You may remember that in my last post I said I was interested in the NOR flashrom inside the Coolbaby NES game console. Well, I've been obsessing with it lately, so let me review the progress from the past two weeks.
My original idea was to read the IC in situ, I soldered up a ton of breakout pins and was able to dump the contents while the system was running.
Unfortunately, the CPU made it difficult to read the flash rom while the system was powered off. Probably some pull-downs or whatever that caused problems for me, so I removed everything and started from scratch. I even tested the console one last time to make sure everyting was working before I started ripping it apart.
I bought a TSOP56-to-dip adapter, and decided it was time to desolder the flash rom to dump it. I tried to protect most of the board with kapton tape and aluminium foil, and fired up the hot air station.
It went surprisingly well, and a few minutes later the chip was cleaned up and secured in the ZIF TSOP56 adapter.
I decided to use a STM32F4 Discovery board for reading the data. It has lots of nice I/O pins, it's fast, it has native USB and much more.
So, here it is all wired up - not pretty but it works. My apologies if you have OCD and like colour coded wires, I just used what was at hand.
The next step was to write a UART-over-USB for the ARM processor. Then, interface the pins to the flash rom and try to implement the protocol for reading the contents. Once that's in place, I wrote a client on the PC side that receives the data and saves it as a binary file.
Yada yada yada, long story short: success! I present to you a sample from the file. Here you can see part of the adventures games lists:
Next up is figuring out how the games are arranged and how the menus work.
Stay tuned.
I'm following up to see if you're able to flash the roms! Really interesting!
Thanks for this
Xavier: I'm reading and writing the flash memory now, and a "hack pcb" is in the works. What's stopping me right now is the fact that I haven't had the time to reverse-engineer the menu system yet. But I'll get to it.
Very interesting project. I had a coolbaby as well.Hope you can reflash the ROM into something more interesting!
I got the HDMI version for christmas and immediately started googling around for hacks so I can add some more of the classics to the game list and found this blog. Can't wait to see how this works out for you! Keep us posted! :)
So we're you able to get anywhere?
Any joy? keen to add some other games and remove some so the kids don't get lost in the list so much. Thanks
Great work Xavier, I'm just posting up a comment so I get notifications of your progress, very cool project, perhaps the hack pcb could include a ribbon cable header for a 72 or 60 pin cartridge slot.. perhaps further down the line, just being able to reflash the rom chip with all my favourites and removing the crap would be excellent, keep up the good work! :-)
Sorry, got mixed up with the first comment(thought your name was Xavier).
Also, I only just noticed something rather interesting..
I wasn't paying a great deal of attention to the pictures and assumed you had the hdmi one and noticed in the picture of hex code the game "bucky o'hare", as far as I have been and to find, this game is only available on the HD version.. Can you confirm if it's on the game list on the packaging or menu.
If not then perhaps the composite and HD versions both have the same flash dump and there is simply just a jumper(or pin connected to ground) that the firmware checks in order to which list of games to display on the menu..
I know it may be a stretch and you ordered yours in October/November so it may have just simply been the first model with a different list of games..
nice job!! fingers crossed for future progress:)
Great job.I've recently bought handheld NES which seems simmilar in design but in smaller form factor. Same flash chip, probably same NOAC, + old Nokia battery for power. Looking at fragment of Yours dump screenshot game list seems preety simmilar.
Hi,
Really nice work there! found mine back ealier today while moving stuff and plugged it back in while looking if hacks advancement where made ^^'
Dunno if it helps but I noticed that if you press A+B+START in the start menu it brings up a factory/test screen.
Anyways, good luck ;)
So, has a hack or flashing software ever been completed for these knockoffs? My ex-wife bought 2 of the 620 in 1, China Knock-Offs of the NES Classics at an auction here in town, and was upset when it had a several more HACKED ROMS then originals. She brought them into my computer repair shop and told me that if anyone knew how to add/remove games it would be me. I told her, I only have 122 ROMS. She is fine with that. So, I see this I and got excited.
I have a similar coolbaby, but with HDMI. And I look forward to see that "hack pcb" and a way to delete and add roms. =]
Do you have a download available for the flash dump? I'd like to take a look at how the ROMs are stored and see if it's easy to extract them for other emulators to run.
I have the HDMI version, which has the USB data lines wired over to the HDMI encoder, but I can't find any specs on that chip. It would be nice if it was possible to hack these over USB without having to open the case.
Thanks,
Mike
Great job. Waiting for a way to update the rom list.
Any update on how you can update one of these?
i dont think there will be an update after 3 years,will be nice thought to have the multirom extracted