It is currently Sun Apr 30, 2017 3:57 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 117 posts ]  Go to page Previous  1 ... 3, 4, 5, 6, 7, 8  Next
Author Message
PostPosted: Fri Nov 11, 2016 11:35 am 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Teardown details are now available (strongly suggest 2nd link, though it's all in Japanese, and is for the Famicom version, but likely share the same key/major internals):

http://www.nintendolife.com/news/2016/1 ... iny_system
http://mazu-bunkai.com/bunkai-wp/review/4313/

Summarised details:

* HDMI: Explore Microelectronics Inc. EP952
* CPU/GPU SoC: AllwinnerTech R16 -- ARM Cortex A7 4-core CPU, Mail400 dual-core GPU
* RAM: Hynix H5TQ2G63GFR -- 256MB DDR3 SDRAM
* Storage: Macronix MX30LF4G18AC -- 512MB SLC NAND flash
* Power management: X-Powers AXP223
* Famicom controller IC: no one's sure yet, but the silkscreening reads WCP 405 1634EM409

I don't see anything that resembles JTAG header solder points on either side of the PCB, so flash dumping would likely require chip desoldering.

I'm curious if the controllers are technically compatible with the original Famicom/NES. I mention this because one of the biggest issues going for speedrun people right now (who use real hardware) is that their joypads are wearing out -- rubber contact pads are starting to crack, etc., so everyone just goes around buying up other used controllers hoping they can create a working controller a la Frankenstein's monster.

lidnariq will likely appreciate the high resolution photos.

Edit: The AXP223 isn't for audio, it's for power management. Another badly-designed website resulting in confusion.


Last edited by koitsu on Fri Nov 11, 2016 1:41 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Fri Nov 11, 2016 11:42 am 
Offline

Joined: Tue Oct 06, 2015 10:16 am
Posts: 391
512mb flash seems a wee bit overlarge.


Top
 Profile  
 
PostPosted: Fri Nov 11, 2016 11:53 am 
Offline
User avatar

Joined: Sun May 27, 2012 8:43 pm
Posts: 1217
koitsu wrote:
I'm curious if the controllers are technically compatible with the original Famicom/NES. I mention this because one of the biggest issues going for speedrun people right now (who use real hardware) is that their joypads are wearing out -- rubber contact pads are starting to crack, etc., so everyone just goes around buying up other used controllers hoping they can create a working controller a la Frankenstein's monster.

I don't think they are electrically compatible, but I hope the pads, button, and shell can be used to refurbish an old controller. A new driver PCB could be created so no vintage parts are used in creating a Frankenstein's monster.


Top
 Profile  
 
PostPosted: Fri Nov 11, 2016 12:36 pm 
Offline

Joined: Tue Nov 23, 2004 9:35 pm
Posts: 567
This page seems to indicate that you can solder a UART to the board, http://linux-sunxi.org/Nintendo_NES_Classic_Edition. This gives one hope that you can use the debugger to reflash the chip.

The NES Classic Edition is similar to the Raspberry Pi 2 Model B. Perhaps RetroPie can be ported to the device and the Nestopia emulator included therein can give much more accurate emulation that Nintendo's own software.

_________________
Nerdly Pleasures - My Vintage Video Game & Computing Blog


Top
 Profile  
 
PostPosted: Fri Nov 11, 2016 12:55 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Great Hierophant wrote:
This page seems to indicate that you can solder a UART to the board, http://linux-sunxi.org/Nintendo_NES_Classic_Edition. This gives one hope that you can use the debugger to reflash the chip.

This is crappiest Wiki page I think I have ever seen in my life. Good grief. Absolutely worthless, other than "hidden gems" you can find: like how once wiring up the serial interface, pressing s toggles some particular debug output mode. Hilariously, no serial port parameters (speed, stop bits, parity) are disclosed there. I've used devices like this in enterprise environments (really!) before, where single-character commands on a serial port can literally make-or-break the device. My reaction every time: holy shit. Dangerous as hell.

The images depicting the GND, Tx, and Rx pins (love that there's no flow control too!) mentioned a website called http://emuonpsp.net/ , so I went there. It's a Japanese website for all sorts of weird modding. However, there's a blog-esque entry under 2016/11/10 (there are no links or id tags etc. which I can link to -- awesome) which describes all the necessary serial port details. There's also some command used to dump some part of the flash, but it's a bit vague/weird (I'd need to understand the Japanese).


Top
 Profile  
 
PostPosted: Sat Nov 12, 2016 6:23 am 
Offline

Joined: Fri Jun 12, 2015 10:20 am
Posts: 19
mikejmoffitt wrote:
I don't think they are electrically compatible, but I hope the pads, button, and shell can be used to refurbish an old controller. A new driver PCB could be created so no vintage parts are used in creating a Frankenstein's monster.


Courtesy of Carey85 from Digital Press:

https://scontent-ort2-1.xx.fbcdn.net/t31.0-8/15003299_10206888671406580_8408959777565897946_o.jpg
https://scontent-ort2-1.xx.fbcdn.net/t31.0-8/15039569_10206888671366579_6781069187562823744_o.jpg

(I linked these rather than embedded because they are large)

It /looks/ like the plastic buttons/d-pad and rubber pieces are vaguely compatible with the original NES controller housings, if not exactly the same.


Top
 Profile  
 
PostPosted: Sat Nov 12, 2016 9:29 am 
Offline
User avatar

Joined: Tue Jun 24, 2008 8:38 pm
Posts: 1499
Location: Fukuoka, Japan
@koitsu

my translation will be very raw but here it goes:

Quote:
■クラシックミニ ファミコンのU-bootログを見てみる

Looking at classic mini famicom U-boot logs

Quote:
というわけで本日11/10に発売になったクラシックミニファミコンを予定通りゲットしました。分解記事等々は
その他のページでやっているので、ツイッターで話題となっていたPCとシリアル通信するのをやってみることにしました。


So here it is on the 10 of November the classic mini famicom went on sale and I got the one I reserved.
Since on other pages (doesn't say which one) they are talking about dissasembly, we decided to check
how to communicate with serial from a PC after talking about that topic on twitter.

Quote:
●用意したもの
(1)マルツUSBシリアルモジュール MPL2303SA
(2)クラシックミニファミコン
(3)PC
(4)TeraTerm(ソフトはなんでもOK)

* Things that were prepared
1) Multi-usb serial module MPL2303SA
2) Classic mini famicom
3) PC
4) TeraTerm(any software is fine)

Quote:
●繋げてみる
海外サイトによると、UARTがそのまま出ている様子。@nvsoftsさんがTXのみを接続してログ見えたとのことで
早速やってみることにしてみました。

* Trying to connect
From an oversea site (meant not from japan), the UART appears to be out (I don't understand context in that case).
@nvsofts said with only connecting TX he saw the logs so right away I tried to check.

Attachment:
DSC09016_mod.JPG
DSC09016_mod.JPG [ 74.94 KiB | Viewed 1272 times ]

Quote:
接続は左からGND/TX/RX、となっているのでUSB-シリアル変換モジュールにそのまま入れます
(ファミコン側TXはRXへ、ファミコン側RXはTXへ接続)。

The connection from the left is GND/TX/RX, sp the serial-usb conversion module is inserted as is
(On the side of the famicom TX to RX, famicom side RX to TX connect)
Note: the part in the parentheses is not clear for me, I suck at particles ^^;;;
Attachment:
DSC09015.JPG
DSC09015.JPG [ 57.75 KiB | Viewed 1272 times ]

Quote:
接続の全体図はこんな感じ。一応コントローラx2、電源ON/リセット用基板は接続します。

The overall connections looks like this. There is 2 controllers, the power on/reset are connected on the board.

Quote:
●通信してみる
 
通信設定は下記のような感じです。
 
 ボーレート:115200baud
 データ:8bit
 パリティ:none
 ストップ:1bit
 フロー:無し
 
(1)PCとUSBシリアルモジュールを接続する
(2)ミニファミコンへ電源を供給する。すると、下記ログが表示されるはず
 
U-Boot 2011.09-rc1 (Aug 30 2016 - 12:07:36) Allwinner Technology

[ 0.218]version: 1.1.0
[ 0.220]uboot commit : 2f04d11e4dfd9d5022e33833412462859727bdcc

ready
no battery, limit to dc
no key input
dram_para_set start
dram_para_set end
Using default environment

In: Out: Err:
 
(3)コンソールに戻り、「S」キーを押しっぱなしにして、ミニファミコンの電源をONする
(4)するとオートブートを止めることが出来る
 
~省略~
cant find rcvy value
cant find fstbt value
no misc partition is found
to be run cmd=sunxi_flash phy_read 43800000 30 20;boota 43800000
WORK_MODE_BOOT
board_status_probe
[ 0.583]key trigger
[ 0.585]Hit any key to stop autoboot: 3 0
clover# 
 
(5)あとはコマンドを入れてみる

* Try to connect

Here's are the communication settings:

 baud rate:115200 baud
 data :8bit
 parity:none
 stop :1bit
 flow :none

1) connect PC to serial module
2) Power on the min famicom. The following logs should be shown:

U-Boot 2011.09-rc1 (Aug 30 2016 - 12:07:36) Allwinner Technology

[ 0.218]version: 1.1.0
[ 0.220]uboot commit : 2f04d11e4dfd9d5022e33833412462859727bdcc

ready
no battery, limit to dc
no key input
dram_para_set start
dram_para_set end
Using default environment

In: Out: Err:

3) Return to the console, press S as much as you can and turn on the mini famicom
4) You can now stop the auto-boot

- you can skip - (this part I'm not sure, it translate literally as "to omit")
cant find rcvy value
cant find fstbt value
no misc partition is found
to be run cmd=sunxi_flash phy_read 43800000 30 20;boota 43800000
WORK_MODE_BOOT
board_status_probe
[ 0.583]key trigger
[ 0.585]Hit any key to stop autoboot: 3 0
clover# 

5) You can try to insert commands after
Quote:
●受け付けるコマンド
今のところubootで受け付けるコマンドは、下記のような感じです。ソース見てないのでアレですが、もっと
あるかも。
 
shutdown/reset/printenv/version/sunxi_flash/boota
 
通常のOSを起動させたいときは、下記コマンドを叩くと起動できました(通常起動と同様)
 
clover# sunxi_flash phy_read 43800000 30 20;boota 43800000

* Executed(?)/accepted commands

Here's are the commands that are currently possible. The source has not been check and was like "what?!" but
there should be more commands.

shutdown/reset/printenv/version/sunxi_flash/boota

When you want to execute the official OS, it was possible by writing the following command (same as official boot)

clover# sunxi_flash phy_read 43800000 30 20;boota 43800000

Quote:
●その他
 リセットボタンを押しながら起動で、色々と出来るっぽいです。あとで試してみたいですね。

* Other
It is executed while pressing the reset button, a lot of things seems to be possible. I want to experiment later!


So this is my quick and dirty translation. Hope it will be useful. If we could find which site he was referencing to, we could have the explanation in something else than Japanese I guess.


Top
 Profile  
 
PostPosted: Sat Nov 12, 2016 10:02 am 
Offline
User avatar

Joined: Mon Jan 03, 2005 10:36 am
Posts: 2806
Location: Tampere, Finland
Banshaku wrote:
The connection from the left is GND/TX/RX, sp the serial-usb conversion module is inserted as is
(On the side of the famicom TX to RX, famicom side RX to TX connect)
Note: the part in the parentheses is not clear for me, I suck at particles ^^;;;

An educated guess: it's probably saying to connect the Famicom's TX to the RX of the other side, and vice versa (i.e. not TX to TX and RX to RX).

_________________
Download STREEMERZ for NES from fauxgame.com! — Some other stuff I've done: kkfos.aspekt.fi


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 12:53 pm 
Offline

Joined: Sun Nov 13, 2016 12:46 pm
Posts: 9
Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip? Here and on a Youtube tear down video, I see the flash listed as Macronix MX30LF4G18AC. But on other sites (including other Youtube tear down videos), I see it listed simply as a Spansion SLC NAND flash chip.

Historically, hasn't Macronix provided the flash based chips to Nintendo? Any ideas why so many websites report the NES Classic as having a Spansion SLC NAND flash chip instead of the Macronix?

Thanks.


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 7:20 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Spork Schivago wrote:
Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip?

Nintendo is going to use whichever vendor/manufacturer of flash chips that they can get at that moment in time. It's based on 1) availability, and 2) price. Pretty much every company does this in every product. It's common with DRAM, flash, and anything else that's "generic". There's nothing abnormal or "weird" about this; in other words, both reviewers are telling the truth.

So, why does the brand of flash chip matter to you?


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 8:23 pm 
Offline

Joined: Sun Nov 13, 2016 12:46 pm
Posts: 9
koitsu wrote:
Spork Schivago wrote:
Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip?

Nintendo is going to use whichever vendor/manufacturer of flash chips that they can get at that moment in time. It's based on 1) availability, and 2) price. Pretty much every company does this in every product. It's common with DRAM, flash, and anything else that's "generic". There's nothing abnormal or "weird" about this; in other words, both reviewers are telling the truth.

So, why does the brand of flash chip matter to you?

I was looking for a datasheet for the NAND. Every post that mentions the Macronix gives me the chip number, but every post that mentions the Spansion doesn't. I've asked people that had the posts that mention the Spansion for a chip number but they haven't been able to give me one yet. The ones with the Macronix, the pictures I've seen, are actually of the Japanese version. I was wondering if maybe the Japanese version had different flash chips.

Different NANDs have different pinouts and everything, right? I'd imagine they're not too compatible. I'd imagine the PCB would have to change a little for the different brands of NAND. Or am I wrong in that? If one NES Classic has a Spansion NAND chip and another has a Macronix, can a person just swap them? I would have thought they couldn't. I know with the PS3's, if you're going to switch NANDs, you need the same chip. There's a few different NAND chips for the PS3s but they're not compatible with the various boards.

It doesn't matter too much now anyways. Once my NES Classic comes (tomorrow or maybe the next day), I was going to maybe pull the NAND and try dumping it but it seems we can just dump it while it's still in the NES. We can also write to it while it's still in the NES as well, so there's no need for me to pull the chip.

Thanks for answering my question.


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 9:42 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 3192
Location: Mountain View, CA, USA
Spork Schivago wrote:
Different NANDs have different pinouts and everything, right? I'd imagine they're not too compatible.

"It depends". I would put my money on that the Spansion and Macronix are pin-compatible with each other. Otherwise this would require multiple PCB revisions designed by Nintendo and manufactured -- this costs more money. So, I would say it's more likely they're identical. The only way to know for sure is to review datasheets for both, assuming one can even find such. You may have to contact the chip manufacturers. If this is really something you're considering doing, then I strongly recommend you start that conversation with them now. Just ask politely for the datasheet for the specific model of chip used.

Spork Schivago wrote:
It doesn't matter too much now anyways. Once my NES Classic comes (tomorrow or maybe the next day), I was going to maybe pull the NAND and try dumping it but it seems we can just dump it while it's still in the NES. We can also write to it while it's still in the NES as well, so there's no need for me to pull the chip.

As far as I can tell, the flash chip used is OTP, i.e. you won't be able to write to anything. Go right ahead and dump the thing using the serial/UART method -- I won't be surprised if a portion of it is encrypted.


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 9:49 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 18216
Location: NE Indiana, USA (NTSC)
Is there a second flash memory used for the save state feature? If not, then the main flash cannot be OTP, though if it's like the DS firmware flash, perhaps only a certain number of sectors are writable.


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 10:21 pm 
Offline
User avatar

Joined: Sun Jan 22, 2012 12:03 pm
Posts: 5047
Location: Canada
koitsu wrote:
As far as I can tell, the flash chip used is OTP, i.e. you won't be able to write to anything. Go right ahead and dump the thing using the serial/UART method -- I won't be surprised if a portion of it is encrypted.

A user on #nesdev confirmed the other night that it's encrypted, but that same user also managed to decrypt it too.


Top
 Profile  
 
PostPosted: Sun Nov 13, 2016 11:50 pm 
Offline

Joined: Tue Nov 23, 2004 9:35 pm
Posts: 567
So if the flash cannot be rewritten except for a small portion needed for save states and configuration data, say 4MB of 512MB, then to really hack more than the save states, you would need to replace the flash chip on the mainboard. I bet someone will have succeeded in running some unauthorized code by this method by the new year.

_________________
Nerdly Pleasures - My Vintage Video Game & Computing Blog


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 117 posts ]  Go to page Previous  1 ... 3, 4, 5, 6, 7, 8  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group