Lexibook JG7415 - Are they crazy?

The Lexibook JG7415 is an 120in1 games- console, which just used the popularity of the WII to get sold as much as possible.
I bought this console locally here just to see if these games are also Sunplus based.

When i opened the console i was surprised that the case was 90% empty. The complete pcb of the console would have easily fit inside one controller.

But what was more surprisingly is the marking Zone 100 110728 v2.1 on the board! Zone is known for it's own Multigame-Consoles, like Zone40 and Zone60, which are both also already emulated in MAME.
So this console was likely be an emulation-target for MAME too.

Next step was to dump this rom!
As the Zone60 (which has 60 games) has a 64mb rom, i was pretty sure that this console (which has 120 games) will have a 128mb rom.
But the rom has A0-A26, which would indicate a 256mb rom!

As this is nothing you can just desolder and put in your programmer for reading, some soldering had to be done.
Luckily the ArduinoMega is an amazing tool for this.

Soldering everything together and checking all connections just took about 1,5 hours.
The only problem with the Arduino, dumping a 256mb rom with it takes about 3,5hours!

First dump was done over night and i sent the dump to Haze for checking! The games booted, but the interesting fact was that only 128mb (split up over the complete romarea) of the 256mb were used.
To verify the dump it was needed to at least dump it one more time...so we had to wait another 3,5hours for verification.
Sad thing, the dumps did not match!
So i dumped it another time, which took another 3,5hours!

While i dumped it the third time, Haze sent me the following message, as he was thinking, that they used known faulty flashroms for this console. And that's why they used 256mb flashroms and only used 128mb of it:

if you divide the ROM into 8MB chunks this is how it maps in terms of used / unused

if the bad bytes are in the not selectable or unused blocks then there's probably nothing to worry about, might even be just bad ROM they used on purpose

0x0000000 0x07fffff - used
0x0800000 0x0ffffff - used
0x1000000 0x17fffff - not selectable, unused
0x1800000 0x1ffffff - not selectable, unused
0x2000000 0x27fffff - not selectable, unused
0x2800000 0x2ffffff - not selectable, unused
0x3000000 0x37fffff - used
0x3800000 0x3ffffff - used
0x4000000 0x47fffff - used
0x4800000 0x4ffffff - used
0x5000000 0x57fffff - not selectable, unused
0x5800000 0x5ffffff - not selectable, unused
0x6000000 0x67fffff - not selectable, unused
0x6800000 0x6ffffff - not selectable, unused
0x7000000 0x77fffff - used
0x7800000 0x7ffffff - used

0x8000000 0x87fffff - used
0x8800000 0x8ffffff - used
0x9000000 0x97fffff - not selectable, unused
0x9800000 0x9ffffff - not selectable, unused
0xa000000 0xa7fffff - not selectable, unused
0xa800000 0xaffffff - not selectable, unused
0xb000000 0xb7fffff - used
0xb800000 0xbffffff - used
0xc000000 0xc7fffff - used
0xc800000 0xcffffff - selectable but unused
0xd000000 0xd7fffff - not selectable, unused
0xd800000 0xdffffff - not selectable, unused
0xe000000 0xe7fffff - not selectable, unused
0xe800000 0xeffffff - not selectable, unused
0xf000000 0xf7fffff - selectable but unused
0xf800000 0xfffffff - selectable but unused

 

I rechecked this with my (now three) dumps and guess what! All three dumps matched exactly in these area's :

0x0000000 0x07fffff - used
0x0800000 0x0ffffff - used
0x1000000 0x17fffff - not selectable, unused
0x1800000 0x1ffffff - not selectable, unused
0x2000000 0x27fffff - not selectable, unused
0x2800000 0x2ffffff - not selectable, unused
0x3000000 0x37fffff - used
0x3800000 0x3ffffff - used
0x4000000 0x47fffff - used
0x4800000 0x4ffffff - used
0x5000000 0x57fffff - not selectable, unused
0x5800000 0x5ffffff - not selectable, unused
0x6000000 0x67fffff - not selectable, unused
0x6800000 0x6ffffff - not selectable, unused
0x7000000 0x77fffff - used
0x7800000 0x7ffffff - used

0x8000000 0x87fffff - used
0x8800000 0x8ffffff - used
0x9000000 0x97fffff - not selectable, unused
0x9800000 0x9ffffff - not selectable, unused
0xa000000 0xa7fffff - not selectable, unused
0xa800000 0xaffffff - not selectable, unused
0xb000000 0xb7fffff - used
0xb800000 0xbffffff - used
0xc000000 0xc7fffff - used
0xc800000 0xcffffff - selectable but unused
0xd000000 0xd7fffff - not selectable, unused
0xd800000 0xdffffff - not selectable, unused
0xe000000 0xe7fffff - not selectable, unused
0xe800000 0xeffffff - not selectable, unused
0xf000000 0xf7fffff - selectable but unused
0xf800000 0xfffffff - selectable but unused

Which mean's ALL used (selectable) area's are GOOD dumped and ALL unused (not selectable) area's are BAD dumped and were different between all three dumps!

Most likely they got the faulty 256mb roms for a very cheap price and just programmed the games around the not working area's!

Without Haze and the working emulation of the Sunplus system, we would have never been able to see this and most likely would have thought that the dumps are BAD. I would have also invested hours of work and checking if my dumping rig has faults are something like that, just because they used bad flashroms in their product's. ==> Are they crazy! ;-)

The rom is already added and the games are working with the next release of MAME, here are shots of it running in MAME:

Another challenge for me and another perfect teamwork with Haze!

Genius TableTop - Black Magic CX

Got another Vtech Learning console yesterday!

This console is a TableTop "PC" with a wireless Keyboard.

The first thing i saw, when i opened the console was a handwritten piece of paper with the text "Zlatko 24 Jahre - Februar 2000" (Zlatko 24 years - February 2000)...this is most likely the guy who built this machine together....but why did he wrote his age on the paper too???

The more interesting thing was found on the pcb itself. this toy uses the same TSOP48 chip package type, as the I.Q.Unlimited cartridge, which i dumped three days ago. (https://team-europe.blogspot.com/2019/11/vtech-iqunlimited-german-rarest.html)

Good that i already built a dumping adapter for this chip-type. The dumping process worked perfectly and this maskrom had a 2mb rom inside.

Included with this console is also a cartridge called "EUROPA". This cartridge is basically empty and working only as a jumper. So the "game" is already inside the internal maskrom of the console.

Here are some videos, the manual and some pictures of the console:
https://archive.org/details/GeniusBlackMagicCX


The rom should get added to MAME the next few days.

VTech I.Q.Unlimited (German) - rarest cartridge in the Vtech-Universe

Nearly seven years ago, i dumped the rom of the I.Q.Unlimited laptop from VTech. (https://team-europe.blogspot.com/2012/12/vtech-iq-unlimited-german.html)

This machine was a big failure in 1999, as the price was way to high and nobody knew if it's now a kids-learning-toy or a work-machine for adults.
That said, the sales of the I.Q.Unlimited were pretty bad back then.

Today the machine has some fan's, because of the Dragonball EZ cpu inside, which is normally only used on PalmOS machines.
And that's also the reason, why the prices are currently most likely in the range of 50-100EUR for a used machine.

Now to the interesting part:
As the machine did not sale very well in the late nineties, and as no information were anywhere in the internet, i always thought that no cartridges got ever released for this machine. (beside the SAVE-Cartridge, which could get used to store some data on it).
Even in the last seven years i never did see any cartridge popping up in the auction platforms.

This all changed last week. I found and bought a complete unit which included a "learning"-cartridge for this system!
It's called "Englisch für Anfänger" (English for beginners):

After playing a little bit with the complete system and the cartridge (both working really well),  i opened it:

VTech used a LH5S4 maskrom with a non-standard TSOP48 pinout. While i know the "LH*"-maskroms already pretty good, as VTech used them in most of their toys, i basically knew, because of the LH5S4, that this is a 4mbit (512kb) maskrom. But the pinout was completely unknown and nothing i have seen so far.
I searched the net for all LH*-datasheets and after about 2 hours i found the correct pinout. I proofed all lines and while this is for a bigger maskrom, everything fitted perfectly!
This even showed that the I.Q. could take cartridges up to 32mbit as all lines go to the cartridge connector.

 Speaking about the cartridge-connector, here is the cartridge-pinout:

01|GND
02|NC
03|D10
04|D11
05|D4
06|D3
07|D12
08|D2
09|D5
10|D9
11|D13
12|D1
13|D6
14|D8
15|D14
16|D0
17|D7
18|OE
19|D15
20|A4
21|A0
22|A16
23|A1
24|A15
25|A2
26|A14
27|A3
28|A13
29|A12
30|A11
31|A10
32|A9
33|A5
34|A8
35|WE??
36|A19
37|A20
38|->JUMPER R4
39|NC
40|CE
41|A18
42|A17
43|A7
44|A6
45|VCC

Next step was to dump the maskrom. For sure, none of my programmers supported this kind of pinout (as it's really ways off, of the standard TSOP48 pinout). So i had to wire an adapter for dumping it.
While i desoldered the maskrom, i did see that the package type is about 3mm shorter as a standard TSOP48 chip, so i couldn't use a normal TSOP48-ZIF-socket to dump the maskrom, as the legs would not connect to the socket.

After another two hours of work i ended up with this:

My ArduinoMega based LH5S4 dumper! ;-)
Which is also usable for all future LH5S4 or  LH5332 maskroms in the TSOP48 package.

I dumped the complete maskrom as the 32mbit variant and got the same 512kb over and over again:

easier to read if you byteswap this:

WTF! "Entertain Trivia" does not sound like "Englisch für Anfänger" or "English for Beginners".
I hoped for something like this happening! As we already knew that VTech did put two games inside most of their cartridges! (easier/cheaper to produce one cartridge for two games and just select the first half of the rom or the second half of the rom with a soldered switch)

Looking at the second half of the dump you see this:

And this is what i was looking for!

So while i thought the I.Q.Unlimited did not have any cartridges ever released! We now have the content of two!

The dump will get forwarded to MAME and should get added in the next few days.

This was a really great challenge for at least half a day, but the story with the I.Q.Unlimited will continue...
My next step will be to create a flashcart for this device!

Konami Picno Flashcart

Another system, which did not have any flashcart so far, is the Konami Picno.

This flashcart has 1mb of space and supports all available games.

This design consists of three layers of PCB's, to get the best slot-in solution for this console.

Did not expect that it will work that good, but the result is pretty amazing, easy to solder and cheap to produce.

GAMEKING Flashcart

EDIT SEPT 2020: THIS IS THE OLD DESIGN! GO HERE FOR THE NEW MULTICART!

Another console which i always wanted to design my own flashcart for, the GameKing from Timetop.

The frontside contains the eeprom and six switches, the backside contains a description for all switches on the board.

This flashcart has 512kb of space and is switchable between 1x 512kb bank or 4x128kb banks.
Which means you can program 4 games with 128kb to it, or just one of those 4in1 roms, which have 512kb.

The cartridge is reprogramable with every programmer which supports 39VF040 eeproms. For example the cheap TL866IIPlus (costs about 35-40EUR) can do the job easily. Programming a 512kb rom takes about 25seconds.

The goal of this cartridge-design was to be as small as possible, while also as much useable as possible.

The cartridge itself should also work within the GameKing3 to play the GK1 and GK3 games on it. As with the recent emulation progress of the GameKing and GameKing3 (emulated in the next MAME-release) it was determined that the GameKing3 makes some checks about flashroms at it's startup. Which could be a protection-check.
Because of this fact, i would need someone with an GameKing3 to verify, if this cartridge is really working on a GK3 handheld. (This person will get a discount on the cartridge!)

Let's do two more this month

Caius contacted me about two 8751H mcu's which  Jorge Silva would borrow us for decapping.
The package arrived today and i took a quick lookat them.

DRAGON BREED (M72)

This game is inside MAME since December 1997 and while the game-emulation works, we had no chance to preserve the MCU the last 22 years.
The MCU got decapped today and completes this romset!

AIR DUEL (M72)

Dumped in March 2000, this is another game which works in MAME since years. And finally today we got the MCU decapped for it!
Another game fully preserved!

Interesting fact:

The dump of "Air Duel" has this at the very first lines:

Whatever "Last of Ninja" is...

EDIT 21-10-2019: Maybe it's from "Ninja Spirit", a game which was released two years earlier (1988) from IREM and they had some MCU's of it left, which they recycled for "Air Duel".  As "Ninja Spirit" is missing it's MCU dump too, we will try if this dump also works for it. 

EDIT 22-10-2019: "Last of Ninja" is really the name of "Ninja Spirit". The MCU-dump is working perfectly for "Air Duel" and it really looks like IREM was just too lazy to remove the wrong game-title from it. This dump will not work with "Ninja Spirit".


Thanks to Caius and Jorge Silva for helping to preserve these games!

Final MCU's from Brian's package

and here we have the last three MCU's of Brian's last package.

Body Slam

Matches the existing decap of it! So this is another confirmation of the decap and practice for my decapping skills.

Fire Trap (US)

This is the MCU for the US-Version of Fire Trap. (The Japan-Version was decapped a couple of weeks ago).

It does not match the handcrafted dump! So this is a new real dump!

Last Mission

So this is really interesting!

As i already decapped this chip about 6 weeks ago already, we got good reads from it back than. Now i decapped this new chip and got a different dump.

While the rompart of the chip is the same on both and matches each other, there's a difference in the empty-part of the rom:

LEFT: old decap

RIGHT: new decap

both dumps will work on the real hardware with no difference, as this is only in the not used area of the rom.

Basically the second dump is cleaner and this way looks "more" correct to me.

As i have the "old" mcu here too, i redumped it a couple of times today and always get the same rom. So they are really different in that area.