I did some research on mappers 162-164 based on debugging all affected games (and excluding any mapper hacks). Here are my findings that incorporate and extend what was previously known:
Common registers
As the FCEUX source code has theorized, they are obviously variants of the same core mapper and thus share common registers.
Bank number LSB, special video mode ($5000 write)
Bank number MSB, sprites in V mode ($5100 write, mapper 164; $5200 write, mappers 162,163)
Inner 32 KiB bank, output latch ($5200 write, mapper 164; $5100 write, mappers 162,163)
Mode Register ($5300 write)
Input Register ($5xxx read)
Mappers
It turns out that there are at least five board variants.
Mapper 162: Waixing FS304 board, always 8 KiB battery-backed SRAM
Games:
Basically identical to mapper 163 sans edge-triggered protection.
Mapper 163: Shenzen Nanjing, always 8 KiB battery-backed SRAM
Games: Too many to list here, but all of them are from Shenzen Nanjing.
Almost identical to mapper 162, except for the edge-triggered protection scheme.
Mapper 164 submapper 0: Waixing board with unknown name, always 8 KiB battery-backed SRAM
Games:
Mapper 164 submapper 1: Mars Production: always 512-byte serial EEPROM, optional 8 KiB non-battery-backed WRAM
Games:
Mapper 164 submapper 2: Mars Production: always 512-byte serial EEPROM but different bit assignments than submapper 1, optional 8 KiB non-battery-backed WRAM
One single game: 口袋精靈: 水晶 (Pokemon Crystal)
Bit 2 of $5xxx(R) represents the non-inverted Data pin from the EEPROM.
--
The (hereby proposed) mapper 164 submappers 0 and 1 are needed to differentiate the correct power-on bank, submappers 1 and 2 to differentiate the EEPROM bit assignment and inversion.
Common registers
As the FCEUX source code has theorized, they are obviously variants of the same core mapper and thus share common registers.
Bank number LSB, special video mode ($5000 write)
Code:
D~7654 3210
---------
VB.? LLLL
|| | ++++- LSB of 32 KiB bank number
|| +------ Unknown, Nanjing games always set this to zero, others to one.
|+-------- If 1 and V=1, substitute CHR A3 during reads only with latched PA0 from last NTRAM read
+--------- If 1, substitute CHR A12 during reads only with latched PA9 from last NTRAM read
Power-on value: mapper-dependent
---------
VB.? LLLL
|| | ++++- LSB of 32 KiB bank number
|| +------ Unknown, Nanjing games always set this to zero, others to one.
|+-------- If 1 and V=1, substitute CHR A3 during reads only with latched PA0 from last NTRAM read
+--------- If 1, substitute CHR A12 during reads only with latched PA9 from last NTRAM read
Power-on value: mapper-dependent
- The V bit set with the B bit clear is used by Nanjing games to use 512 tiles for background images, with PPU $0000-$0FFF used for the upper part, and PPU $1000-$1FFF for the lower part.
- Sprite behavior in V mode is set by register 1/2 bit 3.
- The B bit alone seems to have no effect; setting it along with the V bit creates a 1bpp mode allowing the entire 8 KiB of CHR-RAM to be used as an all-points-addressable bitmap.
It is used by the games Final Fantasy V (G-003), 大話西游 (Dàhuà Xīyóu, Westward Journey, G-004) and 岳飛傳 (Yuèfēi Zhuàn, G-006) to display a notebook (手記/記錄) opened by choosing the bottom option from the SELECT button menu.
Bank number MSB, sprites in V mode ($5100 write, mapper 164; $5200 write, mappers 162,163)
Code:
D~7654 3210
---------
.... S.MM
| ++- MSB of 32 KiB bank number
+---- If 1, force sprites in V mode to be always fetched from PPU $1000-$1FFF
Power-on value: $00
---------
.... S.MM
| ++- MSB of 32 KiB bank number
+---- If 1, force sprites in V mode to be always fetched from PPU $1000-$1FFF
Power-on value: $00
- The S bit has no effect unless the V bit is set in register $5000. If clear, sprites are fetched from the same 4 KiB CHR-RAM page as the background; if set, they are always fetched from the $1000-$1FFF page.
- To check correct implementation of the S bit, test the following three games for correct title screen sprites: [NJ034] Huan Shi Lu, [NJ083] San Guo Zhi Liu Bei Zhuan, [NJ097] Mo Shou Shi Jie E Mo Lie Ren.
Inner 32 KiB bank, output latch ($5200 write, mapper 164; $5100 write, mappers 162,163)
Code:
D~7654 3210
---------
...P .PpP
+--+++- output latch
|
+-- Inner 32 KiB bank number if $5300=$04
Power-on value: $00
---------
...P .PpP
+--+++- output latch
|
+-- Inner 32 KiB bank number if $5300=$04
Power-on value: $00
- The bits, of which there are at least four, in this register can be connected to serial EEPROM or to a simple latch for copy-protection purposes. It is likely just a general-purpose output port that is wired differently in different PCBs.
- If Mode Register $5300 is $04, the 32 KiB bank number from registers $5000 and $5100/$5200 is ORed with p (0/1), without being masked before.
- Several Waixing games use the p bit all the time as an inner 32 KiB bank number by keeping bit 0 of register $5000 clear and setting the p bit as desired.
- At least one Nanjing game (NJ023 Liang Shan Ying Xiong) uses this mode as well, but only as a protection check.
- It is not known whether the p bit functionality is internal to the mapper, or a result of external wiring.
Mode Register ($5300 write)
Code:
D~7654 3210
---------
.... .MMM
+++- Mode
0: Do not OR bank number with p bit.
4: Do OR bank number with p bit.
7: Do not OR bank number with p bit.
Power-on value: $07
Modes 0 and 7 seem to be identical, although mode 0 is only used by 512 KiB games, while mode 7 is used by both 512 KiB and 1 MiB games. FCEUX does additional OR operations for other modes, and pre-masks the bank number, but that seems to contradict what quite a few games actually write.---------
.... .MMM
+++- Mode
0: Do not OR bank number with p bit.
4: Do OR bank number with p bit.
7: Do not OR bank number with p bit.
Power-on value: $07
Input Register ($5xxx read)
Code:
D~7654 3210
---------
.... .I..
+--- Input from EEPROM or other device
What is read from bit 2 is entirely mapper-specific. FCEUX says that it reads back register $5300, but that would clash with the I bit, and the games that read this register for protection purposes do not assume that (but are not bothered by it either).---------
.... .I..
+--- Input from EEPROM or other device
Mappers
It turns out that there are at least five board variants.
Mapper 162: Waixing FS304 board, always 8 KiB battery-backed SRAM
Games:
- Mummy - 神鬼传奇 (Shengui Chuanqi)
- 塞尔达传说: 三神之力 (Zelda Chuanshuo - San Shen zhi Li)
- 法老王 (Pharaoh)
- 火焰纹章 - 圣战的系谱 (Huoyan Wenzhang - Shengzhan de Xipu)
- 西游记后传 (Xiyouji Houzhuan)
Basically identical to mapper 163 sans edge-triggered protection.
- No game seems to use special video modes or the output latch, but all of them use mode 4.
- Note that CPU A8/A9 going to the chip are swapped from Mapper 164 and the above description, so $5100 is the output latch, and $5200 the bank MSB.
- The power-up bank does not seem to matter, as all games have proper initialization code in banks $0-$F; they all choose bank $7 however for their startup code.
Mapper 163: Shenzen Nanjing, always 8 KiB battery-backed SRAM
Games: Too many to list here, but all of them are from Shenzen Nanjing.
Almost identical to mapper 162, except for the edge-triggered protection scheme.
- Uses V mode for many title screens, but not 1bpp mode.
- Games usually run in mode 7, although some check correct mode 4 behavior for protection purposes (NJ023). This is what FCEUX' emulation very roughly approximates with "5100 - When set to 6, sets the 32K PRG bank to 3".
- Note that CPU A8/A9 going to the chip are swapped from Mapper 164 and the above description, so $5100 is the output latch, and $5200 the bank MSB.
- The power-up bank does not seem to matter, as all games have proper initialization code in banks $0-$F; they all choose bank $7 however for their startup code.
- $5xxx(R) bit 2 initially is set.
- $5xxx(R) bit 2 is flipped whenever $5101.0 changes its initial 1 to 0.
- This behavior is used by [NJ045] Xuan Yuan Jian Wai Zhuan Zhi Tian Zhi Hen as a protection check.
Mapper 164 submapper 0: Waixing board with unknown name, always 8 KiB battery-backed SRAM
Games:
- Pet Evolve - 宠物进化史 (Chǒngwù Jìnhuàshǐ)
- 三國誌Ⅱ(Sānguózhì II)
- 口袋妖怪: 鑽石版 (Pokemon Diamond)
- 口袋精靈: 紅 (Pokemon Red)
- 宠物: 红 (Pokemon Red, another)
- 富甲三国 (Fùjiǎ Sānguó)
- 数码暴龙4: 水晶版 (Pokemon Crystal)
- 盟军敢死队 (Méngjūn Gǎnsǐduì)
- All games run in mode 7.
- "Pet Evolve" is often incorrectly set to 162, which only causes problems in the form of a black background once actual gameplay starts after the introduction.
- The power-up bank MUST be $3 for most games, as they usually do not have proper initialization code in other banks.
- $5xxx(R) bit 2 seems to be simply connected to $5200 bit 2, which 三國誌Ⅱ checks.
Mapper 164 submapper 1: Mars Production: always 512-byte serial EEPROM, optional 8 KiB non-battery-backed WRAM
Games:
- 口袋精靈: 金 (Pokemon Gold)
- Final Fantasy 太空戰士 V (Final Fantasy V)
- 大話西游 (Dàhuà Xīyóu)
- 櫻桃小丸子 (Chibi Maruko)
- Dark Seed - 黑暗之蛊
- 岳飛傳 (Yuèfēi zhuàn)
- All games run in Mode 0, except Final Fantasy V, which does not write to $5300 at all.
- The power-up bank MUST be $F for most games, as several of them do not have proper initialization code in other banks.
- Mars Productions' games always save their game state to a 512-byte 93C66A serial EEPROM connected via Microwire interface.
- Some games also have 8 KiB of WRAM at $6000-$7FFF, but not for game-saving purposes.
Code:
D~7654 3210
---------
...S .C.D
| | +- Data pin to EEPROM
| +--- Clock pin to EEPROM
+------ Chip Select pin to EEPROM
Bit 2 of $5xxx(R) represents the inverted Data pin from the EEPROM.---------
...S .C.D
| | +- Data pin to EEPROM
| +--- Clock pin to EEPROM
+------ Chip Select pin to EEPROM
Mapper 164 submapper 2: Mars Production: always 512-byte serial EEPROM but different bit assignments than submapper 1, optional 8 KiB non-battery-backed WRAM
One single game: 口袋精靈: 水晶 (Pokemon Crystal)
- The game runs in Mode 7.
- The power-up bank does not seem to matter, as the game has initialization code in banks $0-$F; it chooses $F however for its startup code.
- The game saves its state to a 512-byte 93C66A serial EEPROM connected via Microwire interface.
Code:
D~7654 3210
---------
.... .SCD
||+- Data pin to EEPROM
|+-- Clock pin to EEPROM
+--- Chip Select pin to EEPROM
---------
.... .SCD
||+- Data pin to EEPROM
|+-- Clock pin to EEPROM
+--- Chip Select pin to EEPROM
Bit 2 of $5xxx(R) represents the non-inverted Data pin from the EEPROM.
--
The (hereby proposed) mapper 164 submappers 0 and 1 are needed to differentiate the correct power-on bank, submappers 1 and 2 to differentiate the EEPROM bit assignment and inversion.