What's new
By:
Filters

Reverse engineering 161 in 1 cartridge to change Rom games

goguelnikov

goguelnikov

Beginner
Joined
Sep 3, 2020
Messages
40
Reaction score
9
Location
Paris
Hy all,

I am wondering if it would be possible to reverse engineer the 161 in 1 cartridge.
they are cheap, but the game list is not incredible.
so the idea would be to be able to understand how it works and replace some of the games with better ones...
any idea if it has already been done ?
maybe it is called the Multi MVS...

any idea where to begin with ?
 
 
if what you're trying to do is remove the hacks and replace them with better games, then you can't really do that.

the reason there are so many hacks is that they're not complete games. they share 90% of the game data with other games.

So for instance you'll have 1 game: KOF2002
then you have KOFHACK#1 KOFHACK#2 KOFHACK#3 KOFHACK#4 KOFHACK#5 etc.
these all borrow assets from KOF2002 and just change a little bit of code so they're able to market the cart as having 6 more games, when really it's just 1.

it's like riding your bicycle with a backpack that has 15 outfits in it and then claiming that your bike can carry 16 people.
 
All right
But if I don’t need any Kofxxx
I can change them by better games ?
 
sure
1. desolder the ROMs from the PCB
2. dump the ROMs that you removed
3. work out the way the games are structured on the ROMs and which game is stored where
4. identify which games you want to remove and similar structured games in MAME that will fit in the space
5. build new files with your new games that fit that structure
6. buy new ROMs and program them with the files you prepared
7. solder these new ROMs to the PCB

honestly not worth the effort IMO, but if you wanted to pursue it, those are the basic steps.
 
even if you figure out the structure. How are you going to test your new build? Desoldering/Resoldering the chips is a major pain and will most probably lead to trace damage on the cart. It would be ideal if you could smoke test it in an emulator somehow.
 
true
not easy to simulate either even with emulators...
 
Last edited:
Yeah considering how these chips are mounted to the pcb desoldering and resoldering would probably destroy parts of the pcb. Probably not worth it to try. Maybe some of the other bootleg carts have easier chips to desolder?
 
I picked up a dead multi-cart, I think it's 138-in-1. One of the cplds is dead so it's scrap. I was intrigued by the big Fujitsu MSP55LV100 70-pin sop flash chips, very little info out there on them but looks like they're 128MB/1Gbit. I thought they would be very nice for other projects, so I've designed a board to hopefully read/write them with an Arduino. I'm currently waiting on the pcb...
I'm not really interested myself but if anyone is seriously looking into hacking multi-carts, then being able to read/write the chips will be the first step, if I'm successful i'll post some details. Like others have said, de/re-soldering will be a pita ;)
 
not having much luck with the MSP55LV100S chips, got the pcb and setup complete, can dump ok but not write, erase, get id, etc. etc.
This is stable Arduino code which i've used for other flash chips so I'm fairly certain it's down to simply not knowing the exact pinout of the chip.
Shame there's no info out there... there exists N64, GBA and MegaDrive/Genesis bootleg carts using this chip, perhaps they would shed some light...
If anyone has one or any info on the chip it might help.
Have tried using the Neo multi-cart to figure it out but most lines just to the CPLD's, and the data lines that do go the cart edge connector are not consistant between chips (not unusual for bootlegs, seems they often just go for easy board layout then rearrange the data before flashing)
2 partial pinouts here and here, neither work for me but I have found pin 68 is /WE thanks to a pic of a GBA flash cart pcb :)

If anyone knows of anything that uses this chip and has a schematic available, that would be very helpful too!
 
Last edited:
rockbottom said:
not having much luck with the MSP55LV100S chips, got the pcb and setup complete, can dump ok but not write, erase, get id, etc. etc.
This is stable Arduino code which i've used for other flash chips so I'm fairly certain it's down to simply not knowing the exact pinout of the chip.
Shame there's no info out there... there exists N64, GBA and MegaDrive/Genesis bootleg carts using this chip, perhaps they would shed some light...
If anyone has one or any info on the chip it might help.
Have tried using the Neo multi-cart to figure it out but most lines just to the CPLD's, and the data lines that do go the cart edge connector are not consistant between chips (not unusual for bootlegs, seems they often just go for easy board layout then rearrange the data before flashing)
2 partial pinouts here and here, neither work for me but I have found pin 68 is /WE thanks to a pic of a GBA flash cart pcb :)

If anyone knows of anything that uses this chip and has a schematic available, that would be very helpful too!
Click to expand...
What would be more worthwhile in my opinion is to focus on the multicart that is the only new one left in production; the 161 in 1 version 3/4. Unfortunately its flash chips are the BK58F0095HVX010A which have even less info available on them. But once their pinout is figured out, whether from research or investigation, I have the ability to rip its contents. In my thread I have a pinout in the works.
 
I have now cracked the MSP55LV100S chip, turns out it's an oddball, 2x 512Mbit 8-bit cores (id matches Spanison S29GL512P) arranged as one 16-bit chip :huh: So I can read,erase,write etc. and have a confirmed good pinout, can write up the details if there's any interest.
Looks like another annoyance will be scrambling, have only dumped the S rom so far, some trivial-ish scrambling which i've cracked, but that's the low-hanging fruit, the others will most likely be trickier... X/
 
S the S-ROM data was arranged as 16-bit? That's interesting, was it just half empty?

IIRC
P-ROMs = 16-Bit
V-ROMs = 8-Bit
M-ROM = 8-bit
S-ROM = 8-bit
C-ROMs = 32-Bit
 
You must log in or register to reply here.
Back
Top