Quickdev16 & Super Nintendo: David Voswinkel Matthias Nagler Matt@dforce3000.de

Quickdev16 & Super Nintendo
David Voswinkel david@optixx.org Matthias Nagler matt@dforce3000.de>
Sunday, January 1, 12
Motivation?
What to expect?
The Super Nintendo
Abbreviations

SFC
Super Famicom Super Family Computer Super Nintendo Entertainment System Super home video computer
SNES Product code SHVC
Super Nintendo

16-bit video game console based on the WDC 65816 processor Successor of successful 8-bit Nintendo Entertainment System Cartridge based system Dedicated video chips Audio co-processor Released November1990 50 Million units sold 785 Games released Last commercial successful 2d only gaming system
Super Famicom

Super Family Computer (SFC) Japan version Release November 1990 NTSC / 60Hz CIC chip
Super Nintendo

North America version Release August 1991 NTSC / 60 Hz CIC chip New cartridge slot format
Super Nintendo

Europe Version Release April 1992 PAL / 50 Hz New CIC Chip
Comparison
SNES Year Price Cpu Gfx Storage 1990 Amiga Genesis 500 1988 1987 3DO 1993 $700 PSX 1994 599DM
329DM 295DM 900DM 65816 2 PPU 8MB 68000 VDP 4MB 68000 OCS 1.4MB
ARM60 R3000 x GPU
700MB 700MB
Games
Games

785 ofcial games released Commercial phase 1990 - 1995 Last game in Japan: Metal Slader Glory (2001) Capacity constraints multimedia content JAP, USA & EU Cartridges
Package design CIC Lockout chip
50/60 Hz Version
Super Mario World

F-Zero
Super Mario Kart

Donkey Country
Yoshis Island
License
3rd party producer are welcome Exclusive releases Lockout chip CIC Cartridges sold for $70 Nintendo charged ~$20 for 8Mbit
cartridge
Approval
Long approval process
Quality assurance Market control Avoid Atari problem (E.T.) No explicit content Limited game genres
Full game play video
Hardware

WDC 65C816 CPU - Nintendo 5A22
Successor of MOS 6502 NTSC 3.57 MHz
24Bit A-Bus to RAM and ROM 8Bit B-Bus to subsystems Co-processor APU with 64KB RAM 2 PPU for graphics with 32KB video RAM each 128KB work RAM 8 DMA Channels No IPL or BIOS starts from reset vector in ROM area SPC has IPL
Mainboard
CPU
Mainboard
PPU
PPU
CPU
Mainboard
PPU
PPU
WRAM
CPU
Mainboard
VRAM
VRAM
PPU
PPU
WRAM
CPU
Mainboard
CPU

16Bit native mode 65C02 emulation mode Registers 8Bit or 16Bit
Accumulator Stack pointer X and Y index registers
Direct page and stack relative addressing modes
Ricoh 5A22
NMI on V-blank DMA for block transfers Only between A and B bus H-DMA (Scanline DMA) MMIO
PPU

Progressive mode 256 x 224 pixel HighRes 512 x 478 pixel 15Bit color depth 8 modes 128 sprites, 32 max. per scanline VRAM OAM CGRAM HDMA
Modes

Tiled mode
Flip horizontally Flip vertically
Bitmap mode Up to 4 layers / playelds Color add / subtract Rotate and zoom
Mode 7

128x128 Tiles Matrix transformations HDMA LUTs
APU

8Bit Sony SPC700 Sample use BBR compression 64KB Ram 8 x 16Bit Channels at 32 kHz Runs own code Independent system Bootstrapped by the main cpu
Cartridges

Nintendo licensed / manufactured 4 Mbit - 48 Mbit cartridges (256KB - 6MB) Mask ROM SRAM battery for savegames MAD chip (address decoding) CIC chip (security chip) Custom chips (graphics enhancement) Memory layouts
LoRom 32 KB pages HiRom 64 KB pages
Cartridge SHVC-1A3B
Rom 4MBit
Cartridge SHVC-1A3B
CIC
Rom 4MBit
Cartridge SHVC-1A3B
MAD CIC
Rom 4MBit
Cartridge SHVC-1A3B
SRAM 64KB MAD CIC
Rom 4MBit
Cartridge SHVC-1A3B
Bat MAD CIC
SRAM 64KB
Rom 4MBit
Cartridge SHVC-1A3B
Pinouts

LoRom 32KB pages HiRom 64KB pages A-Bus
24bit address bus (16MB address space) BA0-BA7 switch between 256 pages 8Bit databus ROM,CPU and WRAM
B-Bus 8bit address bus CPU, SPC and PPUs
LoRom
LoRom
WRAM
LoRom
MMIO
LoRom
Rom
LoRom
Rom
LoRom
Rom
LoRom
HiRom
HiRom
WRAM
HiRom
MMIO
HiRom
Rom
HiRom
Rom
HiRom
Rom
HiRom
Custom Chips
GFX / Calculations

AI
Super Fx CX4 DSP 1 - 4 OBC-1 GB-Z80 MX15001TFC S-DD1 SPC7110 ST010 - ST018
Gameboy Flash Rom Decompression
DSP
Microcode version 1- 4 Vector calculations 2D/3D transformations Memory mapped IO
SA-1

WDC 65C816 CPU @ 10MHz Improved version of SNES CPU 256Byte IRAM CPU and DMA at the same time Memory mapping capabilities Mode CIC copy protection for PAL/NTSC Address space up to 64Mbit
Super Mario RPG
SHVC-1L5B-11
Super Mario RPG
SA 1
SHVC-1L5B-11
Super Mario RPG
SRAM 256KB
SA 1
SHVC-1L5B-11
Super Mario RPG

ROM 32MBit
SRAM 256KB
SA 1
SHVC-1L5B-11
Super FX

RISC CPU @ 10MHz/21.4MHz Framebuffer plot opcodes Light source shading Sprite effects Memory mapped IO Software effects No 3D accelerator at all Clock problems Support for DRAM
Winter Gold
SHVC-1CB5B
Winter Gold
Super FX
SHVC-1CB5B
Winter Gold
SRAM 512KB
Super FX
SHVC-1CB5B
Winter Gold
SRAM 512KB ROM 16MBit
Super FX
SHVC-1CB5B
Winter Gold
SRAM 512KB ROM 16MBit
Super FX
CIC
SHVC-1CB5B
Lockout Chip

Key/- Lock System Chip in cartridge key Chip in system lock that controls the SNES reset line Run the same clock and same code Seeded Calculate and communicate over 2 wires Verify each others results CPU
4Bit Accumulator and x register 32 nybbles RAM 512 Byte ROM
Reverse engineered & PIC implementation
Copy Protection
Generic SRAM protection Specic Copystation checks Import protections PPU ag PAL/NTSC video Copy protections of unlicensed cartridges
Soul Blade HKO
Unlicensed copy protected cartridge

Addons
Satellaview

Online Service Satellite modem, unidirectional Japan only Broadcasted games and content could be downloaded On regular Satellite TV channel Store on 8 Mbit BX-S Flash modules Phoneline modem was planned, but never released
Ultra16
Boot menu for the SNES Support for all regions games 50/60 Hz switching via
software
Support for Satellaview games

Ultra16 Menu
Commercial Development
Mostly assembler Some games in asm and c Cross assembling on PC or Amiga Mostly self written tools Different ofcial Devkits (Intelligent Systems, Ricoh) Prototype cartridges
Flash EPROMS
psy-Q Devkit
Accolade Devkit
Unknown Devkit
Development System
Homebrew Development
Assemblers
WLA DX Snescom cc65 tcc & wla-link WDC Compiler snes-sdk
C Compilers
SDKs
Copier Stations

Storage
DRAM 4 - 128 MBit
3.5 Floppy 1.4MB Parallel port connector Boot / Game menu Save Games on oppies Custom chip and CIC piggybacks
Doctor SF7
Super Wild Card

Super Wild Card

Flash Cartridges
Storage Flash 16 - 64 MBit Parallel port USB SDCard
Tototek Super Flash

Mash Mod
Retrousb Powerpak
Emulation
ZSNES
ZSNES
Started 1998 Windows Intel OS X Linux A lot assembler code using nasm x86 only
Snes9x
Snes9x SNES96 pure C portable code
BSNES
BSNES Started 2005 Clean C++ code Windows / Linux / OS X SDL, QT Debugger
Scene
Homebrew

Very small ... By a magnitude smaller than PSP, NDS or WII community Extensive register-drivern graphics interface No real middleware nor libraries Resources
efnet #snesdev nesdev.parodius.com
Warez Scene

Active early 90ies Napalm Anthrox
Amiga Crews: Quartex, Red Sector & Paradox
Early demos use game music instead of own compositions Writing good audio drivers remain a challange for quite some time
Intros & Demos
Anthrox Sine Dot

Anthrox Mode7
Censor
Napalm
Paradox
Project Quickdev16
optixx, max and D4S Started around February 2009 Version 1 nished in September 2009 Version 2 still going ...
optixx.org
assembla.com/wiki/show/quickdev16
Proof of concept
Milestones
Rom memory layout Cartridge dumper Rom analysis SNES Memory map Documentations BSNES sources
Hardware
STK 500 512K SRAM ATmega16 SDCard Shift register, bus driver and a switch
Modied cartridge
Rom dumper
Multinorm cartridge
STK500
Memory
AVR / SNES Switch

POC running
Mario!
Firmware
Slow SRAM interface Memory CRC checks Simple SD-Card routines Debug printfs via UART
Bugs
WR Line to CART Same game overwrote ROM Switch Situation Switch, plug and then power
Prototype
Hardware Design
Switching between AVR and SNES SRAM
access
Shift register to preload SRAM addresses Counter for fast SRAM address
increment
Prototype
PCB from PCB Pool ATmega 644 8 x 512K SRAM SIO FDTI for UART
AVR , USB and bus driver

Sregs, counter and SRAM

Routing
Routing
PCB Pool
PCB Pool
Front
Back
SRAM
FTDI
AVR
PCB Pool
Good quality Extreme good support via email Delivered on time Pictures of each process step Expensive But worth the money
Problems overcome
Commercial just crashed Seemed to be audio related Wrote some test roms to trigger
problem
LA session powerup
Openbus 0x21

SPC reads 0x21 on B-Bus. Bus driver problem Our SRAM is permanently on the bus CS is not implemented HOTFIX: add an extra OR gate SRAM active when SNES CS low and AVR switch low
Hotx
Version 1
Reduce to 4 x 512K SRAM Kill FTDI to save space and money We call it Black PCBs
Front
Back
Seeedstudio
Seeedstudio PCB
Based Hong Kong Manufactured in China Good email support Fancy colors Free shaping Golden connector
Software
Firmware
USB Bootloader 4kb software V-USB Debug shell via uart
Ucon64
Opensource Supports a lot of copiers and ashcarts Added support for Quickdev16 Libusb based Windows, Linux & OS X support
Qdinc
Inital full rom upload Subsequent uploads are diff only Works with vanilla rmware
Loader 1
Part of the AVR rmware Used RLE compression HiRom WRAM trick Progress feedback via shared memory
Version 1
Loader 2
Use deate compression Progress bar via shared memory Polling of status register IRQ driven Rom info
Version 2
Size matters
mini Boot Code RAM Loader v1 Loader v2 4096 7532 344 31091 35726 debug 4096 24984 742 31091 35726
Loader crunching
Loader v1 Loader v1 RLE Loader v2 Loader v2 RLE Loader v2 deate 65536 31091 65536 58046 35726
More debugging
Chuck Norris Debugging

PCB Quality

First batch was faulty Soldermask was off Some pads had broken connections New batch of PCB for free
Faulty print No golden connectors But all working
Seeedstudio
Seeedstudio
Production
Time to play OEM...
Hack a day
Version 2
Wishlist

CPLD or FPGA Native and fast USB JTAG Custom chip support Time multiplexed bus sharing Memory pattern triggers
Prototype 2
Hardware

AT90USB1287
USB client and host
Xilinx CPLD xc95144xl Cypress 16Mbit SRAM AVR JTAG CPLD JTAG
CPLD
AVR and SRAM

ISP and JTAG

Lost in Verilog

Language

Quickdev16 & Super Nintendo: David Voswinkel Matthias Nagler Matt@dforce3000.de

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Quickdev16 & Super Nintendo: David Voswinkel Matthias Nagler Matt@dforce3000.de

Uploaded by

Copyright:

Available Formats

Quickdev16 & Super Nintendo

David Voswinkel david@optixx.org Matthias Nagler matt@dforce3000.de>

The Super Nintendo

SNES Product code SHVC

ARM60 R3000 x GPU

Package design CIC Lockout chip

Super Mario World

Super Mario Kart

Long approval process

Full game play video

Successor of MOS 6502 NTSC 3.57 MHz

Accumulator Stack pointer X and Y index registers

Direct page and stack relative addressing modes

Flip horizontally Flip vertically

LoRom 32 KB pages HiRom 64 KB pages

SRAM 64KB MAD CIC

Bat MAD CIC

B-Bus 8bit address bus CPU, SPC and PPUs

Gameboy Flash Rom Decompression

Super Mario RPG

Super Mario RPG

Super Mario RPG

Super Mario RPG

4Bit Accumulator and x register 32 nybbles RAM 512 Byte ROM

Reverse engineered & PIC implementation

Soul Blade HKO

Unlicensed copy protected cartridge

Support for Satellaview games

WLA DX Snescom cc65 tcc & wla-link WDC Compiler snes-sdk

DRAM 4 - 128 MBit

Super Wild Card

Super Wild Card

Tototek Super Flash

efnet #snesdev nesdev.parodius.com

Active early 90ies Napalm Anthrox

Amiga Crews: Quartex, Red Sector & Paradox

Intros & Demos

Anthrox Sine Dot

AVR / SNES Switch

AVR , USB and bus driver

Sregs, counter and SRAM

Chuck Norris Debugging

Faulty print No golden connectors But all working

Time to play OEM...

USB client and host

AVR and SRAM

ISP and JTAG

You might also like