INES Mapper 176

iNES Mapper 176 denotes an enhanced MMC3 chipset used by many multicarts as well as Chinese single-game carrtidges, mostly from Waixing.

Three incompatible variations exist that are denoted via NES 2.0 Submapper:

• Submapper 0: UNIF BMC-FK23C/BMC-FK23CA/BMC-Super24in1SC03: Extended MMC3 mode disabled on reset, MMC3 registers $46 and $47 function normally.
• Submapper 1: UNIF BMC-FK23C/BMC-FK23CA/BMC-Super24in1SC03: Extended MMC3 mode enabled on reset, MMC3 registers $46 and $47 function normally.
• Submapper 2: UNIF WAIXING-FS005: Extended MMC3 mode disabled on reset, MMC3 registers $46 and $47 swapped.

Extended MMC3 mode being disabled on reset implies that the last 8 KiB in the first 512 KiB is mapped to CPU $E000-$FFFF, being enabled on reset implies that the last 8 KiB in the first 2 MiB is mapped to CPU $E000-$FFFF.

Registers

Registers in the $5000-$5FFF range can be temporarily disabled through the RAM Configuration Register ($A001).

Mode Register ($5xx0)

Mask: $5xx3, x determined by solder pad setting

7654 3210
---- ----
PCTm PMMM
|||| ||||
|||| |+++- Select PRG Banking Mode (ignored in Extended MMC3 Mode)
|||| |      0: MMC3 PRG Mode, 512 KiB Outer PRG Bank Size
|||| |      1: MMC3 PRG Mode, 256 KiB Outer PRG Bank Size
|||| |      2: MMC3 PRG Mode, 128 KiB Outer PRG Bank Size
|||| |      3: NROM-128 PRG Mode, 16 KiB PRG at $8000-$BFFF mirrored at $C000-$FFFF
|||| |      4: NROM-256 PRG Mode, 32 KiB PRG at $8000-$FFFF
|||| |      5-7: Never used
|||| +---- PRG Base A21
|||+------ Select Outer CHR Bank Size
|||         0: In MMC3 CHR Mode: 256 KiB
|||            In CNROM CHR Mode: 32 KiB
|||         1: In MMC3 CHR Mode: 128 KiB
|||            In CNROM CHR Mode: 16 KiB
||+------- Select CHR Memory Type
||          0: CHR-ROM
||          1: CHR-RAM
|+-------- CHR Mode
|           0: MMC3 CHR Mode
|           1: NROM/CNROM CHR Mode
+--------- PRG Base A22

Power-on value: $00

• It is possible to use NROM mode for PRG banking and MMC3 mode for CHR banking.
• NROM versus CNROM CHR Mode is decided in the Extended Mode Register ($5xx3).
• Bit 5 applies to CHR Memory in its entirety, while Bit 2 of the RAM Configuration Register ($A001) selects mixed CHR-ROM/RAM mode.
• The inner and outer bank numbers are combined ...
  • ... in MMC3 PRG/CHR modes: by masking the MMC3 bank register content according to the specified size (128 or 256 KiB) and OR'ing with the opposite-masked content of the PRG ($5xx1)/CHR ($5xx2) Base;
  • ... in NROM PRG/CHR mode: by using the PRG ($5xx1)/CHR Base ($5xx2) directly.
  • ... in CNROM CHR mode: by masking the CNROM Latch according to the selected Outer CHR Bank Size, and OR'ing with the unmasked content of the CHR Base ($5xx2);
  • ... in Extended MMC3 mode by OR'ing the unmasked (extended) bank register content with the unmasked content of the PRG ($5xx1)/CHR ($5xx2) Base.

PRG Base Register ($5xx1)

Mask: $5xx3, x determined by solder pad setting

7654 3210
---- ----
.PPP PPPP
 ||| ||||
 +++-++++- PRG Base A20..A14

Power-on value: $00

CHR Base Register ($5xx2)

Mask: $5xx3, x determined by solder pad setting

7654 3210
---- ----
ccdC CCCC
|||| ||||
++++-++++- CHR Base A20..A13
||+------- PRG Base A25
++-------- PRG Base A24..A23

Power-on value: $00

Writing to the CHR Base Register also resets the CNROM latch.

Extended Mode Register ($5xx3)

Mask: $5xx3, x determined by solder pad setting

7654 3210
---- ----
.C.. .CE.
 |    || 
 |    |+- Extended MMC3 Mode
 |    |    0: disable
 |    |    1: enable
 +----+-- Select NROM/CNROM CHR Mode
           0: NROM
           1: CNROM

Power-on value: $02 (Submapper 1), $00 (otherwise)

Since all games that use CNROM mode always set both bits 2 and 6 simultaneously, it's not clear which one of these bits actually triggers the CNROM mode, and what the function of the other bit would be.

Mirroring Register ($A000)

Mask: $E001

7654 3210
---- ----
.... ..MM
       ++- Select nametable mirroring 
           0: Vertical
           1: Horizontal
           2: Single-screen, page 0
           3: Single-screen, page 1
Power-on value: $00

Single-screen mirroring is only available when the RAM Configuration Register is enabled ($A001.5).

RAM Configuration Register ($A001)

Mask: $E001

This register functions like MMC3 register $A001 until bit 5 is set, which turns it into the RAM Configuration Register. It is only present on later chipset revisions.

7654 3210
---- ----
RFE. SCWW
|||  ||||
|||  ||++- Select 8 KiB PRG-RAM bank at $6000-$7FFF. Ignored if Bit 5 is clear.
|||  |+--- Select the memory type in the first 8 KiB of CHR space. Ignored if Bit 5 is clear.
|||  |      0: First 8 KiB are CHR-ROM
|||  |      1: First 8 KiB are CHR-RAM
|||  +---- Unknown
||+------- RAM Configuration Register Enable
||          0: RAM Configuration Register disabled, $A001 functions as on MMC3, 8 KiB of WRAM
||          1: RAM Configuration Register enabled, 32 KiB of WRAM
|+-------- FK23C Registers Enable. Ignored if Bit 5 is clear.
|           0: FK23C Registers disabled, $5000-$5FFF maps to the second 4 KiB of the 8 KiB WRAM bank 2
|           1: FK23C Registers enabled in the $5000-$5FFF range
+--------- PRG RAM enable (0: disable, 1: enable)

Power-on value: $00

CNROM latch ($8000-$9FFF, $C000-$FFFF)

In CNROM Mode, writing to these address ranges changes the inner CHR bank.

MMC3-compatible registers, Extended MMC3 Mode ($8000/$8001, $C000/$C001, $E000/$E001)

If the "Extended MMC3 Mode" bit in register $5xx3 is clear, then these registers function identically to the MMC3. If the "Extended MMC3 Mode" bit is set, four more bank registers become available at $8000/$8001, so that the original two 2 KiB CHR banks become four 1 KiB CHR banks, and the two fixed 8 KiB PRG banks become selectable, similar to the RAMBO-1. Furthermore, all eight bits of the PRG-ROM bank numbers will then be used, allowing up to 2 MiB to be bankedswitched, and all "mask" settings of register $5000 are ignored.

Register $8000 if $5xx3 bit 1 is set (Mask: $E001):
7  bit  0
---- ----
CP.. RRRR
||   ||||
||   ++++- Specify which bank register to update on next write to Bank Data register
||         $0: Select 1 KB CHR bank at PPU $0000-$03FF (or $1000-$13FF)
||         $1: Select 1 KB CHR bank at PPU $0800-$0BFF (or $1800-$1BFF)
||         $2: Select 1 KB CHR bank at PPU $1000-$13FF (or $0000-$03FF)
||         $3: Select 1 KB CHR bank at PPU $1400-$17FF (or $0400-$07FF)
||         $4: Select 1 KB CHR bank at PPU $1800-$1BFF (or $0800-$0BFF)
||         $5: Select 1 KB CHR bank at PPU $1C00-$1FFF (or $0C00-$0FFF)
||         $6: Select 8 KB PRG ROM bank at $8000-$9FFF (or $C000-$DFFF)
||         $7: Select 8 KB PRG ROM bank at $A000-$BFFF
||         $8: Select 8 KB PRG ROM bank at $C000-$DFFF (or $8000-$9FFF)
||         $9: Select 8 KB PRG ROM bank at $E000-$FFFF
||         $A: Select 1 KB CHR bank at PPU $0400-$07FF (or $1400-$17FF)
||         $B: Select 1 KB CHR bank at PPU $0C00-$0FFF (or $1C00-$1FFF)
|+-------- Invert PRG A14
+--------- Invert CHR A12

Power-on values:
* Standard MMC3 Registers $0-$7: $00, $02, $04, $05, $06, $07, $00, $01
* Extended MMC3 Registers $8-$B: $FE, $FF, $FF, $FF

Solder Pad

The address mask in the $5000-$5FFF range is determined by the solder pad setting:

Pad setting  Address mask
-----------  ------------
0            $5013
1            $5023
2            $5043
3            $5083
4            $5103
5            $5203
6            $5403
7            $5803

• A solder pad setting of zero (address mask $5013) will produce a usable result for any ROM image.
• Some multicarts only display their menu at settings other than 0.

Protection

Later Waixing games (and re-releases of earlier games) use the RAM Configuration Register for copy-protection purposes:

• Write $A1 to $A001: Address range $5000-$5FFF to second half of 8 KiB WRAM bank 2, mapper registers there are disabled.
• Write three values to $5000, $5010 and $5013.
• Do further initialization.
• Write $E2 to $A001. Mapper registers in address range $5000-$5FFF; WRAM at CPU $6000-$7FFF points to 8 KiB WRAM bank 2.
• Copy 20 bytes from $7000 to $6000.
• Copy and XOR bytes from $6000, $6010 and $6013 to $0100-$0102.
• Execute code at CPU $0100.

Hacked ROMs can be detected by them writing to $5000/$5010/$5013 but then no longer jumping to $0100.