INES Mapper 176
iNES Mapper 176 denotes an enhanced MMC3 chipset used by many multicarts as well as Chinese single-game cartridges, mostly from Waixing. Curiously, it is also used by Techno Source's Intellivision X2 Plug-and-Play console.
Three incompatible variations exist that are denoted via NES 2.0 Submapper:
- Submapper 0: UNIF BMC-FK23C/BMC-FK23CA/BMC-Super24in1SC03: Extended MMC3 mode disabled on reset, MMC3 registers $46 and $47 function normally.
- Submapper 1: UNIF BMC-FK23C/BMC-FK23CA/BMC-Super24in1SC03: Extended MMC3 mode enabled on reset, MMC3 registers $46 and $47 function normally.
- Submapper 2: UNIF WAIXING-FS005: Extended MMC3 mode disabled on reset, MMC3 registers $46 and $47 swapped.
Extended MMC3 mode being disabled on reset implies that the last 8 KiB in the first 512 KiB is mapped to CPU $E000-$FFFF, being enabled on reset implies that the last 8 KiB in the first 2 MiB is mapped to CPU $E000-$FFFF.
Registers
Registers in the $5000-$5FFF range can be temporarily disabled through the RAM Configuration Register ($A001).
Mode Register ($5xx0)
Mask: $5xx3, x determined by solder pad setting
7654 3210 ---- ---- PCTm PMMM |||| |||| |||| |+++- Select PRG Banking Mode (ignored in Extended MMC3 Mode) |||| | 0: MMC3 PRG Mode, 512 KiB Outer PRG Bank Size |||| | 1: MMC3 PRG Mode, 256 KiB Outer PRG Bank Size |||| | 2: MMC3 PRG Mode, 128 KiB Outer PRG Bank Size |||| | 3: NROM-128 PRG Mode, 16 KiB PRG at $8000-$BFFF mirrored at $C000-$FFFF |||| | 4: NROM-256 PRG Mode, 32 KiB PRG at $8000-$FFFF |||| | 5-7: Never used |||| +---- PRG Base A21 |||+------ Select Outer CHR Bank Size ||| 0: In MMC3 CHR Mode: 256 KiB ||| In CNROM CHR Mode: 32 KiB ||| 1: In MMC3 CHR Mode: 128 KiB ||| In CNROM CHR Mode: 16 KiB ||+------- Select CHR Memory Type || 0: CHR-ROM || 1: CHR-RAM |+-------- CHR Mode | 0: MMC3 CHR Mode | 1: NROM/CNROM CHR Mode +--------- PRG Base A22 Power-on value: $00
- It is possible to use NROM mode for PRG banking and MMC3 mode for CHR banking.
- NROM versus CNROM CHR Mode is decided in the Extended Mode Register ($5xx3).
- Bit 5 applies to CHR Memory in its entirety, while Bit 2 of the RAM Configuration Register ($A001) selects mixed CHR-ROM/RAM mode.
- The inner and outer bank numbers are combined ...
- ... in MMC3 PRG/CHR modes: by masking the MMC3 bank register content according to the specified size (128 or 256 KiB) and OR'ing with the opposite-masked content of the PRG ($5xx1)/CHR ($5xx2) Base;
- ... in NROM PRG/CHR mode: by using the PRG ($5xx1)/CHR Base ($5xx2) directly.
- ... in CNROM CHR mode: by masking the CNROM Latch according to the selected Outer CHR Bank Size, and OR'ing with the unmasked content of the CHR Base ($5xx2);
- ... in Extended MMC3 mode by OR'ing the unmasked (extended) bank register content with the unmasked content of the PRG ($5xx1)/CHR ($5xx2) Base.
PRG Base Register ($5xx1)
Mask: $5xx3, x determined by solder pad setting
7654 3210 ---- ---- .PPP PPPP ||| |||| +++-++++- PRG Base A20..A14 Power-on value: $00
CHR Base Register ($5xx2)
Mask: $5xx3, x determined by solder pad setting
7654 3210 ---- ---- ccdC CCCC |||| |||| ++++-++++- CHR Base A20..A13 ||+------- PRG Base A25 ++-------- PRG Base A24..A23 Power-on value: $00
Writing to the CHR Base Register also resets the CNROM latch.
Extended Mode Register ($5xx3)
Mask: $5xx3, x determined by solder pad setting
7654 3210 ---- ---- .C.. .CE. | || | |+- Extended MMC3 Mode | | 0: disable | | 1: enable +----+-- Select NROM/CNROM CHR Mode 0: NROM 1: CNROM Power-on value: $02 (Submapper 1), $00 (otherwise)
Since all games that use CNROM mode always set both bits 2 and 6 simultaneously, it's not clear which one of these bits actually triggers the CNROM mode, and what the function of the other bit would be.
Mirroring Register ($A000)
Mask: $E001
7654 3210
---- ----
.... ..MM
++- Select nametable mirroring
0: Vertical
1: Horizontal
2: Single-screen, page 0
3: Single-screen, page 1
Power-on value: $00
Single-screen mirroring is only available when the RAM Configuration Register is enabled ($A001.5).
RAM Configuration Register ($A001)
Mask: $E001
This register functions like MMC3 register $A001 until bit 5 is set, which turns it into the RAM Configuration Register. It is only present on later chipset revisions.
7654 3210 ---- ---- RFE. SCWW ||| |||| ||| ||++- Select 8 KiB PRG-RAM bank at $6000-$7FFF. Ignored if Bit 5 is clear. ||| |+--- Select the memory type in the first 8 KiB of CHR space. Ignored if Bit 5 is clear. ||| | 0: First 8 KiB are CHR-ROM ||| | 1: First 8 KiB are CHR-RAM ||| +---- Unknown ||+------- RAM Configuration Register Enable || 0: RAM Configuration Register disabled, $A001 functions as on MMC3, 8 KiB of WRAM || 1: RAM Configuration Register enabled, 32 KiB of WRAM |+-------- FK23C Registers Enable. Ignored if Bit 5 is clear. | 0: FK23C Registers disabled, $5000-$5FFF maps to the second 4 KiB of the 8 KiB WRAM bank 2 | 1: FK23C Registers enabled in the $5000-$5FFF range +--------- PRG RAM enable (0: disable, 1: enable) Power-on value: $00
CNROM latch ($8000-$9FFF, $C000-$FFFF)
In CNROM Mode, writing to these address ranges changes the inner CHR bank.
MMC3-compatible registers, Extended MMC3 Mode ($8000/$8001, $C000/$C001, $E000/$E001)
If the "Extended MMC3 Mode" bit in register $5xx3 is clear, then these registers function identically to the MMC3. If the "Extended MMC3 Mode" bit is set, four more bank registers become available at $8000/$8001, so that the original two 2 KiB CHR banks become four 1 KiB CHR banks, and the two fixed 8 KiB PRG banks become selectable, similar to the RAMBO-1. Furthermore, all eight bits of the PRG-ROM bank numbers will then be used, allowing up to 2 MiB to be bankedswitched, and all "mask" settings of register $5000 are ignored.
Register $8000 if $5xx3 bit 1 is set (Mask: $E001): 7 bit 0 ---- ---- CP.. RRRR || |||| || ++++- Specify which bank register to update on next write to Bank Data register || $0: Select 1 KB CHR bank at PPU $0000-$03FF (or $1000-$13FF) || $1: Select 1 KB CHR bank at PPU $0800-$0BFF (or $1800-$1BFF) || $2: Select 1 KB CHR bank at PPU $1000-$13FF (or $0000-$03FF) || $3: Select 1 KB CHR bank at PPU $1400-$17FF (or $0400-$07FF) || $4: Select 1 KB CHR bank at PPU $1800-$1BFF (or $0800-$0BFF) || $5: Select 1 KB CHR bank at PPU $1C00-$1FFF (or $0C00-$0FFF) || $6: Select 8 KB PRG ROM bank at $8000-$9FFF (or $C000-$DFFF) || $7: Select 8 KB PRG ROM bank at $A000-$BFFF || $8: Select 8 KB PRG ROM bank at $C000-$DFFF (or $8000-$9FFF) || $9: Select 8 KB PRG ROM bank at $E000-$FFFF || $A: Select 1 KB CHR bank at PPU $0400-$07FF (or $1400-$17FF) || $B: Select 1 KB CHR bank at PPU $0C00-$0FFF (or $1C00-$1FFF) |+-------- Invert PRG A14 +--------- Invert CHR A12 Power-on values: * Standard MMC3 Registers $0-$7: $00, $02, $04, $05, $06, $07, $00, $01 * Extended MMC3 Registers $8-$B: $FE, $FF, $FF, $FF
Solder Pad
The address mask in the $5000-$5FFF range is determined by the solder pad setting:
Pad setting Address mask ----------- ------------ 0 $5013 1 $5023 2 $5043 3 $5083 4 $5103 5 $5203 6 $5403 7 $5803
- A solder pad setting of zero (address mask $5013) will produce a usable result for any ROM image.
- Some multicarts only display their menu at settings other than 0.
Protection
Later Waixing games (and re-releases of earlier games) use the RAM Configuration Register for copy-protection purposes:
- Write $A1 to $A001: Address range $5000-$5FFF to second half of 8 KiB WRAM bank 2, mapper registers there are disabled.
- Write three values to $5000, $5010 and $5013.
- Do further initialization.
- Write $E2 to $A001. Mapper registers in address range $5000-$5FFF; WRAM at CPU $6000-$7FFF points to 8 KiB WRAM bank 2.
- Copy 20 bytes from $7000 to $6000.
- Copy and XOR bytes from $6000, $6010 and $6013 to $0100-$0102.
- Execute code at CPU $0100.
Hacked ROMs can be detected by them writing to $5000/$5010/$5013 but then no longer jumping to $0100.
