{"id":829,"date":"2012-03-28T10:53:37","date_gmt":"2012-03-28T02:53:37","guid":{"rendered":"http:\/\/www.computersolutions.cn\/blog\/?p=829"},"modified":"2012-03-31T12:32:10","modified_gmt":"2012-03-31T04:32:10","slug":"king-of-game-jamma-board-reverse-engineering","status":"publish","type":"post","link":"https:\/\/www.computersolutions.cn\/blog\/2012\/03\/king-of-game-jamma-board-reverse-engineering\/","title":{"rendered":"King of Game JAMMA Board reverse engineering"},"content":{"rendered":"

As visitors to my office have noticed, we’ve been building a bunch of arcade machines for clients.
\nHere are a couple of pics of the builds in progress:<\/p>\n

Chassis’s undergoing painting
\n<\/p>\n

Unfinished machine
\n\"\"<\/a><\/p>\n

While making those is fun, I also have an interest in what powers them.<\/p>\n

Arcade Machines are really just a wooden box, a display, a controller board, input (buttons and joysticks), and a PSU, they’re pretty basic devices. There is an industry cabling standard – JAMMA which makes connecting them up nice and easy. <\/p>\n

China has a number of hardware choices for powering them, ranging from PC based boards, original arcade boards, and what I think is the better solution for older games – emulation under embedded ARM\/MIPS, vs dedicated boards.<\/p>\n

We went through a number of different versions of hardware available here until I found something I liked.<\/p>\n

Our currently build hardware du jour runs off of something called “King of Game”.
\nAs is usual in China, no documentation, and the factory is less than forthcoming with information.<\/p>\n

\"King<\/a><\/p>\n

Still, not unusual.<\/p>\n

The device does have some interesting features for the would be hacker – <\/p>\n

\"\"<\/a><\/p>\n

It has a nicely labelled “Boot” button, and the component count is quite low. Which generally means its SoC (System on a Chip) based.
\nThe factory has done a little bit of prep work in making sure us ev1l hackorz won’t get at the juicy bits by etching off the cpu.<\/p>\n

A quick look at the chip pin count, and the usual choice of chipset SoC more or less got me the right answer in a few minutes though.<\/p>\n

My guess was Ingenic 4850, and it turned out to be the Ingenic 4755. This is a MIPS based X-Burst CPU<\/p>\n

Even though they’re Chinese vendor, Ingenic does a great job in providing readily available information about their chipset(s). Kudos to the Ingenic guys in Beijing for being so open!<\/p>\n

Datasheets for the 4755 and more importantly toolchains are readily available at the Ingenic FTP site – ftp:\/\/ftp.ingenic.cn\/2soc\/4750<\/a><\/p>\n

Back to the board.<\/p>\n

The King of Game board has USB onboard.
\nPlugging it into a computer shows the flash files available, but unfortunately not the firmware bits I need to see \/ change (e.g. to upgrade emulator capabilities, and change graphics).<\/p>\n

If I hold down boot and plug in the USB, I get prompted for the Ingenic 4750 drivers.
\nThose are relatively easy to find on the ingenic site, so get a hold of those yourselves.<\/p>\n

In order to connect to the board, you use a USB_BOOT.exe (there are also Linux tools available).
\nI downloaded usbboot-1.4b usbboot1.4b-tools<\/a>, and unzipped that.<\/p>\n

The USB Boot file needs a config file though – and the default config files supplied didn’t work \ud83d\ude41<\/p>\n

So, off to check what could be up.<\/p>\n

The USB_Boot utility requires a bunch of settings in order to communicate with a board. After a bit of fiddling playing around with possible options I got it talking to the board.
\nWhile I’m not certain I have the settings completely correct here is what I have right now:<\/p>\n

<\/p>\n

[PLL]
\nEXTCLK\t\t\t24\t\t\t;Define the external crystal in MHz
\nCPUSPEED\t\t336\t\t\t;Define the PLL output frequency
\nPHMDIV\t\t\t3\t\t\t;Define the frequency divider ratio of PLL=CCLK:PCLK=HCLK=MCLK
\nBOUDRATE\t\t57600\t\t\t;Define the uart boudrate
\nUSEUART\t\t\t0\t\t\t;Use which uart, 0\/1 for jz4740,0\/1\/2\/3 for jz4750<\/p>\n

[SDRAM]
\nBUSWIDTH\t\t16\t\t\t;The bus width of the SDRAM in bits (16|32)
\nBANKS\t\t \t4\t\t\t;The bank number (2|4)
\nROWADDR\t \t\t12\t\t\t;Row address width in bits (11-13)
\nCOLADDR\t \t\t9\t\t\t;Column address width in bits (8-12)
\nISMOBILE\t \t0\t\t\t;Define whether SDRAM is mobile SDRAM, this only valid for Jz4750 ,1:yes 0:no
\nISBUSSHARE\t \t1\t\t\t;Define whether SDRAM bus share with NAND 1:shared 0:unshared<\/p>\n

[NAND]
\nBUSWIDTH\t\t8\t\t\t;The width of the NAND flash chip in bits (8|16|32)
\nROWCYCLES\t\t3\t\t\t;The row address cycles (2|3)
\nPAGESIZE\t\t2048\t\t\t;The page size of the NAND chip in bytes(512|2048|4096)
\nPAGEPERBLOCK\t\t64\t\t\t;The page number per block
\nFORCEERASE\t\t0\t\t\t;The force to erase flag (0|1)
\nOOBSIZE\t\t\t64\t\t\t;oob size in byte
\nECCPOS \t\t6\t\t\t;Specify the ECC offset inside the oob data (0-[oobsize-1])
\nBADBLACKPOS \t0\t\t\t;Specify the badblock flag offset inside the oob (0-[oobsize-1])
\nBADBLACKPAGE \t127 \t\t\t;Specify the page number of badblock flag inside a block(0-[PAGEPERBLOCK-1])
\nPLANENUM\t\t1\t\t\t;The planes number of target nand flash
\nBCHBIT\t \t\t4\t\t\t;Specify the hardware BCH algorithm for 4750 (4|8)
\nWPPIN\t\t\t0\t\t\t;Specify the write protect pin number
\nBLOCKPERCHIP\t\t0\t\t\t;Specify the block number per chip,0 means ignore<\/p>\n

[END]
\n<\/code><\/p>\n

If I put the board into USB boot mode (hold down boot button, and plug into the usb), then run the USB_TOOL.EXE file I can communicate<\/p>\n


\n Welcome!
\n USB Boot Host Software!
\n USB Boot Software current version: 1.4b
\n Handling user command.
\n USBBoot :> list<\/p>\n

Device number can connect :1
\n USBBoot :> help<\/p>\n

Command support in current version:
\n help print this help;
\n boot boot device and make it in stage2;
\n list show current device number can connect;
\n fconfig set USB Boot config file;
\n nquery query NAND flash info;
\n nread read NAND flash data with checking bad block and ECC;
\n nreadraw read NAND flash data without checking bad block and ECC;
\n nreadoob read NAND flash oob without checking bad block and ECC;
\n nerase erase NAND flash;
\n nprog program NAND flash with data and ECC;
\n nmark mark a bad block in NAND flash;
\n go execute program in SDRAM;
\n version show current USB Boot software version;
\n exit quit from telnet session;
\n readnand read data from nand flash and store to SDRAM;
\n load load file data to SDRAM;
\n run run command script in file;
\n memtest do SDRAM test;
\n gpios let one GPIO to high level;
\n gpioc let one GPIO to low level;
\n sdprog program SD card;
\n sdread read data from SD card;
\n USBBoot :> boot<\/p>\n

Usage: boot (1)
\n 1:device index number
\n USBBoot :> boot 0<\/p>\n

Checking state of No.0 device: Unboot
\n Now booting No.0 device:
\n Download stage one program and execute at 0x80002000: Pass
\n Download stage two program and execute at 0x80c00000: Pass
\n Boot success!
\n Now configure No.0 device:
\n Now checking whether all configure args valid:
\n Current device information: CPU is Jz4750
\n Crystal work at 24MHz, the CCLK up to 336MHz and PMH_CLK up to 112MHz
\n Total SDRAM size is 16 MB, work in 4 bank and 16 bit mode
\n Nand page size 2048, ECC offset 6, bad block ID 127, use 1 plane mode
\n Configure success!
\n<\/code><\/p>\n

Next up, read the firmware off the flash, and dump it to see which version of the Dingoo code they most probably ripped off \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

As visitors to my office have noticed, we’ve been building a bunch of arcade machines for clients. Here are a couple of pics of the builds in progress: Chassis’s undergoing painting Unfinished machine While making those is fun, I also have an interest in what powers them. Arcade Machines are really just a wooden box, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[390,282],"tags":[537,392,391,393],"class_list":["post-829","post","type-post","status-publish","format-standard","hentry","category-arcade-machines","category-firmware-2","tag-arcade-machines","tag-arm","tag-jamma","tag-reverse-engineering"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/comments?post=829"}],"version-history":[{"count":8,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/829\/revisions"}],"predecessor-version":[{"id":838,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/829\/revisions\/838"}],"wp:attachment":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/media?parent=829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/categories?post=829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/tags?post=829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}