PSone Internal Cheat Cart / Flash ROM

[danhans42]

Interesting...

https://www.ebay.com/itm/PSOne-CAETLA-0 ... 3062693491

Looks like it is just a PSone with one of these fitted..

https://assemblergames.com/threads/hard ... mod.66268/

Anyone know an easy way to make one? Quite fancy having PSXSerial in a ROM that I can boot to using something like romprod.

[TriMesh]

Electrically, it's pretty simple - most of the pins are identical to the ones used on the boot ROM with the exception that CE/ has to go to pin 98 of the CPU (the boot ROM goes to pin 97) - data, address and OE/ go to the same places as the corresponding signals on the boot ROM.

The code you put in the ROM will need to be patched, though - if you install it as a bare ROM it won't have the enable switch.

[Squaresoft74]

I'd be interested to buy such mod kits if anyone would make them.

[danhans42]

Thanks Trimesh,

I shall give this a go. The seller of the PSone on eBay mentions running Caetla - by patched would I be able to just flash caetla?

Would I be correct in assuming that if I use a supported flash part, and wire up W/E I should be able to flash it using xflash?

Thanks

[TriMesh]

Thanks Trimesh,

I shall give this a go. The seller of the PSone on eBay mentions running Caetla - by patched would I be able to just flash caetla?

Would I be correct in assuming that if I use a supported flash part, and wire up W/E I should be able to flash it using xflash?

Thanks

My guess is that it won't work - the switch on an Action Replay is normally at 0x1f020018, but since there is no switch it will just be mirrored into the flash area and read the ROM at 0x1f000018 - this is the 'p' in "Sony Computer Entertainment" in the license string, so bit 0 will read as 0 and the cartridge will come up disabled.

So you will either need to patch out the switch check in Caetla, or use a larger ROM set so that reads from 0x1f020018 return bit 0 set (just using a 256KB ROM and filling the second half with 0xff will do this...)

[danhans42]

That makes sense now. Assume the mapping of the switch into ROM is done by the GAL/PAL?
I only have 256k flash parts on hand anyway so that shouldn't be a problem.

I do remember you looking at the AR carts and USB transfer a while back..do you know how hard would it be to implement the contents/mapping of the GAL/PAL into something more modern?

[TriMesh]

That makes sense now. Assume the mapping of the switch into ROM is done by the GAL/PAL?
I only have 256k flash parts on hand anyway so that shouldn't be a problem.

I do remember you looking at the AR carts and USB transfer a while back..do you know how hard would it be to implement the contents/mapping of the GAL/PAL into something more modern?

Yeah, the PAL normally handled reading the switch and handled the control of the comms port.

The logic in the PAL is really simple - I think it was about 20 lines of Verilog. I will see if I can find it (but it was a while ago...)

If you just flash Caetla into the first 128K and leave the upper 128K at FF and wire up all the address lines, the code should start. One other thing you need to watch for is that if Caetla attempts to write to an unsupported flash type it just hangs, so you will be restricted in the sorts of chips you can use without patching the code.

[danhans42]

I have quite a few EEPROMS that I recovered from faulty PC motherboards, all are mainly winbond but a few are SST.

Looking at the pinouts :-

IC102 - Boot ROM Pinout.png

I assume (sorry for all the questions)

EEPROM /CE goes to Pin98 of the CPU
/OE goes to /OE on the BIOS ROM
Pull /WE high to +3.3 to enable flash writing if needed.
A18/A19 on IC102 - just ignore ?

My first idea was to use romprod/romboot/runrom or caetla to make up 256k, then flash it using a cart and swap the rom into a PS1.

I think the verilog for the PAL/GAL would be interesting, if it could be moved to something more modern just to enable the switch. I seem to recall Charles Macdonald reverse engineering one of the carts (might have been the Saturn version or the GAL on the ISA Card).

Thanks

[danhans42]

Just ordered a TL866II+ programmer to get my on my way. Ill program one up and see if the console will run it.

At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.

Any luck on the Verilog Trimesh? or any ideas on how I can dump on work out the logic inside? I have thee PAL20 removed from a Xplorer cart to play with.

The Microchip SST39SF020A seems easily available to me locally, but not sure of the differences between 39f and 29f and how easy that would be to support in xflash

[likeabaus]

The internal VCD cards include the caetla ROM. That's how they also enable backups/imports/homebrew (via swap) and cheats as bonus features. Im willing to bet, that's what this is.

http://www.shopncsx.com/videocddecoder.aspx

Not much of a description there, but if you look up the functionality of these cards on YouTube or Google in general, you'll quickly see that they also include the caetla ROM

[danhans42]

Indeed they do, although think its slightly modified so it supports the CD stop function.

I had two of those very cards, still have one left over, It comes with a IC102 BIOS rom piggyback cable, gets its power directly from the PSU and then there are three wires that connect to various places. If you look on my blog (https://psx0.wordpress.com/2013/07/17/p ... ovie-card/), i have a scan of the installation guide which shows the connections on a 9xxx series console.
If you want some high res pics of the board give me a shout

[Squaresoft74]

At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.

Did you try using nocash's flasher ?
And following this:

Installer EXE
1) Create nocash expansion rom as raw image (PSX-EXP.ROM)
2) Load PSX-EXP.ROM via "cdrom" filemenu (this will internally allocate 20000h bytes for it, fixing the issue)
3) Create currently loaded expansion rom installer (EXPAND.EXE)
The third step was normally intended for third-party roms (like datel/caetla/xplorer firmwares, for cases when existing burning tools don't work with certain chipsets, like the xplorer carts with two flash chips in them).

But instead start from step 2 and load your rom instead of PSX-EXP.ROM.

[danhans42]

At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.

Did you try using nocash's flasher ?
And following this:

Installer EXE
1) Create nocash expansion rom as raw image (PSX-EXP.ROM)
2) Load PSX-EXP.ROM via "cdrom" filemenu (this will internally allocate 20000h bytes for it, fixing the issue)
3) Create currently loaded expansion rom installer (EXPAND.EXE)
The third step was normally intended for third-party roms (like datel/caetla/xplorer firmwares, for cases when existing burning tools don't work with certain chipsets, like the xplorer carts with two flash chips in them).

But instead start from step 2 and load your rom instead of PSX-EXP.ROM.

Didnt know about that method, will take a look thank you!

I think my issues so far are more electrical/wiring related. The two DIP32 flash parts I have are 512k (Am29F040 and a AT29F040) - which I currently cant get to detect when they are fitted to a 128k AR cart.


The others are PLCC32 and I cant be bothered soldering to them. I've ordered some PLC32/TSOP to DIP32 adapters and some 256k flash parts to try.

Then want to add some definitions to xflash and test adding incompatible ROMS to the source, which so far looks fairly straight forward.

EDIT: Forgot to mention, I have found test points for the address/data and OE lines, as well as a tiny one of CPU pin 98, ill get that in a nicer format and get that uploaded. I find this far easier that trying to solder to the BIOS ROM.

[danhans42]

Alternate points for bios lines... crap diagram but you should get the idea.. numbers are the corresponding pins on BIOS rom. CE is CPU pin 98.##

ps1_bios_alt_points.png

[danhans42]

Just another one on this, have this almost fully wired into the console... where would I connect /WR to from the flashrom? i have looked at some of the cheat cart schematics and they all show it running from the PAL/GAL.. is that just the RW pin on the parallel port?

It must be possible as that simple flash chip in the picures above shows it being flashed on a PSone console.

Thanks

[TriMesh]

Yeah, you can just connect it to the WR/ signal on the CPU - note that there are 2 of them and the one you want is SWR0/, which is on pin 100 of the CPU.

[danhans42]

Perfect

Ill get this wired up and post back. Thanks again for the help

[danhans42]

Tested this weekend. I only had AMD 29LV040's on hand so flashed one with unirom standalone and filled with FF's up to 256k and mirrored that into the second 256k. Then pulled A18 low and works perfectly which is suprising given my wiring is horrific.

Next step, work out how to replicate the functions of the GAL/PAL on the AR's - need to get my head around how the switch maps.

If you have no luck with the verilog you had Trimesh, would it be possbile to hook up my $10 logic analyser the address/data outputs of the GAL and see what happens when that address is read, and try and replicate it in 74 series or something else.

I have also managed to remove the port from a faulty AR cart and build a test board for the PSX, so I can easily connect to the needed pins for experimenting.