Reverse engineering 161 in 1 cartridge to change Rom games

[ManCloud]

Yeah but I still think I might be able to do sth with a 3d printer here... Once my printer is working again

 

[hatmoose]

Short Feedback regarding the SMD adapter:
It seems there usually would be a clamp, which is "missing".

I'll try to design something to push the chip down... As it is now it's not really usable.

+1 this should be a 2-part product. looks like the aliexpress sellers are only selling the bottom "half"

Pictures and dimensions of the missing piece
https://www.weltronics.com.cn/resou...k/201611/177dea7f775b5294c7002759b3d00a81.pdf



Should be easy enough to model, might be quite hard to print on FDM given the very fine details. Resin maybe?

 

[ManCloud]

Thanks for pointing this out!
I had the datasheet but absolutely missed that part.
Fdm might still work. Even though the cover looks very thin it should still work at even 0.8mm wall thickness I guess

And the little dents should also be big enough I hope.

 

[ManCloud]

I Just tinkered a little bit and this should be as close as i can get.
Well not exactly as i mapped the dimensions to be in 0.4mm steps so my printer can print it.

it should work but i couldn't test it by now.

 

[zardam]

I have done another patch for uni-bios that enables pick'n mix for the Vortex multicart. There are some features/limitations/bugs :
- Always boots to PICKnMIX, even with a normal game cartridge.
- Works on MVS only (backup RAM used to store soft dips).
- No high score save.
- Tested on a MV1A only.
- Game list (titles and order) is hardcoded. The custom 161in1 cart must have been created with this one: uni-bios_4_0_PICKnMIX.csv.

The patch is available here: https://github.com/zardam/ub_vortex_multicart (uni-bios_4_0_PICKnMIX.bps)

 

[leonk]

The most recent 161-in-1 cart has 4 different flash ICs. I've now made about a dozen of these (not a big sample size) but I did notice a disturbing trend that some might want to be aware of. While the PROM, SROM and MROM flash chips are solid, not all the F0095H0's are made equally. I've had 3 of them fail on me during programming (from 3 different donor boards) Most common failure is hanging on writing to a specific sector on the same bank.

I'm not sure if this is caused due to these recycled flash chips being abused in their past life and they finally gave up during the reprogramming stage. Or maybe they've always been questionable and 161-in-1 makers shipped these with some sector flaws to customers thinking that the chances a buyer ever finds the bad sector during game play is nil.

Whatever the case is, when we reprogram these, we exercise every sector and now you uncover all their potential flaws. Also, FWIW, all 3 ICs came from AES carts.

 

[Misos]

Would the decrypted Kof 99 rom from the NeoRageX 0.6 romset work on the 161 in 1?
It has all the stuff from the final version but has a 128Kb S-Rom.

 

[Brentradio]

The best way to reverse engineer the 161 in 1 cart is to smash it with a hammer and buy Darksofts MVS kit.

 

[darknezz19]

Would the decrypted Kof 99 rom from the NeoRageX 0.6 romset work on the 161 in 1?
It has all the stuff from the final version but has a 128Kb S-Rom.

Finally got my 161 in 1 working. I somehow ended up with a vtxcartmain directory that had the cpld files from before the 3gb patch, but the newer compiler. Took me forever to figure out what my problem was, sheesh. Working good now. big thanks to Vortex and everyone involved in helping with this project.


As for the neoragex rom of kof99, yes it works. Just tested it.

 

[rewrite]

I Just tinkered a little bit and this should be as close as i can get.
Well not exactly as i mapped the dimensions to be in 0.4mm steps so my printer can print it.

I found it easier to just use the bottom portion of those, and a couple of clips like you'd use on a bag of chips to hold the chip in place. Tried 2 different style SSOP sockets, including the one @hatmoose pictured above there, and neither one works as well as you'd expect it to after 10+ uses unfortunately.

 

[darknezz19]

I've updated the uni-bios patch here. With this version, the soft reboot goes to the multicart menu only if B is pressed when soft rebooting. This allows to set the soft dips for the selected game.

Does anyone has an idea of what to do with the remaining of the donor 161in1 ? I've repurposed the CHA board to a test cart for the diagnostic BIOS, but maybe there are better options ? I do not have any C/V flash chip left as I fried two of them (too much heat when unsoldering I think).

Thank you for the patch zardam. I notice sometimes pulling up the debug bios screen with either 1p + 2p start or 1p start + ABC sometimes isn't working. Same with the hold B to get back to the menu. I'm on a MV-1C. Has anyone else tested this bios patch?

 

[ManCloud]

I'm currently testing the BIOS patches with my QuadBios Adapter (Switching between the Pick'n'Mix and Back to Menü BIOS with a dip switch).
I'll test your issues the next days

 

[Plastic]

Programmer PIN​	J-TAG PINs​
AD0​	TCK​
AD1​	TDI​
AD2​	TDO​
AD3​	TMS​
GND​	GND​
+3.3V​	VCC​

And just a reminder the pinout of the J-TAG connector on the carts is

1 = 3.3V
2 = GND
3 = TCK
4 = TDO
5 = TDI
6 = TMS

From what I understand normal JTAG programmers use the VCC pin as a voltage reference. However this programmer is supplying 3.3V on that pin. Its enough to power the PROG board with all flash chips installed so you can program both CPLDs on it. For the CHA board the programmer is unable to supply enough power for a fully populated board, so you need to either program it with the C flash chips removed or supply external power. I've been doing the latter by powering the CHA board via a MVS motherboard with the programmer plugged in. If too much power is being drawn from the programmer board its red led will turn off.

For openocd I use 2 commands

This one is to verify openocd is seeing the CPLD ok

# openocd -f /usr/share/openocd/scripts/interface/ftdi/um232h.cfg -c "adapter speed 400" -c "transport select jtag" -c init -c scan_chain -c shutdown
Open On-Chip Debugger 0.11.0+dev-snapshot (2023-02-14-01:09)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 400 kHz

jtag
Info : clock speed 400 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x172560dd (mfg: 0x06e (Altera), part: 0x7256, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x172560dd"
Error: IR capture error at bit 2, saw 0x3ffffffffffffd55 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 auto0.tap              Y     0x172560dd 0x00000000     2 0x01  0x03

shutdown command invoked

You can see it found the 0x172560dd device, which is the CPLD. If something is wrong the table will be empty.

This is the command I use to program

# openocd -f /usr/share/openocd/scripts/interface/ftdi/um232h.cfg -c "adapter speed 400" -c "transport select jtag" -c init -c "svf cha_cp1-test.svf" -c shutdown
Open On-Chip Debugger 0.11.0+dev-snapshot (2023-02-14-01:09)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 400 kHz

jtag
Info : clock speed 400 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x172560dd (mfg: 0x06e (Altera), part: 0x7256, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x172560dd"
Error: IR capture error at bit 2, saw 0x3ffffffffffffd55 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
svf processing file: "cha_cp1-test.svf"
FREQUENCY 1.00E+07 HZ;
Info : ftdi: if you experience problems at higher adapter clocks, try the command "ftdi tdo_sample_edge falling"
adapter speed: 10000 kHz

TRST ABSENT;
ENDDR IDLE;
ENDIR IRPAUSE;
STATE IDLE;
SIR 10 TDI (332);
RUNTEST IDLE 10000 TCK ENDSTATE IDLE;
SIR 10 TDI (00E);
...
RUNTEST 50 TCK;
SDR 95 TDI (400000000000000000000000);
SIR 10 TDI (012);
RUNTEST 400000 TCK;
SIR 10 TDI (006);
RUNTEST 10000 TCK;
SIR 10 TDI (3FF);
RUNTEST 10000 TCK;
STATE IDLE;

Time used: 0m5s147ms
svf file programmed successfully for 422 commands with 0 errors

shutdown command invoked

Depending on your linux distro, um232h.cfg might be in a different location.

Quartus by default doesn't output .svf files need for programming with this method. You can enable it by going to Assignments -> Device... -> Device and Pin Options..., then check the Serial Vector Format File (.svf) option. Recompile and the .svf file should show up in output_files/ directory.

I'm having trouble figuring out how to output the svf. Do I open the qpf file to do all this?

 

[ack]

I'm having trouble figuring out how to output the svf. Do I open the qpf file to do all this?

yes open it with quartus 13.x, then do the "Assignments -> Device... -> Device and Pin Options..., then check the Serial Vector Format File (.svf) option. Recompile and the .svf file should show up in output_files/ directory."

 

[Plastic]

yes open it with quartus 13.x, then do the "Assignments -> Device... -> Device and Pin Options..., then check the Serial Vector Format File (.svf) option. Recompile and the .svf file should show up in output_files/ directory."

I redid everything from clean and now it is working thanks!

 

[Plastic]

I redid everything from clean and now it is working thanks!

Nevermind spoke too soon. I am getting this error while tyring to compile PROG_CP1 with quartus. I am using arcade tv's custom menu.

EDIT: Spoke too soon. I forgot to use arcade tv's generated games.txt now its working

Info: *******************************************************************
Info: Running Quartus II 32-bit Analysis & Synthesis
Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
Info: Processing started: Sat Apr 06 18:07:16 2024
Info: Command: quartus_map --read_settings_files=on --write_settings_files=off prog_cp1 -c prog_cp1
Warning (2002: Parallel compilation is not licensed and has been disabled
Info (12021): Found 1 design units, including 1 entities, in source file /users/user/documents/vtxcart-main/cpld/mvs/prog_cp1/rtl/cp1_top.v
Info (12023): Found entity 1: cp1_top
Info (12127): Elaborating entity "cp1_top" for the top level hierarchy
Info (278001): Inferred 1 megafunctions from design logic
Info (278002): Inferred adder/subtractor megafunction ("lpm_add_sub") from the following logic: "Add0"
Info (12130): Elaborated megafunction instantiation "lpm_add_sub:Add0"
Info (12133): Instantiated megafunction "lpm_add_sub:Add0" with the following parameter:
Info (12134): Parameter "LPM_WIDTH" = "9"
Info (12134): Parameter "LPM_DIRECTION" = "ADD"
Info (12134): Parameter "LPM_REPRESENTATION" = "UNSIGNED"
Info (12134): Parameter "ONE_INPUT_IS_CONSTANT" = "NO"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|addcore:adder[1]", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|addcore:adder[1]|a_csnbuffer:oflow_node", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|addcore:adder[1]|a_csnbuffer:result_node", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|addcore:adder[0]", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|look_add:look_ahead_unit", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|altshift:result_ext_latency_ffs", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (12131): Elaborated megafunction instantiation "lpm_add_sub:Add0|altshift:carry_ext_latency_ffs", which is child of megafunction instantiation "lpm_add_sub:Add0"
Info (280013): Promoted pin-driven signal(s) to global signal
Info (280014): Promoted clock signal driven by pin "nPORTWEL" to global clock signal
Info (280015): Promoted clear signal driven by pin "nRESET" to global clear signal
Warning (21074): Design contains 6 input pin(s) that do not drive logic
Warning (15610): No output dependent on input pin "nPORTWEU"
Warning (15610): No output dependent on input pin "nROMOEL"
Warning (15610): No output dependent on input pin "nROMOEU"
Warning (15610): No output dependent on input pin "nAS"
Warning (15610): No output dependent on input pin "M68K_RW"
Warning (15610): No output dependent on input pin "nRESET2"
Info (21057): Implemented 310 device resources after synthesis - the final resource count might be different
Info (2105: Implemented 30 input pins
Info (21059): Implemented 40 output pins
Info (21060): Implemented 24 bidirectional pins
Info (21063): Implemented 165 macrocells
Info (21073): Implemented 51 shareable expanders
Info: Quartus II 32-bit Analysis & Synthesis was successful. 0 errors, 8 warnings
Info: Peak virtual memory: 355 megabytes
Info: Processing ended: Sat Apr 06 18:07:18 2024
Info: Elapsed time: 00:00:02
Info: Total CPU time (on all processors): 00:00:01
Info: *******************************************************************
Info: Running Quartus II 32-bit Fitter
Info: Version 13.0.1 Build 232 06/12/2013 Service Pack 1 SJ Web Edition
Info: Processing started: Sat Apr 06 18:07:18 2024
Info: Command: quartus_fit --read_settings_files=off --write_settings_files=off prog_cp1 -c prog_cp1
Info: qfit2_default_script.tcl version: #1
Info: Project = prog_cp1
Info: Revision = prog_cp1
Warning (2002: Parallel compilation is not licensed and has been disabled
Info (119006): Selected device EPM3256ATC144-10 for design "prog_cp1"
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|ps[2]~45" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|ps[2]~50" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|gn[2]~5" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|a_csnbuffer:result_node|sout_node[1]~47" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|a_csnbuffer:result_node|sout_node[1]~216" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|genr_node[0]~10" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|gc[1]~10" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|genr_node[0]~15" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|gc[1]~11" of type max_mcell
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|a_csnbuffer:result_node|sout_node[2]~67" of type max_sexp
Error (163105): Cannot route source node "P_ADDR_ALL~38" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|a_csnbuffer:result_node|sout_node[2]~69" of type max_mcell
Error (163105): Cannot route source node "WideOr8~62" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|gs[3]~3" of type max_mcell
Error (163105): Cannot route source node "WideOr8~62" of type max_mcell to destination node "WideOr8~65" of type max_mcell
Error (163105): Cannot route source node "WideOr8~62" of type max_mcell to destination node "lpm_add_sub:Add0|addcore:adder[0]|gn[3]~9" of type max_mcell
Error (163104): Can't place node "P_ADDR_ALL~41" of type max_mcell
Error (163104): Can't place node "P_ADDR_ALL~47" of type max_mcell
Error (163104): Can't place node "P_ADDR_ALL~53" of type max_mcell
Error (163104): Can't place node "WideOr8~81" of type max_mcell
Error (163000): Cannot find fit.
Error: Quartus II 32-bit Fitter was unsuccessful. 19 errors, 1 warning
Error: Peak virtual memory: 348 megabytes
Error: Processing ended: Sat Apr 06 18:07:19 2024
Error: Elapsed time: 00:00:01
Error: Total CPU time (on all processors): 00:00:01
Error (293001): Quartus II Full Compilation was unsuccessful. 21 errors, 9 warnings

 

[ack]

Try this:

Go to Assignments -> Settings... -> Analysis & Synthesis Settings
Then change Optimization Technique to Area.

 

[Misos]

How do you program the S-rom when the cart comes with a JS28F256 instead of a JS28F512?
The chip ID returns a 2222 intead of 2223 and when I dump the file the CRC does not match.
The M rom was a normal JS28F512 so I had no problems with that one.

 

[darknezz19]

Have you tried cutting the dump in half and then doubling the first half back to 512mb? Maybe that's all it needs. 512Mb version has a24, where the 256mb only goes up to a23. I'm looking at the sources to see how it can be edited if this doesn't work.

https://github.com/xvortex/VTXCart/blob/main/Dumpers/Firmware/src/User/Inc/defines.h it looks like there is code for the 256MB chip but it's commented out. Maybe just need the 512mb commented out and the 256mb enabled.

 

[Misos]

Have you tried cutting the dump in half and then doubling the first half back to 512mb? Maybe that's all it needs. 512Mb version has a24, where the 256mb only goes up to a23. I'm looking at the sources to see how it can be edited if this doesn't work.

https://github.com/xvortex/VTXCart/blob/main/Dumpers/Firmware/src/User/Inc/defines.h it looks like there is code for the 256MB chip but it's commented out. Maybe just need the 512mb commented out and the 256mb enabled.

Yes, the problem was with the program I was using, it was spliting the file in a weird way.
I used romwak instead to split the file and cmd to mirror it, and it worked.
So if you have a JS28F256, You need to split the file in 2, use the first part (the botton half is empty) and then mirror it like you said.