Reverse engineering 161 in 1 cartridge to change Rom games

HornheaDD · Sep 24, 2023

xodaraP said:
You can make your own OSSC which takes a significant time/equipment/parts investment or you can buy one from VGP, Ali or other sellers

I.e. providing a service

GeorgeSpinner · Sep 24, 2023

HornheaDD said:
So this tells me that this whole project kinda results in nothing, then. Pointless. The whole "because it's there" reason that Vortex did this is rad as hell, no doubt about it, and I salute his ingenuity, but if a NeoSD cart price is the assumed amount someone would charge, what makes anyone think the Chinese wouldn't increase the price of these carts exponentially?

I sincerely doubt they will make custom made-to-order carts. So this just makes the currently easily attainable 161 carts on Ali jump in price if they even want to do this. And since no one here wants to do it for "legal issues" or because they are unable, I guess I'm glad I got mine for $60 even though a chunk of games are garbage.

I would pay a decent amount of money for a set of these carts. The instant loading is a big advantage. 2 carts with all or most games. I don't care about utilities. Hell, I'd pay a decent amount for 1 cart with just the best games (as decided by me, of course).

dexa · Sep 24, 2023

ack said:
I'm using this

https://www.amazon.com/dp/B07T9CPMHT?psc=1&ref=ppx_yo2ov_dt_b_product_details

And the openocd software (in linux) to program the svf file generated from Quartus's compile (svf output needs to be enabled). I've never had much luck getting my usb blaster working, but could just be cause its a cheap knock off.

thanks for suggesting this board @ack.

Looking at the boards pins - which pins are used for the six JTAG connections? GND I can match .. but no clue about the rest.

As I never had to use openocd, do you still have the commands you used?

ack · Sep 24, 2023

dexa said:
thanks for suggesting this board @ack.

Looking at the boards pins - which pins are used for the six JTAG connections? GND I can match .. but no clue about the rest.

As I never had to use openocd, do you still have the commands you used?

Programmer PIN	J-TAG PINs
AD0	TCK
AD1	TDI
AD2	TDO
AD3	TMS
GND	GND
+3.3V	VCC

And just a reminder the pinout of the J-TAG connector on the carts is

1 = 3.3V
2 = GND
3 = TCK
4 = TDO
5 = TDI
6 = TMS

From what I understand normal JTAG programmers use the VCC pin as a voltage reference. However this programmer is supplying 3.3V on that pin. Its enough to power the PROG board with all flash chips installed so you can program both CPLDs on it. For the CHA board the programmer is unable to supply enough power for a fully populated board, so you need to either program it with the C flash chips removed or supply external power. I've been doing the latter by powering the CHA board via a MVS motherboard with the programmer plugged in. If too much power is being drawn from the programmer board its red led will turn off.

For openocd I use 2 commands

This one is to verify openocd is seeing the CPLD ok

Code:

# openocd -f /usr/share/openocd/scripts/interface/ftdi/um232h.cfg -c "adapter speed 400" -c "transport select jtag" -c init -c scan_chain -c shutdown
Open On-Chip Debugger 0.11.0+dev-snapshot (2023-02-14-01:09)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 400 kHz

jtag
Info : clock speed 400 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x172560dd (mfg: 0x06e (Altera), part: 0x7256, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x172560dd"
Error: IR capture error at bit 2, saw 0x3ffffffffffffd55 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
   TapName             Enabled  IdCode     Expected   IrLen IrCap IrMask
-- ------------------- -------- ---------- ---------- ----- ----- ------
 0 auto0.tap              Y     0x172560dd 0x00000000     2 0x01  0x03

shutdown command invoked

You can see it found the 0x172560dd device, which is the CPLD. If something is wrong the table will be empty.

This is the command I use to program

Code:

# openocd -f /usr/share/openocd/scripts/interface/ftdi/um232h.cfg -c "adapter speed 400" -c "transport select jtag" -c init -c "svf cha_cp1-test.svf" -c shutdown
Open On-Chip Debugger 0.11.0+dev-snapshot (2023-02-14-01:09)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 400 kHz

jtag
Info : clock speed 400 kHz
Warn : There are no enabled taps.  AUTO PROBING MIGHT NOT WORK!!
Info : JTAG tap: auto0.tap tap/device found: 0x172560dd (mfg: 0x06e (Altera), part: 0x7256, ver: 0x1)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 2 -expected-id 0x172560dd"
Error: IR capture error at bit 2, saw 0x3ffffffffffffd55 not 0x...3
Warn : Bypassing JTAG setup events due to errors
Warn : gdb services need one or more targets defined
svf processing file: "cha_cp1-test.svf"
FREQUENCY 1.00E+07 HZ;
Info : ftdi: if you experience problems at higher adapter clocks, try the command "ftdi tdo_sample_edge falling"
adapter speed: 10000 kHz

TRST ABSENT;
ENDDR IDLE;
ENDIR IRPAUSE;
STATE IDLE;
SIR 10 TDI (332);
RUNTEST IDLE 10000 TCK ENDSTATE IDLE;
SIR 10 TDI (00E);
...
RUNTEST 50 TCK;
SDR 95 TDI (400000000000000000000000);
SIR 10 TDI (012);
RUNTEST 400000 TCK;
SIR 10 TDI (006);
RUNTEST 10000 TCK;
SIR 10 TDI (3FF);
RUNTEST 10000 TCK;
STATE IDLE;

Time used: 0m5s147ms
svf file programmed successfully for 422 commands with 0 errors

shutdown command invoked

Depending on your linux distro, um232h.cfg might be in a different location.

Quartus by default doesn't output .svf files need for programming with this method. You can enable it by going to Assignments -> Device... -> Device and Pin Options..., then check the Serial Vector Format File (.svf) option. Recompile and the .svf file should show up in output_files/ directory.

leonk · Sep 25, 2023

nam9 said:
So… which versions of the 161-in-1 are ‘compatible’? Anything with the strange stilt chips?

This question was asked before, but no one answered. Over the years, many different 161-in-1 were released. Is the one with the strange stilt chips the only one that will work with the modification described here? Or will older ones work as well?

Is the stilt chips version what's sold on AliExpress today?

xodaraP · Sep 25, 2023

leonk said:
This question was asked before, but no one answered. Over the years, many different 161-in-1 were released. Is the one with the strange stilt chips the only one that will work with the modification described here? Or will older ones work as well?

Is the stilt chips version what's sold on AliExpress today?

I have literally just received one from Ali I ordered to do this mod. I will confirm once my PCBs arrive and I have a chance to open it

For reference I have the blue cart labeled as V3

nem · Sep 25, 2023

Current blue carts will work for this. PCBs are the same as in the pictures taken by Vortex here.

hatmoose · Sep 25, 2023

Would you consider releasing the CAD's for the 56 pin TSOP please?

I'd like to fiddle with the SMT footprints a bit to accommodate something like this test socket. Standard size SMT pads need a hotplate or a micro iron, but with bigger SMT pads home fabrication is (barely) possible without specialist tools.
https://vi.aliexpress.com/item/32952479945.html

Or alternatively re-work for THT to accomodate something like this, which would make home fabrication trivial
https://vi.aliexpress.com/item/573431584.html

Rom1 · Sep 25, 2023

Also, those TSOP56 chips for S/M can be programmed using XGecu T56.

JayAwesome · Sep 25, 2023

No chance using a T48?

Rom1 · Sep 26, 2023

Never tested, but with the right adapter this should be ok too.

nem · Sep 26, 2023

Can Xenocrisis be removed from the game assets, @Vortex?

ManCloud · Sep 26, 2023

Hi Friends,

I just went through the process of of creating my VTXCart...
And it kinda works: some games will run... most games wont.

Hardware: Yellow Case, Board Version - 161in1-SB-1G-P_V10 - 20200216

Initially i had the issue with the scrambled image which was dealt by altering the CPLD pins.

But i still have games just throwing memory errors, claiming the cart is improperly connected or rebooting the MVS to a state, where it shows the Cross-Hatch-Test.

I also found one game booting but then the backgrund tiles are all messed up and the actual game will not load any enemies or terrain... (Zed Blade - Image attached)

All the Chips went with 0 Errors through Program and Verify.

My board has a JS28F256 though, therefore i rebuilt the cart.bin with 32MB support for SROM

ZUPAPA e.g. goes after the parental notice and then into EXCEPTION (image attached)

Any clues where i can start debugging?

xodaraP · Sep 26, 2023

My suggestion would be to check your solder joints. There are a lot of pins on those memory ICs and only 1 or 2 need to be loose to cause problems

ManCloud · Sep 26, 2023

Will definitely do so.
By the way: I was able to mess up my v3 cart by ripping some pins off...

Therefore I designed a new daughter/carrier PCB with THT 1.27 pins instead of SMD headers:

It's a 4-layer PCB and should be a drop-in replacement.

I even thought about creating a programmer board where you could simply remove the F0095H0 instead of the Daughter board...

Maybe next time

Vortex · Sep 26, 2023

As for PROM errors - (except for the cleanliness of the contacts) monitor the voltage.
A voltage drop of less than 3.3 volts causes many errors. so I raised the voltage to 3.58.

ManCloud · Sep 26, 2023

Okay this sounds like a major issue regarding the fact you measured only 3.2V on your stock regulator! I'll definitely raise the voltage level.

Do I have to do it on both boards or only one?

Rom1 · Sep 26, 2023

ManCloud said:
Will definitely do so.
By the way: I was able to mess up my v3 cart by ripping some pins off...

Therefore I designed a new daughter/carrier PCB with THT 1.27 pins instead of SMD headers:

It's a 4-layer PCB and should be a drop-in replacement.

I even thought about creating a programmer board where you could simply remove the F0095H0 instead of the Daughter board...

Maybe next time

Hi, did the same, and they are currently in production.
I didn't used castellated holes in order to reduce cost.

ManCloud · Sep 26, 2023

Unfortunately nothing changed.
I resoldered every joint I came in contact with and cleaned everything thoroughly...

Even switched the system to eliminate that variable...

But the errors are still 1:1 exactly the same.

Next I will insert a better LDO...

Rom1 · Sep 26, 2023

Check traces continuity to CPLD ?

ManCloud said:
Unfortunately nothing changed.
I resoldered every joint I came in contact with and cleaned everything thoroughly...

Even switched the system to eliminate that variable...

But the errors are still 1:1 exactly the same.

Next I will insert a better LDO...

Search

Search

Reverse engineering 161 in 1 cartridge to change Rom games

HornheaDD

GeorgeSpinner

dexa

ack

leonk

xodaraP

nem

hatmoose

Rom1

JayAwesome

Rom1

nem

ManCloud

Attachments

xodaraP

ManCloud

Vortex

ManCloud

Rom1

ManCloud

Attachments

Rom1