Reverse engineering 161 in 1 cartridge to change Rom games

[TobyRieper]

I wouldn't mind hacking / flashing / this cart if it's possible. Is there enough space for the whole library on there if the hacks are removed? Dream come true that would be, be great if it worked with Pick n Mix feature from Uni Bios 4 as well. Can't wait to make the ultimate 161 in 1 cart. I did Gadget UK's mods to it and it works absolutely fine. Just a shame about some glaring omissions from the playable games.

 

[rcboosted]

I wouldn't mind hacking / flashing / this cart if it's possible. Is there enough space for the whole library on there if the hacks are removed? Dream come true that would be, be great if it worked with Pick n Mix feature from Uni Bios 4 as well. Can't wait to make the ultimate 161 in 1 cart. I did Gadget UK's mods to it and it works absolutely fine. Just a shame about some glaring omissions from the playable games.

Which revision do you have? GadgetUK's mods were for revision 2 I think, I didn't see where to do the mod on my revision 4.

 

[TobyRieper]

Which revision do you have? GadgetUK's mods were for revision 2 I think, I didn't see where to do the mod on my revision 4.

I have this board... Not sure which revision it is?

 

[rcboosted]

Based on https://wiki.neogeodev.org/index.php?title=161-in-1_Series_1&t=20200912131532 and https://www.mvs-scans.com/index.php/Multigame_161_in_1_Series_1 it's a revision 1. First one!

 

[TobyRieper]

So that's a good thing? Hopefully I can do the hack that that will hopefully soon be coming out.

 

[rcboosted]

I have no idea lol. I just didn't think they still have revision 1 for sale.

 

[Butter Meister]

We were working on revision 4 because that's the most recent and currently sold revision. It would probably take just as much effort to mod old models, which are never worth working on.

 

[rcboosted]

Here are some unsolicited shots of the newer green shelled 161 in 1. They changed how the chips are mounted yet again along with some goo to keep it down.

 

[Butter Meister]

Here are some unsolicited shots of the newer green shelled 161 in 1. They changed how the chips are mounted yet again along with some goo to keep it down.

Oh geez, a Revision 5??? Fortunately it looks like nothing technical has changed. The only thing different is the S1 and M1 chips being from a different manufacturer, yet still having the same pinout and specs.

They must have tons of these stilt chips lying around if they're still using them. I guess I can't blame them for not wanting to rewrite CPLD code for an obsolete Altera. The epoxy makes me wonder if they're catching onto us

 

[TobyRieper]

Once the hack is figured out I'll just buy a new green model and sell the other. Any timeframe for completion, we looking at this year? It's exciting

 

[Rom1]

This green shell "new version" is not new: look at the revision date on PCB, 2019...
The latest 161in1 are yellow with big hole for the chips.

 

[rcboosted]

This green shell "new version" is not new: look at the revision date on PCB, 2019...
The latest 161in1 are yellow with big hole for the chips.

That's true, the dates on the PCB doesn't match what the sellers are claiming.

 

[rockbottom]

I think the green shell and AES carts are clones, doesn't look like same manufacturer to me... Not unusual with this kind of thing, no honour among thieves with the bootleggers

 

[Talking_Sword]

I have now cracked the MSP55LV100S chip, turns out it's an oddball, 2x 512Mbit 8-bit cores (id matches Spanison S29GL512P) arranged as one 16-bit chip So I can read,erase,write etc. and have a confirmed good pinout, can write up the details if there's any interest.

Hello! I have MSP55LV100S ROM chip, which i need to reflash. I want to ask some questions about it. These questions may be off-topic here (and sort of stupid), but rockbottom seems to be first (besides those chinese pirates) who figured out, how to reflash these ROM chips. I cannot find info on these chips anywhere, this seems the only place, where i can get advice. Sorry about asking it here.

1. The your first attempt to reflash the ROM was unsuccesful. But you later find out, that this chip acts like two S29GL512P in 8-bit mode arranged as one 16-bit chip. Does this prevented from erasing\writing the chip during first attempts, i mean two 8-bit ROMs arranged as one 16-bit ROM cannot be written on "regular" programmers, or it was some other problem? Can i use the "regular" programmer, support S29GL512, to write MSP55LV100S, or i absolutly need Arduino with custom designed firmware for this chip?
2. You wrote in this thread, that you dumped the Mega Drive 112 in 1 multicart. Does it has its ROM address lines mixed up?

 

[Brentradio]

I think a better idea is to use a RasPi loaded with games and make an adapter that plugs it into your MVS or AES. You could use the shell of the 161 in 1 and mount everything inside it so it looks and plugs into your game as it always does. You could even print cool looking 3-D shells as well if you wanted.

Play tons of games in your NEO GEO cab, not just NEO GEO games.

That's a neat idea. Someone should do that. I would buy one.

 

[Talking_Sword]

@Brentradio i'm not sure, if this reply addressed to me, or anyone else.

If it was addressed to me, then:

1. I don't like emulation.
2. I want to reflash the MSP55LV100S chip.

 

[rockbottom]

@Talking_Sword the pinout is here somewhere in this thread, the command set is same as S29GL512. Get S29GL512 datasheet, it has commands for 2 modes, word or byte, use byte but double the command for both byes of the word, (internally it's effectively got 2 S29GL512 in byte mode)
I don't think you'll have much luck with any S29GL512 programmer as it's different physical package so you would still need some kind of custom adapter. Arduino is not ideal being 5v but I like the simplicity of the 8-bit avrs. If you have some 3.3v dev board with enough pins you could at least do away with level shift concerns. But you're ultimately looking at some kind of custom PCB still, I guess if it's just a one-off dump or whatever you could hack something up with wires etc. but that's gonna get real nasty real quick
Yes the MD112 was scrambled, as all bootleggers just love to do, nothing fancy, an annoyance rather than a problem, I'd have to look back at what I did to get details, I think I also created a schematic, I'll have to check...

 

[Talking_Sword]

the pinout is here somewhere in this thread

I read the whole thread and found only this:

http://1.bp.blogspot.com/-ME7sGE_Jk...QFtaIKRSxXXt8WEAyrQCLcBGAsYHQ/s0/55lv100s.png

This pinout is missing /WE pin. You wrote somewhere in the thread, that you have a correct confirmed pinout. You also wrote, that pin 68 is /WE, so if i use pinout from the link above, and assume, that pin 68 is /WE, it will be correct pinout?

Like this:

the command set is same as S29GL512. Get S29GL512 datasheet, it has commands for 2 modes, word or byte, use byte but double the command for both byes of the word, (internally it's effectively got 2 S29GL512 in byte mode)

I read the S29GL512 datasheet and it says, that word\byte configuration is controlled by the /BYTE pin. Maybe i don't read the datasheet thoroughly, and there are other ways to do this?

I don't think you'll have much luck with any S29GL512 programmer as it's different physical package so you would still need some kind of custom adapter.

I don't care about physical compatibility so much. I more care about software compatibility.

As for connectintg the ROM chip, i actually have the cartridge for Mega Drive, not for Neo-Geo (that's why i wrote, that it may be off-topic here). This cartridge have the MSP55LV100S ROM chip, same as older Neo-Geo multicarts. All of the data lines and many of the address lines goes directly to the cartridge connector. The rest of the address lines controlled by the bank switching circuit (consisting of the two 74HC174 and two 74HC32). I have spare Mega Drive cartridge slot, so i can use it to make a adaptor to reflash the chip directly in cartridge. I can temporarily desolder logic chips and connect the rest of the address lines with wires, lift the /WE pin (and other, if needed) and also connect it with wire. It will be messy, but i only need to reflash 2 or 3 cartridges.

Yes the MD112 was scrambled, as all bootleggers just love to do, nothing fancy, an annoyance rather than a problem, I'd have to look back at what I did to get details, I think I also created a schematic, I'll have to check...

What software used to descramble the ROMs? And how to determine, if i descrambled the ROM correctly?

Also, this is equivalent circuit of MSP55LV100S using S29GL512P:

I got it right? Or something wrong?

 

[Fluffy]

Just got another 161-in-1:

Seems to be another different program board.

 

[Butter Meister]

Just got another 161-in-1:

Seems to be another different program board.

Do those P chips have any identifying markings on them?