181
Quickdev16 & Super Nintendo David Voswinkel [email protected] Matthias Nagler [email protected]> Sunday, January 1, 12
Quickdev16 &
Super Nintendo
David [email protected]
Matthias [email protected]>
Sunday, January 1, 12
Motivation?
Sunday, January 1, 12
What to expect?
Sunday, January 1, 12
The Super Nintendo
Sunday, January 1, 12
• SFC
• Super Famicom
• Super Family Computer
• SNES
• Super Nintendo Entertainment System
• Product code SHVC
• Super home video computer
Abbreviations
Sunday, January 1, 12
Super Nintendo• 16-bit video game console based on the WDC 65816 processor
• Successor of successful 8-bit Nintendo Entertainment System
• Cartridge based system
• Dedicated video chips
• Audio co-processor
• Released November1990
• 50 Million units sold
• 785 Games released
• Last commercial successful 2d only gaming system
Sunday, January 1, 12
Super Famicom• Super Family Computer (SFC)
• Japan version
• Release November 1990
• NTSC / 60Hz
• CIC chip
Sunday, January 1, 12
Super Nintendo• North America version
• Release August 1991
• NTSC / 60 Hz
• CIC chip
• New cartridge slot format
Sunday, January 1, 12
Super Nintendo• Europe Version
• Release April 1992
• PAL / 50 Hz
• New CIC Chip
Sunday, January 1, 12
ComparisonSNES Genesis Amiga
5003DO PSX
Year 1990 1988 1987 1993 1994
Price 329DM 295DM 900DM $700 599DM
Cpu 65816 68000 68000 ARM60 R3000
Gfx 2 PPU VDP OCS x GPU
Storage 8MB 4MB 1.4MB 700MB 700MB
Sunday, January 1, 12
Games
Sunday, January 1, 12
Games• 785 official games released
• Commercial phase 1990 - 1995
• Last game in Japan: Metal Slader Glory (2001)
• Capacity constraints multimedia content
• JAP, USA & EU Cartridges
• Package design
• 50/60 Hz Version
• CIC Lockout chip
Sunday, January 1, 12
Super Mario WorldSunday, January 1, 12
F-ZeroSunday, January 1, 12
Super Mario KartSunday, January 1, 12
Donkey CountrySunday, January 1, 12
Yoshis IslandSunday, January 1, 12
License
• 3rd party producer are welcome
• Exclusive releases
• Lockout chip CIC
• Cartridges sold for $70
• Nintendo charged ~$20 for 8Mbit cartridge
Sunday, January 1, 12
Approval
• Long approval process
• Quality assurance
• Market control
• Avoid Atari problem (E.T.)
• No explicit content
• Full game play video
• Limited game genres
Sunday, January 1, 12
Hardware• WDC 65C816 CPU - Nintendo 5A22
• Successor of MOS 6502
• NTSC 3.57 MHz
• 24Bit A-Bus to RAM and ROM
• 8Bit B-Bus to subsystems
• Co-processor APU with 64KB RAM
• 2 PPU for graphics with 32KB video RAM each
• 128KB work RAM
• 8 DMA Channels
• No IPL or BIOS starts from reset vector in ROM area
• SPC has IPL
Sunday, January 1, 12
MainboardSunday, January 1, 12
CPU
MainboardSunday, January 1, 12
CPU
PPUPPU
MainboardSunday, January 1, 12
CPU
PPUPPU
WR
AM
MainboardSunday, January 1, 12
CPU
PPUPPU
WR
AM
VRAM VRAM
MainboardSunday, January 1, 12
Sunday, January 1, 12
CPU
• 16Bit native mode
• 65C02 emulation mode
• Registers 8Bit or 16Bit
• Accumulator
• Stack pointer
• X and Y index registers
• Direct page and stack relative addressing modes
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Ricoh 5A22
• NMI on V-blank
• DMA for block transfers
• Only between A and B bus
• H-DMA (Scanline DMA)
• MMIO
Sunday, January 1, 12
PPU• Progressive mode 256 x 224 pixel
• HighRes 512 x 478 pixel
• 15Bit color depth
• 8 modes
• 128 sprites, 32 max. per scanline
• VRAM
• OAM
• CGRAM
• HDMA
Sunday, January 1, 12
Modes
• Tiled mode
• Flip horizontally
• Flip vertically
• Bitmap mode
• Up to 4 layers / playfields
• Color add / subtract
• Rotate and zoom
Sunday, January 1, 12
Mode 7
• 128x128 Tiles
• Matrix transformations
• HDMA
• LUTs
Sunday, January 1, 12
APU
• 8Bit Sony SPC700
• Sample use BBR compression
• 64KB Ram
• 8 x 16Bit Channels at 32 kHz
• Runs own code
• Independent system
• Bootstrapped by the main cpu
Sunday, January 1, 12
Cartridges• Nintendo licensed / manufactured
• 4 Mbit - 48 Mbit cartridges (256KB - 6MB)
• Mask ROM
• SRAM battery for savegames
• MAD chip (address decoding)
• CIC chip (security chip)
• Custom chips (graphics enhancement)
• Memory layouts
• LoRom 32 KB pages
• HiRom 64 KB pages
Sunday, January 1, 12
Cartridge SHVC-1A3BSunday, January 1, 12
Cartridge SHVC-1A3B
Rom4MBit
Sunday, January 1, 12
Cartridge SHVC-1A3B
Rom4MBit
CIC
Sunday, January 1, 12
Cartridge SHVC-1A3B
Rom4MBit
CIC
MAD
Sunday, January 1, 12
Cartridge SHVC-1A3B
Rom4MBit
CIC
MAD
SRAM64KB
Sunday, January 1, 12
Cartridge SHVC-1A3B
Rom4MBit
CIC
MAD
SRAM64KBBat
Sunday, January 1, 12
• LoRom 32KB pages
• HiRom 64KB pages
• A-Bus
• 24bit address bus (16MB address space)
• BA0-BA7 switch between 256 pages
• 8Bit databus
• ROM,CPU and WRAM
• B-Bus
• 8bit address bus
• CPU, SPC and PPUs
Pinouts
Sunday, January 1, 12
LoRomSunday, January 1, 12
LoRomSunday, January 1, 12
WRAM
LoRomSunday, January 1, 12
MMIO
LoRomSunday, January 1, 12
LoRom
Rom
Sunday, January 1, 12
LoRom
Rom
Sunday, January 1, 12
LoRom
Rom
Sunday, January 1, 12
HiRomSunday, January 1, 12
HiRomSunday, January 1, 12
WRAM
HiRomSunday, January 1, 12
MMIO
HiRomSunday, January 1, 12
HiRom
Rom
Sunday, January 1, 12
HiRom
Rom
Sunday, January 1, 12
HiRom
Rom
Sunday, January 1, 12
Custom Chips• GFX / Calculations
• Super Fx
• CX4
• DSP 1 - 4
• OBC-1
• Gameboy
• GB-Z80
• Flash Rom
• MX15001TFC
• Decompression
• S-DD1
• SPC7110
• AI
• ST010 - ST018
Sunday, January 1, 12
DSP
• Microcode version 1- 4
• Vector calculations
• 2D/3D transformations
• Memory mapped IO
Sunday, January 1, 12
SA-1
• WDC 65C816 CPU @ 10MHz
• Improved version of SNES CPU
• 256Byte IRAM
• CPU and DMA at the same time
• Memory mapping capabilities Mode
• CIC copy protection for PAL/NTSC
• Address space up to 64Mbit
Sunday, January 1, 12
Super Mario RPG
SHVC-1L5B-11Sunday, January 1, 12
Super Mario RPG
SHVC-1L5B-11
SA 1
Sunday, January 1, 12
Super Mario RPG
SHVC-1L5B-11
SA 1SRAM256KB
Sunday, January 1, 12
Super Mario RPG
SHVC-1L5B-11
SA 1SRAM256KB
ROM32MBit
Sunday, January 1, 12
Super FX
• RISC CPU @ 10MHz/21.4MHz
• Framebuffer plot opcodes
• Light source shading
• Sprite effects
• Memory mapped IO
• Software effects
• No 3D accelerator at all
• Clock problems
• Support for DRAM
Sunday, January 1, 12
Winter Gold
SHVC-1CB5BSunday, January 1, 12
Winter Gold
SHVC-1CB5B
SuperFX
Sunday, January 1, 12
Winter Gold
SHVC-1CB5B
SuperFX
SRAM512KB
Sunday, January 1, 12
Winter Gold
SHVC-1CB5B
SuperFX
SRAM512KB
ROM16MBit
Sunday, January 1, 12
Winter Gold
SHVC-1CB5B
SuperFX
SRAM512KB
ROM16MBit
CIC
Sunday, January 1, 12
Lockout Chip• Key/- Lock System
• Chip in cartridge “key”
• Chip in system “lock” that controls the SNES reset line
• Run the same clock and same code
• Seeded
• Calculate and communicate over 2 wires
• Verify each others results
• CPU
• 4Bit
• Accumulator and x register
• 32 nybbles RAM
• 512 Byte ROM
• Reverse engineered & PIC implementation
Sunday, January 1, 12
Copy Protection
• Generic SRAM protection
• Specific Copystation checks
• Import protections
• PPU flag PAL/NTSC video
• Copy protections of unlicensed cartridges
Sunday, January 1, 12
Soul Blade HKO
Unlicensed copy protected cartridge
Sunday, January 1, 12
Addons
Sunday, January 1, 12
Satellaview• “Online Service”
• Satellite modem, unidirectional
• Japan only
• Broadcasted games and content could be downloaded
• On regular Satellite TV channel
• Store on 8 Mbit BX-S Flash modules
• Phoneline modem was planned, but never released
Sunday, January 1, 12
Ultra16
• Boot menu for the SNES
• Support for all regions games
• 50/60 Hz switching via software
• Support for Satellaview games
Sunday, January 1, 12
Ultra16 MenuSunday, January 1, 12
Commercial Development
• Mostly assembler
• Some games in asm and c
• Cross assembling on PC or Amiga
• Mostly self written tools
• Different official Devkits (Intelligent Systems, Ricoh)
• Prototype cartridges
• Flash
• EPROMS
Sunday, January 1, 12
psy-Q DevkitSunday, January 1, 12
Accolade DevkitSunday, January 1, 12
Unknown DevkitSunday, January 1, 12
Development SystemSunday, January 1, 12
Homebrew Development
• Assemblers
• WLA DX
• Snescom
• cc65
• C Compilers
• tcc & wla-link
• WDC Compiler
• SDKs
• snes-sdk
Sunday, January 1, 12
Copier Stations• Storage
• DRAM
• 4 - 128 MBit
• 3.5” Floppy 1.4MB
• Parallel port connector
• Boot / Game menu
• Save Games on floppies
• Custom chip and CIC piggybacks
Sunday, January 1, 12
Doctor SF7Sunday, January 1, 12
Super Wild CardSunday, January 1, 12
Super Wild CardSunday, January 1, 12
Flash Cartridges
• Storage
• Flash
• 16 - 64 MBit
• Parallel port
• USB
• SDCard
Sunday, January 1, 12
Tototek Super FlashSunday, January 1, 12
Mash ModSunday, January 1, 12
Retrousb PowerpakSunday, January 1, 12
Emulation
Sunday, January 1, 12
ZSNES
• ZSNES
• Started 1998
• Windows
• Intel OS X
• Linux
• A lot assembler code using nasm
• x86 only
Sunday, January 1, 12
Snes9x
• Snes9x
• SNES96
• pure C
• portable code
Sunday, January 1, 12
BSNES
• BSNES
• Started 2005
• Clean C++ code
• Windows / Linux / OS X
• SDL, QT
• Debugger
Sunday, January 1, 12
Scene
Sunday, January 1, 12
Homebrew• Very small ...
• By a magnitude smaller than PSP, NDS or WII community
• Extensive register-drivern graphics interface
• No real middleware nor libraries
• Resources
• efnet #snesdev
• nesdev.parodius.com
Sunday, January 1, 12
Warez Scene
• Active early 90ies
• Napalm
• Anthrox
• Amiga Crews: Quartex, Red Sector & Paradox
• Early demos use game music instead of own compositions
• Writing good audio drivers remain a challange for quite some time
Sunday, January 1, 12
Intros & Demos
Sunday, January 1, 12
Anthrox Sine Dot Sunday, January 1, 12
Anthrox Mode7Sunday, January 1, 12
CensorSunday, January 1, 12
NapalmSunday, January 1, 12
ParadoxSunday, January 1, 12
Project Quickdev16
• optixx, max and D4S
• Started around February 2009
• Version 1 finished in September 2009
• Version 2 still going ...
Sunday, January 1, 12
optixx.orgSunday, January 1, 12
assembla.com/wiki/show/quickdev16
Sunday, January 1, 12
Proof of concept
Sunday, January 1, 12
Milestones
• Rom memory layout
• Cartridge dumper
• Rom analysis
• SNES Memory map
• Documentations
• BSNES sources
Sunday, January 1, 12
Hardware
• STK 500
• 512K SRAM
• ATmega16
• SDCard
• Shift register, bus driver and a switch
Sunday, January 1, 12
Modified cartridgeSunday, January 1, 12
Rom dumperSunday, January 1, 12
Multinorm cartridgeSunday, January 1, 12
STK500Sunday, January 1, 12
Memory Sunday, January 1, 12
Sunday, January 1, 12
AVR / SNES SwitchSunday, January 1, 12
POC runningSunday, January 1, 12
Mario!Sunday, January 1, 12
Firmware
• Slow SRAM interface
• Memory CRC checks
• Simple SD-Card routines
• Debug printfs via UART
Sunday, January 1, 12
Bugs
• WR Line to CART
• Same game overwrote “ROM”
• Switch Situation
• “Switch, plug and then power”
Sunday, January 1, 12
Sunday, January 1, 12
Prototype
Sunday, January 1, 12
Hardware Design
• Switching between AVR and SNES SRAM access
• Shift register to preload SRAM addresses
• Counter for fast SRAM address increment
Sunday, January 1, 12
Prototype
• PCB from PCB Pool
• ATmega 644
• 8 x 512K SRAM
• SIO FDTI for UART
Sunday, January 1, 12
AVR , USB and bus driverSunday, January 1, 12
Sregs, counter and SRAMSunday, January 1, 12
RoutingSunday, January 1, 12
RoutingSunday, January 1, 12
PCB PoolSunday, January 1, 12
PCB PoolSunday, January 1, 12
FrontSunday, January 1, 12
BackSunday, January 1, 12
SRAMSunday, January 1, 12
FTDISunday, January 1, 12
AVRSunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
PCB Pool
• Good quality
• Extreme good support via email
• Delivered on time
• Pictures of each process step
• Expensive
• But worth the money
Sunday, January 1, 12
Problems overcome
• Commercial just crashed
• Seemed to be audio related
• Wrote some test roms to trigger problem
Sunday, January 1, 12
Sunday, January 1, 12
LA session powerup
Sunday, January 1, 12
Openbus 0x21
• SPC reads 0x21 on B-Bus.
• Bus driver problem
• “Our” SRAM is permanently on the bus
• CS is not implemented
• HOTFIX: add an extra OR gate
• SRAM active when SNES CS low and AVR switch low
Sunday, January 1, 12
HotfixSunday, January 1, 12
Version 1
• Reduce to 4 x 512K SRAM
• Kill FTDI to save space and money
• We call it
• Black PCBs
Sunday, January 1, 12
FrontSunday, January 1, 12
BackSunday, January 1, 12
SeeedstudioSunday, January 1, 12
Seeedstudio PCB
• Based Hong Kong
• Manufactured in China
• Good email support
• “Fancy colors”
• Free shaping
• Golden connector
Sunday, January 1, 12
Sunday, January 1, 12
Software
Sunday, January 1, 12
Firmware
• USB Bootloader
• 4kb
• software V-USB
• Debug shell via uart
Sunday, January 1, 12
Ucon64
• Opensource
• Supports a lot of copiers and flashcarts
• Added support for Quickdev16
• Libusb based
• Windows, Linux & OS X support
Sunday, January 1, 12
Qdinc
• Inital full rom upload
• Subsequent uploads are diff only
• Works with vanilla firmware
Sunday, January 1, 12
Loader 1
• Part of the AVR firmware
• Used RLE compression
• HiRom
• WRAM trick
• Progress feedback via “shared memory”
Sunday, January 1, 12
Version 1
Sunday, January 1, 12
Loader 2
• Use deflate compression
• Progress bar via “shared memory”
• Polling of status register
• IRQ driven
• Rom info
Sunday, January 1, 12
Version 2
Sunday, January 1, 12
Size matters
mini debug
Boot 4096 4096
Code 7532 24984
RAM 344 742
Loader v1 31091 31091
Loader v2 35726 35726
Sunday, January 1, 12
Loader crunching
Loader v1 65536
Loader v1 RLE 31091
Loader v2 65536
Loader v2 RLE 58046
Loader v2 deflate 35726
Sunday, January 1, 12
Sunday, January 1, 12
More debugging
Sunday, January 1, 12
Chuck Norris Debugging
Sunday, January 1, 12
PCB Quality
• First batch was faulty
• Soldermask was off
• Some pads had broken connections
• New batch of PCB for free
• Faulty print
• No golden connectors
• But all working
Sunday, January 1, 12
Seeedstudio
Sunday, January 1, 12
Seeedstudio
Sunday, January 1, 12
Production
• Time to play OEM...
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Sunday, January 1, 12
Hack a daySunday, January 1, 12
Version 2
Sunday, January 1, 12
Wishlist
• CPLD or FPGA
• Native and fast USB
• JTAG
• Custom chip support
• Time multiplexed bus sharing
• Memory pattern triggers
Sunday, January 1, 12
Prototype 2
Sunday, January 1, 12
Hardware
• AT90USB1287
• USB client and host
• Xilinx CPLD xc95144xl
• Cypress 16Mbit SRAM
• AVR JTAG
• CPLD JTAG
Sunday, January 1, 12
CPLDSunday, January 1, 12
AVR and SRAMSunday, January 1, 12
ISP and JTAGSunday, January 1, 12
Lost in Verilog
Sunday, January 1, 12
