Fun project -hack cheap handheld console- help with BGA NAND flash chip needed

[MaitrotP]

Hi guys!

I got this pocket game for something like 15$ from dx some years ago.



I bought it mainly for hacking it or as a parts source. Back then I did not know what a NOAC (Nintendo on a chip, yes that exists!) is and thought the thing had a µC running some sort of emulator. Now, I found some time for it and opened it. :



On the board there´s not much going on except power and audio circuitry as well as the NOAC under a blob of epoxy. What does seem hackable though and well accessible is the flash chip (supposedly). My thought is maybe to extract the code with the roms from the thing and compile an own one with good games :-)
I have some rusty 6502/10 asm experience and the rom is the least of my concerns.

The BGA flash chip has been put on a piece of PCB for good accessibility.  However I can´t find any info regarding the chip itself. It says "6600M0Y0UE" (don’t have account at intel) and if it was put on that piece of pcb from the manufacturer of the chip itself (intel, unlikely) or by the Famiclone manufacturer (maybe) or by some middleman company (most likely) so there must be info for the flash’s pcb somewhere…??
Anybody has an idea how to read and write data on that thing? SPI? What hardware would I need to access it? Where can I find info on the said chip? Googling for 6600M0Y0UE just
spits out some chinese parts suppliers and not a single PDF. Am I not able to read part numbers correctly?
Best regards!

 
 

[daveshah]

I was looking into doing something similar a few years ago and got hold of the pinout for the whole module - not sure if yours is the same but at a glance looks like Vcc is in the same place at least.

[daveshah]

A bit more info. Flash BGA itself is almost certainly similar to, if not exactly, Intel P30 type StrataFlash. Reading is easy, behaves just like parallel SRAM and could be done with an Arduino Mega or other micro board with enough I/Os. Programming it will be a bit more involved, the datasheet describes the algorithm which will be similar for any Intel NOR flash part.

The NOAC chip will differ from the standard NES architecture slightly - it's almost certainly one of the VRTech "OneBus" parts such as VT168. Unfortunately VRTech's website no longer exists, I might have some stuff saved in a backup somewhere though which I can look for and it should also be in various places on the internet. Once you have the ROM dump and start playing with it should be possible to run ROMs in VRTech's EmuVT (mirrored here, but I'd be careful and suggest checking for viruses or even running in a VM/isolated machine) to avoid having the repeatedly program the flash. I'm not sure but with the right headers FCEUmm might also run OneBus style ROMs.

EDIT: Actually I had the wrong URL, VRTech still have a website with datasheets. The main chip is probably a VT168, VT1682 or VT368 (no data for the latter). Also they seem to provide a compiler and demo projects.

[amyk]

I was looking into doing something similar a few years ago and got hold of the pinout for the whole module - not sure if yours is the same but at a glance looks like Vcc is in the same place at least.

That looks like the standard JEDEC SO44 pinout with some extra address bits tacked on.

Given that this is a cheap far-East product, I'm wondering whether that's not even a real Intel part but just remarked somehow --- or if Intel do mask/OTP ROMs too.

[daveshah]

That looks like the standard JEDEC SO44 pinout with some extra address bits tacked on.

Given that this is a cheap far-East product, I'm wondering whether that's not even a real Intel part but just remarked somehow --- or if Intel do mask/OTP ROMs too.

If it's the standard JEDEC pinout then it is probably the same for the OP's unit as the diagram I found. Remarked is quite possible; though it's a fairly old part so it could also just be surplus/recycled. I suspect that it is flash though simply because flash memory is so cheap and it's probably 128MBit or so where I don't think mask ROM is that common - also these products come in quite a few variants and I don't think the production quantity of each variant is that large.

[anti77]

Seems to have the same type of riser of module on my SUP Game Box Plus 400 in 1, which is based on a VTxx, single side PCB. According to the datasheet there is a PSRAM on my chip beside the flash. However the side pins don't seem to be connected, and there are only a0..a22 address lines for the ST chip.
Thanks daveshah for the pinout.

Any idea how to read/flash this without having to solder 44 cables every time?

[wraper]

Any idea how to read/flash this without having to solder 44 cables every time?

Solder 44 pogo pins onto proto or custom board if it's possible to program in circuit. Or solder female header connectors onto main board and male on flash board so you can simply disconnect it and put into programmer.

[pol1345]

Hi.!
Does anyone know what component this is? it burned and the inscription is not seen
    https://ibb.co/sJH5wfr  https://ibb.co/Tq4vRt0

[Soulreaver]

This is a resistance with a nominal value of 0 ohms, where the protective diode is still burned out on the left.

[davegsm82]

Did anyone ever make any headway with these units? anyone dumped the rom? would be great to see if we could modify the game list.