Just popping in again for a minute.

Thanks Jeff for moving this thread!

I jumped the gun on the pin grouping looking like a serial port bit. I am absolutely convinced that there MUST be a serial port somewhere, but that wasn't it. So, I looked at the cartridge port and cartridge. The cartridge port is an 18 pin card-edge connector with just the basic signals.

Inside the cartridge is a 32M x8 NAND Flash chip (meaning reprogrammable!) NAND flash have the data and address lines on the same pins and rely on other control singals to address it. If you have ever written code to run a alphanumeric LCD display, you already know how to access this chip.

All 18 lines are traced out, which just happens to be the exact number of lines needed to fully control a NAND chip, including writing to it.

This particular chip has a unique feature called Auto-Read on power up. What this does is begin loading the read register with the first 528 bytes starting at zero. You then just toggle the RE line to get each byte.

Now assuming they didn't do something crazy like obscuring the data, it should be possible to read the code off the cartridge. If they did obscure the data, then a dump of the main flash which would have the NAND filesystem driver in it should tell us what they did.

The only drawback is that we don't know much about the sunplus chips, so the code might just look like noise. I am not going to let that discourage me from at least getting the dumps. The mere fact that they chose to use flash chips instead of masked ROM is simply too enticing not to waste some sweat on trying to figure it out.

So, my current goal is to dump both the cartridge and the main flash and probe the crap out of the main controller board to see if I can figure out the pinout and hopefully find a serial debug port or even just an unused HW serial port. GWJax is making good progress on a replacement controller, so I will just catch up with him on that later.

OK, back to (real) work for me!

To clarify, !WP - which is pin 19 on the NAND Flash chip - is connected to VDD. So the chip is not write protected. I just verified this with my very unsteady hands (lack of sleep and lots of caffeine.)

I think we need an updated pinout since the one above was assumed on the 16bit model.

An important point should be made, though. Since this cart is NOT write protected, apparently, you should use caution if you hook it up to read it. I would ground this line through a 1.5K resistor on your reader assembly so that you do not corrupt it accidently. Also, note that the flash is 3.3V technology and it doesn't mention 5v tolerance.

If someone decides to read the chip out, be sure to use 3.3v logic to do it. While 5V will most likely work anyway (especially just reading,) there is some risk to it.

I ordered a few of these 18 pin edge connectors yesterday to build a proper reader/writer. But I am sure someone could hard-wire this up and read it out without them. Those connectors are 1/8" spacing, which looks about right, but I did not grab my micrometer to be sure.

BTW, an XD Picture card is just a standard 8-bit NAND flash interface, which (barring some unique feature of the chip being used) should connect directly to the cartridge port. I have not done anything with XD chips before, but the pinout is here. This obviously means a custom cartridge with an XD connector *should* be possible. Of course, assuming that anything on the original cartridge makes sense and someone figures out how to write custom code. The XD connectors are a little hard to find, so I would just buy a cheap USB reader and rip it out of one of those.

(P.S. it also means you *might* be able to read the cartridge with a USB XD adapter, which oddly enough, I do not have one to try it right now!)

Anyway, let's read out the cartridge before we get too far ahead of ourselves!

As you can see from my posting time, I work... ALOT! So, this will be a little slow going for me. Patience is a virtue they say, though.

Corrected pinout:

From chip side up, connector on left, and pin 1 at the top:

1 VSS
2 IO7
3 IO6
4 IO5
5 IO4
6 IO3
7 IO2
8 IO1
9 IO0
10 VSS
11 VCC
12 WE*
13 ALE
14 CLE
15 CE*
16 RE*
17 R/B*
18 VSS

Notes:

1. Part is 3.3V logic. VCC is +3.3v and VSS is ground
2. WP* (Write Protect) is held high. Chip is not write protected
3. PRE (Power on auto-read) is left floating. This chip-specific feature is not being used