# Skeetendo

’Cause all games were better on the GBC

You are not logged in.

## #1 2013-03-30 09:29:06

Cooltrainer18
New member
From: Jhoto
Registered: 2013-03-29
Post 3/5
Website

### How How How??? [ROM banks]

When i'm learning pointing with koolboy's tutorial...
Koolboy said,
you want to re-point 1FF017.
The first byte (1F) is the bank location.
For example:
0-3FFF is one bank,
4000-7FFF is another bank. Don't understand? (NO)
Well this is how it is:
00 = 0000-3FFF
01 = 4000-7FFF
02 = 8000-BFFF
03 = C000-FFFF
04 = 10000-13FFF
05 = 14000-17FFF
06 = 18000-1BFFF
07 = 1C000-1FFFF
08 = 20000-23FFF
09 = 24000-27FFF
0A = 28000-2BFFF
0B = 2C000-2FFFF
0C = 30000-33FFF
0D = 34000-37FFF
0E = 38000-3BFFF
0F = 3C000-3FFFF
10 = 40000-43FFF
11 = 44000-47FFF
12 = 48000-4BFFF
13 = 4C000-4FFFF
14 = 50000-53FFF
15 = 54000-57FFF
16 = 58000-5BFFF
17 = 5C000-5FFFF
18 = 60000-63FFF
19 = 64000-67FFF
1A = 68000-6BFFF
1B = 6C000-6FFFF
1C = 70000-73FFF
1D = 74000-77FFF
1E = 78000-7BFFF
1F = 7C000-7FFFF       ; and this is 1F and its 7C000-7FFFE
20 = 80000-83FFF
21 = 84000-87FFF
22 = 88000-8BFFF
23 = 8C000-8FFFF
24 = 90000-93FFF
25 = 94000-97FFF
26 = 98000-9BFFF
27 = 9C000-9FFFF
28 = A0000-A3FFF
29 = A4000-A7FFF
2A = A8000-ABFFF
2B = AC000-AFFFF
2C = B0000-B3FFF
2D = B4000-B7FFF
2E = B8000-BBFFF
2F = BC000-BFFFF
30 = C0000-C3FFF
31 = C4000-C7FFF
32 = C8000-CBFFF
33 = CC000-CFFFF
34 = D0000-D3FFF
35 = D4000-D7FFF
36 = D8000-DBFFF
37 = DC000-DFFFF
38 = E0000-E3FFF
39 = E4000-E7FFF
3A = E8000-EBFFF
3B = EC000-EFFFF
3C = F0000-F3FFF
3D = F4000-F7FFF
3E = F8000-FBFFF
3F = FC000-FFFFF
40 = 100000-13FFFF
É
Me: And how can i figured it out?
Koolboy: now we figured out that the bank location is 6B.

I'm here to do hack or learn hack. I hope everyone will help me.
My Email: Cooltrainer18@gmail.com

Offline

## #2 2013-03-30 09:31:13

Vitharix
Member
Registered: 2011-12-29
Post 269/396

Offline

## #3 2013-03-30 10:00:59

Miksy91
Member
Registered: 2010-10-16
Post 1,598/2,348

### Re: How How How??? [ROM banks]

If you have hard time with it, go and watch my hacking tutorial #2.

But all in all;

Inside the cartridge, we've got these small memory chips, each one being able to reserve 0x4000 bytes of data inside them. These are rom banks.

Only one (or specifically two) rom bank can be accessed at the time in the game, and its addresses can be referred to by pointing to area between \$4000 and \$7FFF with pointers. Each rom bank has it's own ordinal number, just like that "1F" in bold there.

Then we've got these hex editors, tools used to modify data of rom images. Now, image is different from the actual cartridge and has all the data stuffed in it (unlike in the cartridge where we've got all the data being split in pieces, rom banks). And by viewing the rom image with a hex editor, we see rom bank with the ordinal number of 01 at offset 0x4000, the one with ordinal number 02 at 0x8000, with 03 at 0xC000 and so on like listed here.

I won't bother explaining more here, so go and watch my video or find some other tutorials for understanding how to work out with these. There are plenty of them around.

Last edited by Miksy91 (2013-03-30 10:03:08)

Offline

## #4 2013-03-30 10:10:23

Cooltrainer18
New member
From: Jhoto
Registered: 2013-03-29
Post 4/5
Website

### Re: How How How??? [ROM banks]

Thanks for replay...
I'm going to see your tutorials!

I'm here to do hack or learn hack. I hope everyone will help me.
My Email: Cooltrainer18@gmail.com

Offline

## #5 2013-04-01 16:01:11

Tauwasser
Member
Registered: 2010-10-16
Post 368/459

### Re: How How How??? [ROM banks]

Miksy91 wrote:

Inside the cartridge, we've got these small memory chips, each one being able to reserve 0x4000 bytes of data inside them. These are rom banks.

Dude, no! There are no such chips! It's all just address mapping!

The Game Boy will just access whatever component feels like to respond. The address and data busses are shared. So it just happens to be the case that for 0x8000–0x9FFF the VRAM chip responds, 0xC000-0xDFFF the WRAM chip responds. Then, because the mapping logic is reduced (done without checking the MSB), the WRAM chip will respond again for 0xE000–0xFFFF (theoretically). However, the upper addresses 0xFF00–0xFF7F; 0xFFFF are function registers, 0xFF80–0xFFFE are RAM inside the CPU, so the data bus is never checked in those cases.

The rest of the range is up to the cartridge! MBC1, MBC2, MBC3, MBC5, MBC7 all map Rom Bank 0x00 to 0x0000–0x3FFF, i.e. they access the ROM chip on the cartridge with address 0x000000–0x003FFF, i.e. they supply the most significant address bits as zeros.
They will supply whatever ROM bank was written to the MBC beforehand when 0x4000–0x7FFF is addressed. Usually, the lower address bits, i.e. A13-A0 will come straight from the Game Edge Connector (GEC). A15 is used as ROM chip select most of the times as well.
If any component chooses to respond to - for instance - WRAM accesses, you will get what is called a "bus crash": data will be ANDed on the bus, or the stronger driver will win (unlikely, because of gate technology).
So the rest of the range happens to be 0x0000–0x7FFF; 0xA000–0xBFFF. The CPU will assert the /CS pin on the GEC for the latter range.

Curious exceptions to this scheme is for instance MBC6. It maps 0x0000–0x1FFF and 0x4000–0x5FFF to ROM, the rest is for FLASH memory also managed by the MBC. Or for instance MMM01 and G-MMC, both of which do complex address mapping for multi-carts. Or for instance routing variations for MBC1, the DMG-MC-DFCN PCB, where the upper bits (i.e. the ROM bank) are shifted right one place to allow for an MBC1 multi cart.

IMO one should not start thinking about this mapping as something like a "chip" inside the DMG that reads the ROM data really really fast to supply it to the user program or somesuch. Because it just isn't how this shit works.

cYa,

Tauwasser

Offline

## #6 2013-04-01 17:22:33

Miksy91
Member
Registered: 2010-10-16
Post 1,607/2,348

### Re: How How How??? [ROM banks]

You know what...
It's very difficult to try to keep up with what you're trying to say sometimes. Even now that I've taken a couple of programming classes, and even studied the basics of computers, there are still lots of words that don't just say anything themselves.

You don't have to reply and explain what all of these are. You can do that if you feel like it though and I might "get" something out of it too.

Tauwasser wrote:

Mapping? As a word, doesn't say anything.

Tauwasser wrote:

The address and data busses are shared.

Okay... we've got address -, data -, and control busses inside the cpu of a normal computer, I think (which are also those words that don't say anything to a person who hasn't studied specifics of computers). So, what does these busses being shared achieve exactly?
It has something to do with "VRAM and WRAM chip responds" like you said, but doesn't tell much (or nothing at all).

Normally, the wanted "piece of data" is brought from the address loaded in address bus into data bus (at least, that's what I've been taught).

Tauwasser wrote:

The rest of the range is up to the cartridge! MBC1, MBC2, MBC3, MBC5, MBC7 all map Rom Bank 0x00 to 0x0000–0x3FFF, i.e. they access the ROM chip on the cartridge with address 0x000000–0x003FFF, i.e. they supply the most significant address bits as zeros.
They will supply whatever ROM bank was written to the MBC beforehand when 0x4000–0x7FFF is addressed.

So, instead of these "memory chips", we've got one big one holding the whole rom data in it, I guess? So, how do rom banks (and especially,  Program Counter) work exactly? What I pick up of your explanation would be something like;

We've got a certain byte written in MBC. This defines, which rom bank we're accessing at the moment. And when we're executing code, the processor only knows the address (or "pointer") where the data is located, but not the rom bank. So when we start to execute an operation, the rom bank has to be loaded from MBC first, and then find the corresponding 0x4000 byte "data set" we're dealing with. And next, we can actually execute data itself after first bringing the PC's address into this "address/data bus" system.

Offline

## #7 2013-04-02 07:51:15

641/705

### Re: How How How??? [ROM banks]

Miksy91 wrote:

You don't have to reply and explain what all of these are. You can do that if you feel like it though and I might "get" something out of it too.

Tauwasser wrote:

Mapping? As a word, doesn't say anything.

https://en.wikipedia.org/wiki/Memory-mapped_I/O

Miksy91 wrote:
Tauwasser wrote:

The rest of the range is up to the cartridge! MBC1, MBC2, MBC3, MBC5, MBC7 all map Rom Bank 0x00 to 0x0000–0x3FFF, i.e. they access the ROM chip on the cartridge with address 0x000000–0x003FFF, i.e. they supply the most significant address bits as zeros.
They will supply whatever ROM bank was written to the MBC beforehand when 0x4000–0x7FFF is addressed.

So, instead of these "memory chips", we've got one big one holding the whole rom data in it, I guess? So, how do rom banks (and especially,  Program Counter) work exactly? What I pick up of your explanation would be something like;

We've got a certain byte written in MBC. This defines, which rom bank we're accessing at the moment.

Yes, it is a register within the MBC.

The ROM chip itself has no “banks” inside. It contains the entire program in a regular flat address space of up to 23 bits, but the Game Boy doesn’t have enough address pins to match, so the MBC maps all of this onto 15 address bits.

Here is a diagram of the input/output pins to a ROM chip. This ROM has 20 address pins (A0–A19), 8 data pins (D0–D7), output enable and chip enable (both active low—i.e., when the pin is low, they are on), and VDD/ground (which provide the reference voltages 5V and 0V respectively).

When chip enable is inactive (that is, when it’s high), the ROM turns off to save power; otherwise the chip functions normally. This is tied to A15 on the edge connector, so when you’re accessing memory address \$8000–\$FFFF, the ROM is off because it’s not needed.

The OE pin disables or enables output to the data pins. When output is enabled, it drives the data pins to the selected value that matches the ROM address. When output is disabled, it silently accepts whatever another device sends over the data pins.

OE example: When the CPU executes a “ld” command that reads from memory (as opposed to writing to memory), it sets the RD pin on the edge connector to 0. This pin is tied to OE, which is active low. When OE is active (that is, when RD is also low), the ROM chip sends the data byte over the data bus. On the other hand, a “ld” that writes to memory won’t set RD to 0. This normally wouldn’t make a difference to the ROM because it is usually turned off when writing (because you’re usually writing to \$8000 or above, so CE is high). But if you write to, say, \$2000 to switch ROM banks via the MBC, CE will be low, so the ROM will be on. If it weren’t for the ROM output being disabled due to OE, the ROM would drive the data pins to contain a ROM byte at the same time the CPU drives the data pins to contain the new bank number, and bad things would happen.

This leads to how the data and address buses are connected. The 8 data pins from the ROM are tied to the 8 data pins on the edge connector (which in turn connect to the CPU’s 8 data pins). They are also connected to the MBC as inputs (so you can set the new ROM bank number, among other things). How are address pins connected on the cart? The lower 13 bits of a 20‐bit ROM address always match those of the equivalent 16‐bit CPU address, so A0–A12 on the edge connector are connected directly to the ROM chip. But A13–A15 don’t match, so the edge connector’s A13–A15 are tied as control inputs to the MBC (see this MBC5 diagram). This is why writing to \$2FFF selects a ROM bank just as well as writing to \$2000—the lower 13 address pins aren’t even touching the MBC, so they have no effect.

Here is another diagram of how MBC, ROM, and the cartridge bus tend to be hooked up.

## #8 2013-04-02 10:17:39

Miksy91
Member
Registered: 2010-10-16
Post 1,608/2,348

### Re: How How How??? [ROM banks]

That was one good post about MBC you pulled off!
I still don't think I understand this subject that well, but at least, some things are starting to make more sense.
For instance, I had always thought there was nothing beside ROM and RAM (, and the busses) inside a cartridge...

I don't know what else to say to this really, but that post should help out others understanding this better as well.

Offline