I have this little chinese NES knockoff which has built in games that aren't obviously the originals for copyright reasons. I am not asking anyone for help with anything illegal, rom related etc.

I am new to playing with flash memory at a hardware level, and I'd like to learn how to dump the contents of these chips. There are 2 on a controller board of some sort called "M400X2-256A". Ideally I'd like to access the filesystem and change files, look at them etc to learn about it.

I have experience microsoldering, have a microscope, hot air, oscilloscope etc, and some general electronics knowledge, but I will be the first to admit I have a lot to learn. Hence asking these questions. But to give you an idea what I can maybe pull off, is why I posted that info.

Anyway thanks for your time and consideration!

Could we see the PCB?

BTW, a better forum for this type of question would be EEVblog.com or a forum that discusses arcade games, etc.

_________________
A backup a day keeps DR away.

Here you go, let me know if you need a closeup of anything and I'll post it tomorrow when I get back to work.

The part number is M36L0T705 and the manufacturer is STMicroelectronics.

I can't find any reference to it, but in any case you may be better off determining the pinout of the 47-pin memory module and working with that. To this end you would need to identify the CPU and hope that its pinout is in the public domain.

FWIW, the M36L0T704 is a 16384 Kb "flash chip" used in the Siemens DreamTeam A31 phone:

http://forum.gsmhosting.com/vbb/f360/dreamteam-a31-flash-error-whats-wrong-343104/

_________________
A backup a day keeps DR away.

There is a Google search result which suggests that this chip may be a combination of 128MB SDRAM and 32M flash memory:

http://www.odysseyelectronics.net/gsitemap4316.html

M36L0T704 -> 128M SDRAM + 16M flash
M36L0T705 -> 128M SDRAM + 32M flash
M36L0T706 -> 128M SDRAM + 64M flash

_________________
A backup a day keeps DR away.

_________________
A backup a day keeps DR away.

_________________
A backup a day keeps DR away.

just having a very quick look at this thread at work, and chips with address pins A0 - A22 could be CFI (common Flash Interface). Devices that can read it are things like the FlashCAT USB https://www.embeddedcomputers.net/products/FlashcatUSB/

definitely not regular NAND flash.

Ive tried a few times to read a CFI but not had success yet, there is not a lot of info about it. And looking for any homebrew CFI readers has came up with nothing so far.

I would be interested in the device, and getting one to hack on when time permits, and link to the thing?

any chance of full pics of all PCBs?

Here are pics of everything, and a link to the device (well nearly identical, the controllers are different.) I bought it from a wholesaler i deal with for $17.
https://www.amazon.ca/Handheld-Retro-Fa ... way&sr=8-4

I posted pictures of everything, and a link so you can see the product online. The message said awaiting approval though, probably due to the link? In the meantime you can search "620 games" on amazon and youll probably see it. just looks like an NES with 2 controllers, but tiny.

Sorry about the part number in the first post, you're right. It was an unfortunate typo.

I can't see the problem.

The datasheet says to disable the PSRAM. You could do that be holding its E2p pin low.

Then enable the flash memory by holding Ef low, Gf low, Wf high, RPf high.

Then drive Lf low to latch the address bus into the flash memory, and read its data on the data bus.

The only other signal pin of interest is WAITf which needs to specially configured, or you can simply try setting it high and low until you find which is the default.

_________________
A backup a day keeps DR away.

could you post top down pics of both sides of the board in the last photo showing the whole board, and cable out the way? I'm guessing this is the one with the memory board on it. I already suspected a blob controller. Shame I was right

Of course, here you go:
RE: the black snot on the processor, is there a good way to remove it besides hot air and pick at it? Is it worth trying?

Thanks a lot.
No there is no reason to remove the black crap, it is just there to protect the cpu or whatever is under there.
A method might be something like : http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno3-decapping-procedure.html

These are called COB for chip-on-board. Something like this:



if you need to hack it at that level, then it really starts to get interesting.

There may be other interfaces on the board, Serial port, JTAG etc.

I appreciate you looking, and your advice. But I'm still not really sure where to begin. Can you see any interfaces on that board? Without schematics which we'll never get, or something clearly labeled, I'm lost.

When I first opened it, I was hoping with all the easy to reach connectors on that memory module, it would be simple to solder a few wires and somehow pull the data off, but it doesn't seem like that is going to be the case.

Do you have any suggestions, or should I let it go, do you think?

AISI, there is no easy way to determine the correspondence between the edge connections of the memory module and the balls of the BGA memory ICs. I was relying on the CPU's pinout to help us in this regard, but you can't get much info out of a blob.

_________________
A backup a day keeps DR away.

Being not sure where to begin in cases like this where there is no clear serial port, JTAG or easily identified controller is normal, so currently you are on the right track!

As Franc said, not having access to CPU pinout or any markings does present a stumbling block. But what you do have is a nice open board with the ability to easily probe it and solder around if need be.

The 4 pads in between CPU and crystal Osc could be something, or could be nothing! interesting the crystal is same frequency as original NES, not a common part to find these days!

The memory board interests me, as it HAS to be a kind of drop-in part from somewhere that gets used on other devices or different variations of devices like this, otherwise they would just create a mainboard to hold the memory chips directly. Also, I am not sure of the age of this product, but the memory chip technology looks rather old. memory such as this was popular for things that used files/data straight off the chip, rather than something like NAND where it would be read from the chip but then converted straight to files or sent to RAM or needed to work through something like a flash controller (USB flash drives for example). common uses were early cell phone memory, bootloaders for embedded systems etc.

I seriously doubt any type of protection to hacking.

I have a few different FlashCats that are supposed to read CFI chips. Hopefully the unit I bought is similar to yours, ad was slighly different but essentially details look the same.

What I normally do in situations where you need to strip things apart is just buy another unit to take chips off and map, then you still have a complete unit to run test on when you conjure up theories.

The crystal frequency (21.47727 MHz) is 6 times the NTSC TV frequency (3.579545 MHz). That's why it's an odd one.

I notice that the T2 and T0 versions of these memory chips require 1.8Vcore and 3Vio. Their organisation is 8M x 16 which requires 23 address bits and 16 data bits. The module has 47 pins (plus ground?), so that leaves only 4 or 5 pins for chip selects, etc.

_________________
A backup a day keeps DR away.

some of these chips only use 8 DQ's for flash

the forums at https://forums.nesdev.com/ have a wealth of information. I am looking at one particular post where OP dumps a NOR: https://forums.nesdev.com/viewtopic.php?f=9&t=18652
he is rather sparse with the details and setup used to dump it, but over here: https://www.reddit.com/r/retrogaming/comments/ad8z2n/retro_fc_q3_clone_teardown/ he says he used a FlashCatUSB:





There is probably much more at the forum and also the IRC channels mentioned that would be useful.

Also, this may dump it: http://xmonstermodsx.freeforums.net/thread/6/progskeet-downgrade-guide

When I get mine I can test with my Saleae Logic analyser and see if those 4 pads are anything. I don't think the chips will be hard to dump with a little research.

I collected a folder of info today that may have something amongst it to help.

Thanks for the reassurance

The memory chip IS used for other things, if you google the silkscreened number on it's pcb, and image search I came across an arcade cabinet of some sort someone was showing, it had the same board in it stuck on like this one. I was trying to identify it hoping it would be a common thing people have hacked before, but I guess you're going to be on the cutting edge on this one.

You're very kind to be purchasing things to research and help me out, it is above and beyond. I feel a little bad, I would have mailed you one.. but it is much appreciated, thank you.

I wish I knew half of what you guys do, but I'm trying to learn slowly but surely.