What's new
By:

Espgaluda 2 (CV1000) repair of bad U2 NAND using JTAG

It looks like there's a switch for whether VCC is provided by the hat or whether it assumes the target PCB is already providing power. I believe the ribbon cable is a 60 pin one so they might be using multiple lines for voltage.
 
Well, here to report my results with the clip, and not so good:

U2: Does not detect (using Parallel NAND mode).
U4: Detects correctly as AMD AM29LV160B using Parallel NOR mode, but does not read correctly. After 0x8000 offset, data is different from JTAG dump of U4. So only the first 0x8000 bytes are read correctly.
U23/U24: Does not detect using Parallel NOR mode.

I tried mashing down on the clip to get better contact, but same results. So unfortunately, it looks like it's not a viable solution, but if it did work, it would be able to read an entire NOR chip in a few seconds.

Unrelated, my version of Ibara appears to be different from the one in MAME - the CRC is different and at the boot screen the "BS" number is different. Not sure what "BS" stands for. The version screen still says 2005/03/22 MASTER VER..

MD5 hash of ibara-u4.bin: (from my PCB)
3d7ab67965c9ec58e67fd5ddcd84821f

MD5 hash of u4: (from the MAME set)
89f0a825ae32d3ef508d1603e96f0530
 

Attachments

  • Clipboard01.png
    Clipboard01.png
    909.8 KB · Views: 130
Thanks for the description. Would it be possible for you to share your new U4 dump ?
 
alamone said:
Well, here to report my results with the clip, and not so good:

U2: Does not detect (using Parallel NAND mode).
U4: Detects correctly as AMD AM29LV160B using Parallel NOR mode, but does not read correctly. After 0x8000 offset, data is different from JTAG dump of U4. So only the first 0x8000 bytes are read correctly.
U23/U24: Does not detect using Parallel NOR mode.

I tried mashing down on the clip to get better contact, but same results. So unfortunately, it looks like it's not a viable solution, but if it did work, it would be able to read an entire NOR chip in a few seconds.

Unrelated, my version of Ibara appears to be different from the one in MAME - the CRC is different and at the boot screen the "BS" number is different. Not sure what "BS" stands for. The version screen still says 2005/03/22 MASTER VER..

MD5 hash of ibara-u4.bin: (from my PCB)
3d7ab67965c9ec58e67fd5ddcd84821f

MD5 hash of u4: (from the MAME set)
89f0a825ae32d3ef508d1603e96f0530
Click to expand...
For U2 you'd need the TSOP48 NAND adapter, their NOR one won't work. There are more adapters for the flashcat Mach/Xport here.
Also for the undetected NOR flash, you can use the source code for the flashcat software to add support yourself.
 
very cool. Did not realise that you can dump all the graphic datas out and fix it up using JTAG.
On side note, i was wondering if it is possible to dump new content from M2 Esp RaDe Psi (switch version has new character Alice Master) and then back ported the code back to arcade pcb?
 
alexcom said:
For U2 you'd need the TSOP48 NAND adapter, their NOR one won't work. There are more adapters for the flashcat Mach/Xport here.
Also for the undetected NOR flash, you can use the source code for the flashcat software to add support yourself.
Click to expand...
Hi, I did use the NAND adapter for that one, it still did not work. But I believe the problem is with the clip, as I tested it out with some memory chips not mounted on PCB and it exhibited the same problem with bad reads past 0x8000, which to me indicates that the address lines past that are not making good contact or are faulty on the clip. I'll have to take a look at the source code to see if I can resolve the undetected chips problem, but that might also be a clip related issue. I don't think it's a bus contention issue as I am halting the CPU before doing the read.
 
alamone said:
I don't think it's a bus contention issue as I am halting the CPU before doing the read
Click to expand...
if you halt CPU does this change NAND control lines (iirc some of them connected to Altera CPLD, and at least one to SH3 GPIO port) ? I think no, it will retain last set state
 
Last edited:
MetalliC said:
if you halt CPU does this change NAND control lines (iirc some of them connected to Altera CPLD, and at least one to SH3 GPIO port) ? I think no, it will retain last set state
Click to expand...
Sorry if I wasn't clear - I meant the read was from NOR chip, not NAND. From what I understand NOR chips are similar to EPROMs with parallel address and data lines.
For the CPU halt, I was grounding TRST on the JTAG interface, which from what I understand would halt all instructions including any activity from the Altera.
 
alamone said:
Sorry if I wasn't clear - I meant the read was from NOR chip, not NAND. From what I understand NOR chips are similar to EPROMs with parallel address and data lines.
For the CPU halt, I was grounding TRST on the JTAG interface, which from what I understand would halt all instructions including any activity from the Altera.
Click to expand...

I have instructions for putting the SH3 into ”ASE mode reset hold” here (search for reset hold)
https://github.com/buffis/cv1k_research/tree/main/JTAG#getting-the-pcb-into-reset-hold-mode-for-jtag
 
Yes, I followed those instructions besides removing TRST from ground, as I wasn't using the JTAG interface itself but just to halt the CPU.

Since it looks like the clip is defective, I'm going to try with a different seller, but it's going to take a while to get here. It looks like these clips were previously commonly used to downgrade PS3 firmware, and for that reason it's treated as a gray market item and is hard to order from more reputable sellers.
 
alamone said:
Sorry if I wasn't clear - I meant the read was from NOR chip, not NAND. From what I understand NOR chips are similar to EPROMs with parallel address and data lines.
For the CPU halt, I was grounding TRST on the JTAG interface, which from what I understand would halt all instructions including any activity from the Altera.
Click to expand...
I see, sorry then.
is there a chance to dump U2 NAND ? it would be good to know it it's maybe different from older game revision

PS: thanks for efforts in finding and dumping this Ibara PCB
 
I bought that NAND clip back in the day. The main target for them was the xbox360. The quality was not good enough and I could never get it to read properly using my Xeltek and the DIL adapter.

Would be nice if you could dump the U2 as well just for completeness. This is an early CV1K game so all assets are uncompressed.
 
Last edited:
Would be very interesting to see if the U2 rom of this has the bugfixed sprites that Kuro has.

Here's one example on a minor bugfix (see the green dot in the ibara one?)

Asset #788 in Ibara dump
wl_u2_788.png


Asset #773 in Ibara kuro dump
bl_u2_773.png


If you can just follow the instructions on page1 in this thread to dump the data for asset #788, that would be cool.
Full dump would obviously be better, but using JTAG that takes a long time, while dumping individual assets is very quick.
 

Attachments

  • 1667894226091.png
    1667894226091.png
    41.5 KB · Views: 101
The advantage of dumping the whole U2 is you just start it up and then do something else :)

Thanks for the info @buffi, I was not aware that this was an issue in Ibara. Many of the CV1K dumps were actually done twice to combat NAND issues.
 
You must log in or register to reply here.
Back
Top