PFQ+ and // port … BIOS reverse engeneering … first contact
It’s now been a while that I started reverse engeneering my Snes Backup Unit BIOS. The unit is a “Pro Fighter Q+” with 16mb of ram, a diskdrive and a parallel port that is very handing when you start coding the SNES. This year the unit is gonna be 15 years old and it’s working like a charm.
About 6 months ago after being bored for a while, I regained interest in the SNES. A comeback to retrogaming after being bored by nextgen games and console. But it’s mostly a return to retrocoding. One goal of my return to the source was to understand how is the PFQ+ is handling the communication with the // port. Once that is done i will try to make a lib to interact with // port in your homebrew.
After a few google queries I managed to find the BIOS rom dump. After a few tweaks I got it to work on my now favourite emu/debugger “Snes9X1.43.ep9r8.exe”. This emulator is quite simple to use and the debug capabilities completly fill my needs.
So how the PFQ+ is accessing the parallel port? It seems it use address from $2800 to $2810, for reading or writing to parallel port. The code isn’t that easy to reverse because of strange coding methods. The protocol is avalaible from ucon64 source code. You fill find the details in “ffe.c” and “fig.c”. The is a checksum schema in place. The funny thing is that on checksum failure the SNES will just hang, not even an on screen message.
The $2809 address is almost writed with all incoming and outgoing data, so it might used at development time for debuging. I might investigate that in a next hardware project dumping data to serial. $2810 might be status contol, since there quite a lot of loop waiting it to have bit #$20 bit set.
I will come soon with a few more explaination about the stuff i have reversed. If you guys have any information on the PFQ+ BIOS interacting with the parallel port (or any other backup device) don’t hesitate to contact me.
++ Lint
EDIT : corrected address from $21xx to $28xx on 09/04/2008