Unlocking the 138/277/355-in-1 boards

kruuth

Member
Joined
May 21, 2009
Messages
645
Reaction score
1
Location
Georgia
Hacking the 138/276/355 in 1 Multigame Jamma Boards

Disclaimer:

I am not responsible for any damage that you cause to your board. It is advised that you make backups of any and all files that you attempt to modify in order to recover in the event you make a mistake. The information provided here is for informational purposes only. At no point in this document will the acquisition of additional, copyrighted games be discussed.

Board information:

This series of boards utilizes the Mini6410 Architecture and a custom designed daughter card for controlling video and user IO. They are not compatible with the standard development boards for this micro computer, and the boards themselves are bootlegs of the original. Official 6410 boards have a 2gb NAND flash onboard. The bootlegs do not have this. These boards also have to have the cards flashed utilizing a specific tool that writes a bootloader based on the total block and sector count of the sd card. Since it would seem that no two SD cards are 100% identical in this respect, copying the card is not possible at this time.

Determining if you have the proper board:

Take a good look at your board. It should have a small, rectangular daughter card on the opposite side of the jamma edge connector. It should also have a USB port, headphone jack, and VGA connector. The larger board itself should be roughly square in appearance. Certain versions of this board come packaged in a black shell similar to other multiboards. Other ones are bare boards. In general, if the board has a MOLEX power connector, volume knob, headphone jack, and SD card slot on one side, and the VGA, USB, and track ball connector on the other then this most likely is one of these boards.



OS information:

The board itself is running a modified version of TinyARM linux created to talk to this specific daughter card. How? That's unknown at this time. However it's a lightweight, embedded linux that is sufficiently advanced to drive this device.

SD Card information:

If your board has a plastic cover on it, look for a square protrusion. That is the SD cover. Pop it off and you will have access to your SD card.


The SD card has three different partitions, a FAT partition, storing the boot loader, an EMU partition storing the emulation software, and the OS partition. The EMU and OS partitions are both EXT2 format and cannot be read in windows without special software. For the remainder of this document these two partitions are going to be referred to as EMU and OS. In general, the SD looks like this:

<<---BOOT:FAT32---><---EMU:EXT2---><---OS:EXT2---><---EMPTYSPACE--->>

or, from a size perspective:

<<---BOOT:102MB---><---EMU:300MB---><---OS:315MB---><---EMPTYSPACE:3.3GB--->>

To backup using linux use the dd command:

dd if=/dev/your_sd_card_device of =your_image_path bs=1M

You can also use Win32 Disk Imager to backup the card. I haven't tried but it supposedly works.

Emulator information:

Fortunately, the emulator chosen for these boards is MAME. In this case, a hacked version of MAME4ALL, and an older copy of XMAME. More information can be found here:

http://chui.dcemu.co.uk/mame4all.html

It's unknown at this time what version of MAME4ALL this board is running. Certain keyboard commands can be used via the USB port but not many. There is another emulator, a flavor of xmame also running on the board, and both are under the EMU partition, under the names clsemuh and xemu.

Bypassing protection:

!!WARNING!!

If you are unfamiliar with *NIX and it's file systems. STOP. Get someone that knows them or read up before you continue. Attempting to modify the contents of the SD card using a non-*NIX operating system may destroy the card.

!!WARNING!!

This board utilizes multiple layers of protection, the first being the bootloader. Since you can't copy the card, this is irrelevant. The next and most important is the games.bin file, located in the EMU partition. The frontend, a hacked version of LemonLauncher, checks this file. It's a SHA1 encoded file. If this file does not match with the games.conf file stored in OS/USR/EMU/xrun then the system goes into a reboot loop. The programmers of the check in China were very lazy in this regard. The frontend checks the games.bin file and if it fails, attempts a reboot by calling the actual linux reboot command.

1. Mount the third partition of the SD card as read/write in linux
2. Go to the system binaries directory
3. Locate the reboot command
4. Rename or relink the command

Adding games:

Games need to be added in two places. First, for them to show up in the menus, they must be added to OS/usr/emu/xrun/games.conf. Looking at the file itself will show how to do this. It's rather simple. Second, the rom name must be added to /usr/emu/xrun/showroms.lst. If you want the frontend to show a snap of the game, then you need to add a snap to /OS/snap and be sure it's in png format. Roms are stored in the /OS/roms directory. Games are loaded in the frontend based on the /OS/usr/emu/xrun/showroms.lst file order and not on the OS/usr/emu/xrun/games.conf file order. Please note that these locations might change depending on the revision of the board you have.

games.conf

games.conf is used to pass information to mame. The only switch in there is -delay, and it's unknown what it does. The base config file, /OS/usr/emu/xrun/xrunh.conf actually has two emulators in it, clsemuh and xemu. They are listed as emu0 and emu1. If your game does not work with one then try the other.

In short:
1. Locate the games.conf file
2. Backup the file
3. Open the games.conf file in a text editor
4. Append the game listing that you want based on the previous line
5. Close the file
6. Locate the showroms.lst file
7. Backup the file
8. Open the showroms.lst file
9. Based on where the rom was added in the list add it to the file
10. Close the file

showroms.lst

Showroms.lst is just a listing of roms that will be presented in the launcher. The order in the list will set the order of the games in the launcher itself. These are the ROM NAMES and NOT THE GAME NAMES.

Tweaking the frontend:

The frontend can easily be hacked by editing the files in OS/usr/emu/xrun. There are several files in here, so you might have to do a litle trial and error based on your board revision. Look for xrun320240.conf and xrun640480.conf or something similar. These allow you to set where the game list is onscreen, the size, font, background image, etc. More information on this can be found on the Lemonlauncher site.

Resizing the partitions:

The standard card that ships with these boards is a 4gb SD card. Of which, about 300mb in total is used. Fortunately, the loader only checks where the start point is for each partition. Since roms are stored on the OS partition, and this is the last partition, you should be able to resize it without much effort. I recommend gparted but another tool that allows for resizing should work as well. As always, backup everything before you try this.

Adding additional support:

The emus from the 355 can be added to the 128/138 board. There should be no difference in hardware. Take the zip file and decompress it to the root of the partition with the other emulators. You will have a new directory called "aemu." To use this emulator you need to edit the xrunh config file to allow it and also the games.conf with the new games. Edit the lines in xrunh to look like this:

emu2 = "cd /sdcard/aemu; ./nemu %r -sr 5 -d8"
emu3 = "cd /sdcard/aemu; ./aemu %r -sr 5"
emu4 = "cd /sdcard/aemu; ./nemu %r -sr 5"
emu5 = "cd /sdcard/aemu; ./aemu %r -sr 0"

then just edit games.conf with the games you want. Be sure to let the frontend know that you are using one of those emus.

What works?

Don't expect miracles from this little ARM board. With some trial-and-error most 8-bit CPU based games should run fine. Some 16-bit should work well with the updated binary.

Binaries of interest:

The mame executables are in the first partition. The binaries are:

xemu-pure MAME. xmame .106 to be exact
xrunmh-LemonLauncher
clsemuh-MAME4ALL horizontal
clsemuv-MAME4ALL vertical
xrunmv-LemonLauncher configured for vertical screens
nemu-Mame compiled just for neo geo
aemu-older mame that supports 2k+ games. CPS2 "sort of" supported.


So, to hack the board…you basically:
1. Disable the reboot command
2. Alter the games.conf file
3. Alter the showroms.lst file
4. Add your games to the roms directory
5. Add your snapshots to the snapshot directory


Thanks:

I'd like to thank the following people for their contributions on this project:

GoneMad - Provided the initial image of the SD for me to look at.
Raven - Sent me his original 128-in-1 board to explore and hack.
armi0024 - Provided me with the 276 and 355 versions of the board.
nixs - Provided the newer 138 and testing support
The lemonlauncher folks for providing insight on how their tool works, and for making a nice, lightweight emu frontend.
 
Last edited:
Great work guys! Maybe i can make use of the one i have sitting around here yet. It would be fine if it were limited to pre 1990 titles.
 
Cool... nice info. I assume that you wrote most of this up a while ago, so just wanted to toss a link over to the other thread, where there's a lot of other info: http://forums.arcade-museum.com/showthread.php?t=229853 .

These boards also have to have the cards flashed utilizing a specific tool that writes a bootloader based on the total block and sector count of the sd card. Since it would seem that no two SD cards are 100% identical in this respect, copying the card is not possible at this time.
I posted in post 502 and 503 on the other thread tell how to image to a different SD card, so it is possible. I also posted how to get to a shell on either the monitor or serial port, and BeagleBoy is building a different kernel for it. I also don't think there's anything special about the video... everything is drawn to the framebuffer /dev/fb0 (and a shell can be redirected to the monitor at /dev/tty1), and the frontend came up on the Raspberry Pi, so it can't be too special.

Maybe we can round up the technical info and move it over here, since that other thread has kinda grown out of control.

DogP
 
Yeah...I slapped it together from my notes and some of them are rather old.

I got the launcher to come up as well on the pi but Mame is not working. I'll post the error. If we can compile on the Raspberry Pi then that'd be awesome.
 
Oh, I'll post the complete list of "supported" games and the emus later today.
 
I got the launcher to come up as well on the pi but Mame is not working.
Yeah, I haven't tried since I got my actual JAMMA board, but I had assumed it was related to being unable to communicate to its own hardware (either intentionally failing, because it couldn't read a S/N or something, or being unable to initialize the controls, audio, or some other chip).

DogP
 
Nope, there's some sort of library issue. It might be the video or something like that. Since I lack a dev board I can't do anything..

Another note, there might be a size limitation on the binaries, which would explain why there are so many different versions of mame(I have a bunch of the older versions of xmame in cold storage on my HD) they hacked out real support for a lot of things to make the binaries fit or something like that.

OBTW, in the code, that xswinit is what I think...I am going to check tonight, but I think it is the binary that controls the settings menu.
 
Here's the errors:

xemu: ./xemu: error while loading shared libraries: libserioicc.so: cannot open shared object file: No such file or directory

clsemuh: just tries to reboot
aemu: just tries to reboot
nemu: just tries to reboot

setdefault: just tries to reboot

Need to get something built on this thing...this is frustrating
 
Some more info...

It is running the 2.6 kernel, 2.6.36-FriendlyARM #220 PREEMPT

ALSA reports the sound card as MINI6410. Not sure about video but all the commands are being handled via busybox.

Video reported as S3C-Media
 
Last edited:
The board has 256mb of RAM.

Sorry about the file posting. I didn't know where to stick them.
 
Just tried booting watching the port. I get this error:

sd boot v1.21 384-60

DRAM: 256 MB
Flash: 0 kB
NAND: No NAND device found!!!
0 MB
MMC: SD 2.0 SDHC / Manufacturer: 0x00,OEM: "",REV: 0.0,S/N: 1044675951,DATE: 2011/11
SDHC size: 3830 MiB
Freq = 50MHz
defev.

read error.## Booting image at c0008000 ...
Boot with Image
 
What are you actually running (original image, one of the OEM board images, etc)? If you're just trying to boot your original image on another SD card, look at the version of the "sd boot" on the original card (look at the serial output while booting that one).

I posted both v1.21 and v1.1... if it's neither of them, you'll probably need to extract the bootloader and load it to the new card (v1.21 wouldn't work on the image with v1.1... I don't know if there are more versions, and if any of them are compatible).

DogP
 
I'm not going to have time to work on this for a couple of days.

Can one of you verify if /dev/mem exists on the stock system?
 
Yeah I can check tonight. I'm pretty certain that it does. I think I cat'ed that directory at some point to see what was in there.
 
Gamelsts

I know theres a whole new thread on this
but those gamelists are not 100% most of those games will not work.
unless there's some kind of protection of what games work.
all the mame4all games work as far as i can see .


cheers
 
Is this all on the sd card? If think it would be easier for me to just have someone else do this for me and I just buy the.modified card and plug it in...
 
Back
Top Bottom