nesdev.org

Code: Select all

  ; The PPU is mapped at $2000-$3FFF.  (Addresses $2000-$2007 are
  ; unique; $2008-$3FFF are mirrors.)  The PPU contains a dynamic
  ; latch called "io_db" in Visual 2C02 and "PPUGenLatch" in FCEUX,
  ; which holds the last value written to any PPU port.  Reading a
  ; write-only PPU port, such as the VRAM address ($2006), returns
  ; the value of io_db.
  lda #$FF
  sta $3F16  ; Fill $3F16 (i.e. $2006) and io_db
  sta $3F16  ; write twice because that's conventional for $2006
  cmp $3F16  ; read io_db
  bne io_db_not_supported  ; NOAC clones may implement io_db wrong

  ; The next read is tricky.  When doing an indexed read that crosses
  ; a 256-byte boundary, 6502 adds the index to the low byte mod 256
  ; and then fixes it up next cycle if there was a carry.
  ; Thus $3FF6 + $20 reads $3F16 then $4016.  The $3F16 read
  ; precharges the data bus with io_db.  Then the $4016 read changes
  ; only those controller port bits that are connected to something.
  ; CAUTION: Open bus works differently on some flash cartridges.
  ; The PowerPak has pull-up resistors that continuously precharge
  ; the data bus with $FF.  But because this is the same value we
  ; stored in io_db, it will not change the test result.
  ldx #$20
  lda $3FF6,x  ; reads $3F16 then $4016

  ; Bits 3-4 are open bus on a Famicom but driven on an NES based
  ; on two wires of controller port 1, and usually driven low.
  ; They probably won't both be true on an NES unless a Zapper is
  ; plugged into port 1 and the trigger is half-pulled.
  and #$18
  cmp #$18
  beq is_famicom
is_nes: