Famicom Network System (aka Famicom Modem) Investigations

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by krzysiobal »

I'd like to try to help you rev-en this board but it seems to be 3 (or 4 layer) - at least at top side the ground polygon is covering many trases in the cartridge connector region :(
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

It is okay krzysiobal, I am working on it slowly but surely. I have the front and back lined up in Photoshop and I started manually tracing the things that we know. It will be a while to get through it. Eventually, all that will be left is the unknown stuff. From what I can tell, the inner 2 layers are only used for signals in really dense areas, otherwise most stuff is on the top and bottom.

Also I plan to eventually trace the card. I am intrigued to see how they hooked up a microwire EEPROM.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

I am not sure what to make of this 44-pin LH5323 chip. It is very mysterious. I identified 2 pins, when grounded, cause it to drive the CPU data bus, seemingly 2 /CSs. Pin 25, which tied directly to GND on the PCB, and also pin 27, which is normally controlled by the 5C66. The remaining unknown pins 37, 41, 7, 8, 9, and 13 (corresponding to 5C66 pins 57,56,55,54,53,52) appear as inputs.

I tied both /CS pins low, then attempted to "dump" the chip like a ROM chip. I hooked up D0-D7 normally, A0-A11 normally, then:

A12 = 5323-37 = 5C66-57
A13 = 5323-41 = 5C66-56
A14 = 5323-7 = 5C66-55
A15 = 5323-8 = 5C66-54
A16 = 5323-9 = 5C66-53
A17 = 5323-13 = 5C66-52

It appears that all of those additional inputs affect the data that spits out from this chip. The data is very periodic looking, I was monitoring D7 with my scope during dumping and it had a definite cyclic pattern. I can dump repeatedly and get identical results. I also dumped in reverse, then reversed the file, and it too was identical. I removed power for 10 seconds, dumped again, and it was still identical.

I opened the file in yy-chr, 1-bit mode, and it contains what looks like tons of misaligned Japanese characters, possibly intended to be 4x4 tiles each, and graphics to construct large brackets / curly braces. I am not really seeing anything at all in terms of numbers, english letters, or other graphics. 2-bit mode won't work, it doesn't align right. I am not really sure what to make of this, it seems like a very unusual ROM chip. It is directly on the CPU address and data busses, not on the card data bus.

The Russian Wikipedia says that the Famicom Network System has a hardware encryption scheme, not sure what that entails or whether this chip is involved. I think I would expect less periodic and less predictable/repeatable data from this chip if that was the case though.

My Famicom Network System did nothing without a card inserted, I got a gray screen. But admittedly, I did not try closing the lid without a card in it. It does have a switch that tells it if the lid is open or not.
User avatar
krzysiobal
Posts: 1037
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland
Contact:

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by krzysiobal »

Here is reverse-engineered schematic of the small PCB:
Image

* Is pin 12 of this connector connected to the pin 14 of famicom slot?

MMC1 CHR and MIRRORING (CIRAM-A10) lines are used as latches to drive lines of some chips (CHR bank 0 is used / mirroring is set to single screen B to output 1)

So basically:
* MMC1 PRG-A14..A17 controls sixteen 16 kB banks of PRG-ROM (which is mapped at $8000-$ffff)
* MMC1 CHR-A14/A15 controls four 8kB banks of PRG-RAM (which is mapped at $6000-7fff)
* MMC1 CHR-A16 acts as a chip enable to the PRG-RAM (0=enabled)
* MMC1 CHR-A13 acts as clock to EEPROM
* MMC1 CIRAM-A10 acts as chip select to EEPROM
* MMC1 CHR-A12 acts as data input to EEPROM
* CPU-D0 is driven with EEPROM data output (only when reading form $6000-$7fff and CIRAM-A10=1 and MMC1-CHR-A16=1)

---

Updated due to suggestion from Ben Boldt
Last edited by krzysiobal on Sat Mar 02, 2019 5:30 am, edited 2 times in total.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

Thanks so much for doing this krzysiobal.

One small glitch is that VCC is both pins 1 & 2, and GND is both pins 41 & 42. It is confusing because the card just has one big finger for both pins in these cases. (The cut-out area does not count as pin numbers.) So actually you are asking if pin 13 is CPU R/W, and I can confirm that it is not, at least not directly. It is very strange, it goes through the lid switch.

P6 is the connector for the lid switch:
P6-1 -> 5C66-15, 5A18-84
P6-2 -> Card Pin 13, with 10k pull-up to 5V
P6-3 -> GND (RF shield), not going to the switch at all.

When the card is clicked down, P6-1 and P6-2 close together. When it is up, they are not connected.

It is conceivable that the 5C66 buffers CPU R/W and sends it out on pin 15. I am not sure why the 5A18 would be connected. It seems 5C66-15 is the output, and 5A18-84 and Card-13 would both then be inputs.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

I found today that the 5C66 responds to reads to these addresses (Address bits A0-A7, A12-A14, /ROMSEL, fits nicely to the hex form $NxNN):

Address - Values observed on CPU data bus

$4xA1 - $FF
$4xA2 - $20 with pull-downs, $2C with pull-ups
$4xA5 - $00 with pull-downs, $78 with pull-ups
$4xA6 - Different every time
$4xA7 - Different every time
$4xA9 - $00
$4xAA - $00
$4xAD - $00 with pull-downs, $7F with pull-ups
$4xB1 - $FF
$4xC0 - $00 with pull-downs, $70 with pull-ups

Note that the card data bus and all other pins were floating during this test, possibly lending itself to differences with pull-ups vs. pull-downs.

Also: the 5C66 would not talk without its crystal attached.
User avatar
Memblers
Site Admin
Posts: 4044
Joined: Mon Sep 20, 2004 6:04 am
Location: Indianapolis
Contact:

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Memblers »

I stumbled into an interesting bit of info about the JRA-PAT software. The dial-up service existed until 2015, and there is a video of it working in 2008 (both links are the same video). I couldn't read the text of course, except where it mentioned Windows Vista, which is funny to see on Famicom. I'd bet that a small number people were still using this.
https://www.nicovideo.jp/watch/sm3351267
https://www.youtube.com/watch?v=ks0JeyhZsR4

Also saw these things:
https://twitter.com/jironosuke99/status ... 8266539008
https://twitter.com/jironosuke99/status ... 1260793856
https://twitter.com/jironosuke99/status ... 6265899013
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

That is absolutely hilarious.

I have been poking a lot at this RF5C66 chip and found a few things. I determined if each pin is an input or output with using pull-up / pull-down resistors. This doesn't exclude the possibility that some of them are bidirectional. I found that pin 29 should be pulled up to prevent the RF5C66 being reset by the CIC chip. That was a breakthrough of a discovery because I couldn't get it to do much before that. I found 4 /CEs and ranges:

Pin 50 - LH5323M1 /CE: Range $5000-5FFF. Range of size $1000 jives with CPU A0-A11 being connected directly.
Pin 40 - Card Bus RAM /CE (for the ram chip in the network system, not in the card): Range $6000-7FFF
Pin 42 - Modem (RF5A18) /CE, Range $4xD0-4xDF, $CxD0-CxDF
Pin 41 - Normally n/c, Range $4xE0-4xEF, $CxE0-CxEF

The plot thickened a little bit for the LH5323M1. I believe pins 52-56 are akin to PRG A12-A16. These pins toggle on counting M2 falling edges when the CPU address bus is in range $5000-5FFF.
52 - Inverts on each M2 falling edge
53 - Inverts each 2 M2 falling edges
54 - each 4
55 - 8
56 - 16
57 - Always low, I have not gotten this pin to ever go high. (I figure this would be like PRG A17, I was pretty sure that it does reveal different data when set 0 vs 1.)

SOO I should dump it toggling like that and see what happens I guess.
User avatar
Banshaku
Posts: 2417
Joined: Tue Jun 24, 2008 8:38 pm
Location: Japan
Contact:

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Banshaku »

The twitter post, which I saw recently, show a device that seems called "micro core" which has the capability of communication and uses cards that seems similar to pc-engine one. The name of the controller is "daiwa my trade", which seems to imply about stock trading but this is me just speculating.

And what make me speculating about it is this book on amazon ホームトレード最前線―ファミコン200%活用法 (home trade forefront, 200% usage on famicom, 1988). The picture on the book is exactly the same device.

Here's the picture, just in case the link get lost on amazon:
51-khv2aAuL._SX347_BO1,204,203,200_.jpg
So it may be possible that people did trading with it for a long time, even though the famicom itself didn't have any game anymore. I wouldn't be surprised, since we still had geocities until recently here :lol:

edit:

and the book on amazon is sold under 大和証券マイトレード推進室 (Daiwa securities 'my trade' promotion office) so this real means it was for trading stocks.
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

Banshaku wrote:The twitter post, which I saw recently, show a device that seems called "micro core" which has the capability of communication and uses cards that seems similar to pc-engine one. The name of the controller is "daiwa my trade", which seems to imply about stock trading but this is me just speculating.

And what make me speculating about it is this book on amazon ホームトレード最前線―ファミコン200%活用法 (home trade forefront, 200% usage on famicom, 1988). The picture on the book is exactly the same device.

Here's the picture, just in case the link get lost on amazon:
51-khv2aAuL._SX347_BO1,204,203,200_.jpg
So it may be possible that people did trading with it for a long time, even though the famicom itself didn't have any game anymore. I wouldn't be surprised, since we still had geocities until recently here :lol:

edit:

and the book on amazon is sold under 大和証券マイトレード推進室 (Daiwa securities 'my trade' promotion office) so this real means it was for trading stocks.
This must be just about the least secure possible way to do something like this, but I guess it is obscure, and that makes it sort of secure... It is very interesting and curious to say the least.

I inspected the breakout board that I used to dump the JRA-PAT ROM chip against your schematic/pinout krzysiobal, and it seems I had A15 incorrect. That pin had a short to GND. I re-dumped it today and now all 3 of the vectors go to places that make sense. It still just sits waiting for bit 7 of register $40C0 to get set. If I skip that, proceeds with the code, not jumping back to the reset vector like I thought before with the bad dump. Nothing ever appears on the screen though, it is probably getting stuck waiting for something else somewhere.

Edit:
I found these registers being written to by JRA-PAT:
40A3
40A6
40A7
40A8
40AB
40AD
40AE
40B1
40C0
40D3 (RF5A18 (Modem) address space 4xD0-4xDF)
40D4 (RF5A18 (Modem) address space 4xD0-4xDF)
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

Update - I have mounted the RF5A18 onto a breakout board, powered it, and found whether each pin appears to be and input or output. I updated the information here:

https://wiki.nesdev.com/w/index.php/User:Ben_Boldt

Does anyone have ideas how/where to store this information in the wiki in a more permanent way? I am not sure if I should just create a new article named "Famicom Network System" and dump it in there? It is more a collection of pinouts at the moment I guess. I don't think it is necessarily ready for that yet but just something to think about ahead of time I guess.


I am still making daily progress on tracing out the PCB. It is a monumental amount of work. I am doing this with Photoshop on my Macintosh. Each signal gets its own layers for top and bottom.
Picture 15.png
I have carefully used a flashlight and double-checking with a continuity tester to trace out MOST of the bottom inner layer traces, which really only exist around the Famicom connector AFAIK. I have all of these dumped onto 1 single photoshop layer currently, because I started with just bits and pieces of traces until I built them up figuring out what was what.

The top inner layer does contain some traces, but not near as many. Whatever it contains is almost entirely obscured by ground planes. Since there is a cutout around each thru-hole, I will still be able to use the flashlight trick to see if a trace exists and what direction it goes. As a last resort, I thought it might be possible to pass a controlled amount of current through an unknown trace and see if I can draw any additional data with a thermal camera. But I do not think it will come to that.

Surprisingly, I have found NO new or incorrect connections or signals this way at all yet.
tepples
Posts: 22708
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by tepples »

The typical pattern is to create a draft in your user space, titled something like "User:Ben Boldt/Famicom Network System".
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

tepples wrote:The typical pattern is to create a draft in your user space, titled something like "User:Ben Boldt/Famicom Network System".
I am thinking about moving this over to an actual wiki article at this point, any objections?
https://wiki.nesdev.com/w/index.php/Use ... ork_System
User avatar
koitsu
Posts: 4201
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by koitsu »

Assuming I survive this week at work, I'll be trying to get scans of the product manuals1 (in PDF) up and available. Once I make those available, if there are any pages or sections people want translated2, please let me know and I'll have them done.

1 -- Famicom Network System manual will be first. JRA-PAT will come later (manual is huge/long).
2 -- Already met with the translator a few weeks ago. He's willing to do the Famicom Network System manual (esp. parts of it which we're interested in), but the entire JRA-PAT manual is out of the question (long, boring, lot of screenshots, and it's not like we can even test/try it here in the US anyway). However, there is a lengthy section in the JRA-PAT manual for error codes which he's agreed to translate, since I figured those might come in handy (not sure if they're generic Famicom Network system error codes or specific to JRA-PAT; I suspect a little of both).
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigation

Post by Ben Boldt »

koitsu wrote:Assuming I survive this week at work, I'll be trying to get scans of the product manuals1 (in PDF) up and available. Once I make those available, if there are any pages or sections people want translated2, please let me know and I'll have them done.

1 -- Famicom Network System manual will be first. JRA-PAT will come later (manual is huge/long).
2 -- Already met with the translator a few weeks ago. He's willing to do the Famicom Network System manual (esp. parts of it which we're interested in), but the entire JRA-PAT manual is out of the question (long, boring, lot of screenshots, and it's not like we can even test/try it here in the US anyway). However, there is a lengthy section in the JRA-PAT manual for error codes which he's agreed to translate, since I figured those might come in handy (not sure if they're generic Famicom Network system error codes or specific to JRA-PAT; I suspect a little of both).
Sounds awesome! Other than the custom CIC, it should be possible to make these cards - they are very much like GameBoy carts. It just needs a small thin PCB printed and a plastic shell via 3d-printer. I think that developing software for this thing could be a major challenge though. Other than the fact that it would be SUPER COOL to get use out of a Famicom Modem, I was not able to find any indication of fancy features other than the known modem abilities itself. I would have kind of hoped for extra sound channels or PPU magic or something like that but signs point strongly to no. For development purposes, time might be better spent designing a regular cart with networking abilities... But as a historical item, we all benefit knowing more about the Famicom Modem and how it works, and I am excited to see what you share with us.
Post Reply