Following up from my previous posts on this, looks like my idea’s are correct about the size of the NAND for setup, and my NAND read stuff works. Yay for me.
JZ4755 boot sequence is as follows:
CPU powers up.
Checks BOOT_SEL line, takes appropriate action.
01 Initialization via USB port: Receives a block of data through the USB (device) port,
and stores it in internal SRAM.
10 Initialization via NAND memory with 512-byte pages at Chip Select 1 (CS1):
11 Initialization via NAND memory with 2048-byte pages at Chip Select 1 (CS1):
In our board, if we press BOOT, this pulls the pin low, so CPU see’s 01, and waits for an IPL from USB.
If we leave it to boot normally, then it reads from NAND.
So far so good.
Lets see if anyone was watching carefully
Our board NAND chip has a page size of 8192+OOB
Our *CPU Hardware* supports either 512bytes or 2048bytes page size on boot.
Our IPL (aka NAND.BIN) must be 8K in size or less, as the CPU has 8k only, and it copies the bootloader to that obeying BOOT_SEL.
Lets look at what happens.
If I read out the NAND (NREAD 0 8192 0 0) with our carefully set sizing, I see the following:
0000 - 2047 (2k in size) - DATA FF 55 55 .. 02 00 0C
2048 - 2549 (512bytes in size) - BLANK
2560 - 4607 (2k in size) - DATA (padded at end with FF's to 2k size) 21 20 00 .. 85 8c 90+ FF -> 2048 end
4608 - 6655 (2k in size) - DATA (padded at end with FF's to 2k size)
So, we have roughly about 6k odd of data, out of our 8k max. Its a bit weirdly laid out though, and has some holes in there, so its _not_ correct
Lets look at the RAW NAND DUMP (NREAD_RAW 0 8192 0 0). Our raw page size is 8192.
00000 - 02047 (2k in size) - DATA FF 55 55 .. 02 00 0C (same as before)
02048 - 02102 (55 bytes) - (presumed OOB / ECC stuff...) NEW
08192 - 10239 (2k in size) - DATA 21 20 00 .. 10 80 00. Our 85 8c 90 above is actually part of the 55byte sequence, so definitely our NREAD is incorrect, as we're suddenly short data.
10240 - 10294 (55 bytes ) - (presumed OOB / ECC stuff...) NEW
16384 - 18431 (2k in size) - DATA (padded with 0's from 17892 - 18431), so our NAND loader data is roughly 5.5KBish.
18432 - 18486 (55 bytes ) - (presumed OOB / ECC stuff...) NEW
25026 onwards FF's - so uninitialized.
So, with that, we know that NREAD doesn’t quite work for our first 4 pages (page 0 – 3), and we either need to NREAD_RAW, or possibly use a 2048byte page size in order to read the NAND.BIN properly.
Thats only necessary for the first 4 pages in the NAND though.
Once the NAND.BIN MINIOS bootstrap is running, it should be able to cope with our proper data size.
How does it do that though?
MINIOS Bootloader starts up, as it gets added to the CPU boot sequence detailed above, then it looks for 3 things in 3 places
Our mystery locations for that are:
Page 61 contains our NAND size stuff, which as we know from above, our Bootloader *can’t* use, as its only 2k or 512byte set at the hardware level initially.
Page 61 in mine has 12 bytes. This looks exceedingly good as I know that my work is, er, working
USBBoot :> nreadraw 61 24 0 0
Reading RAW from No.0 device No.0 flash....
0x00000000 :00 20 00 00 c0 01 00 00 00 01 00 00
00 20 00 00 = 8192 PAGE SIZE
c0 01 00 00 = 448 OOBSIZE
00 01 00 00 = 256 PAGE PER BLOCK
Lets look at the 3 bytes.
First 16bit word is = 8192 – thats our Page Size
Second 16bit word is = 448 – thats our OOB size (oob = out of block, usually used for CRC or Error etc, as NAND can go BAD if you write to it frequently)
Third 16bit word is = 256 – thats how many pages per block we have.
Block 61, and Block 62 are the same. Basically 62 is a backup of 61. If the NAND.BIN MINIOS loader can’t read Block 61 12 bytes, it tries Block 62. If neither work, you’ll need to reflash, or replace the NAND…
Block 63 contains a whole 10 bytes. This is the UID of the device. Mine is set to 0. Lazy buggers
Ok, so now we booted, and the MINIOS bootstraploader / NAND.BIN has read our NAND size, then what?
Well, you’ll need to disassemble the code to see (eg as part of my previous post), but essentially it calls the next thing in line.
This can be Linux, or something else. In the board, the OS used is MINIOS, so it loads something else – aka MINIOS.
MINIOS is actually uCOS-II – You can find details on that from Micrium, as they licence it out.
Ingenic has a custom version of uCOS-II for their board. uCOS-II is also a RTOS (Real Time OS).
You can read more on MINIOS here – http://en.wikipedia.org/wiki/MicroC/OS-II
Anyway, lets get back to work, and less chatter
NAND.BIN passes control onto whatever is sitting at Page 128 (this can be changed, but in the JAMMA board, and in the GameBox GBX-0001), the next loader is at Page 128.
As I don’t have much info on the MINIOS side, I got a lot of this info from other places. Mostly the MINIOS_CFG.INI in the Ingenic FTP Site, plus some gracious help from Joseba Epalza (thanks!) at www.zonadepruebas.com. He supplied a Gamebox dump, and asked me a few questions, which made me re-examine things, which was extremely useful as then I could bounce idea’s and findings off of someone else.
The Gamebox hardware and the Jamma hardware is extremely similar, so the NAND dump in both is good for both of us to double check each others work. Unfortunately, I don’t speak
Portuguese Spanish, so we both relied on Google Translate to talk via email today, but we seem to be doing ok
Onto the tech side again, our secondary loader is, in MINIOS terms, called LOADER.BIN
This sits at Page 128
LOADER.BIN tries to read a file called DEF_BOOT.BIN for configuration settings, as that tells LOADER.BIN where the rest of the filesystem is!
In theory, Page 256 contains
I need to go back and recheck that now, as my dumps are a bit messy, and I need to check on actual hardware, vs the many whoops I renamed that wrong files I now have messing up my desktop.
I also need to check if I need to read as 2k block size/or raw to get the correct data in these pages, as one place online says that the secondary bootloader (LOADER.BIN) also assumes 2k size.
IMG_BOOT.BIN – bootup code if used.
MINIOS.BIN – the OS.
RES.BIN – Resources used by MINIOS.BIN
The rest… (FAT16 Filesystem which is readable over USB via normal boot)
Ignoring my first 8k not quite correct dumped dumps + possibly borked secondary loader stuff, the rest of the data dump looks accurate.
I have what looks like RES.BIN stuff, I have a MINIOS, and I can see interesting things.
Interesting things below:
Dump pos 0x100200 - seems to have the RES.BIN filesystem in mine -
AudioTag.bin <-- significant, means case sensitive
desktoplib_tradition.bin <- chinese traditional
So, I know that that part is correct at least, as it really truly looks like proper data
Other things of note.
Our FAT part of the NAND, that is USB accessible is referred to internally as nfl: (Nand FLash I expect).
Looks like our loader looks for these files in the user side:
Filename strings are NULL terminated.
There is also this:
This seems to be our mapping of game.zip -> proper name file (having taken a look at that).
Which, is why when I added FBANext compatible stuff to the user FS, it complained that it was garbage, but still worked. Lazy lazy lazy hardcoded file list, tsk tsk.
Other other observations -
I was wrong on my guess about DMENU - its actually the bog standard uCOS-II File System dialog in use.
I was wrong about FBANext being used, it looks more like FBAPlus PSP was used, and our version still has the Exit to PSP dialog still in there, as well as the menu options for the framerate etc. I guess I need to see how to bring that up, as that *is* useful!
Mine says JZ4740 1.0sp1 Nov 19 2011 in the ROM. Guess codebase for MINIOS is JZ4740 based?
Lastly, and even more useful, there apparently is a Mini console - Mini CONSOLE V1.0
I need to see how to setup access, as that looks quite interesting...
Guess I need to see if I can get the Ingenic RTOS/uCOS-II stuff, unfortunately their FTP site has it, but the RAR file is broken, so it doesn't unrar completely. This means we're missing all of the good bits that we need for reference. I can give them a call Monday though, and see if they'd be interested in helping me out.
Pretty good progress though
Good reference on this:
http://micrium.com/page/downloads/ports/mips_technologies - MiniOS Mips code. Useful more for how MINIOS does its stuff, than relevance to us.
http://forum.arcadecontrols.com/index.php?topic=108550 - The thread where I've been posting other findings on this.
5 Comments to “JZ4755 Jamma Board Reverse Engineering Part 3 (King of Game Board)”
- May 2013
- April 2013
- March 2013
- January 2013
- December 2012
- October 2012
- August 2012
- July 2012
- June 2012
- May 2012
- April 2012
- March 2012
- December 2011
- November 2011
- October 2011
- September 2011
- July 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- Arcade Machines
- China Related
- Cool Hunting
- General Talk
- IP Cam
- Service Issues
- Tao Bao
- Technical Mumbo Jumbo
- Things that will get me censored
- Useful Info
Most Popular Posts
- IPCam Hacking - pt#2 (12374)
- 138 in 1 Jamma PCB with SD Card (XinYe Arm Jamma Board) - Quick file system firmware reversing engineering notes (11243)
- JZ4755 Jamma Board Reverse Engineering Part 3 (King of Game Board) (7020)
- Samsung N310 (Samsung Go) Hackintosh Installation on Snow Leopard (5618)
- BMW Keys and Transponders E36 E38 E46 etc (EWS2) (3617)
- Lawrence: Here’s a walkthrough for someone who did a legal registration of a new bike a few years ago –...
- Lawrence Sheed: I don’t have on of the boards; all the work I did on the firmware is in the post. There is...
- Brodie Mosen NZ: Hey, I know this is old but I have one of these boards did you end up figuring out how to add more...
- Olivier: Hello Franky, I have checked last week in the Ducati store in Shanghai, a streefighter 848 is 240kRMB and...
- Lawrence Sheed: Not sure, but the bike plate will be in the 70-80,000RMB range at the moment before you even look...
- Large: Checking the Watermark: Review of Shenhua’s Watermark coal project economic assessment | Economists
- Monitoring servers with an USB lamp: Laurence Sheed uses the eBuddy for server load and door entry monitoring .
- Branik's Blog: Bing Is A Nuisance
- Computer Solutions Blog: sysfence updates for debian (startup script, and makefile fix)
- eFront Blog: 5 things you (perhaps) don’t know about eFront