Author Topic: Fun project -hack cheap handheld console- help with BGA NAND flash chip needed  (Read 18008 times)

0 Members and 1 Guest are viewing this topic.

Offline MaitrotPTopic starter

  • Newbie
  • Posts: 1
  • Country: de
Hi guys!

I got this pocket game for something like 15$ from dx some years ago.



I bought it mainly for hacking it or as a parts source. Back then I did not know what a NOAC (Nintendo on a chip, yes that exists!) is and thought the thing had a µC running some sort of emulator. Now, I found some time for it and opened it. :



On the board there´s not much going on except power and audio circuitry as well as the NOAC under a blob of epoxy. What does seem hackable though and well accessible is the flash chip (supposedly). My thought is maybe to extract the code with the roms from the thing and compile an own one with good games :-)
I have some rusty 6502/10 asm experience and the rom is the least of my concerns.

The BGA flash chip has been put on a piece of PCB for good accessibility.  However I can´t find any info regarding the chip itself. It says "6600M0Y0UE" (don’t have account at intel) and if it was put on that piece of pcb from the manufacturer of the chip itself (intel, unlikely) or by the Famiclone manufacturer (maybe) or by some middleman company (most likely) so there must be info for the flash’s pcb somewhere…??
Anybody has an idea how to read and write data on that thing? SPI? What hardware would I need to access it? Where can I find info on the said chip? Googling for 6600M0Y0UE just
spits out some chinese parts suppliers and not a single PDF. Am I not able to read part numbers correctly?
Best regards!

 
 
 

Offline daveshah

  • Supporter
  • ****
  • Posts: 356
  • Country: at
    • Projects
I was looking into doing something similar a few years ago and got hold of the pinout for the whole module - not sure if yours is the same but at a glance looks like Vcc is in the same place at least.
 

Offline daveshah

  • Supporter
  • ****
  • Posts: 356
  • Country: at
    • Projects
A bit more info. Flash BGA itself is almost certainly similar to, if not exactly, Intel P30 type StrataFlash. Reading is easy, behaves just like parallel SRAM and could be done with an Arduino Mega or other micro board with enough I/Os. Programming it will be a bit more involved, the datasheet describes the algorithm which will be similar for any Intel NOR flash part.

The NOAC chip will differ from the standard NES architecture slightly - it's almost certainly one of the VRTech "OneBus" parts such as VT168. Unfortunately VRTech's website no longer exists, I might have some stuff saved in a backup somewhere though which I can look for and it should also be in various places on the internet. Once you have the ROM dump and start playing with it should be possible to run ROMs in VRTech's EmuVT (mirrored here, but I'd be careful and suggest checking for viruses or even running in a VM/isolated machine) to avoid having the repeatedly program the flash. I'm not sure but with the right headers FCEUmm might also run OneBus style ROMs.

EDIT: Actually I had the wrong URL, VRTech still have a website with datasheets. The main chip is probably a VT168, VT1682 or VT368 (no data for the latter). Also they seem to provide a compiler and demo projects.
« Last Edit: December 08, 2016, 05:06:12 pm by daveshah »
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8477
I was looking into doing something similar a few years ago and got hold of the pinout for the whole module - not sure if yours is the same but at a glance looks like Vcc is in the same place at least.
That looks like the standard JEDEC SO44 pinout with some extra address bits tacked on.

Given that this is a cheap far-East product, I'm wondering whether that's not even a real Intel part but just remarked somehow --- or if Intel do mask/OTP ROMs too.
 

Offline daveshah

  • Supporter
  • ****
  • Posts: 356
  • Country: at
    • Projects
That looks like the standard JEDEC SO44 pinout with some extra address bits tacked on.

Given that this is a cheap far-East product, I'm wondering whether that's not even a real Intel part but just remarked somehow --- or if Intel do mask/OTP ROMs too.

If it's the standard JEDEC pinout then it is probably the same for the OP's unit as the diagram I found. Remarked is quite possible; though it's a fairly old part so it could also just be surplus/recycled. I suspect that it is flash though simply because flash memory is so cheap and it's probably 128MBit or so where I don't think mask ROM is that common - also these products come in quite a few variants and I don't think the production quantity of each variant is that large.
 

Offline anti77

  • Newbie
  • Posts: 3
  • Country: hu
Seems to have the same type of riser of module on my SUP Game Box Plus 400 in 1, which is based on a VTxx, single side PCB. According to the datasheet there is a PSRAM on my chip beside the flash. However the side pins don't seem to be connected, and there are only a0..a22 address lines for the ST chip.
Thanks daveshah for the pinout.

Any idea how to read/flash this without having to solder 44 cables every time?
 

Offline wraper

  • Supporter
  • ****
  • Posts: 17834
  • Country: lv
Any idea how to read/flash this without having to solder 44 cables every time?
Solder 44 pogo pins onto proto or custom board if it's possible to program in circuit. Or solder female header connectors onto main board and male on flash board so you can simply disconnect it and put into programmer.
 

Offline pol1345

  • Newbie
  • Posts: 1
  • Country: ve
Hi.!
Does anyone know what component this is? it burned and the inscription is not seen
    https://ibb.co/sJH5wfr  https://ibb.co/Tq4vRt0
 

Offline Soulreaver

  • Newbie
  • Posts: 1
  • Country: ru
This is a resistance with a nominal value of 0 ohms, where the protective diode is still burned out on the left.
 

Offline davegsm82

  • Contributor
  • Posts: 14
  • Country: gb
Did anyone ever make any headway with these units? anyone dumped the rom? would be great to see if we could modify the game list.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf