Every once in a while, you stumble upon something that nobody else seems to have paid much attention to. This all started with my investigation into a glorious product named the Vii.
I can’t really give a great justification as to why this thing was so damned interesting to me, but it seemed weird and quirky and nobody really knew much about it. I thought it might be fun to try to emulate awesome games such as “Fry Egg” on the real Wii, but didn’t really know where to begin — aside from getting my hands on one. When it finally arrived in the mail from China, I opened it up to find myself faced with a couple of epoxy blobs:
This was a bit depressing; there’s not much you can do with these, absent any sort of descriptive markings. Fortunately for us, the makers of this “console” decided to add a cartridge port and a 9-pin joystick controller, and then include a “VC-1” cartridge full of crappy games (“Virtual Console”, I suppose). It was here that we got lucky; the cartridge contained a standard NOR flash chip, which I was able to read out with a standard chip programmer.
Browsing through the contents of the flash chip, there was no recognizable text or known instruction set — but fortunately, we found this header:
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
0000c00: 6368 6b73 756d 3a32 3441 3842 4339 4220 chksum:24A8BC9B
0000c10: 7665 723a 2275 276e 5350 2049 4445 5665 ver:"u'nSP IDEVe
0000c20: 7220 312e 362e 3222 2075 7365 723a 2273 r 1.6.2" user:"s
0000c30: 756e 706c 7573 2220 626f 6479 3a22 5350 unplus" body:"SP
0000c40: 4732 3433 2200 0000 0000 0000 0000 0000 G243"...........
u’nSP? sunplus? What is this crap? Searching on Google didn’t find much (at the time — there’s a lot more now, partially by coincidence and partially as a consequence of the work we’ve done which we’ll get to shortly). We started digging, and, well, to make a long story shorter — it turns out that there is one Chinese company with several names that makes chips that you could probably find in devices you already own.
SPG
The SPG2xx series use a custom instruction set (“u’nSP”), and are designed for something like the TV Plug-n-Play games; they are used in most (if not all) of those, as well as the Vii and the V.smile (if nothing else). Segher took our dumped ROM and scant documentation and built a disassembler, and then a mostly-working emulator for this architecture (more on this below). The top of the line SPG290 uses a different “s+core” architecture, and is used in the Mattel Hyperscan.
SPMP
The SPMP series chips are ARM-based SoCs that are used in cheap Chinese “Personal Media Players” that also generally come bundled with NES or GameBoy emulators; see Marcan’s work on these.
I/O interfaces
I’ve seen a lot of use of these chips in random USB I/O applications. The external hard drive I use to back up my laptop has a SunPlus USB-SATA bridge. They make USB-to-CCD interfaces (aka webcams!).
Everything else
They make chips that go into digital picture frames and portable DVD players, too. In China, they’re used for more general control applications — they make general MCUs under the “GeneralPlus” name, and it was actually here where we found the most info. Although the datasheets for the SunPlus chips are pretty hard to find, the general-purpose chips have freely-available documentation, and many of them use the same instruction set. On the GeneralplusSunplus MCU site (this all gets very confusing), you can find datasheets for other chips that use the u’nSP instruction set, and even an IDE based on an old, hacked up, GPL-violating version of GCC that supports u’nSP!
Based on the ROMs we extracted from the Vii and some experiments, Segher was able to write a disassembler and then eventually an SPG emulator:
I can now play Vii games on my computer, woohoo! Sadly, sound and “Viimote” support have yet to be implemented. Further research showed that most (all?) of the Jakks Pacific TV Plug’n’Play games also use SPG chips, so after some hardware hacking, we were able to play a couple of them, too:
Work lately has focused mostly on the V.tech V.smile, which has the advantage of being cheaply and widely available, and it takes cartridges which are just simple ROMs (or occasionally NOR flash chips) on a PCB … with any luck, we will soon have a SPG development kit for the masses, a need that I’m sure everyone will agree went unfulfilled for quite some time.
Not everything has to be cutting-edge to be fun. 🙂
19 responses so far ↓
1 Suigintou // Apr 18, 2010 at 2:50 am
Homevrew Zhannel, anyone?
2 SquidMan // Apr 18, 2010 at 2:57 am
Awesome. Just awesome. Thanks for the shout-out to S+Core and HyperScan too, by the way :3
3 Erant // Apr 18, 2010 at 5:06 am
As an extra little sidenote regarding the SPMP305x series of chips, we’ve ported the operating system Prex to it, and written a few drivers. Development has slightly stalled, but source can be found at http://code.google.com/p/libspmp3050/
4 DacoTaco // Apr 18, 2010 at 8:24 am
ho ho ho, nice going. i was always wondering who and what was inside the vii
5 Zack Fulpington // Apr 18, 2010 at 3:40 pm
This news has joyed me much more then any Wii or DSi news.
Like, omg. I want a SDK.
6 Bibin // Apr 18, 2010 at 5:03 pm
Speaking of Jakks pacific games, I should note that the Ms. Pac-Man one has a debug test. Access it by randomly bashing buttons when it’s on the license screen (haven’t found another way…) it checks ROM, RAM, does a sprite and color test, and a sound test.
The sound test reveals all the sounds for Pac-Man. Strange! Pac-man isn’t included, only Ms. Pac-Man. Perhaps now that people seem to be showing more attention to these kinds of things perhaps work can be done towards getting Pac-Man playable?
7 nitro2k01 // Apr 18, 2010 at 6:12 pm
So uhm:
* The Vii comes with a flash cartridge – it basically says “Hack me”.
* Vii is using the same architecture as the plug’n’plays and V.smile which might (or might not) mean that the games my be interoperable with some work?
* How much RAM could there be in the Vii? Just snatching a number from one of the links… 128K*16 bits…
Oh and also, it’s apparently µ’nSP not u’nSP. With the µ the name actually begins to make sense, a play on “micron” perhaps.
Zack: The Wii hasn’t needed much news lately. It’s already cracked wide open. The DSi on the other hand could need some h4x.
8 warll // Apr 18, 2010 at 10:49 pm
Awesome! Have I mentioned how much I love articles like this? Yes I have.
I love articles like this!
9 bushing // Apr 19, 2010 at 1:43 am
All of the Jakks Pacific games have a similar testing mode. Segher found the one on Wall-e by disassembling it (it’s something like “hold down A and press left and up during the intro screen”, but mashing buttons works about as well).
We found the one on the Hannah Montana guitar game by mashing buttons — see http://www.youtube.com/watch?v=XiEMtLzcTFw
10 Segher // Apr 19, 2010 at 9:54 am
Bibin/bushing: It’s up / hold A / down / release A, during the first one or two screens. It’s the same on all Jakks games as far as I have seen. Not all have the same tests though.
nitro2k01: On *all* games we have seen so far that have a flash (instead of a ROM), it is hardwired to be read-only.
There are 40 GPIO pins that are connected differently on all games; this makes compatibility between systems harder, it is not “burn the flash and there it goes”, you need some significant coding, There are other differences as well; for example, there is a bond option that changes the coordinate system of the sprites.
It has 10kW (20kB) of internal general-purpose RAM, and a little for video and audio. You can attach an external RAM if you want (we have one game that does that).
Yes it’s µ’nSP, but it’s often spelled as u’nSP (or m’nSP or un’SP or unSP), presumably because people find it hard to type. It means something like microcomputer-and-signal-processor, presumably because it has this “fast” multiplier and inproduct thing.
11 Wii Hackers Reveal Their Next Project « Waxing Erratic // Apr 19, 2010 at 10:08 am
[…] been waiting years1 for this day: Every once in a while, you stumble upon something that nobody else seems to have paid much […]
12 Zack Fulpington // Apr 20, 2010 at 6:59 pm
@nitro2k01: I’m speaking in general about the Nintendo homebrew scene.
13 Brainy142 // Apr 26, 2010 at 3:58 pm
Hey Brushing, you should take a look at these links, we (meaning they) got some homebrew working on one of the sunplus chips (specifically the smp8000 used in a lot of *ahem* cheap mp4 players with “emulation capability”) (hint: goto dealextreme and search mp4 players…)
(original forum topic) http://www.mp4nation.net/forum/viewtopic.php?f=24&t=17095
(youtube vid of “doom”) http://www.youtube.com/watch?v=wuOGC3nY-oQ
another site with some info http://jxdv3.webs.com/
ps. The mp4nation link (in the next couple of pages) has some fun coding outputs :D.
14 Tex© // May 9, 2010 at 12:11 pm
hey bushing when you said “there’s not much you can do with these” are you referring to not being able to remove them or what?
cause this can fix that up
http://www.youtube.com/watch?v=kTPXKA66baQ
15 Bits and bobs - Programming While I'm Awake // Jun 19, 2010 at 3:12 pm
[…] homebrewers have taken apart a Vii, the shameless takeoff of the Wii. […]
16 MeLLOn_SoFt // Jul 25, 2010 at 3:24 pm
@Bushing
@Segher
Ok I would like to know about other ripoffs!
like the sudoku machines you find – You know with the epoxy-chip!
can you take one apart and find out what the processor they use in the Oreint to make ripoff
Black-And-White lcd games!
and can you tell us the chip used in NoRMail
calculators
becuse they are Epoxy as well
if they have been found and looked at WHAT ARE THEY! can you show us the results from the CALCS if there is!
If not can YOU guys FIND OUT what chips are in rippoff games and calc’s!
Please do the lcd games!
i think there may be
Intel 4004’s
I think the lcd games have a interesting chip in them
try to find what it is
17 MeLLOn_SoFt // Jul 26, 2010 at 6:04 pm
Bushing,
can you please decap the chips of the folowing products and post the results on this blog!!??!
can you find the chips that are used in:
CHEAP CaLcUlatoRs
and china- lcd games
18 socram8888 // Jan 5, 2011 at 3:50 am
I have some of these clones too (named MyWico), but it’s just a simple NOAC chip (NES-on-a-chip) with enhanced video and audio modes
19 Sean // May 11, 2013 at 11:11 am
I know that it’s been a while, but did you ever make anymore progress on the Vtech Vsmile homebrew stuff? I think it would be great to have the ability to do Vsmile homebrew games.
You must log in to post a comment.