Game console - security ic ???

[Noopy]

That's some bullshit software then. Especially just for reading purposes as even if there are significant differences, EPROM or FLASH usually can still be read as other similar device. In my Wellon programmer software device ID check checkbox is not even checked by default. Even when programming, there were cases when newer lower voltage version of FLASH was not supported. I simply selected different IC and lowered voltage in settings.
BTW I suggest ordering cheap ZIF socket from China. Will save you a lot of time wasted on soldering spider legs. https://www.ebay.com/itm/150mil-SOP8-Socket-Adapter-Universal-IC-ZIF-Programmer-Converter-For-PCB/152059011073?hash=item23676c6001:g:KHsAAOSwqbZXFJub They are actually quite good and durable.

The Galep 5 seems to be a good tool but in my view absolutely inflexible.  Perhaps more for industrial enviroment. You can count flashed devices and such important things...

Regarding ZIF-Socket: You are right! 

Hack it if you know how to use Cheat Engine and x86 assembly.

"my favourite programming language is solder" 

[Noopy]

My read is that it would have been no problem to dump the data anyway but the Galep didn´t want to.

Isn't there any setting to ignore device ID?

Unfortunately not... 

The problem was between chair and keyboard! There is a checkbox to disable the ID-Check! 

Now I have a dump.
But it doesn´t tell me very much. No plain text. Only hex and hex and hex... 

Any suggestions?
...is it allowed to upload such a dump or is that already illegal?

[Prehistoricman]

The problem was between chair and keyboard! There is a checkbox to disable the ID-Check! 

Now I have a dump.
But it doesn´t tell me very much. No plain text. Only hex and hex and hex... 

Any suggestions?
...is it allowed to upload such a dump or is that already illegal?

I don't think anyone would stop you...
I'd like to take a look at least 

[Noopy]

Done:

https://richis-lab.de/temp/dump_all.hex
https://richis-lab.de/temp/dump_all.bin

 

As far as we got one probably can´t just copy the game, so it should not be very illegal...

[Prehistoricman]

binwalk (common binary analysis program) shows nothing.

I found these stick-fighter sprites (address 194DD8) and here's a graph of the binary entropy.
I noticed that most of the text in the game is made of only a few different fonts, so I bet that's why we're not seeing any ASCII in the dump.

Around these stick-fighter sprites I see 0x00 for the body and a combination of 0x145 and 0x28A in the empty space.
Conclusion: The sprites are made of 6-bit pixels and I'm guessing there is a colour palette and that this empty space colour is invisible.

[Prehistoricman]

It's always a good idea to stuff binaries into Audacity

I saw here that the beginning of the file is repeated near the end. The repeat starts at address 318B68.
I think this means the dump wasn't successful. I don't see any reason for them to program it like this. Along with the odd missing bits I saw in the sprites, I think it's quite likely that this software legitimately can't read this chip. Or it does work, but on a different setting?

[Noopy]

Very interesting and fascinating!   

But I´m suprised the dump seems to be corrupted.
I have chosen the W25Q32FV. The datasheets say F and J are standing for 32M-bit, no obvious difference but there are 100 pages.
Despite the Chip-ID everything looked good. The Galep HW/SW seems to be very robust. It checks connectivity and all sorts of things. But to be honest I´m not very familiar with this kind of stuff.

...

The Galep-Software showed me a Memory Map containing:
000000 - 3FFFFF Data
001000 - 0010FF SecReg1
002000 - 0020FF SecReg2
003000 - 0030FF SecReg3
400300 - 400302 Status Reg

Only the data was marked, so I marked the rest of the Adresses too.
Could that be a problem? ...but I don´t think so...

[Prehistoricman]

Yeah I agree. Maybe ask Galep about it? Seems like they might respond to emails.

[Noopy]

Yeah I agree. Maybe ask Galep about it? Seems like they might respond to emails.

Done! 
Let´s see what they have to say...

[Xenoamor]

It could be a golden image in case a firmware update fails? Seems unlikely though

[Noopy]

Seems not very likely in my view but thanks for your input. 

[Noopy]

Yeah I agree. Maybe ask Galep about it? Seems like they might respond to emails.

Done! 
Let´s see what they have to say...

No answer from this side till now... 

[Prehistoricman]

Done! 
Let´s see what they have to say...

No answer from this side till now... 

That's a damn shame. Maybe they have an extended Christmas break?
Do you have an Arduino or raspberry Pi? I bet someone has written a ready-to-go reader for this EEPROM.

By the way, I understand your reply, but the way you've written it sounds like you just got a response. You could instead say "No answer from them yet".

[Noopy]

No answer from this side till now... 

That's a damn shame. Maybe they have an extended Christmas break?
Do you have an Arduino or raspberry Pi? I bet someone has written a ready-to-go reader for this EEPROM.

Well perhaps next week...
No, I don´t have a Arduino or raspberry.
I have a STK500 and some 8Bit-Atmels but last time I tried to connect it to my computer it refuses to talk with the two USB-RS232-converter I have.
Lately I found a Pickit 3 in the trash. Perhaps it is still good. But I´ve never done anything with a Pickit...

By the way, I understand your reply, but the way you've written it sounds like you just got a response. You could instead say "No answer from them yet".

Thanks for the hint! I see your point! 

[LyndaMorrison]

NOTE: This message has been deleted by the forum moderator Simon for being against the forum rules and/or at the discretion of the moderator as being in the best interests of the forum community and the nature of the thread.
If you believe this to be in error, please contact the moderator involved.
An optional additional explanation is:

[Noopy]

I´m more related to hardware. I have put the data aside and now I´m doing even more hardware... 

[sd]

What happens if you start the device without the mistery IC or if you disconnect it after it's powered on?

[Noopy]

If I remember correctly without the mystery IC it didn´t start and disconnecting it made the console freeze. But since then more than three years are gone... 

[Bluefox]

Hi ive stumbled upon this after searching if anyone had already tried to RE the tchibo retro console, because i wanted to do the same.
Mine isnt the exact same model but pretty similar.
The electronics part isnt my speciality but the software part.
Ive seen you dumped the memory but as it seems those arent available anymore on the website (could you maybe upload them again )
I also dont have a memory reader at my hand but i have a arduino from another project.

Would be cool if this here could help my research 

[Noopy]

No problem! My 8x8TB RAID6 doesn´t forget anything... 

The data is attached here.

[Bluefox]

i tried opening mine but it think i accidentally broke it xD.
My version does not have any screws other than a single one for the battery cover, so i tried prying it open and i think i pushed the on switch away from the coord or broke the connector.
maybe ill fix it.
any tips on opening it?

my version: https://www.tchibo.de/products/402060588/retro-mini-spielekonsole

[Noopy]

Hard to say without having seen the mechanics of the housing. But now you know were there are the clips or whatever holds it together. Next time put the screwdriver at the right location. 

[Noopy]

I have some better pictures for everyone who is still interested in this game console and its ICs:




The Winbond 25Q32JV Flash
Full resolution: https://www.richis-lab.de/images/tcm_rg/22XL.jpg




The controller
Full resolution: https://www.richis-lab.de/images/tcm_rg/23XL.jpg




I still don´t know what controller that is.




Mask revisions






These are interesting fuses... 




And the strange "security" IC.
Full resolution: https://www.richis-lab.de/images/tcm_rg/26XL.jpg
I should delayer it... 




Some mask revisions.


https://www.richis-lab.de/tcm_rg.htm

 

[pcprogrammer]

My 2 cents worth on the mystery chip. It probably is a simple microcontroller that counts the clock pulses and returns an acknowledge at the right moment. In the code the console is running a call will be made to an interface that creates this clock signal and checks the return. If correct the game continues, if not it stops.

This reminds me of the early security dongles used by Xilinx to protect their Xact FPGA suite. It was a simple counter and I was able to fake this with a microcontroller. Later security dongles became more advanced and used encryption.

A bit late to the party, but a way to test if the signals from the mystery chip are in or out is to disconnect the pin that has the answer signal and check if it still gives the same result. The game will not start or continue of course.

On a side note, the pictures you provide are amazing. 

[Noopy]

My 2 cents worth on the mystery chip. It probably is a simple microcontroller that counts the clock pulses and returns an acknowledge at the right moment. In the code the console is running a call will be made to an interface that creates this clock signal and checks the return. If correct the game continues, if not it stops.

That´s possible. A very simple protection.

On a side note, the pictures you provide are amazing. 

Thank you!