Game console - security ic ??? - Page 1
Forum section: electronics / projects

author: Noopy
author_rank: Super Contributor
timestamp: December 29, 2019, 09:46:37 pm
content: Hi all,just out of curiosity I did a teardown of a low-cost game console (15€, "Tchibo Retro-Mini-Spielekonsole").Most parts were no suprise. Unfortunately I wasn´t able to identify the controller.But one thing really puzzeld me: It seems that there is a kind of security chip on the board. Why the hell would a 15€-console need a security chip?Perhaps some experts can give me a hint:- What kind of controller works in this console?- What might the unknown chip do?- What kind of chip might the unkown chip be?And now pictures:The upper SO-8 is a 25Q32 4MB-Flash.The blob in the middle contains the controller.The lower SO-8 is the interesting chip. Supply, ground and three "logic lines".The mystery chip.Backside of the mystery chip.So what´s happening here?After startup the controller fetches 8kB from the flash.1,3s later the mystery chip is adressed for the first time.Then there is a lot of data between flash and controller.Every 95ms (in the menu) or 63ms (in a game) the Controller talks to the mystery chip. Every time only one short "hello".Clock for the flash is 16MHz. Clock to the mystery chip seems to be 33kHz.First communication contains "two impulses", all the other communications contain only "one impulse" always at the same location.Without the chip the game is dead.Controller-DieB1056The mystery-chip-die.And here everything on my hompage (in german):https://www.richis-lab.de/tcm_rg.htmAny ideas?Greetings,Richard

author: ebclr
author_rank: Super Contributor
timestamp: December 30, 2019, 12:16:29 am
content: What about a realtime clock ?

author: Prehistoricman
author_rank: Regular Contributor
timestamp: December 30, 2019, 02:43:30 am
content: Quote from: ebclr on December 30, 2019, 12:16:29 amUnlikely IMO. It's being accessed very often for that, and doesn't have its own clock or battery backup. And there's this:QuoteDo you still have a working one? It would be interesting to know which of those 3 signals are outputs or inputs.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: December 30, 2019, 03:49:24 am
content: No idea, but I just want to say that was an awful lot more work than I was expecting.Tim

author: Noopy
author_rank: Super Contributor
timestamp: December 30, 2019, 06:45:04 am
content: Thanks for your replys!Quote from: Prehistoricman on December 30, 2019, 02:43:30 amMe neither. No battery, no reason for a unnamed chip and as far as I tested the game no need for a realtime clock.Quote from: Prehistoricman on December 30, 2019, 02:43:30 amThere is still one left.Hm... What´s the best way to check the data direction...Quote from: T3sl4co1l on December 30, 2019, 03:49:24 amJust out of curiosity...

author: amyk
author_rank: Super Contributor
timestamp: December 30, 2019, 08:51:23 pm
content: The main IC may be from Sunplus/Generalplus or one of the more obscure high-volume companies that make COB MCUs.Mystery chip could be an EEPROM for things like saved games/high scores?

author: Noopy
author_rank: Super Contributor
timestamp: December 30, 2019, 09:03:21 pm
content: Quote from: amyk on December 30, 2019, 08:51:23 pmHm... Good idea...But the communication is extreme slow...And the die doesn´t look like a memory...Unfortunately I didn´t really play the games but I think there was nothing like saved games or high score. Veeeery low-cost...

author: SeanB
author_rank: Super Contributor
timestamp: December 30, 2019, 09:17:35 pm
content: Looks like an EEprom, with that load of glue logic, one monster of an on die capacitor and 8 blocks of what could be flash, and with a pretty beefy set of transistors to generate the erase and program voltages. Probably writing game state regularly as it is limited in RAM, storing the scores between game sessions, or put there as a deliberate way to fail the game when the EEPROM wears out, and get the punters to buy a new one with the new games on it.

author: Noopy
author_rank: Super Contributor
timestamp: December 30, 2019, 09:39:48 pm
content: Hm, perhaps I´m wrong...Haven´t seen such an EEPROM. But I haven´t seen so much of them.Still the communication is curious slow in my view and why no marking?

author: SeanB
author_rank: Super Contributor
timestamp: December 30, 2019, 10:00:41 pm
content: It is a custom chip, with all that unused area, and all the unused cells of logic in it, but it is definitely programmable, and there is a lot of EEprom there. Might be doing some decryption key for the main chip to prevent cloners from cloning a cheap game, or just doing some housekeeping, but I do not really know. A key for each section of the game is likely, so the manufacturer protects the IP of their game ( probably "borrowed" from a big player in part or entirely) from being similarly appropriated.

author: Noopy
author_rank: Super Contributor
timestamp: December 30, 2019, 10:17:24 pm
content: Sounds convincing.Thanks!Where do you see the big capacitor which you descriped earlier? The big plate in the middle? I thought that´s only a screen to shield something, perhaps a secret logic block...Looks like a face...

author: amyk
author_rank: Super Contributor
timestamp: December 31, 2019, 12:55:28 am
content: You can dump the flash and see if people recognise the CPU/instruction set. There might be some useful text strings in there too. There are other forums exclusively for discussing game console electronics, possibly someone there might even recognise this unit and/or the CPU in it.

author: Noopy
author_rank: Super Contributor
timestamp: December 31, 2019, 10:26:10 am
content: Quote from: amyk on December 31, 2019, 12:55:28 amI already tried to dump the flash.I thought "Hey I have a expensive GALEP-5, that should be no Problem!"Well no.The Galep knows 25Q32BV, 25Q32DW and 25Q32V but no 25Q32JV!I know it´s no big problem to dump such a flash but I don´t like programming, so I have to look for the easiest way to get the data.Quote from: amyk on December 31, 2019, 12:55:28 amDo you have a recommendation for me?

author: Bicurico
author_rank: Super Contributor
timestamp: December 31, 2019, 11:34:31 am
content: My guess is that it is indeed some crypto-chip to protect the games on the flash.There seems to be an industry in China for low cost development of low cost 8-bit alike games to be legally used in cheap retro-consoles.You can find those mini arcades in consumer electronics stores: there are two kind: those that cost around 30 Euro offering one single game like Galaga and which effectively use an emulator and original ROM's and those that cost around 20 Euro and offer 200 games, all of which are a piece of crap!I think that the company/companies that develop these crap games need to protect them, so that they are not just copied. I tried to find some web links, but as usual it is very difficult to find the chinese manufacturer at the origin of any product...Emulation can only be used if royalties have been paid, otherwise the consumer electronics stores won't be able to sell them - they would be quickly confiscated.As a funny note: the better retro arcade consoles can be hacked: while they do come with just one game, the flash contains several, as the board is the same for all models. One can open the case and change something on the PCB (cannnot remember what it was) to play different games.Regards,Vitor

author: Noopy
author_rank: Super Contributor
timestamp: December 31, 2019, 01:47:47 pm
content: Quote from: Bicurico on December 31, 2019, 11:34:31 amIt is definitely one of this!Thanks for your input!

author: RoGeorge
author_rank: Super Contributor
timestamp: December 31, 2019, 02:16:44 pm
content: The wires from pins 7 and 8 in the photo looks like they are switched between them when connected to the ZIF socket. 7 seems to be going to 8, and 8 to 7. Is this intentional?

author: Noopy
author_rank: Super Contributor
timestamp: December 31, 2019, 02:28:41 pm
content: You are right, it looks like it´s switched but the high-res-photo shows that the connection was right.Moreover the Galep was able to read the id but wasn´t happy with the numbers...

author: Prehistoricman
author_rank: Regular Contributor
timestamp: December 31, 2019, 06:20:27 pm
content: Quote from: Noopy on December 30, 2019, 06:45:04 amDesolder the chip and see what lines are still active

author: Noopy
author_rank: Super Contributor
timestamp: January 01, 2020, 09:54:00 am
content: Quote from: Prehistoricman on December 31, 2019, 06:20:27 pmThat´s convincing if the Pins can source and sink.Otherwise (Lowsider on the one side, Pull-Up on the other side) the measurement would be misleading.But ok, probably it is a push-pull-output...I will do that.

author: wraper
author_rank: Unknown
timestamp: January 01, 2020, 10:16:01 am
content: Quote from: Noopy on December 31, 2019, 10:26:10 amQuickly looking into datasheets I see no reason why it 25Q32JV cannot be dumped with 25Q32V selected.

author: Noopy
author_rank: Super Contributor
timestamp: January 01, 2020, 02:13:12 pm
content: Quote from: wraper on January 01, 2020, 10:16:01 amThe software got an slightly differerent device id than expected for the 25Q32V.My read is that it would have been no problem to dump the data anyway but the Galep didn´t want to.I did some measurements at the unmarked chip:Pin 2 seems to be an outputPin 3 seems to be an InputPin 4 could be anything (without connection there is nothing to see)

author: wraper
author_rank: Unknown
timestamp: January 01, 2020, 02:48:35 pm
content: Quote from: Noopy on January 01, 2020, 02:13:12 pmIsn't there any setting to ignore device ID?

author: Noopy
author_rank: Super Contributor
timestamp: January 01, 2020, 10:36:57 pm
content: Quote from: wraper on January 01, 2020, 02:48:35 pmUnfortunately not...

author: wraper
author_rank: Unknown
timestamp: January 01, 2020, 10:53:13 pm
content: Quote from: Noopy on January 01, 2020, 10:36:57 pmThat's some bullshit software then. Especially just for reading purposes as even if there are significant differences, EPROM or FLASH usually can still be read as other similar device. In my Wellon programmer software device ID check checkbox is not even checked by default. Even when programming, there were cases when newer lower voltage version of FLASH was not supported. I simply selected different IC and lowered voltage in settings.BTW I suggest ordering cheap ZIF socket from China. Will save you a lot of time wasted on soldering spider legs.https://www.ebay.com/itm/150mil-SOP8-Socket-Adapter-Universal-IC-ZIF-Programmer-Converter-For-PCB/152059011073?hash=item23676c6001:g:KHsAAOSwqbZXFJubThey are actually quite good and durable.

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 02, 2020, 11:43:09 am
content: Quote from: Noopy on January 01, 2020, 10:36:57 pmHack itif you know how to use Cheat Engine and x86 assembly.

author: Noopy
author_rank: Super Contributor
timestamp: January 02, 2020, 10:12:10 pm
content: Quote from: wraper on January 01, 2020, 10:53:13 pmThe Galep 5 seems to be a good tool but in my view absolutely inflexible.Perhaps more for industrial enviroment. You can count flashed devices and suchimportantthings...Regarding ZIF-Socket: You are right!Quote from: Prehistoricman on January 02, 2020, 11:43:09 am"my favourite programming language is solder"

author: Noopy
author_rank: Super Contributor
timestamp: January 06, 2020, 05:20:55 pm
content: Quote from: Noopy on January 01, 2020, 10:36:57 pmThe problem was between chair and keyboard! There is a checkbox to disable the ID-Check!Now I have a dump.But it doesn´t tell me very much. No plain text. Only hex and hex and hex...Any suggestions?...is it allowed to upload such a dump or is that already illegal?

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 06, 2020, 07:05:28 pm
content: Quote from: Noopy on January 06, 2020, 05:20:55 pmI don't think anyone would stop you...I'd like to take a look at least

author: Noopy
author_rank: Super Contributor
timestamp: January 06, 2020, 07:41:34 pm
content: Done:https://richis-lab.de/temp/dump_all.hexhttps://richis-lab.de/temp/dump_all.binAs far as we got one probably can´t just copy the game, so it should not be very illegal...

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 06, 2020, 10:56:12 pm
content: binwalk (common binary analysis program) shows nothing.I found these stick-fighter sprites (address 194DD8) and here's a graph of the binary entropy.I noticed that most of the text in the game is made of only a few different fonts, so I bet that's why we're not seeing any ASCII in the dump.Around these stick-fighter sprites I see 0x00 for the body and a combination of 0x145 and 0x28A in the empty space.Conclusion: The sprites are made of 6-bit pixels and I'm guessing there is a colour palette and that this empty space colour is invisible.

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 07, 2020, 12:46:26 am
content: It's always a good idea to stuff binaries into AudacityI saw here that the beginning of the file is repeated near the end. The repeat starts at address 318B68.I think this means the dump wasn't successful. I don't see any reason for them to program it like this. Along with the odd missing bits I saw in the sprites, I think it's quite likely that this software legitimately can't read this chip. Or it does work, but on a different setting?

author: Noopy
author_rank: Super Contributor
timestamp: January 07, 2020, 03:31:13 am
content: Very interesting and fascinating!But I´m suprised the dump seems to be corrupted.I have chosen the W25Q32FV. The datasheets say F and J are standing for 32M-bit, no obvious difference but there are 100 pages.Despite the Chip-ID everything looked good. The Galep HW/SW seems to be very robust. It checks connectivity and all sorts of things. But to be honest I´m not very familiar with this kind of stuff....The Galep-Software showed me a Memory Map containing:000000 - 3FFFFF Data001000 - 0010FF SecReg1002000 - 0020FF SecReg2003000 - 0030FF SecReg3400300 - 400302 Status RegOnly the data was marked, so I marked the rest of the Adresses too.Could that be a problem? ...but I don´t think so...

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 07, 2020, 11:35:46 am
content: Yeah I agree. Maybe ask Galep about it? Seems like they might respond to emails.

author: Noopy
author_rank: Super Contributor
timestamp: January 08, 2020, 04:13:27 am
content: Quote from: Prehistoricman on January 07, 2020, 11:35:46 amDone!Let´s see what they have to say...

author: Xenoamor
author_rank: Regular Contributor
timestamp: January 10, 2020, 02:12:40 pm
content: It could be a golden image in case a firmware update fails? Seems unlikely though

author: Noopy
author_rank: Super Contributor
timestamp: January 10, 2020, 11:14:47 pm
content: Seems not very likely in my view but thanks for your input.

author: Noopy
author_rank: Super Contributor
timestamp: January 14, 2020, 10:08:44 pm
content: Quote from: Noopy on January 08, 2020, 04:13:27 amNo answer from this side till now...

author: Prehistoricman
author_rank: Regular Contributor
timestamp: January 15, 2020, 12:07:15 am
content: Quote from: Noopy on January 14, 2020, 10:08:44 pmThat's a damn shame. Maybe they have an extended Christmas break?Do you have an Arduino or raspberry Pi? I bet someone has written a ready-to-go reader for this EEPROM.By the way, I understand your reply, but the way you've written it sounds like you just got a response. You could instead say "No answer from them yet".

author: Noopy
author_rank: Super Contributor
timestamp: January 15, 2020, 04:25:43 am
content: Quote from: Prehistoricman on January 15, 2020, 12:07:15 amWell perhaps next week...No, I don´t have a Arduino or raspberry.I have a STK500 and some 8Bit-Atmels but last time I tried to connect it to my computer it refuses to talk with the two USB-RS232-converter I have.Lately I found a Pickit 3 in the trash. Perhaps it is still good. But I´ve never done anything with a Pickit...Quote from: Prehistoricman on January 15, 2020, 12:07:15 amThanks for the hint! I see your point!

author: Unknown
author_rank: Unknown
timestamp: August 31, 2023, 04:32:22 am
content: NOTE: This message has been deleted by the forum moderator Simon for being against the forum rules and/or at the discretion of the moderator as being in the best interests of the forum community and the nature of the thread.If you believe this to be in error, please contact the moderator involved.An optional additional explanation is:

author: Noopy
author_rank: Super Contributor
timestamp: August 31, 2023, 08:18:19 pm
content: I´m more related to hardware. I have put the data aside and now I´m doing even more hardware...

author: sd
author_rank: Unknown
timestamp: September 01, 2023, 06:18:24 pm
content: What happens if you start the device without the mistery IC or if you disconnect it after it's powered on?

author: Noopy
author_rank: Super Contributor
timestamp: September 01, 2023, 07:49:47 pm
content: If I remember correctly without the mystery IC it didn´t start and disconnecting it made the console freeze. But since then more than three years are gone...

author: Bluefox
author_rank: Newbie
timestamp: January 23, 2024, 08:03:26 pm
content: Hi ive stumbled upon this after searching if anyone had already tried to RE the tchibo retro console, because i wanted to do the same.Mine isnt the exact same model but pretty similar.The electronics part isnt my speciality but the software part.Ive seen you dumped the memory but as it seems those arent available anymore on the website (could you maybe upload them again)I also dont have a memory reader at my hand but i have a arduino from another project.Would be cool if this here could help my research

author: Noopy
author_rank: Super Contributor
timestamp: January 23, 2024, 08:23:27 pm
content: No problem! My 8x8TB RAID6 doesn´t forget anything...The data is attached here.

author: Bluefox
author_rank: Newbie
timestamp: January 31, 2024, 04:20:59 pm
content: i tried opening mine but it think i accidentally broke it xD.My version does not have any screws other than a single one for the battery cover, so i tried prying it open and i think i pushed the on switch away from the coord or broke the connector.maybe ill fix it.any tips on opening it?my version:https://www.tchibo.de/products/402060588/retro-mini-spielekonsole

author: Noopy
author_rank: Super Contributor
timestamp: January 31, 2024, 07:11:30 pm
content: Hard to say without having seen the mechanics of the housing. But now you know were there are the clips or whatever holds it together. Next time put the screwdriver at the right location.

author: Noopy
author_rank: Super Contributor
timestamp: March 15, 2025, 04:49:16 am
content: I have some better pictures for everyone who is still interested in this game console and its ICs:The Winbond 25Q32JV FlashFull resolution:https://www.richis-lab.de/images/tcm_rg/22XL.jpgThe controllerFull resolution:https://www.richis-lab.de/images/tcm_rg/23XL.jpgI still don´t know what controller that is.Mask revisionsThese are interesting fuses...And the strange "security" IC.Full resolution:https://www.richis-lab.de/images/tcm_rg/26XL.jpgI should delayer it...Some mask revisions.https://www.richis-lab.de/tcm_rg.htm

author: pcprogrammer
author_rank: Super Contributor
timestamp: March 15, 2025, 07:12:24 am
content: My 2 cents worth on the mystery chip. It probably is a simple microcontroller that counts the clock pulses and returns an acknowledge at the right moment. In the code the console is running a call will be made to an interface that creates this clock signal and checks the return. If correct the game continues, if not it stops.This reminds me of the early security dongles used by Xilinx to protect their Xact FPGA suite. It was a simple counter and I was able to fake this with a microcontroller. Later security dongles became more advanced and used encryption.A bit late to the party, but a way to test if the signals from the mystery chip are in or out is to disconnect the pin that has the answer signal and check if it still gives the same result. The game will not start or continue of course.On a side note, the pictures you provide are amazing.

author: Noopy
author_rank: Super Contributor
timestamp: March 15, 2025, 09:21:49 am
content: Quote from: pcprogrammer on March 15, 2025, 07:12:24 amThat´s possible. A very simple protection.Quote from: pcprogrammer on March 15, 2025, 07:12:24 amThank you!