The NEC Memory Base 128 is an external PC-Engine RAM backup unit that plugs between the joypad port and the joypad itself. It can stores up to 128 KB, which is 64 times more than the standard backup units (Tennokoe 2 or Duo internal BRAM). Just like the Tennokoe 2, the mb128 needs to be powered by external batteries (4 AA) in order to retain data. It is built around the MSM6389C from OKI Semiconductor, a 1048576 x 1bit solid-state data register. This means that data is transferred 1 bit at a time.
Koei released a similar device (if not a clone), the Save Kun.
- A. III - Takin' the A Train [ADCD3001]
- Atlas Renaissance Voyage [ADCD4002]
- Bishoujo Senshi Sailor Moon Collection [BACD4004]
- Brandish [HECD4007]
- Eikan ha Kimini - Koukou Yakyuu Zenkoku Taikai [ADCD4003]
- Emerald Dragon [HECD3005]
- Fire Pro Jyoshi - Dome Choujyo Taisen [HMCD4008]
- Ganchouhishi - Aoki Ookami to Shiroki Mejika [KOCD3004]
- Linda Cube [HECD5023]
- Magicoal [HECD3002]
- Mahojng Sword Princess Quest Gaiden [NXCD4031]
- Nobunaga no Yabou - Bushou Fuuunroku [KOCD2001]
- Nobunaga no Yabou Zenkokuban [KOCD3005]
- Popful Mail [HECD4011]
- Princess Maker 2 [HECD5020]
- Private Eye Dol [HECD5019]
- Sankokushi III [KOCD3003]
- Shin Megami Tensei [ATCD3006]
- Super Mahjong Taikai [KOCD2002]
- Super Real Mahjong P II - P III Custom [NXCD4030]
- Super Real Mahjong P V Custom [NXCD5032]
- Tadaima Yuusha Boshuuchuu [HMCD3006]
- Vasteel 2 [HMCD4007]
As the Memory Base 128 is plugged into the joyport, communication is done through the joypad control port ($1000).
Without further ado, here is how to send a bit to the Memory Base 128. At this point the bit may not be stored. There is a bit of protocol to respect before getting anything written on the MSM6389C (more on this later). In the following routine the A register holds the bit (0 or 1) to be sent. If you have ever looked at a joypad routine, you will recognize the classic delays used in many games and in MagicKit.
mb128_send_bit:
and #$01
sta joyport ; CLR=0 SEL=bit to send (let's call it b)
pha ; short delay
pla
nop
ora #$02
sta joyport ; CLR=1 SEL=b
pha ; long delay
pla
pha
pla
pha
pla
and #$01
sta joyport ; CLR=0 SEL=b
pha ; short delay
pla
nop
rts
A byte is transferred by sending each bit separately starting from bit 0 to bit 7. This can easily be done by repeatedly shifting the value to the right and sending the carry flag to the Memory Base 128. This can be translated in the following C-like pseudo-code.
void mb128_send_byte(byte a) {
for(int i=0; i<8; i++) {
mb128_send_bit( a & 1 );
a >>= 1;
}
}Reading a bit is performed in a similar fashion. The assembly routine looks like this :
mb128_read_bit:
stz joyport ; CLR=0 SEL=0
pha ; short delay
pla
nop
lda #$02
sta joyport ; CLR=1 SEL=0
pha ; short delay
pla
nop
lda joyport ; read joypad part
stz joyport ; CLR=0 SEL=0
pha ; short delay
pla
and #$01 ; we only need the first bit
rts
Reading a byte is done just like its counterpart. A byte is read by performing 8 consecutive bit reads.
byte mb128_read_byte() {
byte acc = 0;
for(int i=0; i<8; i++) {
acc |= mb128_read_bit() << i;
}
return acc;
}At startup, the Memory Base 128 is in pass-through or joypad mode. The bit sequence 00010101 (or A8 in hex) must be sent in order to switch mode and access the Memory Base 128 storage. Once it is sent, 2 ident bits must be sent and read back from the joyport. The value read will determine if the Memory Base 128 switch was successful. Note that when the Memory Base 128 is active, the joypad (or any device plugged to it) is ignored.
bool mb128_init() {
for(int i=0; i<4; i++) { // we'll make 4 attempts
byte ret;
mb128_send_byte( 0xA8 );
mb128_send_bit( 0 );
ret = (joyport & 0x05) << 4;
mb128_send_bit(1);
ret |= joyport & 0x05;
if(ret == 0x04) { // we detected a mb128
return true;
}
}
// detection failed
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
return false;
}After A8 detection sequence, the Memory Base 128 expects to receive either a read or write command described as follows.
| Sequence | Number of bits | Description |
|---|---|---|
| 1 | 1 | request type (0: write, 1: read) |
| 2 | 10 | address |
| 3 | 3 | bit length (r) |
| 4 | 17 | byte length (N) |
| 5 | 2 | trailing bits |
| 6 | 3 | trailing bits |
Data can now be read or written to the Memory Base 128. First the N bytes are transfered followed by the r remainder bits. Once the transfer is done, the Memory Base 128 returns to pass-through mode, allowing the joypad states to be read by the console.
Knowing the command format, a single bit read command will be (still in pseudo code):
int mb128_read_bit(uint16_t addr) {
if(!mb128_init()) {
// There is no Memory Base 128.
return -1;
}
mb128_send_bit(1); // read command
// address
for(int i=0; i<10; i++) {
mb128_send_bit((addr >> i) & 0x01);
}
// bit size = 1
mb128_send_bit(1);
mb128_send_bit(0);
mb128_send_bit(0);
// 0 bytes
for(int i=0; i<17; i++) {
mb128_send_bit(0);
}
// trailing bits
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
// read bit
return mb128_read_bit();
} All games studied read or write data by chunks of 512 bytes. We will call it a sector. Single read sector will be:
bool mb128_read_sector(uint16_t addr, uint8_t sector[512]) {
if(!mb128_init()) {
// There is no Memory Base 128.
return -1;
}
mb128_send_bit(1); // read command
// address
for(int i=0; i<10; i++) {
mb128_send_bit((addr >> i) & 0x01);
}
// bit size = 0
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
// byte size = 512
mb128_send_byte(0);
mb128_send_byte(0x02);
mb128_send_bit(0)
// trailing bits
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
// read bit
for(int i=0; i<512; i++) {
sector[i] = mb128_read_bit();
}
return true;
} Conversely, writing a sector will be:
bool mb128_write_sector(uint16_t addr, uint8_t sector[512]) {
if(!mb128_init()) {
// There is no Memory Base 128.
return -1;
}
mb128_send_bit(0); // write command
// address
for(int i=0; i<10; i++) {
mb128_send_bit((addr >> i) & 0x01);
}
// bit size = 0
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
// byte size = 512
mb128_send_byte(0);
mb128_send_byte(0x02);
mb128_send_bit(0)
// trailing bits (write only)
mb128_send_bit(0);
mb128_send_bit(0);
// trailing bits
mb128_send_bit(0);
mb128_send_bit(0);
mb128_send_bit(0);
// read bit
for(int i=0; i<512; i++) {
mb128_send_byte(sector[i]);
}
return true;
} The first 2 sectors (1024 bytes) of the Memory Base 128 holds what can be describe as an entry list. Each entry is 16 bytes long. This means that the those sector can hold 64 entries. The first entry contains the header. It is organized as follow :
| offset | purpose |
|---|---|
| 0 | CRC (lsb) |
| 1 | CRC (msb) |
| 2 | Used sector count (lsb) |
| 3 | Used sector count (msb) |
| 4 | Header string ﾒﾓﾘﾍﾞｰｽ128\x0000 |
| . | |
| f | Last header string char (0x00) |
The Header CRC is the sum of the bytes 0x02 to 0x3ff. Some games (Shin Megami Tensei for example) keep bytes 2 and 3 at zero.
Next comes the savegame entries.
| offset | purpose |
|---|---|
| 0 | sector number |
| 1 | sector count |
| 2 | last sector used bytes count (lsb) |
| 3 | last sector used bytes count (msb) |
| 4 | CRC (lsb) |
| 5 | CRC (msb) |
| 6 | unknown (0x00) |
| 7 | unknown (0x00) |
| 8 | entry name |
| . | |
| f | Last entry name char (0x00) |
The first 2 bytes tell where the data is stored (sector number) and how many sectors are used. The meaning of bytes 6 and 7 is unknown. None of the game studied are using them, but they all set those bytes at 0 .
The CRC is simply the sum of all stored bytes. This can be translated in the following pseudo-C code.
u16 size = (sector_count-1) * 512 + last_sector_used_bytes;
u8 out[ size ];
u16 crc = 0;
mb128_read( sector_number, size );
for( i=0; i<size; i++ ) {
crc += out[ i ];
}The entry name is a 8 bytes string. It is supposed to be unique allowing games to retrieve their data. Here are some examples :
ﾕｳｼｬM128for Tadaima Yusha BoshuuchuuMT0,MT1, ... for Shin Megami Tensei
Shin Megami Tensei allows the player to have up to 10 save-states. Where Tadaima Yusha Boshuuchuu only allows 1 save-state.
The format of the data stored is not standardized. This means that they are game dependent. For example, it seems that Tadaima Yusha Boshuuchuu is using the Memory Base 128 as an extra BRAM. On the other hand, Shin Megami Tensei has its own internal format.
- David Shadoff
- Elmer
mooz at blockos dot org
This document is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0).
