Electronics, coding and hacking. And ADD.

Dumping the Coolbaby console flash


You may remember that in my last post I said I was interested in the NOR flashrom inside the Coolbaby NES game console. Well, I've been obsessing with it lately, so let me review the progress from the past two weeks.

My original idea was to read the IC in situ, I soldered up a ton of breakout pins and was able to dump the contents while the system was running.

Unfortunately, the CPU made it difficult to read the flash rom while the system was powered off. Probably some pull-downs or whatever that caused problems for me, so I removed everything and started from scratch. I even tested the console one last time to make sure everyting was working before I started ripping it apart.

I bought a TSOP56-to-dip adapter, and decided it was time to desolder the flash rom to dump it. I tried to protect most of the board with kapton tape and aluminium foil, and fired up the hot air station.

It went surprisingly well, and a few minutes later the chip was cleaned up and secured in the ZIF TSOP56 adapter.

I decided to use a STM32F4 Discovery board for reading the data. It has lots of nice I/O pins, it's fast, it has native USB and much more.

So, here it is all wired up - not pretty but it works. My apologies if you have OCD and like colour coded wires, I just used what was at hand.

The next step was to write a UART-over-USB for the ARM processor. Then, interface the pins to the flash rom and try to implement the protocol for reading the contents. Once that's in place, I wrote a client on the PC side that receives the data and saves it as a binary file.

Yada yada yada, long story short: success! I present to you a sample from the file. Here you can see part of the adventures games lists:

Next up is figuring out how the games are arranged and how the menus work.

Stay tuned.

Cool NES, baby!


About a week ago I stumbled across a NES clones on Aliexpress called "Coolbaby". It's basically a miniature NES clone, not unlike the NES Classic, with 600 built-in games. It was so small and cute I just had to buy one. Let's take a quick look at it, and have a peek inside.

The console is shipped with two controllers, a MicroUSB power supply and an AV video cable. An HDMI version exists, but unfortunately I didn't see that listing before buying this. With a price tag of just $20 I can afford to upgrade to the HDMI version later. Oh, and before you ask, the cartridge door does not open. It's simply a groove for decoration purposes.

It's in fact so small and cute I admit that is the main reason I bought it. It's kind of hard to show on a two-dimensional screen, but here it is with an iPhone 4 for comparison:

The image quality is good, but the colors appear to be a little off. Looks over-saturated with a hint of pink. With a little luck an onboard resistor DAC may be configured wrong, but I'll look into that.

Opening the console is pretty straight-forward. Remove the rubber feet and unscrew four phillips screws and you're in. Prior to opening it I had no idea what to expect, so I was pleasantly surprised when I saw this clean, neat, single-sided PCB inside:

And yes, it really is single-sided. Here is the bottom side of the board.

The PCB consists of two components. A S29GL512N11TFI02 512mbit flash ROM, and what's probably a NOAC (NES On A Chip) or a variant of it, packaged as chip-on-board and drowned in epoxy resin.

U2 is the IC that interest me the most. I suspect it can be dumped and/or reprogrammed, and I intend to do so. There are tons of test points to hook on to, and with a little luck I may be able to replace the entire IC with something I can reprogram via USB.

Well, that's it for now. I'll probably experiment with the hardware as soon as time allows it.

The console is definitely worth the money, and if you're looking for a quick retro fix, go buy one - just make sure you get the HDMI edition.

A 68k sandwich


A while back I decided to test SeeedStudio's $4.90 PCB service, and yesterday the boards arrived. Three boards were ordered, and without knowing if anyone of them will work, I'll start off by showing you the most simplest, but most ambitious one.

This is the "68k Sandwich", codename for an experimental board for the Commodore Amiga 500:

(Yes the silkscreen text is a bit off)

The name is from its placement between the Amiga's motherboard and the CPU. It will literally be sandwiched in between.

The board is based around an ATmega128, which will (hopefully) be able to disable the Amiga's CPU and take charge of the hardware alone. I think it's too early to spill the beans completely, but I can point out the unpopulated USB port and let you wonder what my plans are. I'm sure most of you will be able to figure it out.

Stay tuned.

Cooling the Orange


I recently got my hands on an Orange Pi Zero, a Raspberry Pi Zero alternative, if you're unfamiliar with it. What I noticed, though, is the OPi's CPU gets hot. So hot that it would crash under heavy load. At first I tried passive cooling with a few stick-on-sinks, and they helped, but I decided to take it one step further and built this:

I drilled a hole in the case and attached the smallest 5v fan I could find on eBay. The fan can be a bit noisy at times, so I decided to control it with a switching PNP transistor, hooked up to pin PA11 and crammed everything inside the small case. This simple Python script is started in rc.local and runs in the background indefinitely:


from pyA20.gpio import gpio
from pyA20.gpio import port
from time import sleep

gpio.setcfg( port.PA11, gpio.OUTPUT)

while 1:
    with open( "/sys/devices/virtual/thermal/thermal_zone0/temp" ) as f:
        content = f.readlines()

    temp = int(content[0])

    if temp >= 50:
        gpio.output( port.PA11,gpio.LOW )

    if temp < 45:
        gpio.output( port.PA11, gpio.HIGH )


As you can see, when the CPU's internal temperature exceeds 50 degrees celcius, the fan is switched on. I have a hysteria of 5 degrees, so it will not switch off again until the temperature is less than 45 degrees celcius. This was tested using the cpuburn tools that really, really stress the CPU.

And, hey, I'm as surprised as you are: it actually works very well; when the fan starts running, the CPU temperature drops a few degrees in a matter of seconds.

I may not need this too often, but it was a fun (and cute) build. Besides, what's cooler than being cool? Ice cold!

Another C64FC run


At last another batch of PCBs have arrived, and this time they're yellow. Not quite the lemon-ish tint I expected, but I suppose the shade is a tad retro and may complement the C64 well. I have PCBs and parts for 10 boards in total, four of them have been reserved already. This means I have 6 left - interested? Read on.

This will probably be the last run I do on the C64FC boards.

Price? I guess 25 euros per board is as cheap as it gets. There's no markup for me, and most parts have been sourced from China's shadiest back alleys. If you would rather have a blank PCB and get the parts and do the soldering yourself, you can have one for 3 euros a piece. Shipping not included.

Be warned that the current software only runs on Mac OS X and Linux. This means that if you are a Windows user you'll have to be creative.

If you're interested, let me know in the comments and we will get in touch.

EDIT: SOLD OUT. That went faster than expected. Those of you who have expressed interest will be notified shortly. To protect your privacy, the comments left here will not be visible.

Add to Google