CNROM: Difference between revisions

From NESdev Wiki
Jump to navigationJump to search
m (change cat:dlm to cat:cnrom)
(→‎Notes: Deleting section about $2007 to rewrite in Tricky-to-emulate games, where it'd make more sense)
 
(25 intermediate revisions by 9 users not shown)
Line 1: Line 1:
[[Category:CNROM-like mappers]]
[[Category:CNROM-like mappers]][[Category:Nintendo licensed mappers]][[Category:Expansion audio]]
NES-[[CNROM]] (and its [[Famicom|HVC]] counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM.
{{Infobox iNES mapper
The [[iNES]] format assigns [[iNES Mapper 003|mapper 3]] to this board.
|name=CNROM
 
|company=Nintendo, others
Many CNROM games such as ''Milon's Secret Castle'' store data tables in otherwise unused portions of CHR ROM and access them through <code>[[NES PPU#PPUDATA ($2007)|$2007]]</code> reads. If an emulator can show the title screen of the [[NROM]] game ''Super Mario Bros.'', but CNROM games don't work, the emulator's <code>$2007</code> readback is likely failing to consider CHR ROM bankswitching.
|mapper=3
 
|othermappers=[[iNES Mapper 185|185]]
== Overview ==
|boards=CNROM
* PRG ROM size: 16 KB or 32 KB (DIP-28 standard pinout)
|prgmax=32K
* PRG ROM bank size: Not bankswitched
|prgpage=n/a
* PRG RAM: None
|chrmax=32K
* CHR capacity: 32 KB ROM (DIP-28 standard pinout)
|chrpage=8K
* CHR bank size: 8 KB
|busconflicts=Yes
* Nametable [[mirroring]]: Solder pads select vertical or horizontal mirroring
|audio=No
* Subject to [[bus conflict]]s: Yes [[Category:Mappers with bus conflicts]]
}}
 
{{nesdbbox
== Solder Pad Config ==
|ines|3|iNES 003
* Horizontal mirroring : 'H' disconnected, 'V' connected.
|ines|185|iNES 185
* Vertical mirroring : 'H' connected, 'V' disconnected.
|unif_wild|CNROM|CNROM
 
}}
* 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
'''NES-[[CNROM]]''' (and its [[Famicom|HVC]] counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM. The most common usage of this board, as well as other third-party compatible boards, is assigned to [[iNES Mapper 003|iNES mapper 3]]. (See [[iNES Mapper 003]] for the suggested emulator implementation.)  If the CNROM board mounts only 8 KiB of CHR-ROM, the 8 KiB CHR bank number becomes a Chip Select number for copy-protection purposes, described by [[iNES Mapper 185]].  
* 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.
 
* Bit 4 security implemented to '0' : D2 cathode set to '3' (CHR A12) and D2 anode set to '4' (latch).
* Bit 4 security implemented to '1' : D2 cathode set to '4' (latch) and D2 anode set to '3' (CHR A12).
* Bit 5 security implemented to '0' : D1 cathode set to '1' (CHR A10) and D1 anode set to '2' (latch).
* Bit 5 security implemented to '1' : D1 cathode set to '2' (latch) and D1 anode set to '1' (CHR A10).
* Security unimplemented : D1 and D2 not present.


== Banks ==
== Banks ==
* CPU $8000-$FFFF: 16 KB PRG ROM, fixed (if 16 KB PRG ROM used, then this is the same as $C000-$FFFF)
* CPU $C000-$FFFF: 16 KB PRG ROM, fixed
* PPU $0000-$1FFF: 8 KB switchable CHR ROM bank
* PPU $0000-$1FFF: 8 KB switchable CHR ROM bank
For 16 KB PRG ROM testing, [https://nescartdb.com/profile/view/423/joust Joust (NES)] makes a worthwhile test subject.


== Registers ==
== Registers ==
Line 34: Line 31:
  7  bit  0
  7  bit  0
  ---- ----
  ---- ----
  xxDD xxCC
  ..DC ..BA
   ||  ||
   ||  ||
   ||  ++- Select 8 KB CHR ROM bank for PPU $0000-$1FFF
   ||  ++- CHR A14..A13 (8 KiB bank)
   ++------ Security diodes config
  |+------ Output to Diode 2 (D2)
   +------- Output to Diode 1 (D1)


== Hardware ==
The CNROM board contains a [[74161|74HC161]] binary counter used as a quad D latch (4-bit register) to select the current CHR bank.
The CNROM board contains a [[74161|74HC161]] binary counter used as a quad D latch (4-bit register) to select the current CHR bank.


Early CNROM boards allow security diodes to be placed. If the latched bits 4 and 5 do not correspond to the configuration of the 2 diodes placed on the board while the PPU is rendering, the latched signal will conflict with some of the PPU's adresses bus and create bus conflicts. This system was probably created to make dumping cartridges harder, because the dumping device would have to write the correct value into the 74HC161 latch to dump the CHR ROM proprely, or else bus conflicts will appear and possibly damage the dumping device.
== Security diodes ==
This anti-dump precaution wasn't very effective, and Nintendo quickly gave up on this. Only Japanese games released in 1986 are known to have these diodes present.
As a (weak) copy protection mechanism, the CNROM circuit board has a spot for two diodes that produce additional bus conflicts to hinder cartridge dumping attempts. Diode 1 connects latch bit 'D' to CHR-ROM A10; Diode 2 connects latch bit 'C' to CHR-ROM A12. Each latch bit must be set such that the diode does ''not'' allow current to flow, because if it does, AND-type bus conflicts occur that may cause the wrong CHR-ROM A10 and A12 signals to be applied, depending on the relative output resistances of latch chip and console or dumping device. Both the NES PPU and modern Kazzo-like dumping devices have strong enough output drivers to always win these bus conflicts, but 1980s' dumping equipment will lose these bus conflicts and produce an unusable readout. Each diode can be mounted either with the anode or the cathode facing the latch output. As a diode will allow current to flow if the anode-side voltage is significantly higher than the cathode-side voltage, the latch bit must be 0 if it faces the anode, and 1 if it faces the cathode.
 
The security diodes were mounted by most Nintendo-manufactured Japanese CNROM games manufactured in 1986 as well as Bandai-manufactured CNROM games from 1986 and 1987. They were never used on North American or PAL CNROM games, even as the NES-CNROM board has an unpopulated spot for them until at least revision -02.
 
== Solder Pad Config ==
* Horizontal mirroring : 'H' disconnected, 'V' connected.
* Vertical mirroring : 'H' connected, 'V' disconnected.


Some Japanese CNROM games combine the diode security with special CHR ROM where higher addresses are actually additional chip enable signals. This will cause the game's CHR ROM to be disabled at all if the wrong CHR bank is selected, making only one actual 8K CHR bank available (the games could in theory run in a [[NROM]] board without being affected).
* 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
Those games typically turn the PPU off, switch in the wrong CHR bank (that return open bus) with wrong diode configuration, read a CHR byte in a specific place where the bus conflicts with the mapper will not appear even with the wrong diode config, then read the same byte with the correct bank and diode config latched, and enter in an infinite loop if the two reads matches. Those games have been assigned to [[iNES Mapper 185]]. Trying to dump them as regular NROM games will create bus conflicts with the dumping device, and even if this is bypassed the game will not run because the CHR ROM will be mirrored for all 8K bank select values.
* 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.


== Variants ==
== Variants ==
Line 53: Line 56:
The upper 2 bank select bits on the [[74161|74HC161]] were connected to security diodes.
The upper 2 bank select bits on the [[74161|74HC161]] were connected to security diodes.
If they were connected to CHR ROM address lines instead, this board could have theoretically supported up to 128 KB of CHR ROM.
If they were connected to CHR ROM address lines instead, this board could have theoretically supported up to 128 KB of CHR ROM.
In fact, [[iNES Mapper 003]] encompasses both CNROM and a functionally similar board used in Panesian games that used this much CHR ROM.
In fact, [[iNES Mapper 003]] encompasses both CNROM and similar boards that used more CHR ROM, such as those made by [http://bootgod.dyndns.org:7777/profile.php?id=4090 Bandai] and [http://bootgod.dyndns.org:7777/profile.php?id=1838 Panesian].


The [http://bootgod.dyndns.org:7777/profile.php?id=3953 Japanese version of ''Dance Aerobics''] adds a [http://forums.nesdev.org/viewtopic.php?p=102300#p102300 sound playback IC] to CNROM. It adds a [http://forums.nesdev.org/viewtopic.php?t=9449 register mapped from $6000-$7FFF] that can play one of eight voice recordings. However, the specifics of the compression are not yet known, and there is no standardized way to bundle audio data with [[iNES]] images.
The [http://bootgod.dyndns.org:7777/profile.php?id=3953 Japanese version of ''Dance Aerobics''] adds a [http://forums.nesdev.org/viewtopic.php?p=102300#p102300 sound playback IC] to a CNROM-like board. It adds a [http://forums.nesdev.org/viewtopic.php?t=9449 register mapped from $6000-$7FFF] that can play one of eight voice [https://forums.nesdev.org/viewtopic.php?p=199048#p199048 recordings]. However, the [https://forums.nesdev.org/viewtopic.php?p=199681#p199681 specifics] of the compression are not yet known, and there is no standardized way to bundle audio data with [[iNES]] images.
 
[https://nescartdb.com/profile/view/3844/hayauchi-super-igo ''Hayauchi Super Igo''] is a CNROM-like board with a 2KB SRAM mapped at $6000, using a [[7410|74HC10]] as the address decoder.


Theoretically the bank select register could be implemented with a [[74377|74HC377]] octal D latch, allowing up to 2 megabytes of CHR ROM.
Theoretically the bank select register could be implemented with a [[74377|74HC377]] octal D latch, allowing up to 2 megabytes of CHR ROM.
== See Also ==
* [[iNES Mapper 003]] - The common emulator implementation used for this board, which includes some compatible additions.
* [[iNES Mapper 185]] - Emulation for a subset of CNROM boards that implement a weak form of copy protection.
*[http://nesdev.org/mappers.zip Comprehensive NES Mapper Document] by \Firebug\, information about mapper's initial state is inaccurate.

Latest revision as of 14:47, 9 November 2024

CNROM
Company Nintendo, others
Boards CNROM
PRG ROM capacity 32K
PRG ROM window n/a
PRG RAM capacity None
CHR capacity 32K
CHR window 8K
Nametable mirroring Fixed H or V, controlled by solder pads
Bus conflicts Yes
IRQ No
Audio No
iNES mappers 003, 185
NESCartDB
iNES 003
iNES 185
CNROM

NES-CNROM (and its HVC counterpart) is a particular Nintendo cartridge board which uses uses discrete logic to provide up to four 8 KB banks of CHR ROM. The most common usage of this board, as well as other third-party compatible boards, is assigned to iNES mapper 3. (See iNES Mapper 003 for the suggested emulator implementation.) If the CNROM board mounts only 8 KiB of CHR-ROM, the 8 KiB CHR bank number becomes a Chip Select number for copy-protection purposes, described by iNES Mapper 185.

Banks

  • CPU $8000-$FFFF: 16 KB PRG ROM, fixed (if 16 KB PRG ROM used, then this is the same as $C000-$FFFF)
  • CPU $C000-$FFFF: 16 KB PRG ROM, fixed
  • PPU $0000-$1FFF: 8 KB switchable CHR ROM bank

For 16 KB PRG ROM testing, Joust (NES) makes a worthwhile test subject.

Registers

Bank select ($8000-$FFFF)

7  bit  0
---- ----
..DC ..BA
  ||   ||
  ||   ++- CHR A14..A13 (8 KiB bank)
  |+------ Output to Diode 2 (D2)
  +------- Output to Diode 1 (D1)

The CNROM board contains a 74HC161 binary counter used as a quad D latch (4-bit register) to select the current CHR bank.

Security diodes

As a (weak) copy protection mechanism, the CNROM circuit board has a spot for two diodes that produce additional bus conflicts to hinder cartridge dumping attempts. Diode 1 connects latch bit 'D' to CHR-ROM A10; Diode 2 connects latch bit 'C' to CHR-ROM A12. Each latch bit must be set such that the diode does not allow current to flow, because if it does, AND-type bus conflicts occur that may cause the wrong CHR-ROM A10 and A12 signals to be applied, depending on the relative output resistances of latch chip and console or dumping device. Both the NES PPU and modern Kazzo-like dumping devices have strong enough output drivers to always win these bus conflicts, but 1980s' dumping equipment will lose these bus conflicts and produce an unusable readout. Each diode can be mounted either with the anode or the cathode facing the latch output. As a diode will allow current to flow if the anode-side voltage is significantly higher than the cathode-side voltage, the latch bit must be 0 if it faces the anode, and 1 if it faces the cathode.

The security diodes were mounted by most Nintendo-manufactured Japanese CNROM games manufactured in 1986 as well as Bandai-manufactured CNROM games from 1986 and 1987. They were never used on North American or PAL CNROM games, even as the NES-CNROM board has an unpopulated spot for them until at least revision -02.

Solder Pad Config

  • Horizontal mirroring : 'H' disconnected, 'V' connected.
  • Vertical mirroring : 'H' connected, 'V' disconnected.
  • 16 KB PRG ROM : 'SL' connected, 'CL' disconnected.
  • 32 KB PRG ROM : 'SL' disconnected, 'CL' connected.

Variants

CNROM operates identically to a GNROM with one PRG bank.

The upper 2 bank select bits on the 74HC161 were connected to security diodes. If they were connected to CHR ROM address lines instead, this board could have theoretically supported up to 128 KB of CHR ROM. In fact, iNES Mapper 003 encompasses both CNROM and similar boards that used more CHR ROM, such as those made by Bandai and Panesian.

The Japanese version of Dance Aerobics adds a sound playback IC to a CNROM-like board. It adds a register mapped from $6000-$7FFF that can play one of eight voice recordings. However, the specifics of the compression are not yet known, and there is no standardized way to bundle audio data with iNES images.

Hayauchi Super Igo is a CNROM-like board with a 2KB SRAM mapped at $6000, using a 74HC10 as the address decoder.

Theoretically the bank select register could be implemented with a 74HC377 octal D latch, allowing up to 2 megabytes of CHR ROM.

See Also

  • iNES Mapper 003 - The common emulator implementation used for this board, which includes some compatible additions.
  • iNES Mapper 185 - Emulation for a subset of CNROM boards that implement a weak form of copy protection.
  • Comprehensive NES Mapper Document by \Firebug\, information about mapper's initial state is inaccurate.
Retrieved from "https://www.nesdev.org/w/index.php?title=CNROM&oldid=22214"