 MHz = 2^28, with an error of 0.075%. (Nominal would be 12.4986 sec.)
  - Note that 11.9085 usec * 21.47727 MHz = 2^8, with an error of 0.093%. (Nominal would be 11.9196 usec.)
- Pins 52-56 drive the address pins of the Kanji ROM.  (See notes below the LH5323M1 pinout.)
- Pin 15 (Card R/W) is a non-inverted buffer of CPU R/W.  This signal connects through the lid switch.
- Pin 26 puts out a 3.58 MHz square wave, ~50% duty.  This corresponds to 21.47727 MHz / 6.
- Pin 79 (Exp 2) puts out a 95.95 kHz square wave, 93.7% duty.  Clock source unknown.
  - Note that this seems similar to FDS serial bitrate.
  - Standalone chip can get into a 341.2 kHz mode when touching pin 80, though pulling 80 high or low doesn't correlate.
  - Either frequency, the negative pulse width is 650 nsec.
- CIRAM A10 follows PPU A10 by default, suggesting horizontal arrangement / vertical mirroring is default.

RF5A18 CPU2 Modem Controller

                                                   _____
                                                  /     \
                             (U6 RAM) CPU2 A0 <- / 1 100 \ -- GND
                            (U6 RAM) CPU2 A1 <- / 2    99 \ <> CPU2 D0 (U6 RAM)
                           (U6 RAM) CPU2 A2 <- / 3      98 \ <> CPU2 D1 (U6 RAM)
                          (U6 RAM) CPU2 A3 <- / 4        97 \ <> CPU2 D2 (U6 RAM)
                         (U6 RAM) CPU2 A4 <- / 5          96 \ <> CPU2 D3 (U6 RAM)
                        (U6 RAM) CPU2 A5 <- / 6            95 \ <> CPU2 D4 (U6 RAM)
                       (U6 RAM) CPU2 A6 <- / 7              94 \ <> CPU2 D5 (U6 RAM)
                      (U6 RAM) CPU2 A7 <- / 8                93 \ <> CPU2 D6 (U6 RAM)
                                +5Vcc -- / 9                  92 \ <> CPU2 D7 (U6 RAM)
                    (U6 RAM) CPU2 A8 <- / 10                   91 \ -- +5Vcc
                   (U6 RAM) CPU2 A9 <- / 11                     90 \ -> Modem TXD
                 (U6 RAM) CPU2 A10 <- / 12                       89 \ <- Modem RXD
                (U6 RAM) CPU2 A11 <- / 13                         88 \ <- CPU A2
               (U6 RAM) CPU2 A12 <- / 14                           87 \ <- CPU A1
                 (n/c) CPU2 A13 <- / 15                             86 \ <- CPU A0
                (n/c) CPU2 A14 <- / 16                               85 \ <- /CE (5C66-42)
               (n/c) CPU2 A15 <- / 17                                 84 \ <- P6-1 Lid Switch, Card R/W
                         GND -- / 18                                   83 \ <- M2
                    (n/c) ? <- / 19                                     82 \ <> Card D7
         (U6 RAM) CPU2 R/W <- / 20                                       81 \ <> Card D6
               U6 RAM /CE <- / 21                                            \
                 (n/c) ? <- / 22                                     O       /
   (test point) CPU2 M2 <- / 23                                          80 / <> Card D5
               (GND) ? -> / 24                                          79 / <> Card D4
              (GND) ? -> / 25                                          78 / -- GND
             (GND) ? -> / 26             Nintendo RF5A18              77 / <> Card D3
   (5C66-68) /Reset -> / 27      Package QFP-100, 0.65mm pitch       76 / <> Card D2
  <UNKNOWN> 10k up -> / 28                                          75 / <> Card D1
 <UNKNOWN> 10k up -> / 29             Modem Controller             74 / <> Card D0
             n/c -- / 30                   CPU2                   73 / <- Tone Rx DV
                   /       O                                     72 / <- Tone Rx D8
                   \                                            71 / <- Tone Rx D4
           +5Vcc -- \ 31                                       70 / <- Tone Rx D2
       Modem DATA -> \ 32                                     69 / <- Tone Rx D1
        Modem /INT -> \ 33                                   68 / -> Tone Rx GT         Orientation:
          Modem /RD <- \ 34                                 67 / -> Exp P3-19           --------------------
           Modem /WR <- \ 35                               66 / <- Exp P3-18                80         51
          Modem EXCLK <- \ 36                             65 / <- Exp P3-17                  |         |
               (n/c) ? <- \ 37                           64 / -- +5Vcc                      .-----------.
              Modem AD1 <> \ 38                         63 / -> Modem P4-19              81-|O  RF5A18  |-50
               Modem AD0 <> \ 39                       62 / -> Modem P4-21                  |  Nintendo |
                  (n/c) ? <- \ 40                     61 / -> Modem Audio Enable        100-|  GCD 8C  O|-31
                   (n/c) ? <- \ 41                   60 / -> Modem P4-27                    \-----------'
                  Exp P3-16 <- \ 42                 59 / -> ? (n/c)                          |         |
                         GND -- \ 43               58 / -> Green LED, active low            01         30
              19.6608MHz Xtal -- \ 44             57 / -> Red LED, active low
                    1k to Xtal -- \ 45           56 / -> Modem Reset          Legend:
                            GND -- \ 46         55 / <- Modem P4-23           ------------------------------
                       (+5Vcc) ? -> \ 47       54 / <- Modem P4-28            --[RF5A18]-- Power
                        (+5Vcc) ? -> \ 48     53 / <- Modem P4-25             ->[RF5A18]<- RF5A18 input
                           5C66-69 -> \ 49   52 / <- Switch SW1-4             <-[RF5A18]-> RF5A18 output
                                n/c -- \ 50 51 / <- Switch SW1-2              <>[RF5A18]<> Bidirectional
                                        \     /                               ??[RF5A18]?? Unknown
                                         \   /                                    f      Famicom connection
                                          \ /                                     r      ROM chip connection
                                           V                                      R      RAM chip connection
Notes:
- This chip contains its very own WDC 65C816 CPU, with built-in ROM.
- +5Vcc pins 9, 31, 64, 91 are all connected together internally.
- GND pins 18, 43, 46, 78, 100 are all connected together internally.
- 24, 25, 26 are GND on the PCB, but have internal protection diodes from GND, suggesting they are logic pins.
- 47, 48 are +5Vcc on the PCB, but have internal protection diodes to +5Vcc, suggesting they are logic pins.
- 15, 16, 17, 19, 22, 37, 40, 41, 59 are n/c on the PCB, but have protection diodes from GND, suggesting they may have a function.
- Pin 42 (Exp 16) puts out a 4.92 MHz square wave, ~50% duty.  This is 19.6608 MHz / 4.

LH5323M1 Kanji Graphic ROM

                              _____  Note: Flat spot does not correspond to pin 1.
                             /     \
                     n/c -- / 12 11 \ -- n/c
           (5C66-52) A0 -> / 13   10 \ -- n/c
                CPU D0 <> / 14      9 \ <- A1 (5C66-53)
               CPU D1 <> / 15        8 \ <- A2 (5C66-54)
              CPU D2 <> / 16          7 \ <- A3 (5C66-55)
                GND -- / 17            6 \ -- GND
            CPU D3 <> / 18              5 \ <- A5 (CPU A0)
           CPU D4 <> / 19                4 \ -- n/c
          CPU D5 <> / 20                  3 \ <- A6 (CPU A1)
         CPU D6 <> / 21                    2 \ <- A7 (CPU A2)
        CPU D7 <> / 22  Nintendo LH5323M1   1 \ -- n/c
                 /        Package QFP-44       \
                 \         0.8mm pitch         /
           n/c -- \ 23                     44 / <- A8 (CPU A3)
            n/c -- \ 24   Kanji Graphic   43 / <- A13 (CPU A8)
       (GND) /OE -- \ 25       ROM       42 / <- A16 (CPU A11)
     (CPU A6) A11 -> \ 26               41 / <- A4 (5C66-56)         Orientation:
     (5C66-50) /CE -> \ 27             40 / -- n/c                   --------------------
                GND -- \ 28           39 / -- n/c                        33         23
        (CPU A7) A12 -> \ 29         38 / -- +5Vcc                        |         |
         (CPU A5) A10 -> \ 30       37 / <- A17 (5C66-57 Bankswitch)     .-----------.
                   n/c -- \ 31     36 / <- A15 (CPU A10)              34-| Nintendo O|-22
                    n/c -- \ 32   35 / -- n/c                            |  CCR-01   |
             (CPU A4) A9 -> \ 33 34 / <- A14 (CPU A9)                    | LH5323M1  |
                             \     /                                  44-|O 9528 D   |-12
                              \   /                                      '-----------/
                               \ /                                        |         |
                                V                                        01         11
                                
Notes:
- 6 & 28 are connected together internally.
- 17 has no measurable connection to 6 & 28.
- All logic pins have protection diode from pin 17, suggesting this is the true GND.
- Pin 25 also appears as a logic pin with respect to pin 17.
- When pins 25 and 27 are both driven low, the data bus becomes an output.  Otherwise it is hi-z.
- Pins 13, 9, 8, 7, 41, 37 are controlled by the RF5C66.
  - Pins 13, 9, 8, 7, 41 are controlled with auto-increment function.
  - The value of these pins increments each M2 falling edge when the CPU is in range $5000-5FFF.
  - Pin 37 is a bankswitch, controlled by register $40B0.0
  - At reset and when reading from register $40B0, these pins reset to 0.
  - The conditions resetting or maintaining the bankswitch pin to 1 are still unknown.

8633 CIC Host

                         _______   _______
                         |      \_/      |
 (Guest CIC-2) Data 0 <> | 1          18 | -- +5Vcc
 (Guest CIC-1) Data 1 <> | 2  O       17 | -- n/c
                  n/c -- | 3   8633   16 | -- n/c
                  n/c -- | 4          15 | -> /Fail (5C66-32)
                  n/c -- | 5    CIC   14 | -- n/c
                  n/c -- | 6   Host   13 | -- n/c
      (5C66-26) Clock -> | 7          12 | <- 5C66-30
(Guest CIC-11) /Reset -> | 8    U8    11 | -> +Start (5C66-29)
                  GND -- | 9          10 | -> /Reset (5C66-31)
                         |_______________|

8634A CIC Guest

                         _______   _______
                         |      \_/      |
  (Host CIC-2) Data 0 <> | 1          18 | -- +5Vcc
  (Host CIC-1) Data 1 <> | 2  O       17 | -- n/c
                  n/c -- | 3   8634A  16 | ?? GND
                  n/c -- | 4          15 | -- n/c
                  n/c -- | 5    CIC   14 | -- n/c
                  n/c -- | 6   Guest  13 | ?? +5V
      (5C66-26) Clock -> | 7          12 | ?? Card-33, n/c in Famicom Network System
   (Cap to 5V) /Reset -> | 8          11 | -> +Start (Host CIC-8)
                  GND -- | 9          10 | -- n/c
                         |_______________|

- Note: Some assumptions made on CIC chips based on similarity to F411A from Super NES.

8kByte CHR-RAM

                   _______   _______
                   |      \_/      |
           n/c? -- | 1          28 | -- +5Vcc
        PPU A12 -> | 2  O       27 | <- PPU /WR
         PPU A7 -> | 3          26 | <- +CE: U3=RF5C66 34/38, U4=PPU /A13
         PPU A6 -> | 4          25 | <- PPU A8
         PPU A5 -> | 5  LH5268  24 | <- PPU A9
         PPU A4 -> | 6    CHR   23 | <- PPU A11
         PPU A3 -> | 7    RAM   22 | <- /OE: PPU /RD
         PPU A2 -> | 8   U3/U4  21 | <- PPU A10
         PPU A1 -> | 9          20 | <- /CE: U3=PPU A13, U4=RF5C66 34/38
         PPU A0 -> | 10         19 | <> PPU D7
         PPU D0 <> | 11         18 | <> PPU D6
         PPU D1 <> | 12         17 | <> PPU D5
         PPU D2 <> | 13         16 | <> PPU D4
            GND -- | 14         15 | <> PPU D3
                   |_______________|

8kByte W-RAM

                   _______   _______
                   |      \_/      |
           n/c? -- | 1          28 | -- +5Vcc
        CPU A12 -> | 2  O       27 | <- /WR: Card R/W (P6-2 Lid Switch)
         CPU A7 -> | 3          26 | <- +CE: RAM +CE
         CPU A6 -> | 4          25 | <- CPU A8
         CPU A5 -> | 5  LH5268  24 | <- CPU A9
         CPU A4 -> | 6 Built-in 23 | <- CPU A11
         CPU A3 -> | 7  W-RAM   22 | <- /OE: GND
         CPU A2 -> | 8    U5    21 | <- Card A10
         CPU A1 -> | 9          20 | <- /CE: Built-in RAM /CE
         CPU A0 -> | 10         19 | <> Card D7
        Card D0 <> | 11         18 | <> Card D6
        Card D1 <> | 12         17 | <> Card D5
        Card D2 <> | 13         16 | <> Card D4
            GND -- | 14         15 | <> Card D3
                   |_______________|

8kByte CPU2 RAM

                   _______   _______
                   |      \_/      |
           n/c? -- | 1          28 | -- +5Vcc
       CPU2 A12 -> | 2  O       27 | <- /WR: CPU2 R/W
        CPU2 A7 -> | 3          26 | <- +CE: +5Vcc
        CPU2 A6 -> | 4          25 | <- CPU2 A8
        CPU2 A5 -> | 5  LH5268  24 | <- CPU2 A9
        CPU2 A4 -> | 6   CPU2   23 | <- CPU2 A11
        CPU2 A3 -> | 7    RAM   22 | <- /OE: GND
        CPU2 A2 -> | 8    U6    21 | <- CPU2 A10
        CPU2 A1 -> | 9          20 | <- /CE: CPU2 RAM /CE
        CPU2 A0 -> | 10         19 | <> CPU2 D7
        CPU2 D0 <> | 11         18 | <> CPU2 D6
        CPU2 D1 <> | 12         17 | <> CPU2 D5
        CPU2 D2 <> | 13         16 | <> CPU2 D4
            GND -- | 14         15 | <> CPU2 D3
                   |_______________|

P4: Modem Module Edge Connector

   Famicom     | Modem  |    Famicom
Network System | Module | Network System
               __________
               |        |
      +5Vcc -- | 1   19 | <- 5A18-63
Modem Reset -> | 2   20 | <- Tone Rx GT
  Modem AD0 <> | 3   21 | <- 5A18-62
        GND -- | 4   22 | -> Tone Rx DV
  Modem AD1 <> | 5   23 | -> 5A18-55
  Modem RXD <- | 6   24 | <- Tone Rx Xin, from 5C66-26
 Modem DATA <- | 7   25 | -> 5A18-53
  Modem TXD -> | 8   26 | -- GND
  Modem /WR -> | 9   27 | <- 5A18-60
  Modem /RD -> | 10  28 | <- 5A18-54
Modem EXCLK -> | 11  29 | <> 5C66-60
      +5Vcc -- | 12  30 | <- Modem Audio Enable, 1 = enable
 Tone Rx D1 <- | 13  31 | <> 5C66-62           __________________________
 Modem /INT <- | 14  32 | <> 5C66-61           | Modem Module           |
      +5Vcc -- | 15  33 | -- Audio from 2A03   | Orientation            |
 Tone Rx D2 <- | 16  34 | -- Audio to RF       |                        |
 Tone Rx D8 <- | 17  35 | -- GND               |    19 _____________ 36 |
 Tone Rx D4 <- | 18  36 | -- GND               |     1 |___________| 18 |
               |________|                      |________________________|
 
Note: The modem module uses modem chip Oki MSM6827L and Dual Tone Receiver MC14LC5436P.

P2: Game Card Connector

Card |  | Famicom Network System
-----+--+-------------------------
  1  |--| +5Vcc
  2  |--| +5Vcc
  3  |??| n/c in host
  4  |??| n/c in JRA-PAT, Host has 10k pull-up only.
  5  |<>| Card D0
  6  |<>| Card D1
  7  |<>| Card D2
  8  |<>| Card D3
  9  |<>| Card D4
 10  |<>| Card D5
 11  |<>| Card D6
 12  |<>| Card D7
 13  |<-| Card R/W (P6-2 Lid Switch)
 14  |<-| M2
 15  |<-| /ROMSEL
 16  |<-| CPU A0
 17  |<-| CPU A1
 18  |<-| CPU A2
 19  |<-| CPU A3
 20  |<-| CPU A4
 21  |<-| CPU A5
     |  |
     |  |
 22  |<-| CPU A6
 23  |<-| CPU A7
 24  |<-| CPU A8
 25  |<-| CPU A9
 26  |<-| CPU A10
 27  |<-| CPU A11
 28  |<-| CPU A12
 29  |<-| CPU A13
 30  |<-| CPU A14
 31  |??| n/c in JRA-PAT, Host has 10k pull-up only.
 32  |??| n/c in JRA-PAT, Host has 10k pull-up only.
 33  |??| connected to Guest CIC-12 in JRA-PAT, n/c in host
 34  |??| n/c in JRA-PAT, n/c in host
 35  |->| Guest CIC-11 -> Host CIC-8
 36  |<>| Guest CIC-1 <> Host CIC-2
 37  |<>| Guest CIC-2 <> Host CIC-1
 38  |<-| CIC Clock
 39  |??| n/c in JRA-PAT, Host has 10k pull-up only.
 40  |<-| RAM +CE (n/c in JRA-PAT)
 41  |--| GND
 42  |--| GND

P3: Expansion Connector

                 Outside    |  FNS  |    Outside                   _____________________
                            _________                             / Orientation        /|
                            |       |                            /____________________/ |
                    /IRQ -> | 1  20 | -- +5Vcc                   |o|_| ==      |_||_|o|/
(95.94kHz Clock) 5C66-79 <- | 2  19 | -> 5A18-67                 \_  _  _ _||_  _  _ _/|
                 5C66-78 -> | 3  18 | -> 5A18-66                  |-| |    || HVC-050| |
                 5C66-77 <- | 4  17 | -> 5A18-65                  |-|_|    ||        | |
                 5C66-76 <- | 5  16 | -> 5A18-42 (4.92MHz Clock)  |        ||        | |
                 5C66-75 <- | 6  15 | <> 5C66-64                  |  20 __/__\__ 11  | |
                            |       |                             |o  1 |______| 10 o| |
                 5C66-74 -> | 7  14 | <> 5C66-65                  | ________________ | |
                 5C66-73 -> | 8  13 | <> 5C66-66                  |/_______________/|| |
                 5C66-72 -> | 9  12 | <> 5C66-67                  ||______________|/ | |
                     GND -- | 10 11 | <- 5C66-71                  |                  | |
                            |_______|                             |      ______      | |
                                                                  |o    | |    |    o| |
                                                                  \_____|/     |_____|/

P5: Expansion Connector

Note: This connector only exists on old revisions of Famicom Network System.

Outside |  | Famicom Network System
--------+--+-------------------------
    9   |--| GND
    8   |<>| CPU2 D5
    7   |<>| CPU2 D4
    6   |<>| CPU2 D3
    5   |<>| CPU2 D2
    4   |<>| CPU2 D1
    3   |<>| CPU2 D0
    2   |<-| CPU2 M2
    1   |--| +5V

RF5A18 Internal CPU

CPU2 Memory Map

+================+ $0000
| CPU2 RAM       |
| (U6)           |
+================+ $2000
|   (Returns     |
|   last fetch)  |
+================+ $4100
| CPU2 Control   |
| Registers      |
+================+ $4140
|   (Returns     |
|   last fetch)  |
+================+ $C000
|   (Open Bus)   |
|                |
+================+ $E000
| RF5A18         |
| Internal ROM   |
+================+ $10000

CPU2 Known Registers

Address	Read Has Effect	Read Has Data	Write	Function
$4100	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $E12E writes value #$06 to this address.
$4101	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $E131 writes value #$00 to this address.
$4102	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $E136 writes value #$02 to this address. ROM $F3D6 writes value #$00 to this address. ROM $F840 writes value #$00 to this address.
$4103	Yes	Yes	Unknown	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown) Value $41 from previous fetch observed changed to $40. ROM $E825 reads from this address in the NMI handler and throws away the value. ROM $F3D9 reads from this address and throws away the value.
$4104	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $F415 writes value #$FD to this address.
$4105	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $F410 writes value #$2F to this address.
$4106	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $F3DE writes value #$00 to this address. ROM $F41A writes value #$03 to this address.
$4107	Yes	Unknown	Unknown	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $E78A reads from this address and throws away the value. ROM $F3E1 reads from this address and throws away the value.
$4110	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- (unknown) ||+++++--- Bits exist but function is unknown |+-------- (unknown) +--------- Bit exists but function is unknown Value $41 from previous fetch observed changed to $FF. ROM $E69B reads from this address. ROM $E72F writes to this address. ROM $E754 writes to this address.
$4111	Unknown	Yes	Yes	Unknown Function. Write 76543210 |+++++++-- (unknown) +--------- Pin 90 (Modem TXD) = !($4111.7) Read 76543210 |||||||+-- Bit exists but function is unknown ||+++++--- (unknown) |+-------- Bit exists but function is unknown +--------- (unknown) Value $41 from previous fetch observed changed to $00. ROM $E151 writes to this address. ROM $ECE3 writes to this address. ROM $ED20 writes value to this address. ROM $ED4E writes value #$81 to this address, then OR's that with #$03, then writes the #$83. ROM $EE83 writes a value to this address with bit 0 set to 1. ROM $F0E8 reads from this address, AND's it with #$FE, and writes it back to this address. ROM $F2DC writes a value to this address with bit 0 set to 1.
$4112	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown ||||||+--- (unknown) |||||+---- Bit exists but function is unknown ||+++----- (unknown) |+-------- Bit exists but function is unknown +--------- (unknown) Value $41 from previous fetch observed changed to $04. ROM $E159 writes value #$80 to this address. ROM $E4D8 reads from this address in the IRQ handler and uses bit 0. ROM $E4F9 writes to this address in the IRQ handler. ROM $ECDB writes value #$81 to this address. ROM $ED18 writes value #$81 to this address. ROM $ED4B writes value #$81 to this address. ROM $EE7B writes value #$81 to this address. ROM $F2D4 writes value #$81 to this address.
$4113	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown ||||+++--- (unknown) |||+------ Bit exists but function is unknown ||+------- (unknown) |+-------- Bit exists but function is unknown +--------- (unknown) Value $41 from previous fetch observed changed to $10. ROM $E161 writes value #$00 to this address. ROM $ECD3 writes value #$C0 to this address. ROM $ED11 writes value #$40 to this address. ROM $ED44 writes value #$C0 to this address. ROM $EE73 writes value #$40 to this address. ROM $F2CD writes value #$40 to this address.
$4114	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $E1DE writes value #$02 to this address.
$4120	Unknown	Yes	Yes	Unknown Function. Write 76543210 |||||||+-- Pin 39 (Modem AD0) = $4120.0 ||||||+--- Pin 38 (Modem AD1) = $4120.1 |||||+---- Pin 37 (n/c) = $4120.2 ||||+----- Pin 36 (Modem EXCLK) = $4120.3 |||+------ Pin 35 (Modem /WR) = $4120.4 ||+------- Pin 34 (Modem /RD) = $4120.5 |+-------- Pin 32 (Modem Data): Direction = $4120.6: 1 = input, 0 = output (refer to $4121.0) +--------- (unknown) Read 76543210 |||||||+-- $4120.0 = Pin 33 (Modem /INT) ||+++++--- Bits exist but function is unknown |+-------- (unknown) +--------- Bit exists but function is unknown Value $41 from previous fetch observed changed to $FF Sequence: ROM $E3BC writes value #$38 to this address. ROM $E3C7 writes value #$38 & #$DF = #$18 to this address. ROM $E3CC writes value #$18 | #$20 = #$38 to this address. ROM $E3D4 writes value #$38 & #$DF = #$18 to this address. ROM $E3D9 writes value #$18 & #$EF = #$08 to this address. ROM $E3DE writes value #$08 | #$10 = #$18 to this address. ROM $E3E3 writes value #$58 to this address. ROM $E3E9 writes value #$5A to this address. ROM $E3EE writes value #$52 to this address. ROM $E3F5 writes value #$72 to this address. ROM $E3FA writes value #$52 to this address. ROM $E402 writes value #$72 to this address.
$4121	Unknown	Yes	Yes	Unknown Function. Write 76543210 |||||||+-- Pin 32 (Modem Data) = $4121.0 when set as output (refer to $4120.6) +++++++--- (unknown) Read 76543210 |||||||+-- (unknown) ||+++++--- Bits exist but function is unknown |+-------- (unknown) +--------- Bit exists but function is unknown Value $41 from previous fetch observed changed to $FF. ROM $E3BF writes to this address. ROM $E405 reads this address.
$4122	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||+++++-- (unknown) +++------- Bits exist but function is unknown Value $41 from previous fetch observed changed to $E1. ROM $F3E6 writes value #$FF to this address. ROM $FA70 writes value #$E0 to this address. ROM $FA78 writes value #$E0 to this address. ROM $FA89 reads this address using BIT operation and uses BMI, indicating bit 7 used. ROM $FAA7 reads this address using BIT operation and uses BPL, indicating bit 7 used. ROM $FAB4 reads this address and checks if bits 7 and 6 both = 1. ROM $FABF writes #$40 to this address, reads it right back, and checks if bits 7 and 6 both = 1. ROM $FACF writes value #$20 to this address. ROM $FAF3 writes value #$A0 to this address. ROM $FB00 writes value #$20 to this address. ROM $FB0D writes value #$A0 to this address. ROM $FB15 writes value #$E0 to this address. ROM $FB1D writes value #$20 to this address. ROM $FB25 writes value #$E0 to this address. ROM $FB8F writes value #$E0 to this address. ROM $FC02 writes value #$E0 to this address. ROM $FC13 reads this address using BIT operation and uses BMI, indicating bit 7 used. ROM $FC2D reads this address using BIT operation and uses BPL, indicating bit 7 used. ROM $FC3A reads this address and checks if bits 7 and 6 both = 1. ROM $FC43 writes value #$60 to this address. ROM $FC69 writes value #$E0 to this address. ROM $FC76 writes value #$60 to this address. ROM $FC83 writes value #$E0 to this address. ROM $FC8D reads this address using BIT operation and uses BPL and BVC, indicating bits 7 and 6 are used. ROM $FC96 writes value #$E0 to this address. ROM $FCA4 writes value #$60 to this address.
$4123	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- (unknown) ||+++++--- Bits exist but function is unknown |+-------- (unknown) +--------- Bit exists but function is unknown Value $41 from previous fetch observed changed to $FF. ROM $F3E9 writes value #$FF to this address. ROM $FAD9 writes to this address. ROM $FB32 writes to this address. ROM $FC49 reads from this address. ROM $FCAE reads from this address.
$4124	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown Value $41 from previous fetch observed changed to $FF. ROM $F3EC writes value #$FF to this address. ROM $FADF writes to this address. ROM $FB38 writes to this address. ROM $FC55 reads from this address and checks if it equals $00, indicating all bits exist. ROM $FCB5 reads from this address.
$4125	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- (unknown) ||+++++--- Bits exist but function is unknown |+-------- (unknown) +--------- Bit exists but function is unknown Value $41 from previous fetch observed changed to $FF. ROM $F3EF writes value #$FF to this address. ROM $FAE7 writes to this address. ROM $FB3E writes to this address. ROM $FC4F reads from this address. ROM $FCBC reads from this address.
$4126	Unknown	Yes	Unknown	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- (unknown) ||||||+--- Bit exists but function is unknown |||||+---- $4126.2 = Pin 49 (from 5C66-69) ||||+----- $5126.3 = Pin 51 (Switch SW1-2) |||+------ $4126.4 = Pin 52 (Switch SW1-4) ||+------- $4126.5 = Pin 53 (Modem P4-25) |+-------- $4126.6 = Pin 54 (Modem P4-28) +--------- $4126.7 = Pin 55 (Modem P4-23) Value $41 from previous fetch observed changed to $FB. ROM $E482 reads this address and checks Bit 2. ROM $E7BC reads this address and checks Bits 7 and 6. ROM $E886 reads this address and checks Bits 7 and 6. ROM $E8DC reads this address. ROM $E8FC reads this address and checks Bits 7 and 6. ROM $E9C0 reads this address. ROM $EBAB reads this address and checks Bits 7 and 6. ROM $F1B6 reads this address. ROM $F4F2 reads this address.
$4127	Unknown	Unknown	Yes	Unknown Function. Write 76543210 |||||||+-- Pin 56 (Modem Reset) = $4127.0 ||||||+--- Pin 57 (Red LED) = $4127.1 |||||+---- Pin 58 (Green LED) = $4127.2 ||||+----- Pin 59 (n/c) = $4127.3 |||+------ Pin 60 (Modem P4-27) = $4127.4 ||+------- Pin 61 (Modem Audio Enable) = $4127.5 |+-------- Pin 62 (Modem P4-21) = $4127.6 +--------- Pin 63 (Modem P4-19) = $4127.7 Read 76543210 ++++++++-- (unknown) ROM $E237 writes value #$14 to this address. ROM $E24D writes value #$14 to this address. ROM $E263 writes value #$14 to this address. ROM $E27D writes value #$14 to this address. ROM $E29A writes value #$14 to this address. ROM $E3B0 writes value #$14 to this address. ROM $E987 writes value #$14 to this address. ROM $EA83 writes value #$14 to this address. ROM $F3BF writes value #$FF to this address, then writes again with value #$FE.
$4128	Unknown	Yes	Yes	Unknown Function. Write 76543210 |||||||+-- Pin 68 = $4128.0 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown |||||++--- (unknown) ||||+----- $4128.3 = Pin 69 (Tone Rx D1) |||+------ $4128.4 = Pin 70 (Tone Rx D2) ||+------- $4128.5 = Pin 71 (Tone Rx D4) |+-------- $4128.6 = Pin 72 (Tone Rx D8) +--------- $4128.7 = Pin 73 (Tone Rx DV) Value $41 from previous fetch observed changed to $01. ROM $E599 reads from this address. ROM $E5BB reads from this address and uses bit 0. ROM $F3F7 writes value #$00 to this address.
$4129	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) Value $41 from previous fetch observed changed to $FF with pull-ups and $00 with pull-downs. That is either a coincidence or this particular address is open bus, needs more testing. Pin 23 is a /CE low when writing to this register (untested for reads). Sequence: ROM $E4B6 writes a value to this address. ROM $E4BB writes previous value again, OR'd with #$10. ROM $E4C0 writes previous value again, AND'd with #$2F.
$412F	Unknown	Yes	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown |||||++--- (unknown) ||||+----- Bit exists but function is unknown ||++------ (unknown) |+-------- Bit exists but function is unknown +--------- (unknown) Value $41 from previous fetch observed changed to $08. ROM $E31C writes to this address. ROM #E33B writes to this address. ROM $E4D3 reads from this address in the IRQ handler and uses bit 6. ROM $F377 writes value #$00 to this address. ROM $F40A writes value #$C1 to this address. ROM $F4E1 writes value #$00 to this address. ROM $F4E9 writes to this address. ROM $F99C writes value #$00 to this address.
$4130	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $FF2D writes to this address. ROM $FF40 writes to this address.
$4131	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $FF51 writes to this address. ROM $FF64 writes to this address.
$4132	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $FF75 writes to this address. ROM $FF88 writes to this address.
$4133	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $FF99 writes to this address. ROM $FFAC writes to this address.
$4134	Unknown	Yes	Unknown	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown) Value $41 from previous fetch observed changed to $40. ROM $FFB8 reads this address and uses bit 0 ROM $FFCD reads this address and uses bit 0
$4135	Unknown	Yes	Unknown	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown) ROM $FD35 reads this address and uses bit 0.
$4136	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $F74A writes value #$00 to this address.
$4137	Unknown	Unknown	Yes	Unknown Function. Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) ROM $F3FA writes value #$00 to this address. ROM $F73B writes value #$00 to this address.

See Also

• https://forums.nesdev.org/viewtopic.php?f=9&t=18530