Super Retro-Cade

[kuwanger]

So, after reading about the R-Type 3&Super R-Type thing, I decided to get a Super Retro-Cade. After ordering, I actually bothered to check, and yes, it's another another one of those systems where there was accusations that it uses Retroarch cores that specifically prohibit commercial sale. So, I decided to not cancel the order and do some snooping because even though I've searched a lot, I only found innuendo so far (and pretty strong implications).

Anyways, the Super Retro-Cade arrived, and I went to work hacking it. First was just trying out a keyboard. As another person noted, Ctrl+Alt+Del works. But so do the Magic SysRq keys strongly implying they're using Linux as a basis--so possibly add the lack of source to the infraction list. I ended up trying to use another system to connect through USB but that didn't get very far, so I tried to do something more crazy. Someone mentioned the CPU was an H8 not unlike an Orange Pi. So, the answer was obvious: see if a Lakka image would boot off the SD card.

Turns out, it does--specifically I tried the Orange Pi Lite image, although it looks like the difference is in the uEnv.txt on what .dtb file (and maybe mapping) is used. From there it was trivial to get a shell. So, among other things I can confirm:

CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
Memory: 180900K/262144K available (7168K kernel code, 336K rwdata, 1572K rodata, 3072K init, 274K bss, 15708K reserved, 65536K cma-reserved, 0K highmem)
/cpus/cpu@0 missing clock-frequency property
/cpus/cpu@1 missing clock-frequency property
/cpus/cpu@2 missing clock-frequency property
/cpus/cpu@3 missing clock-frequency property
SMP: Total of 4 processors activated (192.00 BogoMIPS).

Checking under sys and I found out the max cpu clock frequency is 1.2GHz. All well and good, but the real problem is this:

[    1.021748] sunxi-mmc 1c0f000.mmc: Got CD GPIO
[    1.072321] sunxi-mmc 1c0f000.mmc: base:0xd085e000 irq:25
[    1.119616] mmc0: host does not support reading read-only switch, assuming write-enable
[    1.122649] mmc0: new high speed SDHC card at address c552
[    1.122979] mmcblk0: mmc0:c552 SU04G 3.69 GiB
[    1.128004]  mmcblk0: p1 p2
[    1.132354] sunxi-mmc 1c10000.mmc: base:0xd087a000 irq:26

That is, the SDHC card is being mapped to an MMC but there seems to be another MMC which I presume is the onboard storage containing all the roms, emulators, etc. I have limited understanding of MMCs and don't know how to map them to a device--clearly the kernel isn't doing it automatically. My limited understanding is that different MMCs might require different drivers. Or is this a matter of changing uEnv.txt to properly map it in? Or am I entirely wrong and is this just a second alias of the first device?

Edit3: Instructions to access/dump the Super Retro-Cade (1-7). Currently trying to use Lakka is a bad idea as everything pressed on the keyboard goes to terminal so you may accidentally run commands in the background. Note: These steps haven't been verified by anyone else but me so far.

To duplicate what I did you'll need an SD card ~1GB or bigger and for accessing/dumping some experience with the *nix shell:

1) Go to to http://lakka.tv.
2) Click Get and follow the steps to get the "Allwinner Orange Pi" image, "OrgangePi Lite" and write the image.
3) Boot once to allow the auto-resize of storage
4) On one partition is "uEnv.txt". Change the first line to read: "bootargs=console=ttyS0,115200 console=tty0 boot=/dev/mmcblk0p1 disk=/dev/mmcblk0p2 consoleblank=0 quiet tty retroarch=0" (ie add "tty retroarch=0" to the end) to enable a terminal and disable auto starting retroarch service
5) On the second line change "sun8i-h3-orangepi-lite" to "sun8i-h3-bananapi-m2-plus" (or "sun8i-h3-orangepi-pc-plus.dtb" may work the same/better).
6) Put the SD into the Super Retro-Cade and let it boot up. You should end up with a Lakk:a# prompt in the corner. It should auto mount the nand/emmc/whatever to /storage/roms/<different partition names>
7) Use a keyboard connected to one of the USB ports and look in /storage/roms/. mmcblk2p1-... is partition one with the android system. mmcblk2p7-... is external/interal SD in Android parlance? Games are in mmcblk2p7-.../media/GAME. You can't simply add games there because the list needs updated somehow (possibly mmcblk2p1-.../data/com.cx.gamelaunchxc/files/gamelist.db).

 

[WD_GASTER2]

I looked into this a few months ago. Nice find on the SD card boot. on my end i tried to get it to boot into recovery mode. h8 SOC's usually have a way to do this, but was not able to find a way. if you are able to boot it this way, the question would be if the nand could be dumped, modified and then reflashed to an SD card and booted from there.

 

[kuwanger]

A bit more fiddling, and I'm fairly certain it's Android based. A few of my keyboard's multimedia keys work--power and mute specifically--which both invoke the Android UI and behave accordingly. I'm also fairly certain the actually CPU is an H2/3 as the v7 Allwinner lines that include Mali-400 are those. Simply changing the dts wasn't very successful. As others have noted, the mouse doesn't do much. So, I've not gotten very far and would entertain ideas.

 

[ArugulaZ]

I've cracked the thing open out of curiosity and can tell you this... it doesn't have an internal USB port the way the Genesis Flashback HD did. There are three mysterious empty holes on the motherboard, however. I've asked around on the AtariAge forum and I'm told this is an older communication standard, LPT I think. You can access data from the Super Retro Cade if you wire up those three holes. Hopefully that will offer some assistance. Thanks for tackling this project, by the way.

 

[kuwanger]

I'm not really a hardware guy. I actually tried cracking mine open and only saw three screws. Was there a fourth under some plastic or was my efforts to pry it open unsuccessful for some other reason? Is there any chance you could take a photo of the underside of the board? It looks the upper two chips are the same type so I presume they're RAM--I can't make out the text to do a search to verify that. Personally, I'd think the best bet would be to simply figure out how to get my Lakka image so it can recognize whatever storage the device uses. If so, it'd be pretty trivial for others to dump and possibly modify their own units as well.

Oh, and another small note. I did actually try out Retroarch from Lakka. Everything seems to work fine and was able to get gba games to work. The frame rate didn't make much sense though: the rate would be ~55-56 fps but turning off frame throttling and it'd easily say in the 70 fps range. I've seen this on other boards and don't know the why. If nothing else if that could be worked out, people could always just use Lakka or some other Linux distro.

 

[WD_GASTER2]

the 3 "holes" is a tx rx interface. its used to program cell phones. i thought of buying a tool but since documentation on how to fiddle with anything there is non-existent i didnt bother.
if you all want to know what needs to be done to allow fiddling?
-nand needs to be dumped
-image decompiled
-settings .db needs to be edited to enable adb
-let homebrew begin!

that being said since i have no idea it could be achieved with this device its a moot point for me. lol.
for anyone wondering it looks like its running android 5.0 or later and about 1gb of ram.

 

[kuwanger]

And a little bit more finagling, I used "sun8i-h3-bananapi-m2-plus.dtb" on my Orange Pi Lite image and was able to dump the whole contents of internal memory. I presume you can use the Lakka Banana Pi image directly, but I haven't bothered to test it. Of interest:

Filesystem                Size      Used Available Use% Mounted on
...
/dev/mmcblk2p16         495.9M    384.0K    485.3M   0% /storage/roms/mmcblk2p16-57f8f4bc-abf4-655f-b
/dev/mmcblk2p1            1.5G     54.1M      1.4G   4% /storage/roms/mmcblk2p1-mmc-4FPD3R_0x5e984c6
/dev/mmcblk2p12          16.0M      4.0K     15.9M   0% /storage/roms/mmcblk2p12-2E6C-07B2
/dev/mmcblk2p7          619.9M    400.5M    206.7M  66% /storage/roms/mmcblk2p7-mmc-4FPD3R_0x5e984c6
/dev/mmcblk2p2          127.7M      7.6M    120.2M   6% /storage/roms/Volumn

With the games stored on mmcblk2p7-mmc-4FPD3R_0x5e984c6 and using only ~141MB (including thumbnails). So, there's lots of room to add more directly to the system.

Also of interest on the same partition under lib/cores/:

fceumm_libretro_android.so
genesis_plus_gx_libretro_android.so
libMAME4droid.so
mame2003_libretro_android.so
mednafen_supergrafx_libretro_android.so
mgba_libretro_android.so
snes9x2010_libretro_android.so
vba_next_libretro_android.so

So, it definitely includes snes9x and is violating the license on it. One thing I'd note is the system has only 256MB of RAM, not 1GB. I'm not sure how to actually pull out the Android version from the filesystem, but it's definitely Android loading a gamelaunch.apk which contains a "libretroarch-activity.so". So, mystery solved.

 

[WD_GASTER2]

wow thats amazing. amazing job.
are you able to write back to the nand? also did you dump it by blocks or one whole image?

 

[Jhynjhiruu]

Hmm, this seems interesting. Watching...

 

[kuwanger]

are you able to write back to the nand? also did you dump it by blocks or one whole image?

I haven't actually checked if writes work, but I really see no reason why it shouldn't. I mean, I presume that's how save/states are stored. As far as dumping, I just did a filecopy. Right now I'm actually using dd/gzip to rip the whole mmcblk2. Hopefully it's less than ~2.4GB compressed since I only used a 4GB microSD.

Edit: Finished and it was only ~542MB compressed. You can definitely copy games over, but they don't appear in the list. I presume this has something to do with a gamelist.db (which seems to be in sqlite format and contain various descriptive data) in the data/com.cx.gamelaunchxc/files/ folder.

 

[WD_GASTER2]

I haven't actually checked if writes work, but I really see no reason why it shouldn't. I mean, I presume that's how save/states are stored. As far as dumping, I just did a filecopy. Right now I'm actually using dd/gzip to rip the whole mmcblk2. Hopefully it's less than ~2.4GB compressed since I only used a 4GB microSD.

Edit: Finished and it was only ~542MB compressed. You can definitely copy games over, but they don't appear in the list. I presume this has something to do with a gamelist.db (which seems to be in sqlite format and contain various descriptive data) in the data/com.cx.gamelaunchxc/files/ folder.

sending you a pm with a few questions if you dont mind. i am pretty sure you may have just found a way to run homebrew on this.
I am going to bed for a few hours. when i wake up i will dig mine up and lets see what we can do with this if its cool.

 

[ArugulaZ]

Kuwanger: Most likely you missed a screw under a sticker. Generally that's where this stuff gets hidden... either that or a rubber foot.

 

[kuwanger]

I wonder who chenguowen is:

Spoiler

# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=KOT49H
ro.build.display.id=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
ro.build.version.incremental=20170703
ro.build.version.sdk=19
ro.build.version.codename=REL
ro.build.date=2017年 07月 03日 星期一 18:24:50 CST
ro.build.date.utc=1499077490
ro.build.type=eng
ro.build.user=chenguowen
ro.build.host=sunchip
ro.build.tags=test-keys
ro.product.model=CXSD_H3
ro.product.brand=Allwinner
ro.product.name=dolphin_aliyun_p1
ro.product.device=dolphin_aliyun_p1
ro.product.board=exdroid
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=Allwinner
ro.wifi.channels=
ro.board.platform=dolphin
# ro.build.product is obsolete; use ro.product.device
ro.build.product=dolphin_aliyun_p1
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
ro.build.fingerprint=Allwinner/dolphin_aliyun_p1/dolphin_aliyun_p1:4.4.2/KOT49H/20170703:eng/test-keys
ro.build.characteristics=homlet
persist.sys.cpupower=3
# end build properties
#
# ADDITIONAL_BUILD_PROPERTIES
#
persist.sys.disp_density=160
ro.hwc.sysrsl=5
ro.yunos.product.chip=H3
ro.yunos.product.vendor=allwinner
ro.yunos.product.device=dolphin_aliyun_p1
persist.sys.yunosflag=0
net.pppoe.active=true
ro.config.notification_sound=OnTheHunt.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.tvos_codebase.version=2.2.0
ro.build.version.release=1.0.0-D-20170703.1824
sys.setcfg.ctp=true
ro.yunos.vm.jit_threshold_def=40
ro.yunos.vm.jit_codecache_def=1m
ro.yunos.vm.jit_threshold_low=1000
ro.yunos.vm.jit_codecache_low=256k
ro.platform.has.bluetooth=false
ro.product.locale.language=en
ro.product.locale.region=US
persist.sys.timezone=America/Chicago
drm.service.enabled=false
ro.softmouse.left.code=21
ro.softmouse.right.code=22
ro.softmouse.top.code=19
ro.softmouse.bottom.code=20
ro.softmouse.leftbtn.code=23
ro.softmouse.midbtn.code=-1
ro.softmouse.rightbtn.code=-1
ro.product.firmware=Homlet4.4.2-Qin2-v1.0rc1
audio.output.active=AUDIO_CODEC,AUDIO_HDMI
audio.input.active=AUDIO_CODEC
ro.sf.showhdmisettings=7
persist.sys.disp_init_exit=0
ro.kernel.android.checkjni=0
ro.opengles.version=196608
persist.sys.strictmode.visual=0
persist.sys.strictmode.disable=1
debug.hwc.showfps=0
persist.sys.disp_policy=3
persist.sys.hdmi_hpd=1
persist.sys.hdmi_rvthpd=0
persist.sys.cvbs_hpd=1
persist.sys.cvbs_rvthpd=0
ro.zygote.disable_gl_preload=true
persist.sys.usb.config=mtp,adb
ro.udisk.lable=dolphin
ro.adb.secure=0
ro.property.tabletUI=false
ro.property.fontScale=1.0
ro.sf.hwrotation=0
debug.hwui.render_dirty_regions=false
ro.property.max_video_height=2160
persist.evb_flag=1
ro.hwui.texture_cache_size=170
ro.hwui.layer_cache_size=135
ro.hwui.path_cache_size=34
ro.hwui.shap_cache_size=9
ro.hwui.drop_shadow_cache_size=17
ro.hwui.r_buffer_cache_size=17
ro.product.rom.type=YB
ro.product.rom.name=BoxRom
ro.sw.shortpressleadshut=true
ro.sw.directlypoweroff=true
persist.sys.country=US
persist.sys.language=en
persist.defaultHome=com.cx.gamelaunch
persist.defaultHomeClass=com.cx.gamelaunch.MainActivity
persist.sys.redKey=onkey_shurt
persist.sys.redKeyClass=onkey_shurt
persist.sys.blueKey=onkey_shurt
persist.sys.blueKeyClass=onkey_shurt
persist.sys.yellowKey=onkey_shurt
persist.sys.yellowKeyClass=onkey_shurt
persist.sys.greenKey=onkey_shurt
persist.sys.greenKeyClass=onkey_shurt
sys.mem.opt=true
ro.process.num=4
dalvik.vm.heapstartsize=4m
dalvik.vm.heapgrowthlimit=36m
persist.sys.dalvik.vm.lib=libdvm.so
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
# begin fota properties
ro.fota.platform=AW_H3_KK
ro.fota.type=box
ro.fota.oem=sunchipH3_KK
ro.fota.device=CXSD_H3
ro.fota.version=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
# end fota properties

from build.prop. Looked in settings.db and adb_enabled is 1. No idea if it's possible to get that to actually work over usb. No xpad.ko module, which explains why a lot of controllers don't work. Funny enough there is snd-usb-audio.ko and snd-usbmidi-lib.ko and libdrmdecrypt.so. At least according to the spec on the H3 it can do hardware assisted decoding of a lot of video at 1080p/4K so I guess it makes sense...

A (should be) complete file listing

 

[WD_GASTER2]

ok im out to buy an sd card to go to town with this. hopefully it should all go easy peasy

 

[SonicMC]

Any guess if this would work on the retrobit generations? Would love to dump the games off it to play on something else; or change the emulators to something that runs better.

 

[kuwanger]

I'd tend to say no. Retro-bit Generations supposedly uses a low-end MIPS processor. Lakka uses a variety of ARM/x86 CPUs as a base for its distro(s). Having said that, you could try one of the MIPS Linux distros and see if any of those boot, but that's very much a shot in the dark. If I hadn't been told the CPU was H3 I would have had to randomly check through the 63 device table blobs (basically hardware descriptions) for Linux for Lakka vs the ~14 for just H3. Maybe MIPS is a lot less insane, though and any old image will work. *shrug* ARM is pretty stupid.

 

[WD_GASTER2]

yep h8 sd card bootable images tend to play nicely. attempting to boot linaro on it as i type this.

cubieboard h8 images dont output video on boot. T_T oh well. back to booting lakka

 

[WD_GASTER2]

ok i got all the wat to /storage/roms/

is there a way to dump the system partition to the sd card? do you which would be the command from here?

edit
df -h did the trick.

 

[WD_GASTER2]

ok I can confirm at this time that homebrew (and also 3rd party apks)can run on this machine!
a dirty port of the generations dash is now launching (will need to be fully ported and tweaked to work properly)
md.emu runs amazing!!!! ( 60fps even with some filters, yay!!!)
took a lot of fidgeting but it works. lol.

 

[kuwanger]

That's good to hear. I tried a lot to poke around with the nand image and was able to find a .dtb file to use as a basis for Lakka. One frustrating part about being Android based is the input lag. Maybe someone more familiar with Allwinner boards could figure out how to generate the right setup. The funny part is I only in the last day or two really started playing some of the games (other than the R-Type ones).