Raspberry Pi Modchip?

[Magicaldave]

So a couple months back, I found this old thread detailing one user’s attempts to use an RPi as a modchip. I’m pretty sure this is the same guy who figured out how to dump the EEPROM using a Pi as well, so major major kudos go to him for that. 

Here’s the original thread: http://remnantmods.com/forums/viewtopic.php?f=3&t=2384

 

It looks like he actually made it pretty far along before getting hung up on low polling rates on the Pi’s GPIO. There aren’t any updates after this, but it seems like reworking the pi’s Linux kernel turned out to be a somewhat daunting task and went nowhere. 

Would anyone here be interested in picking up this project, or possibly pointing me in the right direction of doing so? I’m nowhere near being a software developer myself but I think this would be worthwhile and would be glad to learn! Imagine the benefits - WOL, easy wifi mods, full HD media playback, LCD, SSH, VNC, so on and so on and so on. If done properly I think this could make all this abandoned silicon (X3, anyone?) we’re all so desperate for completely obsolete. Responses and assistance greatly appreciated on this matter. 

[eeksdee]

I'm not sure why you would want a Pi as a modchip, you can reflash the cheapo $2 Chinese mod chips easily and you can upgrade them with a 1MB flash chip for $3 and now they would accept all kernel sizes.

[Magicaldave]

36 minutes ago, eeksdee said:

I'm not sure why you would want a Pi as a modchip, you can reflash the cheapo $2 Chinese mod chips easily and you can upgrade them with a 1MB flash chip for $3 and now they would accept all kernel sizes.

The whole point is that those modchips are useless unless you’re running a 1.6. If I wanted to switch BIOSES I can just hook a single wire up to my 1.1 and be done with it. 

An XT is not going to give me WiFi support, nor LCD and camera support, nor WOL, nor host a fully functional Linux kernel which I can use to watch my movies in full quality over SMB/ftp. 

This is why people like stuff like the X3 - because it actually has features you might use. 

[Acidmank]

45 minutes ago, eeksdee said:

I'm not sure why you would want a Pi as a modchip, you can reflash the cheapo $2 Chinese mod chips easily and you can upgrade them with a 1MB flash chip for $3 and now they would accept all kernel sizes.

You caught my attention:-

Do you have links to any sellers?

[Magicaldave]

7 minutes ago, Acidmank said:

You caught my attention:-

Do you have links to any sellers?

https://www.ebay.com/i/273421058433?chn=ps&mkevt=1&mkrid=711-117182-37290-0&mkcid=2&itemid=273421058433&targetid=503482152124&device=m&adtype=pla&googleloc=1024352&poi=&campaignid=1669934822&adgroupid=65058350059&rlsatarget=pla-503482152124&abcId=1139296&merchantid=113089587&gclid=Cj0KCQjwrdjnBRDXARIsAEcE5YlrryUWKerWekp0zmd0oIzJVc7qpblkp6PBC1s-q57p-0Mxg2UlIioaAnvTEALw_wcB

[Acidmank]

3 minutes ago, Magicaldave said:

https://www.ebay.com/i/273421058433?chn=ps&mkevt=1&mkrid=711-117182-37290-0&mkcid=2&itemid=273421058433&targetid=503482152124&device=m&adtype=pla&googleloc=1024352&poi=&campaignid=1669934822&adgroupid=65058350059&rlsatarget=pla-503482152124&abcId=1139296&merchantid=113089587&gclid=Cj0KCQjwrdjnBRDXARIsAEcE5YlrryUWKerWekp0zmd0oIzJVc7qpblkp6PBC1s-q57p-0Mxg2UlIioaAnvTEALw_wcB

Is that a 1mb chip onboard?

[Magicaldave]

3 minutes ago, Acidmank said:

Is that a 1mb chip onboard?

Nope, gotta do that yourself. 

https://www.digikey.com/product-detail/en/microchip-technology/SST49LF080A-33-4C-NHE-T/SST49LF080A-33-4C-NHE-TCT-ND/8547948

 

http://assemblergames.com/threads/and-the-aladdin-xt-became-a-decent-modchip.52234/

[Acidmank]

Sorry,

It just occurred to me this discussion ( about the modchip source ) is in the wrong place.

Admin, Can you please move / Delete as you feel fit.

[Magicaldave]

5 minutes ago, Acidmank said:

Sorry,

It just occurred to me this discussion ( about the modchip source ) is in the wrong place.

Admin, Can you please move / Delete as you feel fit.

Haha, no worries. It kinda illustrates my point though; if you’re willing to spend $5 and a few hours getting an Aladdin chip to multiboot, why not spend a few $10 more on a Pi that will mop the floor with some of the more expensive chips that you can barely ever find?

But, to each their own. 

I have some curiosities about whether or not the Pi’s GPIO pins can or cannot actually poll at the necessary 33MHz, so I’m going to run the benchmarks on my Pi when I get a chance to see how far they can actually go. Depending on how close I can get with various libraries, a modest overclock might actually get to the desired speeds. But it honestly doesn’t look all that hopeful. 

Source: https://raspberrypi.stackexchange.com/questions/87846/how-fast-can-gpio-pins-toggle

[eeksdee]

1 hour ago, Magicaldave said:

The whole point is that those modchips are useless unless you’re running a 1.6. If I wanted to switch BIOSES I can just hook a single wire up to my 1.1 and be done with it. 

An XT is not going to give me WiFi support, nor LCD and camera support, nor WOL, nor host a fully functional Linux kernel which I can use to watch my movies in full quality over SMB/ftp. 

This is why people like stuff like the X3 - because it actually has features you might use. 

Attaching a Pi to your LPC header isn't going to give you wireless networking on your Xbox, LCD demand is almost non-existent apart of a very very niche group of people. I don't know what you're talking about camera support, some Pi's have a connector for one but do you think you're going to program it to be used over the LPC header on your Xbox? I don't understand your "watch my movies" comment as again.. you aren't going to be pushing that data over the LPC bus.

Edited June 5, 2019 by eeksdee

[Magicaldave]

15 minutes ago, eeksdee said:

Attaching a Pi to your LPC header isn't going to give you wireless networking on your Xbox, LCD demand is almost non-existent apart of a very very niche group of people. I don't know what you're talking about camera support, some Pi's have a connector for one but do you think you're going to program it to be used over the LPC header on your Xbox? I don't understand your "watch my movies" comment as again.. you aren't going to be pushing that data over the LPC bus.

Lol of course that’s not going over the LPC bus, that’s a goofy idea.

But it’ll go over a fast ethernet connection A-okay, which both the Xbox and RPi support. 

As for LCD, sure, but part of that is that the chips required to do it aren’t printed anymore and it’s kinda poorly documented in the first place. It’s no more niche than spending $400 or more on an X3. This is a community of Xbox modders after all. This is about as niche as it gets my dude.

As for whether or not you’ll be doing this FROM the Xbox itself, well again - absolutely not. This could be done over WiFi, using a regular VNC connection. Or if you wanted to get goofy you could maybe work out a way to SSH it. But I don’t see any reason to put an RPi camera into my Xbox. Regardless, the open-ended nature of using this hardware is the point of using it as a chip. 

[Kekule]

the 

10 hours ago, Magicaldave said:

I have some curiosities about whether or not the Pi’s GPIO pins can or cannot actually poll at the necessary 33MHz,

if you write your own kernel modules, probably... but then youd end up losing a lot of other functionality.  this work was done by the guy who did PiPROM and was abandoned because its easier to just make a chip to do it.

[Magicaldave]

1 hour ago, Kekule said:

the 

if you write your own kernel modules, probably... but then youd end up losing a lot of other functionality.  this work was done by the guy who did PiPROM and was abandoned because its easier to just make a chip to do it.

I sent him an email to ask about it, but there seem to be conflicting sources on what the rates actually are. *one* guy reported ~66Mhz. But he wasn’t using python. So I’ll have to run the numbers myself when I get the chance in a day or two. 

[KunfuMunky]

This comment is not of much help to the project but I would say go for it! I would love to read more about it and if you can get as far as to getting it to work I would love to try the mod on one of the Xboxxes!

[Magicaldave]

I’m a little busy trying to work through a bad flash and fix a console with no hdd. But according to the original author of this project the best he could get was 14Mhz - and THAT was while running machine code. 

So I’m thinking it may be a better option to jerry-rig an actual flash chip over the GPIO air USB. To this end, if anyone has a USB-programmable modchip, I’d love some information and pictures on it to try and work back wards from there. 

[Magicaldave]

So the software appears to already exist for this!

I think the problem in the original implementation is that it was intended to feed live data to the Xbox over the LPC interface and have the PI itself act as the actual modchip. 

But, https://flashrom.org/Flashrom supports LPC and the TSOP40/32 packages that seem to come typical with Xboxes (at least the 1.1 I’m basing this on) 

So from here I need to see if I can actually rig up a PI to run FlashROM over the LPC, at which point I can still just run a script to reflash whatever BIOS I want. This would still require the use of some kind of flash chip in 1.6 Xboxes, which would be ideal since only the v1.6 PSU supplies 5Vsb required for the Pi to be running at all times. 

[mannymod85]

mod chips are cheaper than rp.  although the Arduino nano would probably be the best bet in doing this task I plan on reading the kernel off an alladin chip when I get it with an Arduino and seeing if I can figure out how to do it with a nano no promises but I have a lot of extra nanos that I make ps1 chips with 

[Magicaldave]

1 hour ago, mannymod85 said:

mod chips are cheaper than rp.  although the Arduino nano would probably be the best bet in doing this task I plan on reading the kernel off an alladin chip when I get it with an Arduino and seeing if I can figure out how to do it with a nano no promises but I have a lot of extra nanos that I make ps1 chips with 

I don’t fiddle as much with Arduino as RPi but I think you might be right. The more I investigate it seems more practical to use the Pi as an onboard flasher, so I feel it could end up being a good complement to a modchip. But even doing that over LPC seems to have very limited info, and compatibility, due to the flash chips either requiring SPI or LPC. Doesn’t seem like you can get both. And why would you?

[mannymod85]

I would more less use the nano to see if I can mimic what the Aladdin does to the xbox not saying I will have a success but its something to look into 

[Magicaldave]

Edging a bit closer... one user has posted information about their success in manually flashing an LPC-based flash chip by rigging their Pi up directly to the LPC flash chip by attaching an ATA cable and a couple little capacitors. 

This seems less than ideal, as it’ll be very difficult to install, especially while the chip is still onboard. But it is doable, and the code has already been written.  So I’d like to investigate further into this and try to determine if the LPC pins available through the connector are satisfactory for writing to the onboard flash. Presumably this has to be the case since that was precisely Microsoft’s use case for it in the first place.

 

If anyone would like to add this info to the thread, please do. 

Source: http://ponyservis.blogspot.com/p/programming-lpc-flash-using-raspberry-pi.html

 

[Magicaldave]

Couple extra links to add for my own reference here. I'm not entirely sure but it *seems* like XblastOS is capable to flashing the TSOP while having booted from the console's LPC. This is exactly what's needed here - now just to bridge the gap with some wiring and a crawl through Xblast's code. That's gonna be fun....

Xblast Code/Documentation: https://bitbucket.org/psyko_chewbacca/lpcmod_os/src/master/

STM29F080A Datasheet: http://pdf.datasheetcatalog.com/datasheet/stmicroelectronics/6480.pdf

SST49LF016C Datasheet: http://ww1.microchip.com/downloads/en/DeviceDoc/20005029B.pdf

LPC Debug Port Pinout: https://xboxdevwiki.net/LPC_Debug_Port

Useful Modchip Dev Thread (with some open source chips you guys can print if desired): https://assemblergames.com/threads/xbox-modchip-design-discussions.66612/

RPi GPIO Pinout: https://learn.sparkfun.com/tutorials/raspberry-gpio/gpio-pinout

Putting things together, then. It looks like it should work to flash in this configuration:

XBOX TSOP  |   RPI GPIO Header (Physical)   |        GPIO (Logical)

VCC Pins 10, 31   > 3.3V Pin 1

VSS Pins 31, 32  > GND Pin 06

Chip Enable Pin 9 > 3.3V Pin 17

Write Enable Pin 38 > Pin 7

GP Pins and ID pins for the other user's flash chip are grounded to pin 9 in their design, but don't seem to exist on the TSOP chip I'm examining. 

Hopefully making use of these will be unnecessary, as supply voltage and chip/write enable signals should be taken care of by the Xbox. The goal here is to interface with the LPC port to flash the TSOP, not necessarily to hijack the TSOP altogether. 

Also: comparing the data sheets is a bit confusing for my inexperienced eyes, but I think INIT# for the SST49LF016C is analogous to chip enable on the STM29F080A. TBL# signal doesn't appear to have an analog, nor be needed.

XBOX LPC    |     RPI GPIO (Physical)     |       GPIO (Logical) 

RST# Pin 5   >     Pin 11                     >           Pin 17

LAD0 Pin 11 >    Pin 15                      >           Pin 22

LAD1 Pin 10  >   Pin 16                      >           Pin 23

LAD2 Pin  8    >  Pin 18                      >           Pin 24

LAD3 Pin  7   >  Pin 22                       >           Pin 25

LFRAME Pin 3     > Pin 13                 >           Pin 27

LCLK Pin 1     >     Pin 12                   >           Pin 18

 

Since I have a spare STM29F080A and a few stock IDE cables from old upgrades and failed repairs, I'm going to attempt to use this design to flash the bare chip. If that works, I'll move on to reflashing a live console I just so happen to have bricked recently with config injection.

All of this assumes that either the above user's code or previously mentioned FlashROM software will support the intended flash chips, but if not they're both open source so I think it could be adapted for the STM29F080A and other xbox chips pretty easily.

Unfortunately I'll have to take a break on this for a couple days as my lab is being renovated, so I'm not getting anywhere near my iron or my Xboxes for a couple days while I finish that. I'd love it if someone wants to attempt this in the meantime however!

[oldmate]

I'll watch this with much interest!

[Magicaldave]

So I know I said this project would be on hold, and in a sense it still is - I need to get back up and running so I can actually attempt using the RPi to flash my old TSOP and reimplement the flasher.c program to support the flash chips used on the Xbox. But the hard work in actually making that program was already done by Jaroslav Bulgaric, so many thanks go to him and his friend's dead BIOS chip. 

However, I wanted to share some further info I found that gives me complete certitude as to the possibility of this project. The whole reason it was never finished was due the RPi's GPIO pins not supporting the necessary frequencies on the LPC bus. I've seen the numbers vary - someone doing some benchmarks said they got 66MHz, the original developer of the project told me that by stripping out the Linux kernel he got 14MHz, and what I think are some more reasonable estimates put it around ~200MHz. 

ZOMG, project dead, stop wasting your time!!!111. Well. Not really. Anyone on this forum old enough to remember Xboxhacker might also remember another device for LPC chips that ran at about the same speed: CheapLPC

CheapLPC can read 256KB of flash in about 21 seconds, and write the same in about 5 minutes. While this isn't precisely the spec, it does work! It would just be miserably slow to boot off of. Now that's all fine and dandy for early rev consoles, but what about a 1.6? Welp. Cheapmod is our friend here. Cheapmod is literally just an LPC flash chip, programmed with above, jacked into the Xbox's LPC header. It also has the benefit of actually running at the specified speed for the LPC header. Good so far.

Except that the SST49LF020 is a 256KB, totally obsolete chip. Not only may they be hard to find, compatibility is severely limited because of the size of the chip. Now you're starting to get me here...

Except not really. Bennydiamond on the ASSEMblergames forum (an actual mod chip developer, unlike myself) worked out a way to use the SST49LF080A, a newer generation version of the original chip used for Cheapmod that is 1MB in size. Now we're getting somewhere! The issue here is that the CPLDs are necessary due to incompatibility and can't be stripped out. Otherwise you can't boot off it. Boooo. But, they can be reprogrammed.

I don't have a JTAG programmer or most of the required hardware to make it happen, but I've got a soldering iron, a schematic, and a whole lot of desire. 

However, we've still learned a few things throughout the course of this:

1) You can definitely use a PI to flash an LPC chip - even if it's slow.

2) Chips of appropriate size exist not only to allow full BIOS compatibility, but also banking features.(Modchip users, say it with me: duh)

3) Modchips are a bit simpler than one might expect... as long as you get the right flash chips.

With all this in mind I think it's safe to say Ryan's original design was worth scrapping, but only because it'd just make your box start up really, really slowly. As he said in his original post - it's time to order some chips and some CPLDs in order to make the hardware part of this really really work for ALL systems and ALL bioses. 

So once I get the flashing part down, I'm going to go ahead and install the RPi in my box, maybe make a couple videos about what kind of benefits you can get out of it, and work on a HAT for the PI to integrate the flash chips, CPLDs, and tidy up the issue of 3.3v/5V supply voltage on various xbox revisions. I think other features, like LCD, could be integrated by stealing a couple signals off the xbox mainboard and programmatically feeding them into an LCD attached to the RPi. Dunno how it works on actual mod chips, so I'm not there yet. Not even close....

See you guys in a few days once I'm really back up and running and I've bashed my head up against some C code. (Hopefully successfully!)

[Bowlsnapper]

On 6/7/2019 at 9:16 PM, Magicaldave said:

So I know I said this project would be on hold, and in a sense it still is - I need to get back up and running so I can actually attempt using the RPi to flash my old TSOP and reimplement the flasher.c program to support the flash chips used on the Xbox. But the hard work in actually making that program was already done by Jaroslav Bulgaric, so many thanks go to him and his friend's dead BIOS chip. 

However, I wanted to share some further info I found that gives me complete certitude as to the possibility of this project. The whole reason it was never finished was due the RPi's GPIO pins not supporting the necessary frequencies on the LPC bus. I've seen the numbers vary - someone doing some benchmarks said they got 66MHz, the original developer of the project told me that by stripping out the Linux kernel he got 14MHz, and what I think are some more reasonable estimates put it around ~200MHz. 

ZOMG, project dead, stop wasting your time!!!111. Well. Not really. Anyone on this forum old enough to remember Xboxhacker might also remember another device for LPC chips that ran at about the same speed: CheapLPC

CheapLPC can read 256KB of flash in about 21 seconds, and write the same in about 5 minutes. While this isn't precisely the spec, it does work! It would just be miserably slow to boot off of. Now that's all fine and dandy for early rev consoles, but what about a 1.6? Welp. Cheapmod is our friend here. Cheapmod is literally just an LPC flash chip, programmed with above, jacked into the Xbox's LPC header. It also has the benefit of actually running at the specified speed for the LPC header. Good so far.

Except that the SST49LF020 is a 256KB, totally obsolete chip. Not only may they be hard to find, compatibility is severely limited because of the size of the chip. Now you're starting to get me here...

Except not really. Bennydiamond on the ASSEMblergames forum (an actual mod chip developer, unlike myself) worked out a way to use the SST49LF080A, a newer generation version of the original chip used for Cheapmod that is 1MB in size. Now we're getting somewhere! The issue here is that the CPLDs are necessary due to incompatibility and can't be stripped out. Otherwise you can't boot off it. Boooo. But, they can be reprogrammed.

I don't have a JTAG programmer or most of the required hardware to make it happen, but I've got a soldering iron, a schematic, and a whole lot of desire. 

However, we've still learned a few things throughout the course of this:

1) You can definitely use a PI to flash an LPC chip - even if it's slow.

2) Chips of appropriate size exist not only to allow full BIOS compatibility, but also banking features.(Modchip users, say it with me: duh)

3) Modchips are a bit simpler than one might expect... as long as you get the right flash chips.

With all this in mind I think it's safe to say Ryan's original design was worth scrapping, but only because it'd just make your box start up really, really slowly. As he said in his original post - it's time to order some chips and some CPLDs in order to make the hardware part of this really really work for ALL systems and ALL bioses. 

So once I get the flashing part down, I'm going to go ahead and install the RPi in my box, maybe make a couple videos about what kind of benefits you can get out of it, and work on a HAT for the PI to integrate the flash chips, CPLDs, and tidy up the issue of 3.3v/5V supply voltage on various xbox revisions. I think other features, like LCD, could be integrated by stealing a couple signals off the xbox mainboard and programmatically feeding them into an LCD attached to the RPi. Dunno how it works on actual mod chips, so I'm not there yet. Not even close....

See you guys in a few days once I'm really back up and running and I've bashed my head up against some C code. (Hopefully successfully!)

Well this aged interestingly, didn't it? If you are able to see this notification, you got close. I'm interested by how you figured out that the GPIO would need to communicate with the LPC at a certain frequency.