I finally got around to getting my hands on one of these little bastards. Being the first official Nintendo development cartridge I've owned, it's not too shabby. Of course, being me, the first thing I did when it arrived in the mail was to take it apart, and go to work inspecting its innards.

This thing is about as yellow as Pikachu on a Sunday morning, and has a nice, sexy 4-pin DIP peeking out at you. Staring you in the face is the oddly-colored label, showing the model number DMG-MBC5-32M-R-FLASH, a table of settings for the DIP (the first one is "none" in case you're interested,) and a quaint warning message. By the way, If anyone knows what "G/A-S" stands for, let me know.

Getting it apart is pretty damn easy. Nintendo must have meant for you to be able to replace the battery, since they used normal phillips screws, and put them right on the front of the cart.

Here's a quick look inside. The board is numbered "DMG-B03-11". You can see the Memory Bank Controller (aptly modeled MBC5-D, marked "MBC5DEV,") the Flash chip the a SRAM chip. Exciting stuff, right? So, the obvious question began to form in my mind. "What does it take to query, erase, and flash this thing?"

Before we get to that, let's take a look at how the SRAM chip fits in, just for the hell of it, although it's nothing out of the ordinary:

Here's the datasheet for the SRAM.

Now, let's move on to the real action, the MBC5-D and the flash chip. First, here's a pinout I threw together for the MBC5-D (LZ9GB34):

I'm not 100% sure about the BANK lines, or that all of the NC's are actually not connected, but it should be pretty close. Now, let's take a look at how it fits together. Here's the datasheet for the flash chip.

Some interesting observations:

• The flash's WP# line is connected to the cartridge header's AUDIO IN line.

• The flash's V_pp line is connected directly to V_cc. If you go through all the trouble of hiding write-protect in the mostly unused AUDIO IN line, why not use V_pp as an alternate method of protection?

• WE# is controlled by the MBC5-D.

• WP# is an input to the MBC5-D also.

It seems logical that one should merely have to assert WP# and /WR and then the MBC5-D should then assert its /WE. But, knowing Nintendo I doubt it's that simple. It's more likely you have to configure the MBC5-D to map to a specific bank to get the bus set-up correctly for a write operation.

For now, I suppose it'll remain a mystery until I build a device which can quickly interact with the cart. Looks like it's time to order components again. :P Lord, have mercy...