PSone Internal Cheat Cart / Flash ROM

Post a topic about yourself to let others know your skills, hobbies, etc.
Post Reply
danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

PSone Internal Cheat Cart / Flash ROM

Post by danhans42 » March 14th, 2019, 10:43 pm

Interesting...

https://www.ebay.com/itm/PSOne-CAETLA-0 ... 3062693491

Looks like it is just a PSone with one of these fitted..

https://assemblergames.com/threads/hard ... mod.66268/

Anyone know an easy way to make one? Quite fancy having PSXSerial in a ROM that I can boot to using something like romprod.
Last edited by danhans42 on March 15th, 2019, 8:55 pm, edited 1 time in total.

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » March 15th, 2019, 3:33 am

Electrically, it's pretty simple - most of the pins are identical to the ones used on the boot ROM with the exception that CE/ has to go to pin 98 of the CPU (the boot ROM goes to pin 97) - data, address and OE/ go to the same places as the corresponding signals on the boot ROM.

The code you put in the ROM will need to be patched, though - if you install it as a bare ROM it won't have the enable switch.

User avatar
Squaresoft74
Verified
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 303
Joined: Jan 07, 2016
PlayStation Model: SCPH-7502
Location: France
Contact:

Post by Squaresoft74 » March 15th, 2019, 1:07 pm

I'd be interested to buy such mod kits if anyone would make them. :geek:

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 15th, 2019, 7:14 pm

Thanks Trimesh,

I shall give this a go. The seller of the PSone on eBay mentions running Caetla - by patched would I be able to just flash caetla?

Would I be correct in assuming that if I use a supported flash part, and wire up W/E I should be able to flash it using xflash?

Thanks

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » March 16th, 2019, 1:23 am

danhans42 wrote: March 15th, 2019, 7:14 pm Thanks Trimesh,

I shall give this a go. The seller of the PSone on eBay mentions running Caetla - by patched would I be able to just flash caetla?

Would I be correct in assuming that if I use a supported flash part, and wire up W/E I should be able to flash it using xflash?

Thanks
My guess is that it won't work - the switch on an Action Replay is normally at 0x1f020018, but since there is no switch it will just be mirrored into the flash area and read the ROM at 0x1f000018 - this is the 'p' in "Sony Computer Entertainment" in the license string, so bit 0 will read as 0 and the cartridge will come up disabled.

So you will either need to patch out the switch check in Caetla, or use a larger ROM set so that reads from 0x1f020018 return bit 0 set (just using a 256KB ROM and filling the second half with 0xff will do this...)

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 16th, 2019, 1:45 am

That makes sense now. Assume the mapping of the switch into ROM is done by the GAL/PAL?
I only have 256k flash parts on hand anyway so that shouldn't be a problem.

I do remember you looking at the AR carts and USB transfer a while back..do you know how hard would it be to implement the contents/mapping of the GAL/PAL into something more modern?

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » March 17th, 2019, 6:41 am

danhans42 wrote: March 16th, 2019, 1:45 am That makes sense now. Assume the mapping of the switch into ROM is done by the GAL/PAL?
I only have 256k flash parts on hand anyway so that shouldn't be a problem.

I do remember you looking at the AR carts and USB transfer a while back..do you know how hard would it be to implement the contents/mapping of the GAL/PAL into something more modern?
Yeah, the PAL normally handled reading the switch and handled the control of the comms port.

The logic in the PAL is really simple - I think it was about 20 lines of Verilog. I will see if I can find it (but it was a while ago...)

If you just flash Caetla into the first 128K and leave the upper 128K at FF and wire up all the address lines, the code should start. One other thing you need to watch for is that if Caetla attempts to write to an unsupported flash type it just hangs, so you will be restricted in the sorts of chips you can use without patching the code.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 19th, 2019, 2:15 am

I have quite a few EEPROMS that I recovered from faulty PC motherboards, all are mainly winbond but a few are SST.

Looking at the pinouts :-

IC102 - Boot ROM Pinout.png
I assume (sorry for all the questions)

EEPROM /CE goes to Pin98 of the CPU
/OE goes to /OE on the BIOS ROM
Pull /WE high to +3.3 to enable flash writing if needed.
A18/A19 on IC102 - just ignore ?

My first idea was to use romprod/romboot/runrom or caetla to make up 256k, then flash it using a cart and swap the rom into a PS1.

I think the verilog for the PAL/GAL would be interesting, if it could be moved to something more modern just to enable the switch. I seem to recall Charles Macdonald reverse engineering one of the carts (might have been the Saturn version or the GAL on the ISA Card).

Thanks
You do not have the required permissions to view the files attached to this post.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 26th, 2019, 7:38 pm

Just ordered a TL866II+ programmer to get my on my way. Ill program one up and see if the console will run it.

At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.

Any luck on the Verilog Trimesh? or any ideas on how I can dump on work out the logic inside? I have thee PAL20 removed from a Xplorer cart to play with.

The Microchip SST39SF020A seems easily available to me locally, but not sure of the differences between 39f and 29f and how easy that would be to support in xflash

likeabaus
Extreme PSXDEV User
Extreme PSXDEV User
Posts: 133
Joined: Jul 27, 2016

Post by likeabaus » March 26th, 2019, 11:00 pm

The internal VCD cards include the caetla ROM. That's how they also enable backups/imports/homebrew (via swap) and cheats as bonus features. Im willing to bet, that's what this is.

http://www.shopncsx.com/videocddecoder.aspx

Not much of a description there, but if you look up the functionality of these cards on YouTube or Google in general, you'll quickly see that they also include the caetla ROM

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 27th, 2019, 12:10 am

Indeed they do, although think its slightly modified so it supports the CD stop function.

I had two of those very cards, still have one left over, It comes with a IC102 BIOS rom piggyback cable, gets its power directly from the PSU and then there are three wires that connect to various places. If you look on my blog (https://psx0.wordpress.com/2013/07/17/p ... ovie-card/), i have a scan of the installation guide which shows the connections on a 9xxx series console.
If you want some high res pics of the board give me a shout

User avatar
Squaresoft74
Verified
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 303
Joined: Jan 07, 2016
PlayStation Model: SCPH-7502
Location: France
Contact:

Post by Squaresoft74 » March 27th, 2019, 3:44 am

danhans42 wrote: March 26th, 2019, 7:38 pm At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.
Did you try using nocash's flasher ?
And following this:
nocash wrote: August 13th, 2017, 4:43 am Installer EXE
1) Create nocash expansion rom as raw image (PSX-EXP.ROM)
2) Load PSX-EXP.ROM via "cdrom" filemenu (this will internally allocate 20000h bytes for it, fixing the issue)
3) Create currently loaded expansion rom installer (EXPAND.EXE)

The third step was normally intended for third-party roms (like datel/caetla/xplorer firmwares, for cases when existing burning tools don't work with certain chipsets, like the xplorer carts with two flash chips in them).
But instead start from step 2 and load your rom instead of PSX-EXP.ROM.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 27th, 2019, 7:24 pm

Squaresoft74 wrote: March 27th, 2019, 3:44 am
danhans42 wrote: March 26th, 2019, 7:38 pm At the moment I am trying to flash it using a cheat cart and I am struggling to get Xflash to pick up the correct manufacturer/device ID as per their datasheets. Looking through my parts bin I only have 39Fxxx, a few Am29F040 and only 1 ST29F020.
Did you try using nocash's flasher ?
And following this:
nocash wrote: August 13th, 2017, 4:43 am Installer EXE
1) Create nocash expansion rom as raw image (PSX-EXP.ROM)
2) Load PSX-EXP.ROM via "cdrom" filemenu (this will internally allocate 20000h bytes for it, fixing the issue)
3) Create currently loaded expansion rom installer (EXPAND.EXE)

The third step was normally intended for third-party roms (like datel/caetla/xplorer firmwares, for cases when existing burning tools don't work with certain chipsets, like the xplorer carts with two flash chips in them).
But instead start from step 2 and load your rom instead of PSX-EXP.ROM.
Didnt know about that method, will take a look thank you!

I think my issues so far are more electrical/wiring related. The two DIP32 flash parts I have are 512k (Am29F040 and a AT29F040) - which I currently cant get to detect when they are fitted to a 128k AR cart.


The others are PLCC32 and I cant be bothered soldering to them. I've ordered some PLC32/TSOP to DIP32 adapters and some 256k flash parts to try.

Then want to add some definitions to xflash and test adding incompatible ROMS to the source, which so far looks fairly straight forward.

EDIT: Forgot to mention, I have found test points for the address/data and OE lines, as well as a tiny one of CPU pin 98, ill get that in a nicer format and get that uploaded. I find this far easier that trying to solder to the BIOS ROM.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 28th, 2019, 5:42 am

Alternate points for bios lines... crap diagram but you should get the idea.. numbers are the corresponding pins on BIOS rom. CE is CPU pin 98.##
ps1_bios_alt_points.png
You do not have the required permissions to view the files attached to this post.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 28th, 2019, 10:04 pm

Just another one on this, have this almost fully wired into the console... where would I connect /WR to from the flashrom? i have looked at some of the cheat cart schematics and they all show it running from the PAL/GAL.. is that just the RW pin on the parallel port?

It must be possible as that simple flash chip in the picures above shows it being flashed on a PSone console.

Thanks

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » March 29th, 2019, 6:37 pm

Yeah, you can just connect it to the WR/ signal on the CPU - note that there are 2 of them and the one you want is SWR0/, which is on pin 100 of the CPU.

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » March 29th, 2019, 7:14 pm

Perfect

Ill get this wired up and post back. Thanks again for the help

danhans42
BANNED
BANNED
Posts: 329
Joined: Nov 28, 2012

Post by danhans42 » April 23rd, 2019, 8:07 pm

Tested this weekend. I only had AMD 29LV040's on hand so flashed one with unirom standalone and filled with FF's up to 256k and mirrored that into the second 256k. Then pulled A18 low and works perfectly which is suprising given my wiring is horrific.

Next step, work out how to replicate the functions of the GAL/PAL on the AR's - need to get my head around how the switch maps.

If you have no luck with the verilog you had Trimesh, would it be possbile to hook up my $10 logic analyser the address/data outputs of the GAL and see what happens when that address is read, and try and replicate it in 74 series or something else.

I have also managed to remove the port from a faulty AR cart and build a test board for the PSX, so I can easily connect to the needed pins for experimenting.

Post Reply

Who is online

Users browsing this forum: Google [Bot] and 2 guests