1. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    So, after reading about the R-Type 3&Super R-Type thing, I decided to get a Super Retro-Cade. After ordering, I actually bothered to check, and yes, it's another another one of those systems where there was accusations that it uses Retroarch cores that specifically prohibit commercial sale. So, I decided to not cancel the order and do some snooping because even though I've searched a lot, I only found innuendo so far (and pretty strong implications).

    Anyways, the Super Retro-Cade arrived, and I went to work hacking it. First was just trying out a keyboard. As another person noted, Ctrl+Alt+Del works. But so do the Magic SysRq keys strongly implying they're using Linux as a basis--so possibly add the lack of source to the infraction list. I ended up trying to use another system to connect through USB but that didn't get very far, so I tried to do something more crazy. Someone mentioned the CPU was an H8 not unlike an Orange Pi. So, the answer was obvious: see if a Lakka image would boot off the SD card.

    Turns out, it does--specifically I tried the Orange Pi Lite image, although it looks like the difference is in the uEnv.txt on what .dtb file (and maybe mapping) is used. From there it was trivial to get a shell. So, among other things I can confirm:

    Code:
    CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
    Memory: 180900K/262144K available (7168K kernel code, 336K rwdata, 1572K rodata, 3072K init, 274K bss, 15708K reserved, 65536K cma-reserved, 0K highmem)
    /cpus/[email protected] missing clock-frequency property
    /cpus/[email protected] missing clock-frequency property
    /cpus/[email protected] missing clock-frequency property
    /cpus/[email protected] missing clock-frequency property
    SMP: Total of 4 processors activated (192.00 BogoMIPS).
    
    Checking under sys and I found out the max cpu clock frequency is 1.2GHz. All well and good, but the real problem is this:

    Code:
    [    1.021748] sunxi-mmc 1c0f000.mmc: Got CD GPIO
    [    1.072321] sunxi-mmc 1c0f000.mmc: base:0xd085e000 irq:25
    [    1.119616] mmc0: host does not support reading read-only switch, assuming write-enable
    [    1.122649] mmc0: new high speed SDHC card at address c552
    [    1.122979] mmcblk0: mmc0:c552 SU04G 3.69 GiB
    [    1.128004]  mmcblk0: p1 p2
    [    1.132354] sunxi-mmc 1c10000.mmc: base:0xd087a000 irq:26
    
    That is, the SDHC card is being mapped to an MMC but there seems to be another MMC which I presume is the onboard storage containing all the roms, emulators, etc. I have limited understanding of MMCs and don't know how to map them to a device--clearly the kernel isn't doing it automatically. My limited understanding is that different MMCs might require different drivers. Or is this a matter of changing uEnv.txt to properly map it in? Or am I entirely wrong and is this just a second alias of the first device?

    Edit3: Instructions to access/dump the Super Retro-Cade (1-7). Currently trying to use Lakka is a bad idea as everything pressed on the keyboard goes to terminal so you may accidentally run commands in the background. Note: These steps haven't been verified by anyone else but me so far.

    To duplicate what I did you'll need an SD card ~1GB or bigger and for accessing/dumping some experience with the *nix shell:

    1) Go to to http://lakka.tv.
    2) Click Get and follow the steps to get the "Allwinner Orange Pi" image, "OrgangePi Lite" and write the image.
    3) Boot once to allow the auto-resize of storage
    4) On one partition is "uEnv.txt". Change the first line to read: "bootargs=console=ttyS0,115200 console=tty0 boot=/dev/mmcblk0p1 disk=/dev/mmcblk0p2 consoleblank=0 quiet tty retroarch=0" (ie add "tty retroarch=0" to the end) to enable a terminal and disable auto starting retroarch service
    5) On the second line change "sun8i-h3-orangepi-lite" to "sun8i-h3-bananapi-m2-plus" (or "sun8i-h3-orangepi-pc-plus.dtb" may work the same/better).
    6) Put the SD into the Super Retro-Cade and let it boot up. You should end up with a Lakk:a# prompt in the corner. It should auto mount the nand/emmc/whatever to /storage/roms/<different partition names>
    7) Use a keyboard connected to one of the USB ports and look in /storage/roms/. mmcblk2p1-... is partition one with the android system. mmcblk2p7-... is external/interal SD in Android parlance? Games are in mmcblk2p7-.../media/GAME. You can't simply add games there because the list needs updated somehow (possibly mmcblk2p1-.../data/com.cx.gamelaunchxc/files/gamelist.db).
     
    Last edited by kuwanger, Jun 13, 2019
  2. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    I looked into this a few months ago. Nice find on the SD card boot. on my end i tried to get it to boot into recovery mode. h8 SOC's usually have a way to do this, but was not able to find a way. if you are able to boot it this way, the question would be if the nand could be dumped, modified and then reflashed to an SD card and booted from there.
     
  3. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    A bit more fiddling, and I'm fairly certain it's Android based. A few of my keyboard's multimedia keys work--power and mute specifically--which both invoke the Android UI and behave accordingly. I'm also fairly certain the actually CPU is an H2/3 as the v7 Allwinner lines that include Mali-400 are those. Simply changing the dts wasn't very successful. As others have noted, the mouse doesn't do much. So, I've not gotten very far and would entertain ideas.
     
  4. ArugulaZ

    ArugulaZ GBAtemp Advanced Fan
    Member

    Joined:
    Sep 17, 2009
    Messages:
    664
    Country:
    United States
    [​IMG]

    [​IMG]

    I've cracked the thing open out of curiosity and can tell you this... it doesn't have an internal USB port the way the Genesis Flashback HD did. There are three mysterious empty holes on the motherboard, however. I've asked around on the AtariAge forum and I'm told this is an older communication standard, LPT I think. You can access data from the Super Retro Cade if you wire up those three holes. Hopefully that will offer some assistance. Thanks for tackling this project, by the way.
     
  5. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    I'm not really a hardware guy. I actually tried cracking mine open and only saw three screws. Was there a fourth under some plastic or was my efforts to pry it open unsuccessful for some other reason? Is there any chance you could take a photo of the underside of the board? It looks the upper two chips are the same type so I presume they're RAM--I can't make out the text to do a search to verify that. Personally, I'd think the best bet would be to simply figure out how to get my Lakka image so it can recognize whatever storage the device uses. If so, it'd be pretty trivial for others to dump and possibly modify their own units as well.

    Oh, and another small note. I did actually try out Retroarch from Lakka. Everything seems to work fine and was able to get gba games to work. The frame rate didn't make much sense though: the rate would be ~55-56 fps but turning off frame throttling and it'd easily say in the 70 fps range. I've seen this on other boards and don't know the why. If nothing else if that could be worked out, people could always just use Lakka or some other Linux distro.
     
  6. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    the 3 "holes" is a tx rx interface. its used to program cell phones. i thought of buying a tool but since documentation on how to fiddle with anything there is non-existent i didnt bother.
    if you all want to know what needs to be done to allow fiddling?
    -nand needs to be dumped
    -image decompiled
    -settings .db needs to be edited to enable adb
    -let homebrew begin!

    that being said since i have no idea it could be achieved with this device its a moot point for me. lol.
    for anyone wondering it looks like its running android 5.0 or later and about 1gb of ram.
     
  7. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    And a little bit more finagling, I used "sun8i-h3-bananapi-m2-plus.dtb" on my Orange Pi Lite image and was able to dump the whole contents of internal memory. I presume you can use the Lakka Banana Pi image directly, but I haven't bothered to test it. Of interest:

    Code:
    Filesystem                Size      Used Available Use% Mounted on
    ...
    /dev/mmcblk2p16         495.9M    384.0K    485.3M   0% /storage/roms/mmcblk2p16-57f8f4bc-abf4-655f-b
    /dev/mmcblk2p1            1.5G     54.1M      1.4G   4% /storage/roms/mmcblk2p1-mmc-4FPD3R_0x5e984c6
    /dev/mmcblk2p12          16.0M      4.0K     15.9M   0% /storage/roms/mmcblk2p12-2E6C-07B2
    /dev/mmcblk2p7          619.9M    400.5M    206.7M  66% /storage/roms/mmcblk2p7-mmc-4FPD3R_0x5e984c6
    /dev/mmcblk2p2          127.7M      7.6M    120.2M   6% /storage/roms/Volumn
    
    With the games stored on mmcblk2p7-mmc-4FPD3R_0x5e984c6 and using only ~141MB (including thumbnails). So, there's lots of room to add more directly to the system.

    Also of interest on the same partition under lib/cores/:

    Code:
    fceumm_libretro_android.so
    genesis_plus_gx_libretro_android.so
    libMAME4droid.so
    mame2003_libretro_android.so
    mednafen_supergrafx_libretro_android.so
    mgba_libretro_android.so
    snes9x2010_libretro_android.so
    vba_next_libretro_android.so
    
    So, it definitely includes snes9x and is violating the license on it. One thing I'd note is the system has only 256MB of RAM, not 1GB. I'm not sure how to actually pull out the Android version from the filesystem, but it's definitely Android loading a gamelaunch.apk which contains a "libretroarch-activity.so". So, mystery solved.
     
  8. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    wow thats amazing. amazing job.
    are you able to write back to the nand? also did you dump it by blocks or one whole image?
     
    Last edited by WD_GASTER2, Sep 30, 2018
  9. Jhynjhiruu

    Jhynjhiruu GBAtemp Advanced Fan
    Member

    Joined:
    Dec 31, 2016
    Messages:
    817
    Country:
    Hmm, this seems interesting. Watching...
     
  10. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    I haven't actually checked if writes work, but I really see no reason why it shouldn't. I mean, I presume that's how save/states are stored. As far as dumping, I just did a filecopy. Right now I'm actually using dd/gzip to rip the whole mmcblk2. Hopefully it's less than ~2.4GB compressed since I only used a 4GB microSD. :)

    Edit: Finished and it was only ~542MB compressed. You can definitely copy games over, but they don't appear in the list. I presume this has something to do with a gamelist.db (which seems to be in sqlite format and contain various descriptive data) in the data/com.cx.gamelaunchxc/files/ folder.
     
    Last edited by kuwanger, Sep 30, 2018
  11. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    sending you a pm with a few questions if you dont mind. i am pretty sure you may have just found a way to run homebrew on this.
    I am going to bed for a few hours. when i wake up i will dig mine up and lets see what we can do with this if its cool.
     
    Last edited by WD_GASTER2, Sep 30, 2018
  12. ArugulaZ

    ArugulaZ GBAtemp Advanced Fan
    Member

    Joined:
    Sep 17, 2009
    Messages:
    664
    Country:
    United States
    Kuwanger: Most likely you missed a screw under a sticker. Generally that's where this stuff gets hidden... either that or a rubber foot.
     
  13. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    I wonder who chenguowen is:

    Code:
    # begin build properties
    # autogenerated by buildinfo.sh
    ro.build.id=KOT49H
    ro.build.display.id=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
    ro.build.version.incremental=20170703
    ro.build.version.sdk=19
    ro.build.version.codename=REL
    ro.build.date=2017年 07月 03日 星期一 18:24:50 CST
    ro.build.date.utc=1499077490
    ro.build.type=eng
    ro.build.user=chenguowen
    ro.build.host=sunchip
    ro.build.tags=test-keys
    ro.product.model=CXSD_H3
    ro.product.brand=Allwinner
    ro.product.name=dolphin_aliyun_p1
    ro.product.device=dolphin_aliyun_p1
    ro.product.board=exdroid
    ro.product.cpu.abi=armeabi-v7a
    ro.product.cpu.abi2=armeabi
    ro.product.manufacturer=Allwinner
    ro.wifi.channels=
    ro.board.platform=dolphin
    # ro.build.product is obsolete; use ro.product.device
    ro.build.product=dolphin_aliyun_p1
    # Do not try to parse ro.build.description or .fingerprint
    ro.build.description=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
    ro.build.fingerprint=Allwinner/dolphin_aliyun_p1/dolphin_aliyun_p1:4.4.2/KOT49H/20170703:eng/test-keys
    ro.build.characteristics=homlet
    persist.sys.cpupower=3
    # end build properties
    #
    # ADDITIONAL_BUILD_PROPERTIES
    #
    persist.sys.disp_density=160
    ro.hwc.sysrsl=5
    ro.yunos.product.chip=H3
    ro.yunos.product.vendor=allwinner
    ro.yunos.product.device=dolphin_aliyun_p1
    persist.sys.yunosflag=0
    net.pppoe.active=true
    ro.config.notification_sound=OnTheHunt.ogg
    ro.config.alarm_alert=Alarm_Classic.ogg
    ro.tvos_codebase.version=2.2.0
    ro.build.version.release=1.0.0-D-20170703.1824
    sys.setcfg.ctp=true
    ro.yunos.vm.jit_threshold_def=40
    ro.yunos.vm.jit_codecache_def=1m
    ro.yunos.vm.jit_threshold_low=1000
    ro.yunos.vm.jit_codecache_low=256k
    ro.platform.has.bluetooth=false
    ro.product.locale.language=en
    ro.product.locale.region=US
    persist.sys.timezone=America/Chicago
    drm.service.enabled=false
    ro.softmouse.left.code=21
    ro.softmouse.right.code=22
    ro.softmouse.top.code=19
    ro.softmouse.bottom.code=20
    ro.softmouse.leftbtn.code=23
    ro.softmouse.midbtn.code=-1
    ro.softmouse.rightbtn.code=-1
    ro.product.firmware=Homlet4.4.2-Qin2-v1.0rc1
    audio.output.active=AUDIO_CODEC,AUDIO_HDMI
    audio.input.active=AUDIO_CODEC
    ro.sf.showhdmisettings=7
    persist.sys.disp_init_exit=0
    ro.kernel.android.checkjni=0
    ro.opengles.version=196608
    persist.sys.strictmode.visual=0
    persist.sys.strictmode.disable=1
    debug.hwc.showfps=0
    persist.sys.disp_policy=3
    persist.sys.hdmi_hpd=1
    persist.sys.hdmi_rvthpd=0
    persist.sys.cvbs_hpd=1
    persist.sys.cvbs_rvthpd=0
    ro.zygote.disable_gl_preload=true
    persist.sys.usb.config=mtp,adb
    ro.udisk.lable=dolphin
    ro.adb.secure=0
    ro.property.tabletUI=false
    ro.property.fontScale=1.0
    ro.sf.hwrotation=0
    debug.hwui.render_dirty_regions=false
    ro.property.max_video_height=2160
    persist.evb_flag=1
    ro.hwui.texture_cache_size=170
    ro.hwui.layer_cache_size=135
    ro.hwui.path_cache_size=34
    ro.hwui.shap_cache_size=9
    ro.hwui.drop_shadow_cache_size=17
    ro.hwui.r_buffer_cache_size=17
    ro.product.rom.type=YB
    ro.product.rom.name=BoxRom
    ro.sw.shortpressleadshut=true
    ro.sw.directlypoweroff=true
    persist.sys.country=US
    persist.sys.language=en
    persist.defaultHome=com.cx.gamelaunch
    persist.defaultHomeClass=com.cx.gamelaunch.MainActivity
    persist.sys.redKey=onkey_shurt
    persist.sys.redKeyClass=onkey_shurt
    persist.sys.blueKey=onkey_shurt
    persist.sys.blueKeyClass=onkey_shurt
    persist.sys.yellowKey=onkey_shurt
    persist.sys.yellowKeyClass=onkey_shurt
    persist.sys.greenKey=onkey_shurt
    persist.sys.greenKeyClass=onkey_shurt
    sys.mem.opt=true
    ro.process.num=4
    dalvik.vm.heapstartsize=4m
    dalvik.vm.heapgrowthlimit=36m
    persist.sys.dalvik.vm.lib=libdvm.so
    dalvik.vm.dexopt-flags=m=y
    net.bt.name=Android
    dalvik.vm.stack-trace-file=/data/anr/traces.txt
    # begin fota properties
    ro.fota.platform=AW_H3_KK
    ro.fota.type=box
    ro.fota.oem=sunchipH3_KK
    ro.fota.device=CXSD_H3
    ro.fota.version=dolphin_aliyun_p1-eng 4.4.2 KOT49H 20170703 test-keys
    # end fota properties
    

    from build.prop. Looked in settings.db and adb_enabled is 1. No idea if it's possible to get that to actually work over usb. No xpad.ko module, which explains why a lot of controllers don't work. Funny enough there is snd-usb-audio.ko and snd-usbmidi-lib.ko and libdrmdecrypt.so. At least according to the spec on the H3 it can do hardware assisted decoding of a lot of video at 1080p/4K so I guess it makes sense...

    A (should be) complete file listing
     
  14. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    ok im out to buy an sd card to go to town with this. hopefully it should all go easy peasy
     
  15. SonicMC

    SonicMC GBAtemp Fan
    Member

    Joined:
    Dec 6, 2007
    Messages:
    324
    Country:
    United States
    Any guess if this would work on the retrobit generations? Would love to dump the games off it to play on something else; or change the emulators to something that runs better.
     
  16. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    I'd tend to say no. Retro-bit Generations supposedly uses a low-end MIPS processor. Lakka uses a variety of ARM/x86 CPUs as a base for its distro(s). Having said that, you could try one of the MIPS Linux distros and see if any of those boot, but that's very much a shot in the dark. If I hadn't been told the CPU was H3 I would have had to randomly check through the 63 device table blobs (basically hardware descriptions) for Linux for Lakka vs the ~14 for just H3. Maybe MIPS is a lot less insane, though and any old image will work. *shrug* ARM is pretty stupid.
     
    Last edited by kuwanger, Sep 30, 2018
    SonicMC likes this.
  17. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    yep h8 sd card bootable images tend to play nicely. attempting to boot linaro on it as i type this.

    cubieboard h8 images dont output video on boot. T_T oh well. back to booting lakka
     
    Last edited by WD_GASTER2, Oct 1, 2018
  18. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    ok i got all the wat to /storage/roms/

    is there a way to dump the system partition to the sd card? do you which would be the command from here?

    edit
    df -h did the trick.
     
    Last edited by WD_GASTER2, Oct 1, 2018
  19. WD_GASTER2

    WD_GASTER2 scrublord extraordinaire!
    Developer

    Joined:
    Jun 17, 2018
    Messages:
    756
    Country:
    United States
    ok I can confirm at this time that homebrew (and also 3rd party apks)can run on this machine!
    a dirty port of the generations dash is now launching (will need to be fully ported and tweaked to work properly)
    md.emu runs amazing!!!! ( 60fps even with some filters, yay!!!)
    took a lot of fidgeting but it works. lol.
     
    Last edited by WD_GASTER2, Oct 4, 2018
  20. kuwanger

    OP kuwanger GBAtemp Advanced Maniac
    Member

    Joined:
    Jul 26, 2006
    Messages:
    1,510
    Country:
    United States
    That's good to hear. I tried a lot to poke around with the nand image and was able to find a .dtb file to use as a basis for Lakka. One frustrating part about being Android based is the input lag. Maybe someone more familiar with Allwinner boards could figure out how to generate the right setup. The funny part is I only in the last day or two really started playing some of the games (other than the R-Type ones). :)
     
    WD_GASTER2 likes this.
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Super, Retro,