NES Classic Edition - Nintendo's own repro console

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

User avatar
koitsu
Posts: 4214
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: NES Classic Edition - Nintendo's own repro console

Post by koitsu » Fri Nov 11, 2016 11:35 am

Teardown details are now available (strongly suggest 2nd link, though it's all in Japanese, and is for the Famicom version, but likely share the same key/major internals):

http://www.nintendolife.com/news/2016/1 ... iny_system
http://mazu-bunkai.com/bunkai-wp/review/4313/

Summarised details:

* HDMI: Explore Microelectronics Inc. EP952
* CPU/GPU SoC: AllwinnerTech R16 -- ARM Cortex A7 4-core CPU, Mail400 dual-core GPU
* RAM: Hynix H5TQ2G63GFR -- 256MB DDR3 SDRAM
* Storage: Macronix MX30LF4G18AC -- 512MB SLC NAND flash
* Power management: X-Powers AXP223
* Famicom controller IC: no one's sure yet, but the silkscreening reads WCP 405 1634EM409

I don't see anything that resembles JTAG header solder points on either side of the PCB, so flash dumping would likely require chip desoldering.

I'm curious if the controllers are technically compatible with the original Famicom/NES. I mention this because one of the biggest issues going for speedrun people right now (who use real hardware) is that their joypads are wearing out -- rubber contact pads are starting to crack, etc., so everyone just goes around buying up other used controllers hoping they can create a working controller a la Frankenstein's monster.

lidnariq will likely appreciate the high resolution photos.

Edit: The AXP223 isn't for audio, it's for power management. Another badly-designed website resulting in confusion.
Last edited by koitsu on Fri Nov 11, 2016 1:41 pm, edited 1 time in total.

calima
Posts: 997
Joined: Tue Oct 06, 2015 10:16 am

Re: NES Classic Edition - Nintendo's own repro console

Post by calima » Fri Nov 11, 2016 11:42 am

512mb flash seems a wee bit overlarge.

User avatar
mikejmoffitt
Posts: 1348
Joined: Sun May 27, 2012 8:43 pm

Re: NES Classic Edition - Nintendo's own repro console

Post by mikejmoffitt » Fri Nov 11, 2016 11:53 am

koitsu wrote:I'm curious if the controllers are technically compatible with the original Famicom/NES. I mention this because one of the biggest issues going for speedrun people right now (who use real hardware) is that their joypads are wearing out -- rubber contact pads are starting to crack, etc., so everyone just goes around buying up other used controllers hoping they can create a working controller a la Frankenstein's monster.

I don't think they are electrically compatible, but I hope the pads, button, and shell can be used to refurbish an old controller. A new driver PCB could be created so no vintage parts are used in creating a Frankenstein's monster.

Great Hierophant
Posts: 743
Joined: Tue Nov 23, 2004 9:35 pm

Re: NES Classic Edition - Nintendo's own repro console

Post by Great Hierophant » Fri Nov 11, 2016 12:36 pm

This page seems to indicate that you can solder a UART to the board, http://linux-sunxi.org/Nintendo_NES_Classic_Edition. This gives one hope that you can use the debugger to reflash the chip.

The NES Classic Edition is similar to the Raspberry Pi 2 Model B. Perhaps RetroPie can be ported to the device and the Nestopia emulator included therein can give much more accurate emulation that Nintendo's own software.

User avatar
koitsu
Posts: 4214
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: NES Classic Edition - Nintendo's own repro console

Post by koitsu » Fri Nov 11, 2016 12:55 pm

Great Hierophant wrote:This page seems to indicate that you can solder a UART to the board, http://linux-sunxi.org/Nintendo_NES_Classic_Edition. This gives one hope that you can use the debugger to reflash the chip.

This is crappiest Wiki page I think I have ever seen in my life. Good grief. Absolutely worthless, other than "hidden gems" you can find: like how once wiring up the serial interface, pressing s toggles some particular debug output mode. Hilariously, no serial port parameters (speed, stop bits, parity) are disclosed there. I've used devices like this in enterprise environments (really!) before, where single-character commands on a serial port can literally make-or-break the device. My reaction every time: holy shit. Dangerous as hell.

The images depicting the GND, Tx, and Rx pins (love that there's no flow control too!) mentioned a website called http://emuonpsp.net/ , so I went there. It's a Japanese website for all sorts of weird modding. However, there's a blog-esque entry under 2016/11/10 (there are no links or id tags etc. which I can link to -- awesome) which describes all the necessary serial port details. There's also some command used to dump some part of the flash, but it's a bit vague/weird (I'd need to understand the Japanese).

Bratwurst
Posts: 23
Joined: Fri Jun 12, 2015 10:20 am

Re: NES Classic Edition - Nintendo's own repro console

Post by Bratwurst » Sat Nov 12, 2016 6:23 am

mikejmoffitt wrote:I don't think they are electrically compatible, but I hope the pads, button, and shell can be used to refurbish an old controller. A new driver PCB could be created so no vintage parts are used in creating a Frankenstein's monster.


Courtesy of Carey85 from Digital Press:

https://scontent-ort2-1.xx.fbcdn.net/t31.0-8/15003299_10206888671406580_8408959777565897946_o.jpg
https://scontent-ort2-1.xx.fbcdn.net/t31.0-8/15039569_10206888671366579_6781069187562823744_o.jpg

(I linked these rather than embedded because they are large)

It /looks/ like the plastic buttons/d-pad and rubber pieces are vaguely compatible with the original NES controller housings, if not exactly the same.

User avatar
Banshaku
Posts: 2323
Joined: Tue Jun 24, 2008 8:38 pm
Location: Fukuoka, Japan
Contact:

Re: NES Classic Edition - Nintendo's own repro console

Post by Banshaku » Sat Nov 12, 2016 9:29 am

@koitsu

my translation will be very raw but here it goes:

■クラシックミニ ファミコンのU-bootログを見てみる

Looking at classic mini famicom U-boot logs

というわけで本日11/10に発売になったクラシックミニファミコンを予定通りゲットしました。分解記事等々は
その他のページでやっているので、ツイッターで話題となっていたPCとシリアル通信するのをやってみることにしました。


So here it is on the 10 of November the classic mini famicom went on sale and I got the one I reserved.
Since on other pages (doesn't say which one) they are talking about dissasembly, we decided to check
how to communicate with serial from a PC after talking about that topic on twitter.

●用意したもの
(1)マルツUSBシリアルモジュール MPL2303SA
(2)クラシックミニファミコン
(3)PC
(4)TeraTerm(ソフトはなんでもOK)

* Things that were prepared
1) Multi-usb serial module MPL2303SA
2) Classic mini famicom
3) PC
4) TeraTerm(any software is fine)

●繋げてみる
海外サイトによると、UARTがそのまま出ている様子。@nvsoftsさんがTXのみを接続してログ見えたとのことで
早速やってみることにしてみました。

* Trying to connect
From an oversea site (meant not from japan), the UART appears to be out (I don't understand context in that case).
@nvsofts said with only connecting TX he saw the logs so right away I tried to check.

DSC09016_mod.JPG

接続は左からGND/TX/RX、となっているのでUSB-シリアル変換モジュールにそのまま入れます
(ファミコン側TXはRXへ、ファミコン側RXはTXへ接続)。

The connection from the left is GND/TX/RX, sp the serial-usb conversion module is inserted as is
(On the side of the famicom TX to RX, famicom side RX to TX connect)
Note: the part in the parentheses is not clear for me, I suck at particles ^^;;;
DSC09015.JPG

接続の全体図はこんな感じ。一応コントローラx2、電源ON/リセット用基板は接続します。

The overall connections looks like this. There is 2 controllers, the power on/reset are connected on the board.

●通信してみる
 
通信設定は下記のような感じです。
 
 ボーレート:115200baud
 データ:8bit
 パリティ:none
 ストップ:1bit
 フロー:無し
 
(1)PCとUSBシリアルモジュールを接続する
(2)ミニファミコンへ電源を供給する。すると、下記ログが表示されるはず
 
U-Boot 2011.09-rc1 (Aug 30 2016 - 12:07:36) Allwinner Technology

[ 0.218]version: 1.1.0
[ 0.220]uboot commit : 2f04d11e4dfd9d5022e33833412462859727bdcc

ready
no battery, limit to dc
no key input
dram_para_set start
dram_para_set end
Using default environment

In: Out: Err:
 
(3)コンソールに戻り、「S」キーを押しっぱなしにして、ミニファミコンの電源をONする
(4)するとオートブートを止めることが出来る
 
~省略~
cant find rcvy value
cant find fstbt value
no misc partition is found
to be run cmd=sunxi_flash phy_read 43800000 30 20;boota 43800000
WORK_MODE_BOOT
board_status_probe
[ 0.583]key trigger
[ 0.585]Hit any key to stop autoboot: 3 0
clover# 
 
(5)あとはコマンドを入れてみる

* Try to connect

Here's are the communication settings:

 baud rate:115200 baud
 data :8bit
 parity:none
 stop :1bit
 flow :none

1) connect PC to serial module
2) Power on the min famicom. The following logs should be shown:

U-Boot 2011.09-rc1 (Aug 30 2016 - 12:07:36) Allwinner Technology

[ 0.218]version: 1.1.0
[ 0.220]uboot commit : 2f04d11e4dfd9d5022e33833412462859727bdcc

ready
no battery, limit to dc
no key input
dram_para_set start
dram_para_set end
Using default environment

In: Out: Err:

3) Return to the console, press S as much as you can and turn on the mini famicom
4) You can now stop the auto-boot

- you can skip - (this part I'm not sure, it translate literally as "to omit")
cant find rcvy value
cant find fstbt value
no misc partition is found
to be run cmd=sunxi_flash phy_read 43800000 30 20;boota 43800000
WORK_MODE_BOOT
board_status_probe
[ 0.583]key trigger
[ 0.585]Hit any key to stop autoboot: 3 0
clover# 

5) You can try to insert commands after
●受け付けるコマンド
今のところubootで受け付けるコマンドは、下記のような感じです。ソース見てないのでアレですが、もっと
あるかも。
 
shutdown/reset/printenv/version/sunxi_flash/boota
 
通常のOSを起動させたいときは、下記コマンドを叩くと起動できました(通常起動と同様)
 
clover# sunxi_flash phy_read 43800000 30 20;boota 43800000

* Executed(?)/accepted commands

Here's are the commands that are currently possible. The source has not been check and was like "what?!" but
there should be more commands.

shutdown/reset/printenv/version/sunxi_flash/boota

When you want to execute the official OS, it was possible by writing the following command (same as official boot)

clover# sunxi_flash phy_read 43800000 30 20;boota 43800000

●その他
 リセットボタンを押しながら起動で、色々と出来るっぽいです。あとで試してみたいですね。

* Other
It is executed while pressing the reset button, a lot of things seems to be possible. I want to experiment later!


So this is my quick and dirty translation. Hope it will be useful. If we could find which site he was referencing to, we could have the explanation in something else than Japanese I guess.

User avatar
thefox
Posts: 3141
Joined: Mon Jan 03, 2005 10:36 am
Location: Tampere, Finland
Contact:

Re: NES Classic Edition - Nintendo's own repro console

Post by thefox » Sat Nov 12, 2016 10:02 am

Banshaku wrote:The connection from the left is GND/TX/RX, sp the serial-usb conversion module is inserted as is
(On the side of the famicom TX to RX, famicom side RX to TX connect)
Note: the part in the parentheses is not clear for me, I suck at particles ^^;;;

An educated guess: it's probably saying to connect the Famicom's TX to the RX of the other side, and vice versa (i.e. not TX to TX and RX to RX).
Download STREEMERZ for NES from fauxgame.com! — Some other stuff I've done: fo.aspekt.fi

Spork Schivago
Posts: 9
Joined: Sun Nov 13, 2016 12:46 pm

Re: NES Classic Edition - Nintendo's own repro console

Post by Spork Schivago » Sun Nov 13, 2016 12:53 pm

Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip? Here and on a Youtube tear down video, I see the flash listed as Macronix MX30LF4G18AC. But on other sites (including other Youtube tear down videos), I see it listed simply as a Spansion SLC NAND flash chip.

Historically, hasn't Macronix provided the flash based chips to Nintendo? Any ideas why so many websites report the NES Classic as having a Spansion SLC NAND flash chip instead of the Macronix?

Thanks.

User avatar
koitsu
Posts: 4214
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: NES Classic Edition - Nintendo's own repro console

Post by koitsu » Sun Nov 13, 2016 7:20 pm

Spork Schivago wrote:Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip?

Nintendo is going to use whichever vendor/manufacturer of flash chips that they can get at that moment in time. It's based on 1) availability, and 2) price. Pretty much every company does this in every product. It's common with DRAM, flash, and anything else that's "generic". There's nothing abnormal or "weird" about this; in other words, both reviewers are telling the truth.

So, why does the brand of flash chip matter to you?

Spork Schivago
Posts: 9
Joined: Sun Nov 13, 2016 12:46 pm

Re: NES Classic Edition - Nintendo's own repro console

Post by Spork Schivago » Sun Nov 13, 2016 8:23 pm

koitsu wrote:
Spork Schivago wrote:Could someone please confirm something for me? My sister ordered me an NES Classic but it's coming via mail and won't be here for a couple more days. Does the NES Classic have the Macronix MX30LF4G18AC NAND flash chip or does it have a Spansion NAND flash chip?

Nintendo is going to use whichever vendor/manufacturer of flash chips that they can get at that moment in time. It's based on 1) availability, and 2) price. Pretty much every company does this in every product. It's common with DRAM, flash, and anything else that's "generic". There's nothing abnormal or "weird" about this; in other words, both reviewers are telling the truth.

So, why does the brand of flash chip matter to you?

I was looking for a datasheet for the NAND. Every post that mentions the Macronix gives me the chip number, but every post that mentions the Spansion doesn't. I've asked people that had the posts that mention the Spansion for a chip number but they haven't been able to give me one yet. The ones with the Macronix, the pictures I've seen, are actually of the Japanese version. I was wondering if maybe the Japanese version had different flash chips.

Different NANDs have different pinouts and everything, right? I'd imagine they're not too compatible. I'd imagine the PCB would have to change a little for the different brands of NAND. Or am I wrong in that? If one NES Classic has a Spansion NAND chip and another has a Macronix, can a person just swap them? I would have thought they couldn't. I know with the PS3's, if you're going to switch NANDs, you need the same chip. There's a few different NAND chips for the PS3s but they're not compatible with the various boards.

It doesn't matter too much now anyways. Once my NES Classic comes (tomorrow or maybe the next day), I was going to maybe pull the NAND and try dumping it but it seems we can just dump it while it's still in the NES. We can also write to it while it's still in the NES as well, so there's no need for me to pull the chip.

Thanks for answering my question.

User avatar
koitsu
Posts: 4214
Joined: Sun Sep 19, 2004 9:28 pm
Location: A world gone mad

Re: NES Classic Edition - Nintendo's own repro console

Post by koitsu » Sun Nov 13, 2016 9:42 pm

Spork Schivago wrote:Different NANDs have different pinouts and everything, right? I'd imagine they're not too compatible.

"It depends". I would put my money on that the Spansion and Macronix are pin-compatible with each other. Otherwise this would require multiple PCB revisions designed by Nintendo and manufactured -- this costs more money. So, I would say it's more likely they're identical. The only way to know for sure is to review datasheets for both, assuming one can even find such. You may have to contact the chip manufacturers. If this is really something you're considering doing, then I strongly recommend you start that conversation with them now. Just ask politely for the datasheet for the specific model of chip used.

Spork Schivago wrote:It doesn't matter too much now anyways. Once my NES Classic comes (tomorrow or maybe the next day), I was going to maybe pull the NAND and try dumping it but it seems we can just dump it while it's still in the NES. We can also write to it while it's still in the NES as well, so there's no need for me to pull the chip.

As far as I can tell, the flash chip used is OTP, i.e. you won't be able to write to anything. Go right ahead and dump the thing using the serial/UART method -- I won't be surprised if a portion of it is encrypted.

tepples
Posts: 21706
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Re: NES Classic Edition - Nintendo's own repro console

Post by tepples » Sun Nov 13, 2016 9:49 pm

Is there a second flash memory used for the save state feature? If not, then the main flash cannot be OTP, though if it's like the DS firmware flash, perhaps only a certain number of sectors are writable.

User avatar
rainwarrior
Posts: 7636
Joined: Sun Jan 22, 2012 12:03 pm
Location: Canada
Contact:

Re: NES Classic Edition - Nintendo's own repro console

Post by rainwarrior » Sun Nov 13, 2016 10:21 pm

koitsu wrote:As far as I can tell, the flash chip used is OTP, i.e. you won't be able to write to anything. Go right ahead and dump the thing using the serial/UART method -- I won't be surprised if a portion of it is encrypted.

A user on #nesdev confirmed the other night that it's encrypted, but that same user also managed to decrypt it too.

Great Hierophant
Posts: 743
Joined: Tue Nov 23, 2004 9:35 pm

Re: NES Classic Edition - Nintendo's own repro console

Post by Great Hierophant » Sun Nov 13, 2016 11:50 pm

So if the flash cannot be rewritten except for a small portion needed for save states and configuration data, say 4MB of 512MB, then to really hack more than the save states, you would need to replace the flash chip on the mainboard. I bet someone will have succeeded in running some unauthorized code by this method by the new year.

Post Reply