What's new
By:
Filters

Reverse engineering 161 in 1 cartridge to change Rom games

rockbottom said:
In other news...

got the menu code running in Mame, turns out it uses only S rom graphics, no C, uses two S roms with trivial bankswitch mechanism.
lots writes to 2ffff0, 25fff0, 2fffc0, presumably communicating with the cpld and atmega, also reading data from 200000-2fffff region so looks like it should have a P2 data rom somewhere in P1 or P2 roms which i've yet to locate...
Click to expand...
You might have a look at 161 in 1 page in the NEO•GEO dev wiki https://wiki.neogeodev.org/index.php?title=161-in-1_Series_1
Razoola's observations on the registers at mentioned memory locations has been documented there, presumably when has was working on support for this gigabootcart in universe bios 4.

Great work, keep it up!
 
Butter Meister said:
I had assumed that they included so many ROM hacks because they would reuse assets between vanilla and hacked games to save on storage space.
Click to expand...
I made the same assumption. It was also the only logical explanation for the multiple hacks. Well, sometimes I just don't get it.
It's like the 18 in 1 CPS1 boards with 75% hacks...
 
You guys are quite right about reusing assets, despite being 120-in-1, there's only actually 76 unique games, the "big" assets (C and V) only have one copy in rom. eg. kof2002 has 12 variants(!) but only one copy of C and V are shared for all. For S and M there's actually no reason to use 128MB chips at all, both use less than 1/8th of the chip capacity (under 16MB) so they didn't need to worry about reusing stuff there. For P they've basically put all P1's (first 1MB) for each game in one chip (labelled P3 :D ), the rest in P1 and P2, seems some variants reuse P2.
The raw dump size is actually quite deceptive, there's lots of junk, duplicated stuff, empty space, unused stuff (eg. P for samsho5, all assets for Super Sidekicks 1 even though they're not listed in the menu!) I'm mostly done creating "cut lists" of what's where in each rom and frankly the whole lot is one big mess, I guess it proved tricky for them keeping track of everything ;)
If I was to extract just the "used" stuff for each game the overall total size would be much smaller, suprisingly the limiting factor for number of games seems to have been V, which looks to have received the most care in fitting everything in with the least wasted space, funny I would have guessed C but all bets are off with bootlegs :D

blackwine said:
You might have a look at 161 in 1 page in the NEO•GEO dev wiki https://wiki.neogeodev.org/index.php?title=161-in-1_Series_1Razoola's observations on the registers at mentioned memory locations has been documented there, presumably when has was working on support for this gigabootcart in universe bios 4.
Click to expand...
Yes 161 seems very similar, i've compared pcb pics of all the other multi-carts on MVS Scans and i'm reasonably sure the vast majority are all made by the same people. It's a bit of a mystery why they made new pcbs for the 161 as it only has 1 extra V and 2 extra C compared to this cart, but this cart has unpopulated locations for... 1 extra V and 2 extra C :D so on the face of it 161 could exist on this cart (with 3 extra chips)! The 161 has many more unused chip locations, so can only assume they intended something bigger (>200-in-1 ?) but for whatever reason didn't go ahead with it, perhaps their supply of the "recovered" 128MB chips dried up or something... ?( would also explain why they changed to using those weird chips with the flex adapters on the later versions.
 
Last edited:
I'm just making assumptions about the 161 in 1 for now, because those 'stilt chips' are really something. Version 1 of the 161-in-1 uses the same chips as the 120 in 1, you can see the data for that on the wiki or from rockbottom's work. Versions 3 and 4 use the stilt chips and are more or less the exact same architecture just in a different layout. Version 4 is what I have been analyzing and working on since that's still sold on aliexpress.

C is two stilt chips in series with each other. The C chips on the version 1 board total 2 gigabytes so each stilt chip must be 1gb in size. That, and among the many weird names I found for the stilt chip in my research, some of them had 1024 in the title. That would total 4gb of flash storage, but not necessarily structured in such a way to store every game.

Fortunately the S and M chips already have full datasheets online. In theory, I can oscilloscope the S and M chips compare their wavelengths to the 'stilt chips' and determine the pinout one by one. Am I desperate enough to try that? I suppose I could try.
 
I assumed their strange choice of games was because they intended to release other versions in the future. The manufacturers description called it volume 1 (or something like that). It implied there might be a volume 2 at some point.

Memory is not that expensive these days. I'm sure they could have included every MVS game but then it would be the last cart they ever sold.

The other possibility based on the of the discussion here is that there was a technical reason why newer games like AOF 3 was problematic. Did it have extra security maybe?

It's hard to believe that even a non-gamer would think we'd all prefer useless titles like Mahjong.
 
Zebra said:
... Memory is not that expensive these days ...
Click to expand...
Well certainly NAND flash is cheap as chips these days, problem is for this kind of thing you need parallel NOR which is still much more expensive and chips over 512Mbit are quite rare. Fortunately for the bootleggers the Japanese pachislot industry has a seemingly insatiable appetite for ever-larger NOR flash and a high turn over of new tech (new stuff comes out, old stuff gets scrapped), this provides them with cheap (maybe even free?) high capacity chips. Of course being bootleggers they don't give a whit if they're used, 2nd hand, "recovered", call it what you will.

I suspect if they had to pay full price for the quantity of NOR flash required for the 161 it probably wouldn't be worth doing, certainly not for the £50 ish they currently sell for.

An example, here in UK, from big supplier 512Mbit chip is around £6. I would need around 50 of those for a 161, so that's £300 just for the chips, before pcbs, cpld's etc. etc. It's one of those things that can only happen in China :D
 
I'm sure they could have figured it out if they really wanted to include every game. They seem to be very crafty. After all, piracy is China's key export.

I actually thought they'd go the flash cart route rather than trying to fit everything into fast memory.
Flash cart devices have been around since the early 90's. I had a Super Magicom to "back-up" SNES and Genesis games to 3.5" floppy discs when I was a kid. I saw the first Neo Geo back-up devices in the mid 90's. They have that knowledge...

With current tech the largest MVS game could load from slow to fast memory in seconds. So, my assumption is that it's greed rather than a technical limitation.

It was the same with that appalling Neo Geo mini device. Including just 40 games was BS. Especially when half of them were King of Fighters games... What part of "WE ALL KNOW ABOUT MAME!" don't they get...

Does anyone know what sort of hardware would have been used to load content to the 161 in 1 cart? Maybe we don't need to understand it. Maybe we just need to buy the right hyper-dingulator (or whatever it's called).
 
Zebra said:
... I actually thought they'd go the flash cart route rather than trying to fit everything into fast memory ...
Click to expand...
Well they're just bootleggers at the end of the day so whatever's easiest and turns the most profit is what they'll go for. They have access to the worlds biggest e-waste market, maybe people actually paying them to take stuff off their hands :D Might as well just use all those cheap/free chips instead...
 
Zebra said:
Does anyone know what sort of hardware would have been used to load content to the 161 in 1 cart? ...
Click to expand...
Flash chips are all programmed off-board before soldering, no way to flash them on-board. I guess they must have access to one of very few, rare, expensive stand-alone programmers that support the 55lv100 chips.

On my 120, even the atmega8 (qfp version) doesn't have an isp port :S crazy, they must be very confident (or don't care about) their mcu code :D . The only in-circuit reprogrammable parts are the 3 cpld's which have jtag ports.
 
Last edited:
You should get a 161in1 from Aliexpress: they cost around 50$ delivered and are easily available. I truly believe this is THE thing to hack.

If you need some testing and support contact me, i have some 161 on hand. Also don't forget to update NeoGeoDev wiki : https://wiki.neogeodev.org/index.php?title=161-in-1_Series_1
If you need an account contact me
 
Zebra said:
I saw the first Neo Geo back-up devices in the mid 90's.
Click to expand...
Did these exist? I am familiar with the SNES disk devices, etc. but Neo Geo?
 
rockbottom said:
lots writes to 2ffff0, 25fff0, 2fffc0, presumably communicating with the cpld and atmega, also reading data from 200000-2fffff region so looks like it should have a P2 data rom somewhere in P1 or P2 roms which i've yet to locate...
Click to expand...
Those are the memory areas for protection IIRC. Try running a game that is nmot protected and you should see no access to that adress.
 
muckyfingers said:
Ya, the Multi Game Doctor could dump and run the backup of the early small Neo games. They had adapters to use the same device on multiple consoles.
Click to expand...
I'm really curious about that device now. Most consoles had a unique bus going to the cartridge whereas Neo Geo has a dedicated one for each function (main CPU, sound CPU, fix, sprites, samples). That would mean that Multi Game Doctor was conceived in a way it could dump and store different ROM banks in different devices.
 
Darksoft said:
Those are the memory areas for protection IIRC. Try running a game that is nmot protected and you should see no access to that adress.
Click to expand...
It's just the carts game-select menu code I'm running, not games, but yes it's the same range used by the various protection chips. According to Razoola's notes on the neogeo dev wiki the 161 does something similar (but only to 0x2ffffx). It's obviously communicating with the cpld and atmega, I've not gone through the code in any great detail yet, it's also reading blocks of data from random places in the 0x2xxxxx range (loading soft dip settings?) so looks like the menu should have it's own P2 rom which I haven't yet found in the dumps (not actually sure I will be able to without a working cart as there's lots junk in the P roms)

Tried dumping the atmega today but as suspected it's locked... shame :evil:
 
Rom1 said:
You should get a 161in1 from Aliexpress....
Click to expand...
I've got a 161 on the way, it's 2nd hand, don't yet know how old or what version. I'm actually hoping it'll be the v1 with the same chips, if not I guess i'll be trying to figure out those bizarre "stilt chips" with the flexi-pcb adapters :D
 
djsheep said:
Wow. The price seems insane (1 week production run?).

https://www.neostore.com/Multi-Game-Doctor-II-MGD-NEO-GEO-interface-cart-p/1489.htm

https://videogamedevelopmentdevices.fandom.com/wiki/Multi-Game_Doctor_2


The guys from Tototek or Gamedoctor in HK would be the best source for this I think...
Click to expand...
They cost around $650 back in the 90's.

It was more expensive than the SNES and Genesis disc drives but we were paying $200-$300 for an AES game so it's pricing could be justified.

The MGD 2 wasn't the only one for the Neo Geo. I remember the guy at our local shady video game store showing me one that backed up games to CD but it had the same problem as the Neo Geo CD. Soooooooo slow it was painful.

I found it acceptable to wait 1 to 2 minutes to load a snes game with 2-3 disc changes back then so the Neo loading must have been unbearable.
 
rockbottom said:
Rom1 said:
You should get a 161in1 from Aliexpress....
Click to expand...
I've got a 161 on the way, it's 2nd hand, don't yet know how old or what version. I'm actually hoping it'll be the v1 with the same chips, if not I guess i'll be trying to figure out those bizarre "stilt chips" with the flexi-pcb adapters :D
Click to expand...
On latest revision the PCB lets the solder point accessible. Not a bad design :)
 
Is the latest revision the green 161 in 1 cart they are advertising as "version 2" on aliexpress?

I was wondering what was different in version 2 as game list looked the same.

I noticed they do seem to have some new Neo Geo cart products lately. E.g. These custom one game carts where you tell them which game you want and they make it for you.

https://www.aliexpress.com/item/400...675#49_4452#3098#9599#134_4452#3564#16062#412
 
You must log in or register to reply here.
Back
Top