xxx-in-1 with parallel flash dump

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

xxx-in-1 with parallel flash dump

Post by x3e »

Hi Guys,

I hope I'm in the right place, I just registered for this forum. Interesting stuff here!

So I bought a xxx-in-1 console in a junk shop for €10. I was very interested to see how they could make such a console so cheap. After some research I discovered that this is basically an emulator in a box. Awesome!

But the games on it still aren't great. That's why I decided to dump the ROM to see if I can modify them. I hacked together an improvised dump tool with some stuff I had lying around and some coding, and that seemed to work. So now I have 8 MiB of bootleg nes games. But I can't find a way to emulate them. I downloaded NintendulatorNRS and tried to emulate the whole package with many many different NES headers. I also tried to extract individual roms and run them (by adding headers as well), but they don't seem to work either.

Can anyone give me some pointers on this? Would be awesome! The dump should be in an attachment here. In case you want to play around with it yourself.
Attachments
rom.zip
(3.1 MiB) Downloaded 134 times
Last edited by x3e on Wed Aug 31, 2022 1:50 am, edited 1 time in total.
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by x3e »

Here's some pictures to give an impression of what I've been doing:
PCB front.JPG
dump setup.jpg
User avatar
Ben Boldt
Posts: 1149
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: [help needed] xxx-in-1 with parallel flash dump

Post by Ben Boldt »

How did you disable the rest of the circuit board from being powered and operating the ROM while you were dumping it? Have you dumped more than once and gotten identical results?

Edit:
It looks like you did get it to dump valid data. I notice that there is CHR-ROM data at the very beginning which is unusual. However, since this appears to be a 1-bus design, I guess I didn't know what to expect.
rom.png
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by x3e »

Ben Boldt wrote: Mon Apr 11, 2022 1:59 pm How did you disable the rest of the circuit board from being powered and operating the ROM while you were dumping it? Have you dumped more than once and gotten identical results?
Thanks for your reply Ben! It's not very noticeable in my photo, but I shorted the reset button with some solder (holds the CPU in reset) and cut the trace between the reset button and the flash chip. It's not pretty but it works :)

By the way; yes, I have dumped more than once and keep getting the same result.

Can you tell me what program you're using to analyse the data in your screenshot? Sorry but I am very new to all of this.
Edit: NVM, it's called YY-CHR.

If I accidentally would have swapped two wires on the address bus, could that result in the CHR-ROM being at the beginning where you didn't expect it?That could very well be the case, as you have seen in my photos it's a big mess of cables ;)
Last edited by x3e on Tue Apr 12, 2022 9:30 am, edited 2 times in total.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by NewRisingSun »

This is a VT09 with a hitherto unseen CPU opcode encryption variant. Set Console Type to VT09, Mapper 256, Submapper 12, PRG-RAM to 8 KiB, and wait until I upload a new NintendulatorNRS build in the next few days. :lol:

What is the exact name of the plug-and-play console, with model number if possible?

Edit: My god, it says 2021 on the PCB. That means that they are still selling the same shitty Nice Code games that they made in back in 2004! These "replacement games" have had a longer commercial lifespan than the original NES/Famicom library.
Attachments
Menu.png
Menu.png (12.51 KiB) Viewed 2080 times
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by x3e »

Lol. What surprises me is that Nintendo hasn't sued these companies to bankruptcy for al those years ;)
NewRisingSun wrote: Tue Apr 12, 2022 12:52 pm This is a VT09 with a hitherto unseen CPU opcode encryption variant. Set Console Type to VT09, Mapper 256, Submapper 12, PRG-RAM to 8 KiB, and wait until I upload a new NintendulatorNRS build in the next few days. :lol:
Woah, that's really quick! Very awesome, can't wait! :D

On the outside it says "Gaming console Model: EVR.88.770", but that label mentions a Dutch city so that's definitely a rebrand/repackaging by a Dutch company.
On the inside of the casing it has a "Gaming Tech" logo. As you might have seen, the PCB is labeled "CT-885-38" which leads me to https://cheertone.com/mfg/559 which looks very similar to my console. Only mine is blue and has a slightly different game list I suppose.
But the problem with this is that someone (kludge) in another topic also claims he has a Gaming Tech CT-885, with a very different PCB. I also threw away the packaging and manual, so I can't do further investigation on that front. No definitive answer to your question. Sorry!
calima
Posts: 1745
Joined: Tue Oct 06, 2015 10:16 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by calima »

What grounds would Nintendo have to sue? Assuming this doesn't include the hacks like "Mario 9", but only original code.

Hw patents long expired. Design patents long expired.
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by x3e »

Well, I just saw copyright strings from some companies in the binary I extracted from the console. I was just assuming redistributing/selling (big) parts of games copyrighted by Nintendo, Namco etc. would be illegal in at least some jurisdictions. But your comment appears to suggest otherwise. I really don't have strong knowledge about these kind of topics.
calima
Posts: 1745
Joined: Tue Oct 06, 2015 10:16 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by calima »

That's what I said, maybe I wasn't clear :P

If it includes existing games without permission, or existing IP, that's of course illegal.
NewRisingSun
Posts: 1510
Joined: Thu May 19, 2005 11:30 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by NewRisingSun »

The copyright infringement comes from the inclusion of the Inventor hacks of commercial NES games. The purpose of these hacks is to allow for the inclusion of commercial NES games without them being recognizable as such to the casual observer (i.e. lawyers). Or in other words, to make lawsuits not legally impossible, but unlikely.
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: [help needed] xxx-in-1 with parallel flash dump

Post by x3e »

Thanks to NewRisingSun, my flash dump run great on the latest release of NintendulatorNRS. Thank you so much!

Is there anyone who has experience or can give me some pointers (pun intended) for modifying the game list?

I've already noticed the following:
  • Category headers start at $681C0, these include the displayed "name" of the category, the number of games in it, and pointers to the game list.
  • Game list starts at $682AF, this list includes a pointer to the game name and an identifier number.
  • A list of the game names starts at $6867F, these are raw strings.
  • The "parts" of a ROM are not necessarily located next to each other, for example for "Zero Gravity" (Balloon Fight rom hack), the PRG ROM is located at $638000 - $63C000, while the CHR ROM is located at $72000 - $074010.
Is there a central location with pointers to the PRG and CHR ROMS of each game?
x3e
Posts: 7
Joined: Mon Apr 11, 2022 11:38 am

Re: xxx-in-1 with parallel flash dump

Post by x3e »

Just an update in case any of you are interested.

I managed to write a program that is able to modify the game list. The only challenge I had after that was flashing the modified dump back to the chip.

After destroying the first console by trying to bend a pin and breaking it off in the process, I found the exact same game console a few weeks later. I decided to buy it and give it another try. I upgraded my setup a lot, and managed to desolder the flash chip from the board, and mount it in a "holder" that made flashing a lot easier. I wrote a program to rewrite the nand flash, and after doing so, I soldered the chip back to the board.

So after a few months of hard work, I'm finally able to do what I always wanted; play the NES Tom & Jerry game on a crappy piece of hardware :)

I have open sourced the code that I wrote for modifying the game list. Maybe it will help the people at viewtopic.php?t=19581. I have open sourced the flasher as well, but I'm not sure if anyone will have a use for it.

Thanks again for the help everyone, especially NewRisingSun. This was a fun project!
Attachments
new_dumper.jpg
tj.jpg
Post Reply