I would like to document an ongoing project that I have been working on.  The main purpose of this is to provide information to others that might like to attempt such things.  I would also like to hear comments, questions, and suggestions on the things that I have done.  Hopefully, there are others out there that know about these issues, and may be able to add some insight.

Flavor's Homebrew NGPC Cart Project
or
How I Killed Crush Roller

For a while, I had been reading information about flash chips.  Some of this reading was particularly useful in the creation of my Multi-ROM loader "NGPCpack."  I started playing around with the idea of re-writing an official SNK cart.  The main problem is that there is no official documentation availabe for the chips that come on the official SNK carts.

I gathered as many technical documents as I could about similar flash chips to learn about how these chips worked, and to make some inferences about how the official SNK chips work.  So, I read several documents to learn as much as I could.  

One of the things that I learned was that many of these flash chips can be write protected.  What SNK did when they would produce a game is to flash the chip, and then protect all the blocks on the chip that contained code.  This way, they could still use some of the unprotected blocks for save-game information.  I thought that it would be really cool if I could just rewrite over an official cart.  Then, presumably, I wouldn't have to modify any hardware to make my own writeable carts.

So, I read my documents some more.  A common theme that I found was that, with the chips that used block protection, there was a way to temporarily unprotect the entire chip.  It wasn't as simple as writing some code, though.  The chips normally use 3 volts (hence the 2 AA batteries that the NGPC uses).  Temporary unprotection required me to apply 12 volts to a specific pin (the RESET pin).  It was my understanding that, once this 12v was applied, the whole chip would be writeable.

So, I hatched a plan to apply 12v to that RESET pin.  To do this, I had to isolate the RESET pin.  This was no easy task, because the RESET pin was also connected to 2 other pins on the cart.  I would need to cut the trace to the RESET pin.  Then, I would need to cut the trace from the RESET to the 2 other pins.  Even more problematic was the fact that the trace from the RESET pin to the other 2 pins ran under the flash chip, so it was hard to cut.  What I ended up doing was to cut all the way through the board (under the flash chip) to sever the trace.  Then, I cut the trace from the edge connector (that plugs into the NGPC) to the RESET pin.  I soldered a wire from the edge connector to the other 2 pins (to restore their connection to the edge connector), and then soldered a wire onto the RESET pin's trace.  Now, I had isolated the RESET pin.  I made a temporary connection from the RESET pin's wire to the other wire, and the cart still worked.  I knew I hadn't ruined anything, yet.

I got everything plugged into my Flash Linker and got ready to re-program Crush Roller.  I had a bit of a problem making the initial 12v connection, because I wasn't using a real connector or anything.  It was just touching wires to the power supply.  Anyway, when I finally held the 12v on there, Crush Roller made a popping noise.  I wasn't too happy with that, but I tried poor Crush in my Flash Linker and NGPC.  He was no longer.  I had rendered Crush Roller braindead.

So, I began my search for a replacement brain for Crush Roller.  I looked at all the on-line chip resellers that I could find.  It's difficult to find drop-in replacements for these flash chips.  It's even more difficult when you want to order small quantities.  I searched http://www.findchips.com/ for many different chips.  I think I did find a suitable 8Mbit one on there, once, but when I tried to order it from http://www.mouser.com/, I found that I would have to wait approximately 52 weeks to get the item in stock.  Then, I tried http://www.arrow.com/ and they had what I wanted.  I ordered 3 AMD 16Mbit flash chips just to have a couple extra in case I ruined another chip or in case I wanted to replicate my efforts after a success.  The total came close to $55.

Oh, I just checked, as I was writing this, and I found that Mouser has the following (seemingly suitable part) in stock.  Though, it is only 4Mbit.
Mouser Part:	511-M29W004BT70N
Desc:		STM FLASH EEPROMS tsop-40 512kx8 70ns
Part:		M29W004BT70N1
Cost (USD):	$8.00

Well, on with the story.  I got the chips, and I brought Crush Roller and the chips over to my wife's office.  One of her co-workers has the tools and knowhow to solder surface-mount chips.  He was great.  He helped me replace Crush Roller's chip with my newly obtained AMD chip.  He also had to help me fix my previously broken traces, but that proved to be no problem for him.

I brought Crush Roller and his new brain back to my evil lab for some probing.  My Flash Linker seemed to like the new Crush Roller.  Though, the programming times were unbelievably slow.  I had to modify my PocketSend source code to program the AMD chips in a different way.  They have what's called "Bypass Mode."  You need to Unlock Bypass Mode, and then you can program the chip byte-by-byte much more efficiently than before.  Well, there were some more code tweaks that I needed to make to my PocketSend application, but I got it going.  

I burned a ROM to the newly made flash cart, and tried it in my NGPC.  Sadly, though, my NGPC didn't get along with Crush Roller's new brain (maybe jealous of its superior intellect).

I had done some research into how the Bung Pocket Flash carts worked, and I knew that they reported themselves as being a Toshiba part number even though they are definitely not a Toshiba part.  In fact, I had started this whole process with the document for the flash chip that's on the Bung cart.  One of the Pocket Flash carts that I have uses an SST flash chip.  The other one uses a StarRAM part.  I have yet to find any information about StarRAM.

So, my guess was that the NGPC did some sort of check to figure out if the chip's manufacturer ID was valid.  It turns out that, in the BIOS, the NGPC checks for one of the following manufacturer IDs.
0x98		Toshiba
0xEC		Samsung	
0xB0		Sharp
I had also built in a special function into the latest version of my PocketSend application that would querry carts and save a file full of information about carts.  One particular user that goes by the name "Sweater Fish Deluxe and Opa Opa" was kind enough to querry all of his carts and send me a file full of information.  His information matched up nicely with the BIOS checks.  For example, here are some lines from the CartInfo.txt file he sent to me.

Manufacturer ID = 0x98
Device ID = 0x2f
Cart Name = CARD FIGHT E

Manufacturer ID = 0xec
Device ID = 0x2f
Cart Name = CARD FIGHT 2

I recently did some more searching, and (not surprisingly), none of these parts seem to exist.  :)

Anyway, back to the Crush Roller situation.  While developing NGPCpack, I had learned that you can put the NGPC into a state that it won't respond unless you remove the batteries.  In fact, it will let you do things like remove the cart.  It'll even let you put a new cart in.  Well, that is, if your code is running from RAM.  If you pull out the cart while it's running from the cart, it doesn't respond nicely.

So, I created a program that I entitled "Swap Trick."  I boot up the NGPC with my "Swap Trick" ROM running on my Bung Pocket Flash cart.  Then, my "Swap Trick" (while running from RAM) puts the NGPC into this special non-watchdogging mode and waits w while.  While it's waiting, I yank out the Pocket Flash and insert my new AMD brained Crush Roller cart.  Then, once the wait loop is finished, it tries to re-start the currently inserted cart.

Great.  It works!  Well, not completely.  It worked with a PD ROM.  Will it work with an official ROM?  NO!  If I try to do this whole process with a regular ROM, it won't boot up.  I have 2 theories on why this might be.

1)	The official ROMs include some sort of check to make sure that they're running on a valid flash chip.  More likely is that they make some sort of BIOS call that checks the manufacturer ID of the flash chip.

2)	The official ROMs put my AMD chip in to some odd state.  This is very possible, because I tried to run NGPCpack on the Crush Roller cart, and it went crazy.  It seems to work great, but some of the flashing routines are just a bit different.  Now, perhaps, this could be overcome by purchasing chips that worked more like the official flash chips.  I would love to get myself a SST chip that's just like the one on my Pocket Flash cart.

Okay, so, perhaps, I could hack an official ROM to work properly.  I am pretty sure that I could rewrite NGPCpack to work properly.  Then, I could just have a Crush Roller cart full of a BUNCH of PD ROMs.  That would be cool.  Also, I plan to build my "Swap Trick" code into my NGPCpack so that I can use the swap trick whenever I want.  I always have NGPCpack on my Bung carts, so it would be handy.

So, that's about it.  I haven't progressed any further than that, yet.  In some respects, my Crush Roller transplant has been very successful.  In other ways, it's been disapointing.  No matter what, though, it has been very interesting, and I have learned a lot about this hardware.

What do you think?  Do you have any information that you'd like to share?  I would love to hear any comments, suggestions, or questions that you might have.

Thanks for listening!

Flavor  (http://www.personal.triticom.com/~erm/NGPC/)

====================================

Well, I wanted to let you all know that I got it working with official
ROMs.  It was actually a problem with my "Swap Trick" code.  It took me a
while to track it down, because I had assumed that it was a hardware
problem.

See, to perform the swap trick, I need to put the NGPC into a mode where
watchdogging doesn't take place.  Then, I pause for a while to allow the
user to swap carts.

After that is where the problem came.  I put the NGPC back in normal
watchdogging mode, and started the current cart.

Well, since it was back to normal watchdogging, if the current ROM did
any processing before it started doing its watchdogging, then the NGPC
would shut down.

So, I just had to leave the NGPC in no-watchdog mode, and start the
current cart.  Then, the cart would be responsible for resetting the
watchdog to a normal state.  

It was as easy as that.  Now, I need to test some other junk.  :)

But, I'm happy with the progress.  Now, it seems to work pretty similar to
a Bung cart.  Well, except that I need a Bung cart to use this cart.  

I'm having problems with my PD ROM MultiPack on the Crush Roller cart, so
I have to work on that.  I hope that other ROMs don't have similar
problems.  I played a couple games, but I haven't done any extensive
testing.

================================