INES Mapper 176

iNES Mapper 176 is used by many multicarts as well as mid-2000s' new releases and re-releases from Waixing. It consists of an MMC3 clone with greatly extended capabilities. Its UNIF board names are:

• BMC-FK23C (no WRAM, no DIP switch)
• BMC-FK23CA (no WRAM, with DIP switch)
• BMC-Super24in1SC03 (functional duplicate of BMC-FK23C)
• WAIXING-FS005 (32 KiB WRAM, 16 KiB of which battery-backed, no DIP switch)

Three incompatible subtypes exist that do not correspond to these UNIF board names. No submappers have been proposed, as the subtypes can be easily discerned heuristically by looking at ROM sizes:

• Subtype 0, ROM size other than specified below: boot in first 512 KiB of PRG-ROM.
• Subtype 1, 1024 KiB PRG-ROM, 1024 KiB CHR-ROM: boot in second 512 KiB of PRG-ROM.
• Subtype 2, 16384 KiB PRG-ROM, no CHR-ROM: Like Subtype 0, but MMC3 registers $46 and $47 swapped.

Subtype 1 is used by multicarts holding four 128 KiB PRG-ROM-bearing games with no space left in those 512 KiB for the multicart menu. The menu is then put into a separate 32 KiB PRG bank that is mapped into the full PRG address space as the end of a second 512 KiB PRG-ROM bank, the other 480 KiB of that second 512 KiB PRG-ROM bank being empty.

Registers

Registers in the $5000-$5FFF range can be temporarily disabled through the RAM Configuration Register ($A001).

Mode Register ($5xx0)

Mask: $5xx3, x determined by DIP Switch setting

7654 3210
---- ----
PCTm PMMM
|||| ||||
|||| |+++- Select PRG Banking Mode
|||| |      0: MMC3 PRG Mode, 512 KiB Outer PRG Bank Size
|||| |      1: MMC3 PRG Mode, 256 KiB Outer PRG Bank Size
|||| |      2: MMC3 PRG Mode, 128 KiB Outer PRG Bank Size
|||| |      3: NROM-128 PRG Mode, 16 KiB PRG at $8000-$BFFF mirrored at $C000-$FFFF
|||| |      4: NROM-256 PRG Mode, 32 KiB PRG at $8000-$FFFF
|||| |      5-7: Never used
|||| +---- 16 KiB PRG Base bit 7
|||+------ Select Outer CHR Bank Size
|||         0: In MMC3 CHR Mode: 256 KiB
|||            In CNROM CHR Mode: 32 KiB
|||         1: In MMC3 CHR Mode: Same as Outer PRG Bank Size
|||            In CNROM CHR Mode: 16 KiB
||+------- Select CHR Memory Type
||          0: CHR-ROM
||          1: CHR-RAM
|+-------- CHR Mode
|           0: MMC3 CHR Mode
|           1: NROM/CNROM CHR Mode
+--------- 16 KiB PRG Base bit 8

Power-on value: $00

• It is possible to use NROM mode for PRG banking and MMC3 mode for CHR banking.
• NROM versus CNROM CHR Mode is decided in the Extended Mode Register ($5xx3).
• Bit 5 applies to CHR Memory in its entirety, while Bit 2 of the RAM Configuration Register ($A001) selects mixed CHR-ROM/RAM mode.
• The inner and outer bank numbers are combined ...
  • ... in MMC3 PRG/CHR modes: by masking the MMC3 bank register content according to the specified size (128 or 256 KiB) and OR'ing with the opposite-masked content of the PRG ($5xx1)/CHR ($5xx2) Base;
  • ... in NROM PRG/CHR mode: by using the PRG ($5xx1)/CHR Base ($5xx2) directly.
  • ... in CNROM CHR mode: by masking the CNROM Latch according to the selected Outer CHR Bank Size, and OR'ing with the unmasked content of the CHR Base ($5xx2);
  • ... in Extended MMC3 mode by OR'ing the unmasked (extended) bank register content with the unmasked content of the PRG ($5xx1)/CHR ($5xx2) Base.

PRG Base Register ($5xx1)

Mask: $5xx3, x determined by DIP Switch setting

7654 3210
---- ----
.PPP PPPP
 ||| ||||
 +++-++++- 16 KiB PRG Base bits 0-6

Power-on value: $00 (Subtypes 0 and 2), $20 (Subtype 1)

CHR Base Register ($5xx2)

Mask: $5xx3, x determined by DIP Switch setting

7654 3210
---- ----
CPCC CCCC
|||| ||||
++++-++++- 8 KiB CHR Base bits 0-7
 |
 +-------- 16 KiB PRG Base bit 9

Power-on value: $00

Writing to the CHR Base Register also resets the CNROM latch.

Extended Mode Register ($5xx3)

Mask: $5xx3, x determined by DIP Switch setting

7654 3210
---- ----
.C.. .CE.
 |    || 
 |    |+- Extended MMC3 Mode
 |    |    0: disable
 |    |    1: enable
 +----+-- Select NROM/CNROM CHR Mode
           0: NROM
           1: CNROM

Power-on value: $00

Since all games that use CNROM mode always set both bits 2 and 6 simultaneously, it's not clear which one of these bits actually triggers the CNROM mode, and what the function of the other bit would be.

RAM Configuration Register ($A001)

Mask: $E001

This register functions like MMC3 register $A001 until bit 5 is set, which turns it into the RAM Configuration Register.

7654 3210
---- ----
RFE. SCWW
|||  ||||
|||  ||++- Select 8 KiB PRG-RAM bank at $6000-$7FFF. Ignored if Bit 5 is clear.
|||  |+--- Select the memory type in the first 8 KiB of CHR space. Ignored if Bit 5 is clear.
|||  |      0: First 8 KiB are CHR-ROM
|||  |      1: First 8 KiB are CHR-RAM
|||  +---- Single-screen mirroring enable. Ignored if Bit 5 is clear.
|||         0: Do not allow single-screen mirroring (ignore $A000 bit 1)
|||         1: Allow single-screen mirroring (use $A000 bit 1)
||+------- RAM Configuration Register Enable
||          0: RAM Configuration Register disabled, $A001 functions as on MMC3, 8 KiB of WRAM
||          1: RAM Configuration Register enabled, 32 KiB of WRAM
|+-------- FK23C Registers Enable. Ignored if Bit 5 is clear.
|           0: FK23C Registers disabled, $5000-$5FFF maps to the second 4 KiB of the 8 KiB WRAM bank 2
|           1: FK23C Registers enabled in the $5000-$5FFF range
+--------- PRG RAM enable (0: disable, 1: enable)

Power-on value: $00

Of the four 8 KiB WRAM banks, only bank 1 and 3 are non-volatile. Games usually use bank 0 as work RAM, bank 2 for protection, and banks 1 and 3 for save game data.

CNROM latch ($8000-$9FFF, $C000-$FFFF)

In CNROM Mode, writing to these address ranges changes the inner CHR bank.

MMC3-compatible registers ($8000/$8001, $A000, $C000/$C001, $E000/$E001)

If the "Extended MMC3 Mode" bit in register $5xx3 is clear, then these registers function identically to the MMC3. If the "Extended MMC3 Mode" bit is set, four more bank registers become available at $8000/$8001, so that the original two 2 KiB CHR banks become four 1 KiB CHR banks, and the two fixed 8 KiB PRG banks become selectable:

Register $8000 if $5xx3 bit 1 is set (Mask: $E001):
7  bit  0
---- ----
CP.. RRRR
||   ||||
||   ++++- Specify which bank register to update on next write to Bank Data register
||         $0: Select 1 KB CHR bank at PPU $0000-$03FF (or $1000-$13FF)
||         $1: Select 1 KB CHR bank at PPU $0800-$0BFF (or $1800-$1BFF)
||         $2: Select 1 KB CHR bank at PPU $1000-$13FF (or $0000-$03FF)
||         $3: Select 1 KB CHR bank at PPU $1400-$17FF (or $0400-$07FF)
||         $4: Select 1 KB CHR bank at PPU $1800-$1BFF (or $0800-$0BFF)
||         $5: Select 1 KB CHR bank at PPU $1C00-$1FFF (or $0C00-$0FFF)
||         $6: Select 8 KB PRG ROM bank at $8000-$9FFF (or $C000-$DFFF)
||         $7: Select 8 KB PRG ROM bank at $A000-$BFFF
||         $8: Select 8 KB PRG ROM bank at $C000-$DFFF (or $8000-$9FFF)
||         $9: Select 8 KB PRG ROM bank at $E000-$FFFF
||         $A: Select 1 KB CHR bank at PPU $0400-$07FF (or $1400-$17FF)
||         $B: Select 1 KB CHR bank at PPU $0C00-$0FFF (or $1C00-$1FFF)
|+-------- Invert PRG A14
+--------- Invert CHR A12

Power-on values:
* Standard MMC3 Registers $0-$7: $00, $02, $04, $05, $06, $07, $00, $01
* Extended MMC3 Registers $8-$B: $FE, $FF, $FF, $FF

If the RAM Configuration Register is enabled and bit 3 is set, a second Mirroring bit in register $A000 becomes available, allowing single-screen mirroring to be selected in addition to Vertical and Horizontal Mirroring:

Register $A000 if $A001 bit 3 is set (Mask: $E001):
7  bit  0
---- ----
.... ..MM
       ++- Select nametable mirroring 
           0: Vertical
           1: Horizontal
           2: Single-screen, page 0
           3: Single-screen, page 1
Power-on value: $00

DIP Switch

The address mask in the $5000-$5FFF range is determined by the DIP switch setting:

DIP setting  Address mask
-----------  ------------
0            $5013
1            $5023
2            $5043
3            $5083
4            $5103
5            $5203
6            $5403
7            $5803

• A DIP setting of zero (address mask $5013) will produce a usable result for any ROM image.
• Some multicarts only display their menu at settings other than 0.

Protection

Later Waixing games (and re-releases of earlier games) use the RAM Configuration Register for copy-protection purposes:

• Write $A1 to $A001: Address range $5000-$5FFF to second half of 8 KiB WRAM bank 2, mapper registers there are disabled.
• Write three values to $5000, $5010 and $5013.
• Do further initialization.
• Write $E2 to $A001. Mapper registers in address range $5000-$5FFF; WRAM at CPU $6000-$7FFF points to 8 KiB WRAM bank 2.
• Copy 20 bytes from $7000 to $6000.
• Copy and XOR bytes from $6000, $6010 and $6013 to $0100-$0102.
• Execute code at CPU $0100.

Hacked ROMs can be detected by them writing to $5000/$5010/$5013 but then no longer jumping to $0100.

Notes

• Multicarts without CHR-ROM have large amounts of CHR-RAM into which an individual game's CHR data is copied when it is selected:
  • 128 KiB: 10-in-1 Omake Game, 150-in-1 Real Game, 245-in-1 Real Game
  • 256 KiB: 120-in-1 (Waixing)
• Waixing re-released some of their earlier games, that were originally published using other mappers, in the mid-2000s using their FS005 board, often without updating the serial number.
• There are about 60 multicarts and about 52 single Waixing games, including rereleases, using Mapper 176.

Errata

• Games using advanced functionalites such as Extended MMC3 Mode or 32 KiB WRAM have duplicates in some emulators' implementations of INES Mapper 030, INES Mapper 074 and INES Mapper 199. As these mapper numbers are also used for other boards, these games should be reassigned to Mapper 176 instead of adding Mapper 176 functionality to Mappers 30, 74 and 199.
• GoodNES 3.23b's "Mortal Kombat Trilogy - 8 People (M1274) (Ch) [!]" is actually the "KY-9005 9-in-1" multicart and runs on NES 2.0 Mapper 260.
• 帝国风暴 (Dìguó Fēngbào) - Napoleon's War with serial number 980340 requires PAL or Dendy timing to not freeze before the main game screen is shown. Serial number 980100029 does not suffer from this problem.
• 龙域天下 (Lóng yù Tiānxià), Waixing's Chinese localization of Radia Senki: Reimeihen, requires PAL or Dendy timing to not glitch and eventually freeze during the introduction.
• Five Kids on the 120-in-1 multicart writes to OneBus bank registers in its IRQ handler and glitches on normal NES/Famicom hardware.
• The menus of several multicarts using this mapper time their music by polling $2002 bit 7 but do not take the race condition into account. As a result, its music is audibly slowed down irregularly when played on an original NES/Famicom console.
• The menus of several multicarts using this mapper have a game selection cursor that changes its position erratically with original Nintendo controllers or any controller that returns 1 rather than 0 after all buttons have been read via $4016.