NeoGeoX Hacking and Mods

[mr_b]

home.educities.edu.tw/fushiyun2000/neo_geo_x_hack_play_other_game.htm

And boom goes the dynamite. Good day NGX! There went all your support.

 

[fenikso]

I wonder if, down the line, we could hook up CD/DVD drives to the dock and play Neo CD games? That would be boss. I have a USB powered drive and would love to be able to hook it up to the NGX dock. I know someone will probably put an emulator on there for ISOs, but I have a few games and wouldn't mind playing them on the system.

Is such a thing possible, or am I shooting too high?

Anyone?

 

[lastcallhall]

Anyone?

the dock is essentially a port replicator with no real hardware of its own. Adding a CD drive to the NGX handheld (which contains the guts of the system would be extremely difficult, if not outright impossible. To say nothing of the way the two would interface with eachother...

 

[Tacitus]

the dock is essentially a port replicator with no real hardware of its own. Adding a CD drive to the NGX handheld (which contains the guts of the system would be extremely difficult, if not outright impossible. To say nothing of the way the two would interface with eachother...

What he meant was to add th CD drive via USB. That is absolutely possible.

 

[fenikso]

What he meant was to add th CD drive via USB. That is absolutely possible.

That would be so fecking awesome. NGCD, PSX, Turbo Duo, 3DO etc.

 

[Tacitus]

That would be so fecking awesome. NGCD, PSX, Turbo Duo, 3DO etc.

It should be very easy to do. You'd need to compile with driver but it may already have been inserted. Only way to test is to take a standard, compliant drive and plug it in via USB.

If there isn't source available for this build, there are others that are. Either way, you could absolutely hook up a USB CD drive and run an emu to access it.

 

[lastcallhall]

What he meant was to add th CD drive via USB. That is absolutely possible.

Ahh, that makes more sense.

 

[Fandangos]

So the NeoGeo X is a copy of a russian dingoo?

So... can you do the reverse? Port the NeoGeoX system for the dingoo?

 

[The Webmiester]

I've read most of this thread and didn't see this, but has anyone just thought about writing a program that would swap the bits around to be compatible with the way the NGX is wired up? So you craft your SD image the way you want, then run it through a program and dd it to the SD card?

edit: Oops nm, seems that this is covered in the Chinese website's opening paragraph.

 

[cabear]

And boom goes the dynamite. Good day NGX! There went all your support.

i love how it says "Hello!" on a few sentences.

ill probably be having a buddy of mine just mod the card slot pins instead of mess with an adapter. seems easier since i already have a 16gig sd card.

 

[mr_e]

I've read most of this thread and didn't see this, but has anyone just thought about writing a program that would swap the bits around to be compatible with the way the NGX is wired up? So you craft your SD image the way you want, then run it through a program and dd it to the SD card?

edit: Oops nm, seems that this is covered in the Chinese website's opening paragraph.

Ack has something along those lines in code snippits above as well. He did all this with software and folks kept rolling with the hardware mods. The magic to flashing your handset without opening it is in this thread too. The only thing left is for someone to create an image that doesnt boot straight into the NGX menu system, but another menu system instead(dmenu), allowing peeps to take advantage of the "hidden features" that are already in there. Then documenting the flash process cleanly. This thread is no longer the place for that considering all the shit that has crept in.

 

[nerdstick]

So based on the instructions for doing a firmware recovery on the rzx-50 I have been able to do the same with an empty internal sd card in my ngx.

The summary of how to do it is the following, and this only works on 32bit winxp or 32bit win7.

- download and decompress ftp://ftp.ingenic.cn:/3sw/JZ4770/01LinuxBsp/20110729/burn/usb_boot_burn-jz4770-20111025.rar
- open device manager in windows (makes it easier to see when the device is detected)
- with the ngx powered off, press and hold the start button and plug into your computer
- this will cause an unknown JZ4770 boot device to show up in device manager
- manually install the drivers that are from the rar
- unplug the ngx
- start USBbootTool.exe
- with the ngx powered off, press and hold the start button and plug into your computer

If you want to just do a full recovery, just pick your full internal sd image backup file for uboot.bin then click the checkbox to the left of uboot.bin. This should write it out to the internal sd card of the ngx, progress bar is at the bottom.

The USBbootTool.exe supports being able to write different files to different offsets within the internal sd card, these can be adjusted in tool_cfg/LinuxFileCfg.ini. The default one that you see when you start the tool is

[File1]
FileName=uboot.bin				
StartPage=0
NandOption=2

[File2]
FileName=uImage 				
StartPage=8192
NandOption=2

[File3]
FileName=filesystem
StartPage=24576
NandOption=2

The StartPage value * 512 represents where the file will be written to the internal sd card. So you can define your own offsets for where a specific file should be written, and not have to write out an entire image each time.

The full image replacement works with uboot.bin because its starting point is 0.

-ack

You need to make an image that contains the ngx's uboot and kernel and the RZX-50's userspace (rootfs/appfs/cfgfs). That by itself should make it bootable, but you will want to make the following changes to the userspace first.

Edit all dmenu.ini files (2x on appfs, 1x on cfgfs) and change ipen_rus to ipen_eng. This will make the menus english.

edit /etc/inittab on rootfs and add the following line

::respawn:/bin/udc_monitor

Then create a /bin/udc_monitor file on the rootfs (make sure to chmod 755) with the following in it

#!/bin/sh

# translate between ngx's way of handling udc and rzx
while [ 1 ];do
  USB_STATE=`cat /sys/devices/platform/musb_hdrc.0/uh_cable`

  if [ $USB_STATE == "usb" ]; then
    if [ ! -f /dev/udc_cable ]; then
     touch /dev/udc_cable
   fi
  else
    if [ -f /dev/udc_cable ]; then
      rm -f /dev/udc_cable;
    fi
  fi
  sleep 3
done

udc is the junk that has to do with the disk presented to windows when you plug in the device. Without it the device is 0 bytes.

There are still a number of issues that have to be worked out. The main one is the user interface is hiding files when it shouldn't.

-ack

The hidden file issue is fixed but editing demu_lock.ini on the appsfs and changing the value to 1

-ack

There is an easier way then this if you have kpartx installed.

# ls -l
total 1931264
drwxr-xr-x 2 root root          6 Jan  1 11:20 appfs
drwxr-xr-x 2 root root          6 Jan  1 11:20 cfgfs
-rw-r--r-- 1 root root 1977614336 Jan  1 11:19 internal-ngx-rzx.img
drwxr-xr-x 2 root root          6 Jan  1 11:20 otherfs
drwxr-xr-x 2 root root          6 Jan  1 11:20 rootfs

# losetup -v -f internal-ngx-rzx.img 
Loop device is /dev/loop0

# kpartx -v -a /dev/loop0
add map loop0p1 (252:2): 0 983040 linear /dev/loop0 24576
add map loop0p2 (252:3): 0 266240 linear /dev/loop0 1007616
add map loop0p3 (252:4): 0 40960 linear /dev/loop0 1273856
add map loop0p4 (252:5): 0 2097152 linear /dev/loop0 1314816

# mount /dev/mapper/loop0p1 rootfs
# mount /dev/mapper/loop0p2 appfs
# mount /dev/mapper/loop0p3 cfgfs
# mount /dev/mapper/loop0p4 otherfs

To clean up after you have done whatever and umount'd.

# kpartx -v -d /dev/loop0
del devmap : loop0p4
del devmap : loop0p3
del devmap : loop0p2
del devmap : loop0p1
# losetup -d /dev/loop0

You want http://www.ritmixrussia.ru/static/downloads/FW/RZX/RZX-50/RZX-50_fw_121126.rar, its the official firmware from the manufacture.

I am recalling this from memory, but it should basicly be:

- take your stock ngx image and mount the root/app/cfg filesystems^1
- mount the filesystems in the above rar file too
- rsync the rzx filesystems over the ngx filesystems (ie: rsync -avr --delete rxz-rootfs/ ngx-rootfs/)
- do the above tweaks I talked about with the dmenu.ini/inittab/udc_monitor/dmenu_lock.ini stuff
- write image

[1] you may need to mkfs.ext3 the root/app/cfg filesystems on the ngx image first. I seem to remember there being a few issues, like the appfs not having enough inodes and filesystem corruption on the cfgfs.



I am unsure if its safe to write any existing firmware to the 370. The jz4770 supports both SD and NAND as the internal storage and I am unclear which one that chip maps to. I am pretty sure the SD and NAND boot loaders aren't the same.

On a side note I probably wont be doing any more poking on the ngx until the firmware/source for the GCW Zero comes out, which is based on the exact same chip and is suppose to be open source.

-ack

These are all of his posts. By using the usbtool software (on Windows 32-bit) you can reflash the internal SD using a backup through USB alone. Either an original rip or a modified version with swapped-roms, which I suppose is the only way to do it which involves no disassembly nor SD modification (although he's unsure how safe it is on anything other than a 337, beware).

Unlike the SD-mod, it would require no disassembly, little technical know-how once an image is shared, and could open the device fully for all sorts of emulators opposed to just neogeo like the SD option.

 

[FA-MAS]

I think I'm doing something wrong again. So I've got my modded sd card reader hooked up to my Mac.

I can read the Ninja Masters, I've taken a dd of the entire drive /dev/sdd in my case. I've written that back to another SD card. I thought dd was supposed to do an exact copy of the drive. But when I write it back to another card, it looks like it put the partition there. But card_game folder isn't there

So I took a dd of the Ninja Masters partition /dev/sdd1 and wrote it to the partition on the new card. The card_game folder is there.

Yet but when I put it in the NGX, it doesn't recognize it's there. Yet, according to my Mac, it appears identical, cept it's on a bigger card. What am I doing wrong?

Edit: Think maybe I'm over complicating it. The chinese site says could use a FAT16 or 32 partition. Should I just make the file system on the card and put the files there?

 

[cabear]

These are all of his posts. By using the usbtool software (on Windows 32-bit) you can reflash the internal SD using a backup through USB alone. Either an original rip or a modified version with swapped-roms, which I suppose is the only way to do it which involves no disassembly nor SD modification (although he's unsure how safe it is on anything other than a 337, beware).

yup it's just getting the proper files where they need to go. i have a 370 so ill be waiting a bit, but that tool is great for those that can take advantage of it. like mr_e said the answer's been there the whole time.

 

[Lord_Veacross]

Hello everyone!

I did something interesting last night, I copied the sys_update_file from the NGX to my computer. Than opened it with WordPad instead of NotePad, after about 45 seconds it displayed a very large gradient of junk ASCII. However after every or so "page" there were plain text announcements of directory changes memory address accesses and a few parent directories. I am not for sure if this would be helpful to anyone? I tried to cut out the garbage and tourniquet the plain text, but its wicked long and sometimes WordPad crashes without letting me save what I had done so far. But I feel it is at least worth a look for those looking for specific values and address's.

From what I can recall there is a lot of SD mnt failure announcements and a few specific commands with one ending in SNK go go go.

 

[ack]

I think I'm doing something wrong again. So I've got my modded sd card reader hooked up to my Mac.

Hi

You would need a modded sd card, not a modded sd card reader.

-ack

 

[FA-MAS]

Hi

You would need a modded sd card, not a modded sd card reader.

-ack

I think you misunderstood. I'm doing the same thing others are doing with the adapters. It's just I've wired up a full SD card slot to an external reader connected to my Mac.

 

[ack]

I think you misunderstood. I'm doing the same thing others are doing with the adapters. It's just I've wired up a full SD card slot to an external reader connected to my Mac.

You would want to do it like this

1. dd original ninjam sd card with no adapter to your hard drive, this will give you the scrambled image.
2. dd scrambled ninjam image to a sd card that is using your adapter, this will cause the data being written to your sd card to be unscrambled.
3a. put sd card with adapter into ngx, should see the ninjam.
and/or
3b. connect just the sd card to your computer, should see the partition/files.

Be aware that the ninjam partition table is bad and your mac may/may not allow you to mount it because of that.

-ack

 

[FA-MAS]

You would want to do it like this

1. dd original ninjam sd card with no adapter to your hard drive, this will give you the scrambled image.
2. dd scrambled ninjam image to a sd card that is using your adapter, this will cause the data being written to your sd card to be unscrambled.
3a. put sd card with adapter into ngx, should see the ninjam.
and/or
3b. connect just the sd card to your computer, should see the partition/files.

Be aware that the ninjam partition table is bad and your mac may/may not allow you to mount it because of that.

-ack

Well i don't have an adapter to plug into the NGX.

My plan was:
1. Using my modded card reader, unscramble and DD Ninja Masters.
2. Using my modded card reader, write that DD to another card, causing it to be scrambled to regular SD readers but readable by NGX.

Shouldn't that be possible, or is my logic wrong there?

 

[ack]

Well i don't have an adapter to plug into the NGX.

My plan was:
1. Using my modded card reader, unscramble and DD Ninja Masters.
2. Using my modded card reader, write that DD to another card, causing it to be scrambled to regular SD readers but readable by NGX.

Shouldn't that be possible, or is my logic wrong there?

It wont work. You need a modded SD card, check this post for details.

http://www.neo-geo.com/forums/showt...ing-and-Mods&p=3468058&viewfull=1#post3468058

-ack

 

[FA-MAS]

It wont work. You need a modded SD card, check this post for details.

http://www.neo-geo.com/forums/showt...ing-and-Mods&p=3468058&viewfull=1#post3468058

-ack

Ah, so even if I'm able to write the data to the card exactly, the NGX is initializing the card "swapped" which a regular SD card wouldn't do. I get it. Bummer.

 

[SlickDizzy]

It wont work. You need a modded SD card, check this post for details.

http://www.neo-geo.com/forums/showt...ing-and-Mods&p=3468058&viewfull=1#post3468058

-ack

So, wait...I'm not fully understanding your older post. Did you manage to spoof the NGX with an unmodified card somehow (!!!) or was that post assuming an already modded card is being used? Sorry if this question is a bit asinine, I've been keeping up well on the hardware modding side but the software stuff is where I get lost.

 

[ack]

So, wait...I'm not fully understanding your older post. Did you manage to spoof the NGX with an unmodified card somehow (!!!) or was that post assuming an already modded card is being used? Sorry if this question is a bit asinine, I've been keeping up well on the hardware modding side but the software stuff is where I get lost.

I was able to compile my own kernel to boot the ngx, but its missing some drivers that are part of the stock ngx kernel. You can monkey around in a shell and use usb networking, but snk_desktop crashes when you try to run it. I never looked into why it was crashing, it maybe something simple. The spoofing stuff I did was within my compiled kernel which made it so you could use any SD card that had the encoded data. It should be possible to add the decoding into the kernel itself so you could just use normal data on a normal SD card.

I had someone else ask about the kernel, so I am in the processing getting a patch together so others can compile their own.

-ack

 

[ack]

Hi

There is one correction to my previous post about merging the rzx and ngx images.

In the dmenu.ini files ipen_rus should be changed to ipen_en, not ipen_eng.

I also forgot about 2 additional files I changed related to the udc stuff.

in rootfs replace the contents of /usr/bin/udc_connect.sh with the following

#!/bin/sh
USB_STATE=`cat /sys/devices/platform/musb_hdrc.0/uh_cable`

if [ $USB_STATE == "usb" ]
then
        /bin/sync
        MMC_STATUS=`cat /proc/jz/mmc`
        MMC_NAME=`cat /var/MMCNAME`

        if [ $MMC_NAME != "no" ] && [ $MMC_STATUS == "INSERT" ]
        then
                umount -f /mnt/memory
#               umount -f /mnt/mmc
                echo /dev/mmcblk0p4 > /sys/devices/platform/musb_hdrc.0/gadget/gadget-lun0/file
#               echo /dev/$MMC_NAME > /sys/devices/platform/musb_hdrc.0/gadget/gadget-lun1/file
        else
                umount -f /mnt/memory
                echo /dev/mmcblk0p4 > /sys/devices/platform/musb_hdrc.0/gadget/gadget-lun0/file

        fi
fi

in rootfs replace the contents of /usr/bin/udc_disconnect.sh with the following

#!/bin/sh

    echo "" > /sys/devices/platform/musb_hdrc.0/gadget/gadget-lun0/file
#    echo "" > /sys/devices/platform/musb_hdrc.0/gadget/gadget-lun1/file
    /bin/mount -t vfat -o rw,utf8 /dev/mmcblk0p4 /mnt/memory

#    MMC_STATUS=`cat /proc/jz/mmc`
#    MMC_NAME=`cat /var/MMCNAME`
#    if [ $MMC_NAME != "no" ] && [ $MMC_STATUS == "INSERT" ] 
#       then
#       /bin/mount -t vfat -o rw,utf8,noatime /dev/$MMC_NAME /mnt/mmc
#    fi
        /bin/sync

-ack

 

[ack]

Here is patch/config for the kernel I was messing with.

http://www.gotwalls.com/neogeox/linux-2.6.31.3-ngxack-v0.config
http://www.gotwalls.com/neogeox/linux-2.6.31.3-ngxack-v0.diff

The patch should be applied on top of the following patch

ftp://ftp.ingenic.cn:/3sw/JZ4770/01LinuxBsp/20110729/source/linux-2.6.31.3-jz-20110809-FR1.patch.gz

which should be applied to a stock 2.6.31.3 kernel.

I was building the kernel on a ubuntu 12.04 32bit VM, with the cross compile tool chain located here

http://code.google.com/p/dingoo-linux/downloads/list

The kernel needs to be an u-boot uImage format.

Assuming you have a stock image of your internal sd, you would want to hexedit the image directly. Do a ascii search for linux, which should bring you to the area where the kernel command line is at, which will look like this

0003A4B0   01 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
0003A4C0   40 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  @...............
0003A4D0   00 00 02 00  00 00 02 00  FF FF FF FF  00 00 00 00  ................
0003A4E0   62 6F 6F 74  61 72 67 73  3D 6D 65 6D  3D 32 35 36  bootargs=mem=256
0003A4F0   4D 20 63 6F  6E 73 6F 6C  65 3D 74 74  79 53 32 2C  M console=ttyS2,
0003A500   35 37 36 30  30 6E 38 20  69 70 3D 6F  66 66 20 72  57600n8 ip=off r
0003A510   6F 6F 74 3D  2F 64 65 76  2F 6D 6D 63  62 6C 6B 30  oot=/dev/mmcblk0
0003A520   70 31 20 72  6F 00 62 6F  6F 74 63 6D  64 3D 6D 73  p1 ro.bootcmd=ms
0003A530   63 20 72 65  61 64 20 30  78 38 30 36  30 30 30 30  c read 0x8060000
0003A540   30 20 30 78  34 30 30 30  30 30 20 30  78 33 30 30  0 0x400000 0x300
0003A550   30 30 30 3B  62 6F 6F 74  6D 00 62 6F  6F 74 64 65  000;bootm.bootde
0003A560   6C 61 79 3D  30 00 62 61  75 64 72 61  74 65 3D 35  lay=0.baudrate=5
0003A570   37 36 30 30  00 6C 6F 61  64 73 5F 65  63 68 6F 3D  7600.loads_echo=
0003A580   31 00 65 74  68 61 64 64  72 3D 30 30  3A 32 61 3A  1.ethaddr=00:2a:
0003A590   63 36 3A 32  63 3A 62 64  3A 66 63 00  61 75 74 6F  c6:2c:bd:fc.auto
0003A5A0   6C 6F 61 64  3D 6E 00 62  6F 6F 74 66  69 6C 65 3D  load=n.bootfile=
0003A5B0   22 75 49 6D  61 67 65 22  00 00 00 00  62 6F 6F 74  "uImage"....boot
0003A5C0   61 72 67 73  3D 6D 65 6D  3D 32 35 36  4D 20 63 6F  args=mem=256M co
0003A5D0   6E 73 6F 6C  65 3D 74 74  79 53 32 2C  35 37 36 30  nsole=ttyS2,5760
0003A5E0   30 6E 38 20  69 70 3D 6F  66 66 20 72  77 20 72 64  0n8 ip=off rw rd
0003A5F0   69 6E 69 74  3D 2F 6C 69  6E 75 78 72  63 00 62 6F  init=/linuxrc.bo
0003A600   6F 74 63 6D  64 3D 6D 73  63 20 72 65  61 64 20 30  otcmd=msc read 0
0003A610   78 38 30 36  30 30 30 30  30 20 30 78  38 30 30 30  x80600000 0x8000

replace the top "console=ttyS2,57600n8" with spaces, so it looks like this

0003A4B0   01 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ................
0003A4C0   40 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  @...............
0003A4D0   00 00 02 00  00 00 02 00  FF FF FF FF  00 00 00 00  ................
0003A4E0   62 6F 6F 74  61 72 67 73  3D 6D 65 6D  3D 32 35 36  bootargs=mem=256
0003A4F0   4D 20 20 20  20 20 20 20  20 20 20 20  20 20 20 20  M               
0003A500   20 20 20 20  20 20 20 20  69 70 3D 6F  66 66 20 72          ip=off r
0003A510   6F 6F 74 3D  2F 64 65 76  2F 6D 6D 63  62 6C 6B 30  oot=/dev/mmcblk0
0003A520   70 31 20 72  6F 00 62 6F  6F 74 63 6D  64 3D 6D 73  p1 ro.bootcmd=ms
0003A530   63 20 72 65  61 64 20 30  78 38 30 36  30 30 30 30  c read 0x8060000
0003A540   30 20 30 78  34 30 30 30  30 30 20 30  78 33 30 30  0 0x400000 0x300
0003A550   30 30 30 3B  62 6F 6F 74  6D 00 62 6F  6F 74 64 65  000;bootm.bootde
0003A560   6C 61 79 3D  30 00 62 61  75 64 72 61  74 65 3D 35  lay=0.baudrate=5
0003A570   37 36 30 30  00 6C 6F 61  64 73 5F 65  63 68 6F 3D  7600.loads_echo=
0003A580   31 00 65 74  68 61 64 64  72 3D 30 30  3A 32 61 3A  1.ethaddr=00:2a:
0003A590   63 36 3A 32  63 3A 62 64  3A 66 63 00  61 75 74 6F  c6:2c:bd:fc.auto
0003A5A0   6C 6F 61 64  3D 6E 00 62  6F 6F 74 66  69 6C 65 3D  load=n.bootfile=
0003A5B0   22 75 49 6D  61 67 65 22  00 00 00 00  62 6F 6F 74  "uImage"....boot
0003A5C0   61 72 67 73  3D 6D 65 6D  3D 32 35 36  4D 20 63 6F  args=mem=256M co
0003A5D0   6E 73 6F 6C  65 3D 74 74  79 53 32 2C  35 37 36 30  nsole=ttyS2,5760
0003A5E0   30 6E 38 20  69 70 3D 6F  66 66 20 72  77 20 72 64  0n8 ip=off rw rd
0003A5F0   69 6E 69 74  3D 2F 6C 69  6E 75 78 72  63 00 62 6F  init=/linuxrc.bo
0003A600   6F 74 63 6D  64 3D 6D 73  63 20 72 65  61 64 20 30  otcmd=msc read 0
0003A610   78 38 30 36  30 30 30 30  30 20 30 78  38 30 30 30  x80600000 0x8000

This will cause kernel output to go to the lcd.

To inject your compiled kernel into the image (or directly to your sd card) run the following dd command.

# dd if=my-uImage-kernel of=my-internal-sd.img bs=1 seek=4194304 conv=notrunc

You will also want to update your /etc/inittab in the rootfs to give yourself a shell. I made the following change to mine

# Launch the main application
tty1::respawn:/usr/local/sbin/main

to

# Launch the main application
tty1::respawn:-/bin/sh
tty2::respawn:-/bin/sh

good luck..
-ack