Custom Controller for Elvis?

29 posts / 0 new
Last post
RetroPlayer
RetroPlayer's picture
Custom Controller for Elvis?

Late to the party, but just cracked open my Elvis head.

The ICESDA, ICESCK, and ICE lines on the J22 connector on the main board are for an I2C (3 wire) interface to the Analog to Digitial converter (Sonix SNAD01A) Which is an 8 channel 10-BIT ADC chip. All of the motor pots are connected to this. There is one in the head and one on the main board.

Any custom controller will need to be able to either communicate with this or replace it with something else.

There is a 512K Flash chip in the center of the controller. I will need to get an adapter for my eeprom programmer to dump the code. I imagine it is essentially a bootloader with the basic functions and some basic phrases you hear when you do not have a cart inserted.

The main processor is a sunplus chip on a COB board on the bottom side of the main board. All connections have huge test pads which would be awesome if we actually knew anything about it! There is also a very small grouping of three pins that look suspiciously like a serial port (TX, RX, and GND) I don't have time to mess with this anymore today, but I will attempt to probe it and talk to it if I can.

I would be very surprised if there wasn't some type of SPI port on this, which would allow talking to SD cards.

Anyway, whatever I do, I purchased a bluetooth serial module to put inside there with the intention of controlling him wirelessly.

They definitely made this head for hacking. But, GWJAX will likely beat me since he seems to know programming. I am an electronics guy mainly. I intend to design a replacement PCB as well, using an AVR or ARM. It really looks deceptively simple with all the labeling and modular design. You simply need logic level signals to control it.

GWJax, if you would like to coordinate our efforts, I am interested.

(Edited since this was moved from a different thread and the context was lost)

GWJax
GWJax's picture

Sure just pm me and i'll let you in on what I'm doing.

Jeff Block
Jeff Block's picture

Hey guys...

Sounds like you are both getting down to the nitty gritty.  That's when it gets fun!  Rather than sending PM's, why not post here where the rest of the community can benefit from your experiences?  Would love to be able to follow along, and I know others will too.

GWJax
GWJax's picture

Sure Jeff I have no problem with that. Thanks for making this thread. Indead this will help others out with understanding the Elvis and it's boards. GWJax

RetroPlayer
RetroPlayer's picture

Just popping in again for a minute.

Thanks Jeff for moving this thread!

I jumped the gun on the pin grouping looking like a serial port bit. I am absolutely convinced that there MUST be a serial port somewhere, but that wasn't it. So, I looked at the cartridge port and cartridge. The cartridge port is an 18 pin card-edge connector with just the basic signals.

Inside the cartridge is a 32M x8 NAND Flash chip (meaning reprogrammable!) NAND flash have the data and address lines on the same pins and rely on other control singals to address it. If you have ever written code to run a alphanumeric LCD display, you already know how to access this chip.

All 18 lines are traced out, which just happens to be the exact number of lines needed to fully control a NAND chip, including writing to it.

This particular chip has a unique feature called Auto-Read on power up. What this does is begin loading the read register with the first 528 bytes starting at zero. You then just toggle the RE line to get each byte.

Now assuming they didn't do something crazy like obscuring the data, it should be possible to read the code off the cartridge. If they did obscure the data, then a dump of the main flash which would have the NAND filesystem driver in it should tell us what they did.

The only drawback is that we don't know much about the sunplus chips, so the code might just look like noise. I am not going to let that discourage me from at least getting the dumps. The mere fact that they chose to use flash chips instead of masked ROM is simply too enticing not to waste some sweat on trying to figure it out.

So, my current goal is to dump both the cartridge and the main flash and probe the crap out of the main controller board to see if I can figure out the pinout and hopefully find a serial debug port or even just an unused HW serial port. GWJax is making good progress on a replacement controller, so I will just catch up with him on that later.

OK, back to (real) work for me!

GWJax
GWJax's picture

Hey guys if you want to see the data sheet for what was said above then download it from here

GWJax

GWJax
GWJax's picture

I just pin out the NAND Flash memory in the Elvis from the chip side up counting from left to right the pin layout is as follows for those who wish to use it further.:

pin1 - VSS

Pin2 - RB

pin3 - RE

Pin4 - CE

PIN5 - CLE

PIN6 - ALE

PIN7 - WE

PIN8 - VDD

PIN9 - VSS

PIN10 - I/O 9

PIN11 - I/O 2

PIN12 - I/O 10

PIN13 - I/O 3

PIN14 - I/O 12

PIN15 -I/O 5

PIN16 - I/O 13

PIN17 - I/O 6

PIN18 - VSS

Now here is a picture of it.

Nocturnal
Nocturnal's picture

Im curious how you determined the pin functions, particularly since the data/address lines are all over the place (relatively speaking), and if correct, probably unusable. !WP also seems to be missing.

Nocturnal
Nocturnal's picture

Ah, I see where you went wrong. You were looking at the 16bit version pinout, not the 8 bit version pin out.

pin 9 = I/0 0 
pin 10 = I/0 1 
pin 11 = I/0 2 
pin 12 = I/0 3 
pin 13 = I/0 4 
pin 14 = I/0 5 
pin 15 = I/0 6 
pin 16 = I/0 7 

The other signals look to be the same across both versions. 

Nocturnal
Nocturnal's picture

This is the actual datasheet for the chip pictured above.

GWJax
GWJax's picture

Thanks for the correction Nocturnal I was looking at the 16bit and not the 8bit. But at least I got someones attention!LOL I know I can alway cont on you Nocturnal to find my mistakes.Laughing

GWJax
GWJax's picture

Nocturnal One question if this is an 8bit and not a 16bit then why is the quote in the data sheet: for this is connected to the chip as stated below"

NOTE:


1. For x16 version only

2. A 0.1uF capacitor should be connected between the Vcc Supply Voltage pin and the Vss Ground pin to decouple

the current surges from the power supply. The PCB track widths must be sufficient to carry the currents required

during program and erase operations."

 

Nocturnal
Nocturnal's picture

If you have time, check if the !WP line is tied to ground. Is there anything on the underside of the board?

GWJax
GWJax's picture

Nocturnal said: Im curious how you determined the pin functions, particularly since the data/address lines are all over the place (relatively speaking), and if correct, probably unusable. !WP also seems to be missing.

The write protect (WP) is not connected to anything that I have found. Which i do not understand this either since the data sheet instructs you to groung this pin while turning on and off. I have no answer for this.

Nocturnal
Nocturnal's picture

The chip comes in 8 / 16 bit versions, which the datasheet reflects. Note 1 is linked to the I/O 8-15 lines in table 1.2. Note 2 is a general note for all versions.

The 16 bit version has a different model number (ie HY27US16561A instead of HY27US08561A). 

GWJax
GWJax's picture

GWJax said: Nocturnal One question if this is an 8bit and not a 16bit then why is the quote in the data sheet: for this is connected to the chip as stated below" NOTE:

1. For x16 version only

2. A 0.1uF capacitor should be connected between the Vcc Supply Voltage pin and the Vss Ground pin to decouple

the current surges from the power supply. The PCB track widths must be sufficient to carry the currents required

during program and erase operations."

 

never mind on this post it is an 8bit after taking a closer look at the part number. But why still the quote about the 16bit version only! With the 0.1uf cap

Nocturnal
Nocturnal's picture

Notice in the pin name field of the table

IO0-IO7
IO8-IO15(1)

Note 1 is tied specifically to the IO8-IO15 lines, which are only present (as the note states) in the 16 bit version. Note 2 is not tied to any specific item (that I can find) and so applies to all.

Nocturnal
Nocturnal's picture

GWJax said:

Nocturnal said: Im curious how you determined the pin functions, particularly since the data/address lines are all over the place (relatively speaking), and if correct, probably unusable. !WP also seems to be missing.

The write protect (WP) is not connected to anything that I have found. Which i do not understand this either since the data sheet instructs you to groung this pin while turning on and off. I have no answer for this.

I would be very surprised if this pin is floating.

GWJax
GWJax's picture

There's not much to check on this board let me check again.

GWJax
GWJax's picture

OK I found it! WP is connected to C2 on the board which is connected to ground. This makes sense.

RetroPlayer
RetroPlayer's picture

To clarify, !WP - which is pin 19 on the NAND Flash chip - is connected to VDD. So the chip is not write protected. I just verified this with my very unsteady hands (lack of sleep and lots of caffeine.)

I think we need an updated pinout since the one above was assumed on the 16bit model.

An important point should be made, though. Since this cart is NOT write protected, apparently, you should use caution if you hook it up to read it. I would ground this line through a 1.5K resistor on your reader assembly so that you do not corrupt it accidently. Also, note that the flash is 3.3V technology and it doesn't mention 5v tolerance.

If someone decides to read the chip out, be sure to use 3.3v logic to do it. While 5V will most likely work anyway (especially just reading,) there is some risk to it.

I ordered a few of these 18 pin edge connectors yesterday to build a proper reader/writer. But I am sure someone could hard-wire this up and read it out without them. Those connectors are 1/8" spacing, which looks about right, but I did not grab my micrometer to be sure.

BTW, an XD Picture card is just a standard 8-bit NAND flash interface, which (barring some unique feature of the chip being used) should connect directly to the cartridge port. I have not done anything with XD chips before, but the pinout is here. This obviously means a custom cartridge with an XD connector *should* be possible. Of course, assuming that anything on the original cartridge makes sense and someone figures out how to write custom code. The XD connectors are a little hard to find, so I would just buy a cheap USB reader and rip it out of one of those.

(P.S. it also means you *might* be able to read the cartridge with a USB XD adapter, which oddly enough, I do not have one to try it right now!)

Anyway, let's read out the cartridge before we get too far ahead of ourselves!

As you can see from my posting time, I work... ALOT! So, this will be a little slow going for me. Patience is a virtue they say, though.

RetroPlayer
RetroPlayer's picture

BTW, a cheap trick to figure out where power goes on something: Look for big polarized caps (the big yellow one in the middle of the cartridge for example) and this is likely the main filter cap going across VDD and VSS(ground.) Since it is polarized, you have your positive and gnd markings already and they will be direct connections to the main source.

RetroPlayer
RetroPlayer's picture

Corrected pinout:

From chip side up, connector on left, and pin 1 at the top:

1 VSS
2 IO7
3 IO6
4 IO5
5 IO4
6 IO3
7 IO2
8 IO1
9 IO0
10 VSS
11 VCC
12 WE*
13 ALE
14 CLE
15 CE*
16 RE*
17 R/B*
18 VSS

Notes:

1. Part is 3.3V logic. VCC is +3.3v and VSS is ground
2. WP* (Write Protect) is held high. Chip is not write protected
3. PRE (Power on auto-read) is left floating. This chip-specific feature is not being used

RetroPlayer
RetroPlayer's picture

I am designing a reader for this and a custom xD cart as we speak, so if anyone has the time to double and triple check these connections, any corrections would be appreciated.

Nocturnal
Nocturnal's picture

RetroPlayer said: Since this cart is NOT write protected, apparently, you should use caution if you hook it up to read it. I would ground this line through a 1.5K resistor on your reader assembly so that you do not corrupt it accidently.

Thats probably not necessary, in order to change any of the data, you have to write a specific sequence of bytes, which is not likely to happen accidentally (unless you do something stupid).

RetroPlayer
RetroPlayer's picture

Nocturnal,

You are right, and it wouldn't even be possible without modifying the cart. Consider it a blonde moment.

RetroPlayer
RetroPlayer's picture

Some other junk:

Looks like the Sunplus chip on the main controller is an audio CODEC chip used for sound playback and recording. Most likely just an ADPCM codec. This is then connected to a 16-bit stereo DAC chip and out to the speaker amp. This means audio is probably stored as something recognizable and probably compatible with windows PCs.

The CPU on the bottom of the main controller board has 108 pins. I am unable to match this up with any sunplus chip that I know of, so it is possible that it is not a sunplus processor at all. That was based on an assumption anyway.

It is probably an ASIC built on a more powerful core than sunplus provides (I don't see anything suitable by sunplus.) It could even be something crazy like an ARM based core.

RetroPlayer
RetroPlayer's picture

My time has unfortunately been spent on an entirely different project, but I received my 256MB xD picture card today and did a quick minute of research. Oddly, enough, the pinout for the xD and the Elvis cartridge are identical pin-for-pin, except in one case: Pin 1

On the Elvis cart, pin 1 is GND. On the xD card it is VCC (+3.3v)

Both the xD and the elvis cart are 3.3v and pin 10 (the only other difference) is VCC on the elvis cart and !write_protect on the xD card, which is fine as-is and will simply make the xD card non-write protected.

The width of the cards and pitch of the connectors are different as well, so no luck just plugging an xD card in, even if the pin 1 wasn't an issue. Anyway, this will make a xD cart a breeze. No wierd artwork needed to match up the pins!

Also, not sure if anyone here is already familiar with: http://mcu.sunplusmcu.com/ If you go into their download section, they have programming guides for their 8 and 16 bit processors and a free IDE (programming interface.) This might shine some light on reverse engineering the code once we snag it.

Keep in mind that there is no guarantee that the processor used in the elvis is a sunplus processor. I do not see a model made by them that matches up with what I see on the main board either in capability or number of pins. It could be an ASIC with a sunplus core or even something more powerful like an ARM7, which is actually used in alot of toys, including the mattel juicebox video player. Elvis is fairly complex and has a lot of stuff going on at once. I would expect a fairly powerful micro. I don't see anything from sunplus that is capable.

Oh, finally, those 18-pin connectors I ordered were WAY too big. I should've realized that, but I was in a hurry. Also, I haven't gotten my USB xD reader yet and haven't had time to throw something together to read the cards on a micro.

When I get the time to wire this all up, I will start poking at it with my logic analyser.

Later

P.S. Anyone know the name of the connectors they are using on the Elvis board? They look sort of like AMP MTA5 series, but I am not so sure.

RetroPlayer
RetroPlayer's picture

Cart connector is 1.27mm (.05") x 18 position. NOT an easy connector to find!