Nintendo 64 Hardware Exposed

When we are playing N64 games it's easy to forget that the cartridges actually contain an electronic circuit which makes interacting with the N64 possible. We will look at the insides of a number of N64 carts to see how they work and this should cover the majority of board variations. Please note that I will be only showing Japanese and European cart internals but the circuits themselves should be very similar for a single game across multiple regions, with the main difference being the type of boot/security chip used. To actually take an N64 cart apart you will need to first remove the two 3.8mm security bit (Gamebit) screws from the back and they you will be able to separate the 2 plastic halves (there are tabs at the bottom). Now that you have the cart in pieces you will find metal shielding that has to be taken out by removing the 2 Phillips head screws and then pulling the shield toward you from the top. This will give you access to the circuit board which will give you opportunity to test the battery (if present) and if needed clean the board contacts using a cotton swab dipped in isopropyl.

I did a video which includes a look inside the Japanese version of Ocarina of Time:

https://youtu.be/IHfRid7Br58

Let's now look at individual carts:

Mortal Kombat 4 (EUR) NUS-NM4P-EUR

This cart only has 2 chips; MX23L12802-35A 16MB mask ROM and CIC-NUS-7101 PAL boot chip. There is no internal game save facility.

The Legend of Zelda: Ocarina of Time (JAP) NUS-CZLJ-JPN

Ocarina of Time has a 23C256028CZ-W05 32MB mask ROM, a CIC-NUS-6105 NTSC boot chip, LH52V246AD 32KB SRAM for games saves coupled with the battery and a 74LV2416 chip likely power management. At the top left there are 3 test pads marked TP1, TP2 and TP3 which are connected as follows:

TP1 +V battery. Should always measure 3V to GND if the battery is good (there are rectangular GND connections at the left and right of the board).

TP2 connected to pin 1 of the 74LV2416 and pulled to +V battery voltage via a 1K resistor.

TP3 +V supply for the SRAM and LV2416. To GND will measure the same as the battery voltage (3V) when the N64 is off and 3.3V when the N64 is on.

TP1 let's check the battery voltage and TP3 allows up to monitor the VCC voltage for the SRAM but TP2 is a little bit strange. If TP2 is taken to GND then TP3 drops to less than a volt and TP1 lowers to about 2.3V (I have only tested with the cart out of the N64). This effectively simulates a bad battery condition and consequently if TP2 is held to GND long enough (about 6 seconds) the save files will be lost. Thus TP2 possibly tests that the 74LV2416 is able to cope with a bad battery condition.

Resident Evil 2 (EUR) NUS-NREP-EUR

Compared to Mortal Kombat 4 (above), RE2 uses a much more complicated circuit which is due to the large overall ROM size and its internal save support, and it uses SMD components (except for the battery) instead of through-hole components. There are 2 MX23L25603-35A2 32MB mask ROM chips, a CIC7101A PAL boot chip (appears to be SMD version of CIC-NUS-7101), a LH52V246AN 32KB SRAM for game saves which is backed up by the soldered CR2032 3V battery, and a LV2416 (full number is probably 74LV2416) which is for power management for the battery backed SRAM. The familiar test contacts are present at the top left of the board.

Jikkyo J-League 1999: Perfect Striker 2 (JAP) NUS-NPSJ-JPN

This cart has a MX23L12802-35B1 16MB mask ROM, a LH52V246A 32KB SRAM for game saves backed up by the battery, a CIC-NUS-6102A NTSC boot IC and a BU9811 which could be a power management chip for the SRAM. The board also has the 3 test pads (as with RE2, above) labelled as 1, 2 and 3.

Super Mario 64 (EUR) NUS-NSMP-EUR

The SM64 cart has a LHR51D0M, likely to be a mask ROM 8MB in size, a CIC-NUS-7101 PAL boot chip and a BU9850 4Kb serial EEPROM for game saves.

Pocket Monsters' Snap (JAP) NUS-NPFJ-JPN

Pokémon Snap uses a LHR53G20 which is possibly an 8MB mask ROM, a CIC-NUS-6103 NTSC boot IC and a 29L1100KC-15B0 1Mb flash RAM for game saves.

Mario Kart 64 (JAP) NUS-NKTJ-JPN

This cart has 2 mask ROM chips, one is a TC536433P and the other is a TC533233P (both of unknow size), a CIC-NUS-6102 NTSC boot chip and a BU9850 4Kb serial EEPROM for saving game data.

Dōbutsu no Mori (JAP) NUS-NAFJ-JPN

A Japanese exclusive for the N64, Dōbutsu no Mori (Animal Crossing) is unique in that although it has a CR2032 battery it is not used for save progress but rather to keep the real-time clock ticking, which appears to be handled by the 'RTCK-NUS' chip and a 32.768KHz crystal. Other chips on the board are the MX23L12802-35C 16MB mask ROM, a 29L1100KC-15B0 1Mb flash RAM for game saves, a 74LV2416 power management chip and a CIC-NUS-6102 NTSC boot chip. There are 4 test points to the left of the board, numbered 1 to 4, which are as follows:

1 +V battery.

2 possibly a test input to simulate a bad battery condition.

3 RTC +V, which should be 3V when the N64 is off and 3.3V when the N64 is on.

4 a ~2KHz signal possibly to check the RTC is running.

Morita Shogi 64 (JAP) NUS-P-NMSJ

Please go to:

https://sites.google.com/site/jamesskingdom/Home/video-games-by-james-s/video-game-software#h.p_qd8qlUlPsqio

N64 Controller Pak NUS-004

The controller Pak for the N64 is used by some games for saving progress (and other game information) and plugs into an N64 controller, serving as a 32KB portable memory card which supports a maximum of 123 pages (each page is 256 bytes) and 16 save files total. Note that 5 pages are required for the directory which is why only 123 pages are available for game saves.

For a look inside an official controller pak please see the photo that follows:

We have a TC55257DFL-85V 32KB SRAM chip for the game saves backed up by a CR2032 battery (soldered on the board's underside) and a LV2416 unknown IC which you should recognise if you have read the N64 cartridges section. The LV2416 appears to have something to do with power management (and even has the label 'PWIC') and as with the N64 cartridges that use a battery for game saves there are 3 test pads (numbered 1-3) which for the controller pak are on the underside of the board. TP1 is the +V battery connection (should be around 3V if the battery is good), TP2 seems to be an input that could be for testing a bad battery condition by taking the connection to GND, and TP3 is connected to the SRAM's +V terminal and will be 3V when the N64 is off and 3.3V when the N64 is on.

The pinout for the edge connector is as follows:

1 GND 17 GND

2 A14 18 CE1

3 A12 19 /CE2

4 A7 20 /WE

5 A6 21 A13

6 A5 22 A8

7 A4 23 A9

8 A3 24 A11

9 A2 25 /OE

10 A1 26 A10

11 A0 27 D7

12 D0 28 D6

13 D1 29 D5

14 DET. 30 D4

15 3V3 31 3V3

16 D2 32 D3

There is no numbering on the controller pak circuit board but in the above photo top left connection is 17 and top right is 32.

The DET. (detect) signal is an input to the controller and if taken high (3V3) the controller knows that something is plugged into its expansion port but as to whether it is a controller pak, rumble pak or transfer pak the controller finds out by writing to and reading from a specific address that attached peripherals are mapped to, to see what response it gets. A controller pak requires no logic especially for being detected, in fact simply connecting detect to 3V3 is enough for a game to think that a controller pak is connected although it will see it as a corrupted and un-repairable controller pak if no RAM was connected.

It's worth mentioning that most N64 games that support the controller pak have a built-in controller pak management screen that can be accessed by pressing and holding start while powering on the N64 (the screen will vary with each game). With most games the controller pak menu appears immediately but with Mortal Kombat 4, for example, it does not show until after the company logos.

For more information about how data is organised in the controller pak please go to:

https://level42.ca/projects/ultra64/Documentation/man/pro-man/pro26/26-03.html

Some interesting points I picked up from the above linked programming manual:

* The serial number stored in the controller pak can be used as a means of detecting a change of controller pak but it's advised against.

* Nintendo planned to support controller paks bigger than 32KB without any extra work from the game application (how they would have done that without adopting the same approach of the unofficial controller paks having switchable 32KB banks, I don't know unless it would have had something to do with CE1 and CE2).

I soldered some wires to an official controller pak and connected them to my logic analyser while I had WWF Warzone running and found that both WE and OE went low for 1us (WE is low when the controller pak is being written to and OE is low when there are reads) and high for 31us. The controller sends data in 32 byte blocks at a time to/from the controller pak so one 32 byte read or write takes roughly 1ms. Looking at A0 also, which alternatively changed between high and low due to sequential address access when accessing the controller pak, I found that A0 changed 2us before OE/WE went low and held its state for 3us after OE/WE returned high. I found that D0 had similar timing, so if you wanted to interface with the controller expansion connector you would need very fast hardware; when I tried using an Arduino Uno which generated an interrupt whenever WE went low the Arduino was too slow as it takes about 2us just to enter the ISR.

N64 Equalizer

Please go to Equalizer Hacked.

N64 Transfer Pak NUS-019

The transfer pak plugged into an N64 controller to allow the transfer of data between certain N64 games and a Game Boy or Game Boy Colour game slotted into the transfer pak, with a number of Pokemon games being the most remembered examples. To open the transfer pak you will need to first unscrew the 4 security screws holding together the 2 plastic pieces and then to separate the circuit board from the other parts there is a single screw holding the edge connector in place. Here is a photo of the internals:

The edge connector board (right in photo above) effectively converts the 32 connector of the N64 controller expansion port to 30 using the soldered flat flex cable, the other end of which plugs into the connector on the main PCB (left in photo above), labelled CN1. The adapter board has the detect pin always connected to 3.3V so that the controller knows something is plugged in but all other connections are carried through the flat cable although there is only one VCC (3.3V) connection. The pinout follows:

1 GND 16 A2

2 A14 17 /OE

3 CE1 18 A1

4 A12 19 A10

5 /CE2 20 A0

6 A7 21 D7

7 /WE 22 D0

8 A6 23 D6

9 A13 24 D1

10 A5 25 D5

11 A8 26 D4

12 A4 27 VCC

13 A9 28 D2

14 A3 29 D3

15 A11 30 GND

The edge connector is thus very handy for use in projects.

The main board makes uses of a Nintendo custom chip, LESH-NUS (U2), to do the hard work of communicating with the Game Boy cartridge and N64 controller, and there is 1 other 'chip' of interest (U1) which is actually a small board that converts the 3.3V from the controller edge connector to the 5V that a Game Boy cartridge needs (this supply to the Game Boy cart is software controlled, permitting removal/insertion of Game Boy carts while the N64 is on). Hidden from view unless you look at the right angle there is a push button switch located under the Game Boy cartridge connector which detects whether a Game Boy game has been inserted.