INES Mapper 176: Difference between revisions

From NESdev Wiki
Jump to navigationJump to search
(Yet another 'mon RPG)
 
(51 intermediate revisions by 3 users not shown)
Line 1: Line 1:
Mapper 176 is used by some Chinese games by [http://bootleggames.wikia.com/wiki/Fuzhou_Waixing_Computer_Science_%26_Technology_Co.,LTD Waixing] (aka WXN). At one point, FCEUX by way of fceumm rewired mapper 176 to be handled by the BMCFK23C board but it is unclear what that means. Hacked builds of VirtuaNesEX and Nestopia acquired support for this mapper, at least so far as to emulate "水浒神兽" (''Shui Hu Shen Shou'', Waixing ES-1087; literally "Water Margin Animal"; appears to be a ''Pokémon''-style RPG). FCEUX supposedly acquired support for it in r2519 by reimplementing the mapper and getting BMCFK23C out of the picture.
{{DEFAULTSORT:176}}[[Category:iNES Mappers]][[Category:Multicart mappers]][[Category:MMC3-like mappers]][[Category:MMC3 with CHR ROM and CHR RAM]][[Category:Mappers with scanline IRQs]][[Category:Mappers with large PRG RAM]][[Category:NES 2.0 mappers with submappers]]
'''iNES Mapper 176''' denotes the '''8025''' enhanced [[MMC3]] chipset. It used by many multicarts, Chinese single-game and educational computer cartridges, and Techno Source's ''Intellivision X2'' Plug-and-Play console. Incompatible variations exist that are denoted via NES 2.0 Submapper.


CaH4e3 insists that mapper 176 belongs to BMCFK23C or variants thereof, subject to some caveats: the prg may be wired differently, and there are 'protections' relating to different dip switches which connect to address bits and control which addresses the mappers respond to. Preliminary investigation bears this out, and the chinese test case above can be made to work as a BMCFK23C variant. Consequently, this whole document may be obsolete soon and turn into a BMCFK23C reference.
{| class="wikitable"
! colspan="13" | Submappers
|-
! rowspan="2" | # !! rowspan="2" | PCB codes !! rowspan="2" | [[UNIF]] MAPR !! colspan="5" | MMC3 !! colspan="4" | Outer bank registers !! rowspan="2" | Example
|-
! Ext. mode !! PRG bits !! $46/47 !! [[Mirroring#Single-Screen|1SM]] !! Extra WRAM !! Address mask !! PRG A21+ !! CHR A21+ !! CNROM latch
|-
| 0 || LP-8002KB, SFC-12B || '''BMC-Super24in1SC03'''  || - || 6 || normal || - || - || $Fxx3 || - || - || - || ''YH-xxx'' multicarts, ''Rockman 6-in-1''
|-
| 1 || FK-xxx/BS-xxx || '''BMC-FK23C'''/'''BMC-FK23CA''' || $5FF3.1 || 8 || normal || - || - || $Fxx3 || - || - || yes || ''FK-xxxx'' multicarts
|-
| 2 || FS005/FS006 || '''WAIXING-FS005''' || $5FF3.1 || 6 || swapped || yes || $A001.0-1 || $Fxx3 || $5xx0.3/7, $5xx2.6-7/5 || - || - || Waixing 2005+ re-releases, ''245-in-1 Real Game''
|-
| 3 || JX9003B || - || - || 8 || normal || - || - || $Fxx7 || $5xx5 || $5xx6 || - || ''Super Mario 160-in-1 Funny Time''
|-
| 4 || ? || - || - || 6 || normal || - || - || $Fxx3 || $5xx2.7 || - || - || ''GameStar Smart Genius Deluxe''
|-
| 5 || HST-162|| - || - || 6 || normal || - || - || $Fxx3 || $4800 || - || - || ''Game 500-in-1''
|-
|}
* The '''SFC-12B''' PCB (submapper 0) mounts both CHR-ROM and CHR-RAM that are selected via $5xx0.5.
* Eight MMC3 PRG bits mean that bit 6 and 7 of $8000.6/7 are applied, and the fixed banks are $FE/$FF rather than $3E/$3F. This implies that the multicart's reset vector lies at address PRG-ROM address $1FFFFC rather than $7FFFC if the PRG-ROM is that large.
=Registers=
'''FS005 (Submapper 2)''' can disable the registers in the $5000-$5FFF range using the [[#RAM Configuration Register ($A001)|RAM Configuration Register ($A001)]]. The same register also enables a mixed CHR-ROM/CHR-RAM mode that is similar to [[INES Mapper 195]].


This documentation is based on VirtuaNesEX's hack's and FCEUX's sources are somewhat non-representative of logical hardware. This documentation was reasoned out from those sources into a slightly more logical explanation; working sources should be considered authoritative.
==Mode Register ($5xx0)==
Mask: $F''xx''7 ('''Submapper 3'''), $5''xx''3 (all others), ''x'' determined by [[#Solder Pad|solder pad setting]]
7654 3210
---- ----
PCTm PMMM
|||| ||||
|||| |+++- Select PRG Banking Mode (ignored in Extended MMC3 Mode)
|||| |      0: MMC3 PRG Mode, 2 MiB/512 KiB Outer PRG Bank Size
|||| |      1: MMC3 PRG Mode, 256 KiB Outer PRG Bank Size
|||| |      2: MMC3 PRG Mode, 128 KiB Outer PRG Bank Size
|||| |      3: NROM-128 PRG Mode, 16 KiB PRG at $8000-$BFFF mirrored at $C000-$FFFF
|||| |      4: NROM-256 PRG Mode, 32 KiB PRG at $8000-$FFFF
|||| |      5: UNROM PRG Mode, 16 KiB PRG at $8000-$BFFF, inner bank #7 at $C000-$FFFF
|||| |      6-7: Never used
|||| +---- PRG A21 ('''Submapper 2''' only)
|||+------ Select Outer CHR Bank Size
|||        0: In MMC3 CHR Mode: 256 KiB
|||            In CNROM CHR Mode: 32 KiB ('''Submapper 1''' only)
|||        1: In MMC3 CHR Mode: 128 KiB
|||            In CNROM CHR Mode: 16 KiB ('''Submapper 1''' only)
||+------- '''Submappers 0/1''' with both CHR-ROM and CHR-RAM (e.g. '''SFC-12B''' PCB):
||          0: Select CHR-ROM
||          1: Select CHR-RAM
||        '''Submapper 1''' with $5xx0.6=1:
||          0: Enable CNROM latch (CNROM mode)
||          1: Disable CNROM latch (NROM mode)
|+-------- CHR A10-12 Mode
|          0: from MMC3
|          1: from PPU
+--------- PRG A22 ('''Submapper 2''' only)
Power-on value: $00


The initial PRG state is as follows:
==PRG Base Register LSB ($5xx1)==
Mask: $F''xx''7 ('''Submapper 3'''), $F''xx''3 (all others), ''x'' determined by [[#Solder Pad|solder pad setting]]
7654 3210
---- ----
.PPP PPPP
  ||| ||||
  +++-++++- PRG A20..A14
Power-on value: $00
Depending on the PRG banking mode set via $5xx0, only the higher bits of this register are applied:
PRG A..
21111111
09876543
--------
MMMMMMMM  Submappers 1/3 in PRG Mode 0 (MMC3 2 MiB) or Extended MMC3 Mode
BBMMMMMM  Submappers 0/2/4 in PRG Mode 0 (MMC3 512 KiB)
BBBMMMMM  PRG Mode 1 (MMC3 256 KiB)
BBBBMMMM  PRG Mode 2 (MMC3 128 KiB)
BBBBBBBC  PRG Mode 3 (NROM-128)
BBBBBBCC  PRG Mode 4 (NROM-256)
BBBBLLLC  PRG Mode 5 (UNROM)
M: Bit comes from MMC3 ($8000.6/7 or fixed bank)
B: Bit comes from PRG Base Register ($5xx1)
L: Bit comes from UNROM Latch ($8000-$FFFF or fixed bank)
C: Bit comes from CPU


      $8000  $A000  $C000  $E000  
'''Submapper 5''' only selects PRG A14-A18 (i.e. 512 KiB) via this register, selecting upper PRG bits via register [[#PRG Base Register MSB ($4800), Submapper 5 only|$4800]].
    +-------+-------+-------+-------+
==PRG Base Register MSB ($5xx5), Submapper 3 only==
    |   0  |   1  |   62  |   63  |
Mask: $F''xx''7 ('''Submapper 3'''), ''x'' determined by [[#Solder Pad|solder pad setting]]
    +-------+-------+-------+-------+
  7654 3210
---- ----
.... PPPP
      ||||
      ++++- PRG Base A24..A21
Power-on value: $00
==PRG Base Register MSB ($4800), Submapper 5 only==
Mask: $F800
7654 3210
---- ----
..PP PPPP
  || ||||
  ++-++++- PRG Base A24..A19
Power-on value: $00


This is the case even for 1024KB roms where you might expect 127 and 128 instead. Perhaps the registers are only 6 bits. This distinction is significant.  
==CHR Base Register LSB ($5xx2)==
Mask: $F''xx''7 ('''Submapper 3'''), $5''xx''3 (all others), ''x'' determined by [[#Solder Pad|solder pad setting]]
7654 3210
---- ----
ccdC CCCC
|||| ||||
++++-++++- CHR A20..A13
||+------- PRG A25 ('''Submapper 2''' only)
++-------- PRG A24..A23 ('''Submapper 2''' only)
+--------- PRG A21 ('''Submapper 4''')
Power-on value: $00


By writing to $5FF1, you can effect the following:
Depending on the CHR banking mode set via $5xx0, only the higher bits of this register are applied:
CHR A..
21111111111
09876543210
-----------
BBBMMMMMMMM  MMC3 CHR Mode ($5xx0.6=0), 256 KiB ($5xx0.4=0)
BBBBMMMMMMM  MMC3 CHR Mode ($5xx0.6=0), 128 KiB ($5xx0.4=1)
BBBBBBLLPPP  CNROM CHR Mode ($5xx0.6=1, $5xx0.5=0), 32 KiB ($5xx0.4=0), '''Submapper 1''' only
BBBBBBBLPPP  CNROM CHR Mode ($5xx0.6=1, $5xx0.5=0), 16 KiB ($5xx0.4=1), '''Submapper 1''' only
BBBBBBBBPPP  NROM CHR Mode ($5xx0.6=1, $5xx0.5=1 or '''Submapper''' other than '''1''')
M: Bit comes from MMC3 ($8000.0-5)
B: Bit comes from CHR Base Register ($5xx2)
L: Bit comes from CNROM Latch ($8000-$FFFF)
P: Bit comes from PPU


      $8000  $A000  $C000  $E000 
==CHR Base Register MSB ($5xx6), Submapper 3 only==
    +-------+-------+-------+-------+
Mask: $F''xx''7 ('''Submapper 3'''), ''x'' determined by [[#Solder Pad|solder pad setting]]
    |            <$5FF1>            |
    +-------+-------+-------+-------+


By writing $24 to $5010, you can set the 'SBW' mode bit. Once that bit is set, other registers become available for mapping control. There seems to be no way to clear the bit.
7654 3210
---- ----
.... PPPP
      ||||
      ++++- CHR Base A24..A21
Power-on value: $00


By writing to $5001 with SBW set, you can effect the following:
==Extended Mode Register ($5xx3), Submappers 1-2 only==
Mask: $F''xx''3, ''x'' determined by [[#Solder Pad|solder pad setting]]


      $8000  $A000  $C000  $E000  
  7654 3210
    +-------+-------+-------+-------+
---- ----
    |             $5001             |
.?.. .?E.
    +-------+-------+-------+-------+
        |
        +- [[#MMC3-compatible registers ($8000/$8001, $A000, $C000/$C001, $E000/$E001)|Extended MMC3 Mode]]
             0: disable
             1: enable
Power-on value: $00
Most multicarts write value $44 rather than $00 to disable Extended MMC3 Mode. Hardware tests do not indicate any difference in behavior between writing $00 and $44.
==Mirroring Register ($A000)==
Mask: $E003
7654 3210
---- ----
.... ..MM
        ++- Select nametable mirroring
            0: Vertical
            1: Horizontal
            2: Single-screen, page 0 ('''Submapper 2''' only)
            3: Single-screen, page 1 ('''Submapper 2''' only)
Power-on value: $00


By writing to $5011 with SBW set, you can effect the following:
Single-screen mirroring is only available when the RAM Configuration Register is enabled ($A001.5).


      $8000  $A000  $C000  $E000 
==RAM Configuration Register ($A001), Submapper 2 only==
    +-------+-------+-------+-------+
Mask: $E003
    |            <$5011>            |
    +-------+-------+-------+-------+


There is a CHR register at $5FF2 with the following format:
This register functions like MMC3 register $A001 until bit 5 is set, which turns it into the RAM Configuration Register.


  $5FF2:  [CCCC CCCC] (exact number of bits unknown)
7654 3210
    C = Select 8k CHR page @ $0000-1FFF
---- ----
RFE. SCWW
|||  ||||
|||  ||++- Select 8 KiB PRG-RAM bank at $6000-$7FFF. Ignored if Bit 5 is clear.
|||  |+--- Select the memory type in the first 8 KiB of CHR space. Ignored if Bit 5 is clear.
|||  |      0: First 8 KiB are CHR-ROM
|||  |      1: First 8 KiB are CHR-RAM
|||  +---- Unknown
  ||+------- RAM Configuration Register Enable
||          0: RAM Configuration Register disabled, $A001 functions as on MMC3, 8 KiB of WRAM
||          1: RAM Configuration Register enabled, 32 KiB of WRAM
|+-------- Outer Bank Registers Enable. Ignored if Bit 5 is clear.
|          0: Outer Bank Registers disabled, $5000-$5FFF maps to the second 4 KiB of the 8 KiB WRAM bank 2
|          1: Outer Bank Registers enabled in the $5000-$5FFF range
+--------- PRG RAM enable (0: disable, 1: enable)
Power-on value: $00


With this mapper, there may be no VROM present.
==UNROM latch ($8000-$FFFF)==
In UNROM Mode (PRG Mode 5), writing to this address range changes the 16 KiB inner PRG bank at $8000-$BFFF.


There are registers at $A000 and $A001. I haven't been able to verify them yet, but here's how VirtuaNesEX has them:
==CNROM latch ($8000-$FFFF), Submapper 1 only==
In CNROM Mode, writing to this address range changes the inner CHR bank.


  $A000:  [.... ..MM] Mirroring
==MMC3-compatible registers, Extended MMC3 Mode ($8000/$8001, $C000/$C001, $E000/$E001)==
    0 = Vert
Mask: $E003 (verified on real hardware)
    1 = Horz
    2 = 1ScA
    3 = 1ScB


  $A001:  [.... ..EE] Enable Write SRAM
Some multicart games depend on writes to $9FFF not doing anything as a result of the MMC3 address mask being $E003 rather than the standard $E001.
    1,2,3 = Enabled


VirtuaNesEX has the write enable fixed to always enabled. This documentation is just provided as a clue in case that works out not to work well.
If the "Extended MMC3 Mode" bit in register $5xx3 is clear, then these registers function identically to the [[MMC3]]. On '''Submappers 1 and 2''', if the "Extended MMC3 Mode" bit is set, four more bank registers become available at [[MMC3#Bank_select_.28.248000-.249FFE.2C_even.29|$8000/$8001]], so that the original two 2 KiB CHR banks become four 1 KiB CHR banks, and the two fixed 8 KiB PRG banks become selectable, similar to the [[RAMBO-1]]. Register $8000 if $5xx3 bit 1 is set:
7  bit  0
---- ----
CP.. RRRR
||  ||||
||  ++++- Specify which bank register to update on next write to Bank Data register
||        $0: Select 1 KB CHR bank at PPU $0000-$03FF (or $1000-$13FF)
||        $1: Select 1 KB CHR bank at PPU $0800-$0BFF (or $1800-$1BFF)
||        $2: Select 1 KB CHR bank at PPU $1000-$13FF (or $0000-$03FF)
||        $3: Select 1 KB CHR bank at PPU $1400-$17FF (or $0400-$07FF)
||        $4: Select 1 KB CHR bank at PPU $1800-$1BFF (or $0800-$0BFF)
||        $5: Select 1 KB CHR bank at PPU $1C00-$1FFF (or $0C00-$0FFF)
||        $6: Select 8 KB PRG ROM bank at $8000-$9FFF (or $C000-$DFFF)
||        $7: Select 8 KB PRG ROM bank at $A000-$BFFF
||        $8: Select 8 KB PRG ROM bank at $C000-$DFFF (or $8000-$9FFF)
||        $9: Select 8 KB PRG ROM bank at $E000-$FFFF
||        $A: Select 1 KB CHR bank at PPU $0400-$07FF (or $1400-$17FF)
||        $B: Select 1 KB CHR bank at PPU $0C00-$0FFF (or $1C00-$1FFF)
|+-------- Invert PRG A14
+--------- Invert CHR A12
Power-on values:
* Standard MMC3 Registers $0-$7: $00, $02, $04, $05, $06, $07, $00, $01
* Extended MMC3 Registers $8-$B: $FE, $FF, $FF, $FF


Additionally, VirtuaNesEX handles register writes to $5000 and $5013 but doesn't do anything with them.
=Solder Pad=
The address mask in the $5000-$5FFF range is determined by the solder pad setting:
Pad setting  Address mask
-----------  ------------
0            $5013
1            $5023
2            $5043
3            $5083
4            $5103
5            $5203
6            $5403
7            $5803
* A solder pad setting of zero (address mask $5013) will produce a usable result for any ROM image.
* Some multicarts only display their menu at settings other than 0.


[[Category:iNES Mappers]]
=Protection (Submapper 2 only)=
Later Waixing games (and re-releases of earlier games) use the RAM Configuration Register for copy-protection purposes:
* Write $A1 to $A001: Address range $5000-$5FFF to second half of 8 KiB WRAM bank 2, mapper registers there are disabled.
* Write three values to $5000, $5010 and $5013.
* Do further initialization.
* Write $E2 to $A001. Mapper registers in address range $5000-$5FFF; WRAM at CPU $6000-$7FFF points to 8 KiB WRAM bank 2.
* Copy 20 bytes from $7000 to $6000.
* Copy and XOR bytes from $6000, $6010 and $6013 to $0100-$0102.
* Execute code at CPU $0100.
Hacked ROMs can be detected by them writing to $5000/$5010/$5013 but then no longer jumping to $0100.
=See also=
* [[NES 2.0 Mapper 523]] is a variant of this mapper with hard-wired mirroring that connects CHR-ROM differently to produce 4/2 KiB instead of 2/1 KiB banks.

Latest revision as of 18:48, 17 December 2021

iNES Mapper 176 denotes the 8025 enhanced MMC3 chipset. It used by many multicarts, Chinese single-game and educational computer cartridges, and Techno Source's Intellivision X2 Plug-and-Play console. Incompatible variations exist that are denoted via NES 2.0 Submapper.

Submappers
# PCB codes UNIF MAPR MMC3 Outer bank registers Example
Ext. mode PRG bits $46/47 1SM Extra WRAM Address mask PRG A21+ CHR A21+ CNROM latch
0 LP-8002KB, SFC-12B BMC-Super24in1SC03 - 6 normal - - $Fxx3 - - - YH-xxx multicarts, Rockman 6-in-1
1 FK-xxx/BS-xxx BMC-FK23C/BMC-FK23CA $5FF3.1 8 normal - - $Fxx3 - - yes FK-xxxx multicarts
2 FS005/FS006 WAIXING-FS005 $5FF3.1 6 swapped yes $A001.0-1 $Fxx3 $5xx0.3/7, $5xx2.6-7/5 - - Waixing 2005+ re-releases, 245-in-1 Real Game
3 JX9003B - - 8 normal - - $Fxx7 $5xx5 $5xx6 - Super Mario 160-in-1 Funny Time
4 ? - - 6 normal - - $Fxx3 $5xx2.7 - - GameStar Smart Genius Deluxe
5 HST-162 - - 6 normal - - $Fxx3 $4800 - - Game 500-in-1
  • The SFC-12B PCB (submapper 0) mounts both CHR-ROM and CHR-RAM that are selected via $5xx0.5.
  • Eight MMC3 PRG bits mean that bit 6 and 7 of $8000.6/7 are applied, and the fixed banks are $FE/$FF rather than $3E/$3F. This implies that the multicart's reset vector lies at address PRG-ROM address $1FFFFC rather than $7FFFC if the PRG-ROM is that large.

Registers

FS005 (Submapper 2) can disable the registers in the $5000-$5FFF range using the RAM Configuration Register ($A001). The same register also enables a mixed CHR-ROM/CHR-RAM mode that is similar to INES Mapper 195.

Mode Register ($5xx0)

Mask: $Fxx7 (Submapper 3), $5xx3 (all others), x determined by solder pad setting 

7654 3210
---- ----
PCTm PMMM
|||| ||||
|||| |+++- Select PRG Banking Mode (ignored in Extended MMC3 Mode)
|||| |      0: MMC3 PRG Mode, 2 MiB/512 KiB Outer PRG Bank Size
|||| |      1: MMC3 PRG Mode, 256 KiB Outer PRG Bank Size
|||| |      2: MMC3 PRG Mode, 128 KiB Outer PRG Bank Size
|||| |      3: NROM-128 PRG Mode, 16 KiB PRG at $8000-$BFFF mirrored at $C000-$FFFF
|||| |      4: NROM-256 PRG Mode, 32 KiB PRG at $8000-$FFFF
|||| |      5: UNROM PRG Mode, 16 KiB PRG at $8000-$BFFF, inner bank #7 at $C000-$FFFF
|||| |      6-7: Never used
|||| +---- PRG A21 (Submapper 2 only)
|||+------ Select Outer CHR Bank Size
|||         0: In MMC3 CHR Mode: 256 KiB
|||            In CNROM CHR Mode: 32 KiB (Submapper 1 only)
|||         1: In MMC3 CHR Mode: 128 KiB
|||            In CNROM CHR Mode: 16 KiB (Submapper 1 only)
||+------- Submappers 0/1 with both CHR-ROM and CHR-RAM (e.g. SFC-12B PCB):
||          0: Select CHR-ROM
||          1: Select CHR-RAM
||         Submapper 1 with $5xx0.6=1:
||          0: Enable CNROM latch (CNROM mode)
||          1: Disable CNROM latch (NROM mode)
|+-------- CHR A10-12 Mode
|           0: from MMC3
|           1: from PPU
+--------- PRG A22 (Submapper 2 only)

Power-on value: $00

PRG Base Register LSB ($5xx1)

Mask: $Fxx7 (Submapper 3), $Fxx3 (all others), x determined by solder pad setting 

7654 3210
---- ----
.PPP PPPP
 ||| ||||
 +++-++++- PRG A20..A14

Power-on value: $00

Depending on the PRG banking mode set via $5xx0, only the higher bits of this register are applied: 

PRG A..
21111111
09876543
--------
MMMMMMMM  Submappers 1/3 in PRG Mode 0 (MMC3 2 MiB) or Extended MMC3 Mode
BBMMMMMM  Submappers 0/2/4 in PRG Mode 0 (MMC3 512 KiB)
BBBMMMMM  PRG Mode 1 (MMC3 256 KiB)
BBBBMMMM  PRG Mode 2 (MMC3 128 KiB)
BBBBBBBC  PRG Mode 3 (NROM-128)
BBBBBBCC  PRG Mode 4 (NROM-256)
BBBBLLLC  PRG Mode 5 (UNROM)

M: Bit comes from MMC3 ($8000.6/7 or fixed bank)
B: Bit comes from PRG Base Register ($5xx1)
L: Bit comes from UNROM Latch ($8000-$FFFF or fixed bank)
C: Bit comes from CPU

Submapper 5 only selects PRG A14-A18 (i.e. 512 KiB) via this register, selecting upper PRG bits via register $4800.

PRG Base Register MSB ($5xx5), Submapper 3 only

Mask: $Fxx7 (Submapper 3), x determined by solder pad setting 

7654 3210
---- ----
.... PPPP
     ||||
     ++++- PRG Base A24..A21

Power-on value: $00

PRG Base Register MSB ($4800), Submapper 5 only

Mask: $F800 

7654 3210
---- ----
..PP PPPP
  || ||||
  ++-++++- PRG Base A24..A19

Power-on value: $00

CHR Base Register LSB ($5xx2)

Mask: $Fxx7 (Submapper 3), $5xx3 (all others), x determined by solder pad setting 

7654 3210
---- ----
ccdC CCCC
|||| ||||
++++-++++- CHR A20..A13
||+------- PRG A25 (Submapper 2 only)
++-------- PRG A24..A23 (Submapper 2 only)
+--------- PRG A21 (Submapper 4)

Power-on value: $00

Depending on the CHR banking mode set via $5xx0, only the higher bits of this register are applied: 

CHR A..
21111111111
09876543210
-----------
BBBMMMMMMMM  MMC3 CHR Mode ($5xx0.6=0), 256 KiB ($5xx0.4=0)
BBBBMMMMMMM  MMC3 CHR Mode ($5xx0.6=0), 128 KiB ($5xx0.4=1)
BBBBBBLLPPP  CNROM CHR Mode ($5xx0.6=1, $5xx0.5=0), 32 KiB ($5xx0.4=0), Submapper 1 only
BBBBBBBLPPP  CNROM CHR Mode ($5xx0.6=1, $5xx0.5=0), 16 KiB ($5xx0.4=1), Submapper 1 only
BBBBBBBBPPP  NROM CHR Mode ($5xx0.6=1, $5xx0.5=1 or Submapper other than 1)

M: Bit comes from MMC3 ($8000.0-5)
B: Bit comes from CHR Base Register ($5xx2)
L: Bit comes from CNROM Latch ($8000-$FFFF)
P: Bit comes from PPU

CHR Base Register MSB ($5xx6), Submapper 3 only

Mask: $Fxx7 (Submapper 3), x determined by solder pad setting 

7654 3210
---- ----
.... PPPP
     ||||
     ++++- CHR Base A24..A21

Power-on value: $00

Extended Mode Register ($5xx3), Submappers 1-2 only

Mask: $Fxx3, x determined by solder pad setting 

7654 3210
---- ----
.?.. .?E.
       | 
       +- Extended MMC3 Mode
           0: disable
           1: enable

Power-on value: $00

Most multicarts write value $44 rather than $00 to disable Extended MMC3 Mode. Hardware tests do not indicate any difference in behavior between writing $00 and $44.

Mirroring Register ($A000)

Mask: $E003

7654 3210
---- ----
.... ..MM
       ++- Select nametable mirroring 
           0: Vertical
           1: Horizontal
           2: Single-screen, page 0 (Submapper 2 only)
           3: Single-screen, page 1 (Submapper 2 only)
Power-on value: $00

Single-screen mirroring is only available when the RAM Configuration Register is enabled ($A001.5).

RAM Configuration Register ($A001), Submapper 2 only

Mask: $E003

This register functions like MMC3 register $A001 until bit 5 is set, which turns it into the RAM Configuration Register. 

7654 3210
---- ----
RFE. SCWW
|||  ||||
|||  ||++- Select 8 KiB PRG-RAM bank at $6000-$7FFF. Ignored if Bit 5 is clear.
|||  |+--- Select the memory type in the first 8 KiB of CHR space. Ignored if Bit 5 is clear.
|||  |      0: First 8 KiB are CHR-ROM
|||  |      1: First 8 KiB are CHR-RAM
|||  +---- Unknown
||+------- RAM Configuration Register Enable
||          0: RAM Configuration Register disabled, $A001 functions as on MMC3, 8 KiB of WRAM
||          1: RAM Configuration Register enabled, 32 KiB of WRAM
|+-------- Outer Bank Registers Enable. Ignored if Bit 5 is clear.
|           0: Outer Bank Registers disabled, $5000-$5FFF maps to the second 4 KiB of the 8 KiB WRAM bank 2
|           1: Outer Bank Registers enabled in the $5000-$5FFF range
+--------- PRG RAM enable (0: disable, 1: enable)

Power-on value: $00

UNROM latch ($8000-$FFFF)

In UNROM Mode (PRG Mode 5), writing to this address range changes the 16 KiB inner PRG bank at $8000-$BFFF.

CNROM latch ($8000-$FFFF), Submapper 1 only

In CNROM Mode, writing to this address range changes the inner CHR bank.

MMC3-compatible registers, Extended MMC3 Mode ($8000/$8001, $C000/$C001, $E000/$E001)

Mask: $E003 (verified on real hardware)

Some multicart games depend on writes to $9FFF not doing anything as a result of the MMC3 address mask being $E003 rather than the standard $E001.

If the "Extended MMC3 Mode" bit in register $5xx3 is clear, then these registers function identically to the MMC3. On Submappers 1 and 2, if the "Extended MMC3 Mode" bit is set, four more bank registers become available at $8000/$8001, so that the original two 2 KiB CHR banks become four 1 KiB CHR banks, and the two fixed 8 KiB PRG banks become selectable, similar to the RAMBO-1. Register $8000 if $5xx3 bit 1 is set: 

7  bit  0
---- ----
CP.. RRRR
||   ||||
||   ++++- Specify which bank register to update on next write to Bank Data register
||         $0: Select 1 KB CHR bank at PPU $0000-$03FF (or $1000-$13FF)
||         $1: Select 1 KB CHR bank at PPU $0800-$0BFF (or $1800-$1BFF)
||         $2: Select 1 KB CHR bank at PPU $1000-$13FF (or $0000-$03FF)
||         $3: Select 1 KB CHR bank at PPU $1400-$17FF (or $0400-$07FF)
||         $4: Select 1 KB CHR bank at PPU $1800-$1BFF (or $0800-$0BFF)
||         $5: Select 1 KB CHR bank at PPU $1C00-$1FFF (or $0C00-$0FFF)
||         $6: Select 8 KB PRG ROM bank at $8000-$9FFF (or $C000-$DFFF)
||         $7: Select 8 KB PRG ROM bank at $A000-$BFFF
||         $8: Select 8 KB PRG ROM bank at $C000-$DFFF (or $8000-$9FFF)
||         $9: Select 8 KB PRG ROM bank at $E000-$FFFF
||         $A: Select 1 KB CHR bank at PPU $0400-$07FF (or $1400-$17FF)
||         $B: Select 1 KB CHR bank at PPU $0C00-$0FFF (or $1C00-$1FFF)
|+-------- Invert PRG A14
+--------- Invert CHR A12

Power-on values:
* Standard MMC3 Registers $0-$7: $00, $02, $04, $05, $06, $07, $00, $01
* Extended MMC3 Registers $8-$B: $FE, $FF, $FF, $FF

Solder Pad

The address mask in the $5000-$5FFF range is determined by the solder pad setting: 

Pad setting  Address mask
-----------  ------------
0            $5013
1            $5023
2            $5043
3            $5083
4            $5103
5            $5203
6            $5403
7            $5803
  • A solder pad setting of zero (address mask $5013) will produce a usable result for any ROM image.
  • Some multicarts only display their menu at settings other than 0.

Protection (Submapper 2 only)

Later Waixing games (and re-releases of earlier games) use the RAM Configuration Register for copy-protection purposes:

  • Write $A1 to $A001: Address range $5000-$5FFF to second half of 8 KiB WRAM bank 2, mapper registers there are disabled.
  • Write three values to $5000, $5010 and $5013.
  • Do further initialization.
  • Write $E2 to $A001. Mapper registers in address range $5000-$5FFF; WRAM at CPU $6000-$7FFF points to 8 KiB WRAM bank 2.
  • Copy 20 bytes from $7000 to $6000.
  • Copy and XOR bytes from $6000, $6010 and $6013 to $0100-$0102.
  • Execute code at CPU $0100.

Hacked ROMs can be detected by them writing to $5000/$5010/$5013 but then no longer jumping to $0100.

See also

  • NES 2.0 Mapper 523 is a variant of this mapper with hard-wired mirroring that connects CHR-ROM differently to produce 4/2 KiB instead of 2/1 KiB banks.
Retrieved from "https://www.nesdev.org/w/index.php?title=INES_Mapper_176&oldid=18970"