Quick Dev

Quickdev16 &

Super Nintendo

David Voswinkeldavid@optixx.org

Matthias Naglermatt@dforce3000.de>

Sunday, January 1, 12

Motivation?

What to expect?

The Super Nintendo

• SFC

• Super Famicom

• Super Family Computer

• SNES

• Super Nintendo Entertainment System

• Product code SHVC

• Super home video computer

Abbreviations

Super Nintendo• 16-bit video game console based on the WDC 65816 processor

• Successor of successful 8-bit Nintendo Entertainment System

• Cartridge based system

• Dedicated video chips

• Audio co-processor

• Released November1990

• 50 Million units sold

• 785 Games released

• Last commercial successful 2d only gaming system

Super Famicom• Super Family Computer (SFC)

• Japan version

• Release November 1990

• NTSC / 60Hz

• CIC chip

Super Nintendo• North America version

• Release August 1991

• NTSC / 60 Hz

• CIC chip

• New cartridge slot format

Super Nintendo• Europe Version

• Release April 1992

• PAL / 50 Hz

• New CIC Chip

ComparisonSNES Genesis Amiga

5003DO PSX

Year 1990 1988 1987 1993 1994

Price 329DM 295DM 900DM $700 599DM

Cpu 65816 68000 68000 ARM60 R3000

Gfx 2 PPU VDP OCS x GPU

Storage 8MB 4MB 1.4MB 700MB 700MB

Games• 785 official games released

• Commercial phase 1990 - 1995

• Last game in Japan: Metal Slader Glory (2001)

• Capacity constraints multimedia content

• JAP, USA & EU Cartridges

• Package design

• 50/60 Hz Version

• CIC Lockout chip

Super Mario WorldSunday, January 1, 12

F-ZeroSunday, January 1, 12

Super Mario KartSunday, January 1, 12

Donkey CountrySunday, January 1, 12

Yoshis IslandSunday, January 1, 12

License

• 3rd party producer are welcome

• Exclusive releases

• Lockout chip CIC

• Cartridges sold for $70

• Nintendo charged ~$20 for 8Mbit cartridge

Approval

• Long approval process

• Quality assurance

• Market control

• Avoid Atari problem (E.T.)

• No explicit content

• Full game play video

• Limited game genres

Hardware• WDC 65C816 CPU - Nintendo 5A22

• Successor of MOS 6502

• NTSC 3.57 MHz

• 24Bit A-Bus to RAM and ROM

• 8Bit B-Bus to subsystems

• Co-processor APU with 64KB RAM

• 2 PPU for graphics with 32KB video RAM each

• 128KB work RAM

• 8 DMA Channels

• No IPL or BIOS starts from reset vector in ROM area

• SPC has IPL

MainboardSunday, January 1, 12

PPUPPU

VRAM VRAM

• 16Bit native mode

• 65C02 emulation mode

• Registers 8Bit or 16Bit

• Accumulator

• Stack pointer

• X and Y index registers

• Direct page and stack relative addressing modes

Ricoh 5A22

• NMI on V-blank

• DMA for block transfers

• Only between A and B bus

• H-DMA (Scanline DMA)

• MMIO

PPU• Progressive mode 256 x 224 pixel

• HighRes 512 x 478 pixel

• 15Bit color depth

• 8 modes

• 128 sprites, 32 max. per scanline

• VRAM

• OAM

• CGRAM

• HDMA

• Tiled mode

• Flip horizontally

• Flip vertically

• Bitmap mode

• Up to 4 layers / playfields

• Color add / subtract

• Rotate and zoom

Mode 7

• 128x128 Tiles

• Matrix transformations

• HDMA

• LUTs

• 8Bit Sony SPC700

• Sample use BBR compression

• 64KB Ram

• 8 x 16Bit Channels at 32 kHz

• Runs own code

• Independent system

• Bootstrapped by the main cpu

Cartridges• Nintendo licensed / manufactured

• 4 Mbit - 48 Mbit cartridges (256KB - 6MB)

• Mask ROM

• SRAM battery for savegames

• MAD chip (address decoding)

• CIC chip (security chip)

• Custom chips (graphics enhancement)

• Memory layouts

• LoRom 32 KB pages

• HiRom 64 KB pages

Cartridge SHVC-1A3BSunday, January 1, 12

Cartridge SHVC-1A3B

Rom4MBit

Cartridge SHVC-1A3B

Rom4MBit

Cartridge SHVC-1A3B

Rom4MBit

Cartridge SHVC-1A3B

Rom4MBit

SRAM64KB

Cartridge SHVC-1A3B

Rom4MBit

SRAM64KBBat

• LoRom 32KB pages

• HiRom 64KB pages

• A-Bus

• 24bit address bus (16MB address space)

• BA0-BA7 switch between 256 pages

• 8Bit databus

• ROM,CPU and WRAM

• B-Bus

• 8bit address bus

• CPU, SPC and PPUs

Pinouts

LoRomSunday, January 1, 12

HiRomSunday, January 1, 12

Custom Chips• GFX / Calculations

• Super Fx

• CX4

• DSP 1 - 4

• OBC-1

• Gameboy

• GB-Z80

• Flash Rom

• MX15001TFC

• Decompression

• S-DD1

• SPC7110

• AI

• ST010 - ST018

• Microcode version 1- 4

• Vector calculations

• 2D/3D transformations

• Memory mapped IO

• WDC 65C816 CPU @ 10MHz

• Improved version of SNES CPU

• 256Byte IRAM

• CPU and DMA at the same time

• Memory mapping capabilities Mode

• CIC copy protection for PAL/NTSC

• Address space up to 64Mbit

Super Mario RPG

SHVC-1L5B-11Sunday, January 1, 12

Super Mario RPG

SHVC-1L5B-11

Super Mario RPG

SHVC-1L5B-11

SA 1SRAM256KB

Super Mario RPG

SHVC-1L5B-11

SA 1SRAM256KB

ROM32MBit

Super FX

• RISC CPU @ 10MHz/21.4MHz

• Framebuffer plot opcodes

• Light source shading

• Sprite effects

• Memory mapped IO

• Software effects

• No 3D accelerator at all

• Clock problems

• Support for DRAM

Winter Gold

SHVC-1CB5BSunday, January 1, 12

Winter Gold

SHVC-1CB5B

SuperFX

Winter Gold

SHVC-1CB5B

SuperFX

SRAM512KB

Winter Gold

SHVC-1CB5B

SuperFX

SRAM512KB

ROM16MBit

Winter Gold

SHVC-1CB5B

SuperFX

SRAM512KB

ROM16MBit

Lockout Chip• Key/- Lock System

• Chip in cartridge “key”

• Chip in system “lock” that controls the SNES reset line

• Run the same clock and same code

• Seeded

• Calculate and communicate over 2 wires

• Verify each others results

• CPU

• 4Bit

• Accumulator and x register

• 32 nybbles RAM

• 512 Byte ROM

• Reverse engineered & PIC implementation

Copy Protection

• Generic SRAM protection

• Specific Copystation checks

• Import protections

• PPU flag PAL/NTSC video

• Copy protections of unlicensed cartridges

Soul Blade HKO

Unlicensed copy protected cartridge

Addons

Satellaview• “Online Service”

• Satellite modem, unidirectional

• Japan only

• Broadcasted games and content could be downloaded

• On regular Satellite TV channel

• Store on 8 Mbit BX-S Flash modules

• Phoneline modem was planned, but never released

Ultra16

• Boot menu for the SNES

• Support for all regions games

• 50/60 Hz switching via software

• Support for Satellaview games

Ultra16 MenuSunday, January 1, 12

Commercial Development

• Mostly assembler

• Some games in asm and c

• Cross assembling on PC or Amiga

• Mostly self written tools

• Different official Devkits (Intelligent Systems, Ricoh)

• Prototype cartridges

• Flash

• EPROMS

psy-Q DevkitSunday, January 1, 12

Accolade DevkitSunday, January 1, 12

Unknown DevkitSunday, January 1, 12

Development SystemSunday, January 1, 12

Homebrew Development

• Assemblers

• WLA DX

• Snescom

• cc65

• C Compilers

• tcc & wla-link

• WDC Compiler

• SDKs

• snes-sdk

Copier Stations• Storage

• DRAM

• 4 - 128 MBit

• 3.5” Floppy 1.4MB

• Parallel port connector

• Boot / Game menu

• Save Games on floppies

• Custom chip and CIC piggybacks

Doctor SF7Sunday, January 1, 12

Super Wild CardSunday, January 1, 12

Flash Cartridges

• Storage

• Flash

• 16 - 64 MBit

• Parallel port

• USB

• SDCard

Tototek Super FlashSunday, January 1, 12

Mash ModSunday, January 1, 12

Retrousb PowerpakSunday, January 1, 12

Emulation

• ZSNES

• Started 1998

• Windows

• Intel OS X

• Linux

• A lot assembler code using nasm

• x86 only

Snes9x

• Snes9x

• SNES96

• pure C

• portable code

• BSNES

• Started 2005

• Clean C++ code

• Windows / Linux / OS X

• SDL, QT

• Debugger

Homebrew• Very small ...

• By a magnitude smaller than PSP, NDS or WII community

• Extensive register-drivern graphics interface

• No real middleware nor libraries

• Resources

• efnet #snesdev

• nesdev.parodius.com

Warez Scene

• Active early 90ies

• Napalm

• Anthrox

• Amiga Crews: Quartex, Red Sector & Paradox

• Early demos use game music instead of own compositions

• Writing good audio drivers remain a challange for quite some time

Intros & Demos

Anthrox Sine Dot Sunday, January 1, 12

Anthrox Mode7Sunday, January 1, 12

CensorSunday, January 1, 12

NapalmSunday, January 1, 12

ParadoxSunday, January 1, 12

Project Quickdev16

• optixx, max and D4S

• Started around February 2009

• Version 1 finished in September 2009

• Version 2 still going ...

optixx.orgSunday, January 1, 12

assembla.com/wiki/show/quickdev16

Proof of concept

Milestones

• Rom memory layout

• Cartridge dumper

• Rom analysis

• SNES Memory map

• Documentations

• BSNES sources

Hardware

• STK 500

• 512K SRAM

• ATmega16

• SDCard

• Shift register, bus driver and a switch

Modified cartridgeSunday, January 1, 12

Rom dumperSunday, January 1, 12

Multinorm cartridgeSunday, January 1, 12

STK500Sunday, January 1, 12

Memory Sunday, January 1, 12

AVR / SNES SwitchSunday, January 1, 12

POC runningSunday, January 1, 12

Mario!Sunday, January 1, 12

Firmware

• Slow SRAM interface

• Memory CRC checks

• Simple SD-Card routines

• Debug printfs via UART

• WR Line to CART

• Same game overwrote “ROM”

• Switch Situation

• “Switch, plug and then power”

Prototype

Hardware Design

• Switching between AVR and SNES SRAM access

• Shift register to preload SRAM addresses

• Counter for fast SRAM address increment

Prototype

• PCB from PCB Pool

• ATmega 644

• 8 x 512K SRAM

• SIO FDTI for UART

AVR , USB and bus driverSunday, January 1, 12

Sregs, counter and SRAMSunday, January 1, 12

RoutingSunday, January 1, 12

PCB PoolSunday, January 1, 12

FrontSunday, January 1, 12

BackSunday, January 1, 12

SRAMSunday, January 1, 12

FTDISunday, January 1, 12

AVRSunday, January 1, 12

PCB Pool

• Good quality

• Extreme good support via email

• Delivered on time

• Pictures of each process step

• Expensive

• But worth the money

Problems overcome

• Commercial just crashed

• Seemed to be audio related

• Wrote some test roms to trigger problem

LA session powerup

Openbus 0x21

• SPC reads 0x21 on B-Bus.

• Bus driver problem

• “Our” SRAM is permanently on the bus

• CS is not implemented

• HOTFIX: add an extra OR gate

• SRAM active when SNES CS low and AVR switch low

HotfixSunday, January 1, 12

Version 1

• Reduce to 4 x 512K SRAM

• Kill FTDI to save space and money

• We call it

• Black PCBs

FrontSunday, January 1, 12

BackSunday, January 1, 12

SeeedstudioSunday, January 1, 12

Seeedstudio PCB

• Based Hong Kong

• Manufactured in China

• Good email support

• “Fancy colors”

• Free shaping

• Golden connector

Software

Firmware

• USB Bootloader

• 4kb

• software V-USB

• Debug shell via uart

Ucon64

• Opensource

• Supports a lot of copiers and flashcarts

• Added support for Quickdev16

• Libusb based

• Windows, Linux & OS X support

• Inital full rom upload

• Subsequent uploads are diff only

• Works with vanilla firmware

Loader 1

• Part of the AVR firmware

• Used RLE compression

• HiRom

• WRAM trick

• Progress feedback via “shared memory”

Version 1

Loader 2

• Use deflate compression

• Progress bar via “shared memory”

• Polling of status register

• IRQ driven

• Rom info

Version 2

Size matters

mini debug

Boot 4096 4096

Code 7532 24984

RAM 344 742

Loader v1 31091 31091

Loader v2 35726 35726

Loader crunching

Loader v1 65536

Loader v1 RLE 31091

Loader v2 65536

Loader v2 RLE 58046

Loader v2 deflate 35726

More debugging

Chuck Norris Debugging

PCB Quality

• First batch was faulty

• Soldermask was off

• Some pads had broken connections

• New batch of PCB for free

• Faulty print

• No golden connectors

• But all working

Seeedstudio

Production

• Time to play OEM...

Hack a daySunday, January 1, 12

Version 2

Wishlist

• CPLD or FPGA

• Native and fast USB

• JTAG

• Custom chip support

• Time multiplexed bus sharing

• Memory pattern triggers

Prototype 2

Hardware

• AT90USB1287

• USB client and host

• Xilinx CPLD xc95144xl

• Cypress 16Mbit SRAM

• AVR JTAG

• CPLD JTAG

CPLDSunday, January 1, 12

AVR and SRAMSunday, January 1, 12

ISP and JTAGSunday, January 1, 12

Lost in Verilog

Quick Dev

Documents

DEV-35: Modeling Existing ABL Systems with UMLdownload.psdn.com/media/exch_audio/2008/DEV/DEV-35_Mercer-Hu… · DEV-35: Modeling Existing ABL Systems with UML Thomas Mercer-Hursh,

Quick Start Gui Dev 104 Final

Designing Quick Starting Embedded Systems Training · Designing Quick Starting Embedded Systems Training ... the ROM loads a boot image into internal RAM. dev…. Kernel dev…. dev…

STUDENT C - itgstextbook.com · STUDENT C. 6 marks Dev Dev Dev Dev Dev Dev Dev privacy concern reliability NAQ reliability not the concern in A Detailed steps beyond article, appropriate

Build mini - Windows 10 Dev & Cross platform Dev

CareerZone Quick Guide - Department of Labor...CareerZone Quick Guide: An Overview to Creating CareerZone Portfolio Accounts Career Dev. & Youth Initiatives Office P a g e | 3 protected

Skills dev

Industrial Compressor Pumps DEV-40, DEV-55 & DEV-100

Collaborative dev

iPhone App Dev Overview - Mobile Dev Camp Vietnam 1

The OpenCV Tutorials · •ffmpeg or libav development packages: libavcodec-dev, libavformat-dev, libswscale-dev; •[optional] libdc1394 2.x; •[optional] libjpeg-dev, libpng-dev,

DEV-i - Bluetechnixdatasheets.bluetechnix.at/goto/DEV-i.MX6x/archive/DEV-i.MX6x_HUM_… · 2.1.14 MIPI CSI ... The form factor of the DEV-i ... The minimum requirements are 12V @

AirPrime MC Series Dev Kit Quick Start Guide€¦ · When operating, the Sierra Wireless ... AirPrime MC Series Dev Kit Quick Start Guide 4 Proprietary and Confidential 2130705

Condor-dev-latest.jar to Condor-dev-latest-V2- setup.exe (For …guardian.galaxyadvisors.com/releases/Condor-dev-latest... · 2019-08-08 · Condor-dev-latest.jar to Condor-dev-latest-V2-setup.exe

Dev bondvalves

Dev(/)ops ?

Corporate Profile Dev Information Technology Ltd. Dev

UI Evolving Platform Evolving Architecture Evolving · Amazon Go store Ignore Script Dev Desktop Dev Web Dev Mobile App Dev Chatbot Dev Skills Dev IoT Dev. 5 ... Application Connector

Designing Quick Starting Embedded Systems … Quick Starting Embedded Systems Training ... the ROM loads a boot image into internal RAM. dev…. Kernel dev…. dev…. dev…. dev…

XenGT Setup Guide - GitHub...7 libperl-dev libgtk2.0-dev libc6-dev-i386 libaio-dev libsdl1.2-dev \ nfs-common libyajl-dev libx11-dev autoconf libtool xsltproc bison flex \ xutils-dev