Version 4 is what's currently sold as of February 2020.
Interesting those adapters aren't flexi's but very thin rigid pcbs, 0.4 or 0.6mm thick by the looks. 
Incredible job! well doneFull dump totals just under 3GB, zips to around 1.2GB
Yes, I will put all it up somewhere at some point, I got side tracked with the arrival of a 161 cart, started looking at that instead
Nice job once more.Yes, I will put all it up somewhere at some point, I got side tracked with the arrival of a 161 cart, started looking at that instead
I had nearly completed lists of each dump, detailing what was where, what was bad, hacked etc. I was also working on some tools: one to automate creating Mame drivers for each game (to confirm bugs etc.) Another to automate the process of fixing issues in the dumps by overwriting the relevant part with good data, then re-scramble ready to burn back to flash. I'll get back to that once I've got a dumping pcb for the 161 chips into production.
As for the 161, created a schematic of the CHA board, sadly the two C chips didn't tell me much more. As it stands the 32 data line pins are confirmed, not much else, all other pins on all chips just go to the cplds so I can't confirm which address line is which, whats /oe, /ce etc.
I've cross referenced it with 120 schematics, hasn't changed too much so I'm hoping they've kept the address lines the same at least...
As for the chips themselves, still no info found, digging through some supported device lists for various high-end Japanese chip programmers I've found couple other Micron chips of same size and same weird 88-pad TFLGA package. They are: N28H00DB03JDK32E and MT28HL08GNBB3EBK. Sadly no info on them either :/ It's quite strange, it seems info on "big" Nor flash is kept out of public domain by the manufacturers, no mention on websites, no support info, datasheets, pinouts etc. I've contacted Micron tech support, will be suprised if they give me anything but we'll see...
I'll admit the prospect of re-programming these atm is looking fairly bleak (without knowing correct address lines can't send unlock commands etc.) but it
's far from over yet, still got a few tricks to try...
) Not much more can/will happen now until it arrives.
Can only hope the same is true for the F0095H0...
Progress...
PCB arrived and assembled.
Had some issues, for a while I was not getting consistant dumps, weird issue with one of the level translators oscillating or generating noise, not something easily diagnosed without a high end scope, bodged my way round it for now... I guess a rev 2 pcb will be needed at some point
Dumped P, turns out there's a few unused games in there, King of Monsters 2, Windjammers, Zintrick, 2 other kof97 variants/hacks.
Also 2 versions of the menu code, one English, one Chinese, not sure if there's a way to change the cart language or if it's set in production somehow?
Got it running in mame but not looked at it's inner workings in much detail yet.
P rom is scrambled, or in other words address lines are swapped around compared to C. This is annoying as I now don't know which is correct (or perhaps neither?) when it comes to programming. On that note, haven't attempted anything other than dumping so far. Wouldn't want to accidentally issue full chip erase command before having full rom backup
Much faster dumping now, turns out the Arduino DigitalWrite() commands are insanely slow, just switching to direct port bit twiddling has dropped dumping time by 2 thirds,
a previous 1hr 128MB dump is now 20mins. This has brought the 1GB F0095H0 full chip dump down from ~8hrs to about 2.5
I don't even want to know how many hours I would have saved it I'd found this before dumping the 120-in-1
That's all for now...
(each 64Mx16 block is a single MT28GU01G)
(pins with '?' cannot be 100% confirmed)This is incredible progress! So if the cplds are hard-coded to a region, is it just an index? So if a game I want to get rid of is 200MB let's say, can I put a 199MB game in its place? The menu will just go to this region, which is now a different game. If the next cpld depends on the 200MB size, maybe the 199MB game can be padded with 0s or junk data? I'm just shooting in the dark lol. If this is all possible, then maybe all the regions can be mapped out, and we can figure out which games can fit in which slot etc. Unless of course the hard-coding can be changed somehow.Time for an update, the mystery F0095H0 chips have fallen, now have full reprogramming ability
Turns out they consist of 8x Micron MT28GU01G 128MB/1Gb cores arranged as follows:
The proper pinout is different to all (P,C,V) used on the cart, they've scrambled data lines (same scheme all 3) and address lines (same scheme for C and V, different scheme for P), also some additional block swapping for P.
Have designed a new rev 2 dumping/programming pcb now the correct pinout is known, should get those soon hopefully. Simpler design this time, just a single 16-bit level translator and loads pull-up resistors, knowing the internal layout now it makes more sense to just have a common 16-bit data bus, means less components and easier assembly for anyone wishing to make one.
So where are we at now exactly?
Well, basically any existing data can now be reprogrammed, bad data corrected, like-for-like game swaps, fix bugs, hack/improve menu etc. etc.
What can't so far be done is "wipe the slate clean" as it were, so I can't erase the whole thing and say I want this game, that game etc. and arrange/program everything as I see fit.
The reason for this is the 3x cplds are hard-coded to select certain rom regions for each game. The menu code simply issues a binary game number (literally 1 to 161, with 0 to go back to the menu) which each cpld interprets differently depending on its internal config.
This is kind of annoying as going further at this point will mean from-scratch replacement firmware for each cpld. (Or unlocked dumps being found and reversed - unlikely)
In a nutshell: fairly easy for C (pretty much just a dumb slave), harder but do-able for V (also a slave but not quite so dumb + NEO-PCM functionality), very complex for P as this is the master/brain of the cart that controls the other 2, deals with system comms and handles reads/writes to the MCU.
As for the MCU itself, it's looking like rather than having any control over the cart, it deals just with loading/saving game softdip settings (saves in it's internal eeprom) Although that said I've not looked into that side of things much yet.
So that's it for now, when the new pcb arrives and tests ok, I plan to release everything done so far for others to have a play. In the mean time i'm looking at the P/master cpld, planning some hardware attacks, need to know a bit more about it before I can assess whether a replacement firmware will be possible or not.
This is exactlty what @Darksoft and I have been looking for a while (32bit flash). Where to get them? (I suppose you can't ).Time for an update, the mystery F0095H0 chips have fallen, now have full reprogramming ability
Turns out they consist of 8x Micron MT28GU01G 128MB/1Gb cores arranged as follows:
Already saw those, but 512KB is way too small for our needs. To be complete, we are looking for 32bit flashes with (ideally) 64MB/128MB capacity.
Oh yash, idk if such high sizes exist in new stock. But I have actually purchased the exact same stilt chips as seen on the 161 in 1 in aliexpress. Obviously not a reliable source, but they can be purchased still.