Layout
| Offset | Size | Field | Snake (V1.2) | Fractal (V1.1) |
|---|---|---|---|---|
0x00 | 28 | Licence text | " LICENSED BY SNK CORPORATION" | the same |
0x1C | 4 | Start address (little-endian) | 0x00200089 | 0x00200040 |
0x20 | 2 | Catalogue number (little-endian) | 0x0000 | 0x0000 |
0x22 | 1 | Sub-catalogue number | 0x00 | 0x00 |
0x23 | 1 | Mode: 0x00 monochrome, 0x10 colour | 0x10 | 0x10 |
0x24 | 12 | Game name, ASCII | " SNAKE 1.2 " | " FRACTAL " |
0x30 | 16 | Reserved | zeros | zeros |
The two files are the public-domain homebrew ROMs Snake (Ivan Macintosh) and Fractal (Tomasz “Dox” Slanina), 512 KiB each, read in place for this page.
The licence text
Both real ROMs begin with " LICENSED BY SNK CORPORATION": 28 bytes, the first a space. The other spelling is "COPYRIGHT BY SNK CORPORATION", also 28 bytes (it has no leading space). Both end with the same 19
bytes, " BY SNK CORPORATION" at offset 0x09, and that tail is all the RACE emulator tests (initRom in its main.c compares those 19 bytes and then reads the mode byte).
The viewer therefore calls any file with that tail an NGP ROM, and marks a first nine bytes that are neither spelling as a problem. No ROM with the COPYRIGHT spelling was found on this machine.
The other fields
- Start address – where the CPU starts. It points into the ROM at
0x200000and up. Snake starts at0x200089, after the handler table; Fractal starts at0x200040, where it has no table. - Catalogue number and sub-catalogue – SNK’s number for the game and its revision; both zero in the two homebrew ROMs. RACE looks at the first byte (and in a few places the second) of the catalogue number to apply per-game fixes, which shows it is how the games are told apart.
- Mode –
0x10is a colour game,0x00a monochrome one; RACE refuses any other value (and treats one sample ROM that lacks the setting as colour). The viewer’s Mode option overrides the byte. - Name – twelve ASCII characters, space padded.
The interrupt handler table
Snake carries 72 bytes at 0x40: eighteen 32-bit little-endian addresses, seventeen of them 0x00200088 (a RETI at 0x88: handlers that do nothing) and the sixth, the V-blank handler, 0x00200754. Its first code, the start address
0x200089, calls a routine at 0x20077B, then LDA XIX,($200040) and LDA XIY,($6FB8), loads B with 18 and loops LD XWA,(XIX+), LD (XIY+),XWA, DJNZ: it copies the table from the ROM to RAM at
0x006FB8. The BIOS’s interrupt routines jump through those eighteen RAM pointers (BIOS and interrupts). Fractal has no table: its code begins at 0x40.
| No. | ROM | RAM | Interrupt |
|---|---|---|---|
| 0 | 0x40 | 0x6FB8 | SWI 3 |
| 1 | 0x44 | 0x6FBC | SWI 4 |
| 2 | 0x48 | 0x6FC0 | SWI 5 |
| 3 | 0x4C | 0x6FC4 | SWI 6 |
| 4 | 0x50 | 0x6FC8 | RTC alarm |
| 5 | 0x54 | 0x6FCC | V-blank |
| 6 | 0x58 | 0x6FD0 | Interrupt from the Z80 |
| 7 | 0x5C | 0x6FD4 | 8-bit timer 0 |
| 8 | 0x60 | 0x6FD8 | 8-bit timer 1 |
| 9 | 0x64 | 0x6FDC | 8-bit timer 2 |
| 10 | 0x68 | 0x6FE0 | 8-bit timer 3 (to the Z80) |
| 11 | 0x6C | 0x6FE4 | Serial receive |
| 12 | 0x70 | 0x6FE8 | Serial communication |
| 13 | 0x74 | 0x6FEC | Reserved |
| 14 | 0x78 | 0x6FF0 | End of DMA channel 0 |
| 15 | 0x7C | 0x6FF4 | End of DMA channel 1 |
| 16 | 0x80 | 0x6FF8 | End of DMA channel 2 |
| 17 | 0x84 | 0x6FFC | End of DMA channel 3 |
The order is that of the interrupt stubs in RACE’s replacement BIOS (its comments name them); the position of the V-blank handler (number 5) agrees with Snake’s table, which is the one place a real ROM confirms the order. The table is a convention of the program’s start-up code, not a field the console reads from the header: the viewer shows it when at least 16 of the 18 words are addresses inside the ROM.
Not described
- Whether the real BIOS reads anything from the header other than the licence text, the start address and the mode (the ROM’s catalogue numbers of retail games, and the use of the sub-catalogue number, are not documented in any source read).
- Retail ROMs: none was available, so all the field values above are from two homebrew games.