What's new
By:
Filters

Reverse engineering 161 in 1 cartridge to change Rom games

Seriously epic!! One cart (well two I guess) to rule them all :thumbup:
 
Forgot to mention.
I also significantly improved the quality of the PCM sound of the cartridge by throwing out the stock 3.3v (actually 3.2 volts stabilizers and installing my own in its place, adjusted to exactly 3.58 volts (the CPLDs are 5 volts tolerant while the maximum voltage on flash memory is 3.6 volts). The logic "1" level rise-up of 0.3 volts (10%), coupled with the correct (improved) timings in the CPLD, gave rock-solid stability. No more distorted or absent sounds in ANY game.

I do not intend to make any profit from my research. If the Chinese copy my work, I think we will all be happy.

Perhaps later I will compile and release a new (third) set of cartridge entirely consisting of homebrew games and other useful utilities. If you have something to share, you are welcome.
 

Attachments

  • 1694280837406.jpg
    1694280837406.jpg
    237.8 KB · Views: 500
  • 1694280837396.jpg
    1694280837396.jpg
    220.3 KB · Views: 507
Last edited:
Thanks for all your work on this.

Been trying to use the compiler but running into an issue. A handful of games have a graphics mode > 4 configured in the fpga file, which the compiler throw an unsupported mode error for and aborts. Do these games need to be excluded or is there some trick to get them working?
 
ack said:
Been trying to use the compiler but running into an issue.
Click to expand...
Yeah, here lies the main limitation of this architecture. Due to the fact that there is a limited number of macrocells in the CPLD, we cannot (at least now) implement some specific bankswitches on them (NEO-CMC, NEO-PVC, etc.) as well as decryptors. For some games there are patches that disable these things, for some you will have to take bootlegs. Alas, the entire original romset simply will not fit into this CPLD architecture without changes.
 
So… which versions of the 161-in-1 are ‘compatible’? Anything with the strange stilt chips?
 
@Vortex, will you be posting a how-to guide on your github? Awesome work.

Also, can you run 2 MVS 161 carts (one with each half of the library) in a multislot board without crashing?
 
Will this work with the 120-in-1’s?
 
Vortex said:
Yeah, here lies the main limitation of this architecture. Due to the fact that there is a limited number of macrocells in the CPLD, we cannot (at least now) implement some specific bankswitches on them (NEO-CMC, NEO-PVC, etc.) as well as decryptors. For some games there are patches that disable these things, for some you will have to take bootlegs. Alas, the entire original romset simply will not fit into this CPLD architecture without changes.
Click to expand...
ic. Will have to look into the "nd" versions of those games from the winkawaks romset (ie mslug3nd) as those are decrypted. Perhaps they also switched them to normal style P rom bank switching too.

Would you be able to provide the crc's of the original dumped versions of the flash chips? I've started dumping the flash chip on my MVS 161in1.

Code: 
$ md5sum *.bin
e30ebb94fc129d1635afb0a5f78f11bd  crom-1.bin
1ceb03bbd7fc3611a4a6806a7982b8ba  crom-2.bin
eed71a77f26ce0bca11030184f550aa6  mrom.bin
b609221e0d9a7aef10fb38d66c4cd84a  prom-p1.bin
34bd54d8a8035140c0c038e398b3626b  prom-p2.bin
854b014c56a9eaf364b21b2a1ae23614  prom-p3.bin
dca5766ed117b7314d4fcb754601de88  srom.bin
c3862638c05c501c50a57ca100735da9  vrom.bin

Additionally these are the Test IDs I've gotten for the different flash chips:
Code: 
JS28F512M29EWL = 2223
MSP55LV100S = 2323
F0096H0 = 88B0

thanks
 
Last edited:
I don’t even own an AES anymore but I know how awesome this is to the community. One of the biggest annoyances with the 161s is why all the dupes and hacks and incomplete library!!?

Digging into this did you figure out why they may have opted out of simply doing a nice clean complete collection cart?
 
NeoCverA said:
Digging into this did you figure out why they may have opted out of simply doing a nice clean complete collection cart?
Click to expand...
It's discussed earlier in the thread, it's because the full library does not fit on a single cart, and the duplicates / hacks share files so are much smaller than individual games. That's why he has made two carts in the videos.
 
So to add a game like Metal SLug 5 for example, it needs to be fully decrypted, and extracted S-rom?
The whole "fully decrypted" business with the neo geo roms are confusing.. the "nd" roms are not fully decrypted for example..
I find many "fully decrypted" that only has the C roms and sometimes the P rom, decrypted, but still V and M roms are encrypted :(

Is there any way to get a REAL fully decrypted set of a selected neo geo game?
I know @iq_132 made some tools for encrypting/decrypting the individual files way back, but I am not sure that I get em all correct, since I have no CRC for the fully decrypted set to compare it with

In Metal slug 5 everything is encrypted, and S rom baked into the end of C. :S
 
thanks for the amazing work @Vortex!

a few questions:
1. Does the WeAct STM32H750 programmer work for all the required chip flashing or is anything else needed?
2. Is the whole reprogramming part documented aynwhere?
3. Is the game split between the two carts documented anywhere? As far as I understood the VTXCart.exe tool, I have to supply the game list in the games.txt file myself.
 
bytestorm said:
So to add a game like Metal SLug 5 for example, it needs to be fully decrypted, and extracted S-rom?
The whole "fully decrypted" business with the neo geo roms are confusing.. the "nd" roms are not fully decrypted for example..
I find many "fully decrypted" that only has the C roms and sometimes the P rom, decrypted, but still V and M roms are encrypted :(

Is there any way to get a REAL fully decrypted set of a selected neo geo game?
I know @iq_132 made some tools for encrypting/decrypting the individual files way back, but I am not sure that I get em all correct, since I have no CRC for the fully decrypted set to compare it with

In Metal slug 5 everything is encrypted, and S rom baked into the end of C. :S
Click to expand...
I sent Vortex a freshly decrypted and deprotected MS5 (non plus) and a "plus removed" SVC.
 
dexa said:
thanks for the amazing work @Vortex!

a few questions:
1. Does the WeAct STM32H750 programmer work for all the required chip flashing or is anything else needed?
2. Is the whole reprogramming part documented aynwhere?
3. Is the game split between the two carts documented anywhere? As far as I understood the VTXCart.exe tool, I have to supply the game list in the games.txt file myself.
Click to expand...
1. WeAct board and thee pcb’s (gerbers are on the git). Nothing else. Each pcb required 2 2x22 2.54mm pin headers and 2-3 0.1u caps.
2. vtxcrt tool generates all necessary dumps for the programmer, and verilog include files for cpld. Flash programming and verifying is carried out by STM32. sources and binaries are available.
3. You decide what to include to the cart by editing games.txt file. Vtxcart do checks automatically and will inform you if something goes wrong (for example, if there is no space left)
4. To program the cpld’s you will need a Quartus 13 and a USB blaster.
 
Vortex said:
1. WeAct board and thee pcb’s (gerbers are on the git). Nothing else. Each pcb required 2 2x22 2.54mm pin headers and 2-3 0.1u caps.
2. vtxcrt tool generates all necessary dumps for the programmer, and verilog include files for cpld. Flash programming and verifying is carried out by STM32. sources and binaries are available.
3. You decide what to include to the cart by editing games.txt file. Vtxcart do checks automatically and will inform you if something goes wrong (for example, if there is no space left)
4. To program the cpld’s you will need a Quartus 13 and a USB blaster.
Click to expand...
Will the vtxcrt tool also handle the decryption? Or do I need to supply non-encrypted Roms?
 
Vortex said:
1. WeAct board and thee pcb’s (gerbers are on the git). Nothing else. Each pcb required 2 2x22 2.54mm pin headers and 2-3 0.1u caps.
2. vtxcrt tool generates all necessary dumps for the programmer, and verilog include files for cpld. Flash programming and verifying is carried out by STM32. sources and binaries are available.
3. You decide what to include to the cart by editing games.txt file. Vtxcart do checks automatically and will inform you if something goes wrong (for example, if there is no space left)
4. To program the cpld’s you will need a Quartus 13 and a USB blaster.
Click to expand...

thanks for the quick reply.
Regarding 3: I didnt expected the tool to look at the space left - good to know.

Before I ask more questions: do you plan on posting a complete how to? I´ll happily wait for that :)
 
You must log in or register to reply here.
Back
Top