wraggster
April 19th, 2010, 16:20
News from http://hackmii.com/2010/04/sunplus-the-biggest-chip-company-youve-never-heard-of/#more-818
Every once in a while, you stumble upon something that nobody else seems to have paid much attention to. This all started with my investigation into a glorious product named the Vii.
I can’t really give a great justification as to why this thing was so damned interesting to me, but it seemed weird and quirky and nobody really knew much about it. I thought it might be fun to try to emulate awesome games such as “Fry Egg” on the real Wii, but didn’t really know where to begin — aside from getting my hands on one. When it finally arrived in the mail from China, I opened it up to find myself faced with a couple of epoxy blobs:
http://farm5.static.flickr.com/4027/4530607942_957c886220.jpg
This was a bit depressing; there’s not much you can do with these, absent any sort of descriptive markings. Fortunately for us, the makers of this “console” decided to add a cartridge port and a 9-pin joystick controller, and then include a “VC-1″ cartridge full of crappy games (“Virtual Console”, I suppose). It was here that we got lucky; the cartridge contained a standard NOR flash chip, which I was able to read out with a standard chip programmer.
http://farm4.static.flickr.com/3421/3889584756_eb232d2d4a.jpg
Browsing through the contents of the flash chip, there was no recognizable text or known instruction set — but fortunately, we found this header:
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
0000c00: 6368 6b73 756d 3a32 3441 3842 4339 4220 chksum:24A8BC9B
0000c10: 7665 723a 2275 276e 5350 2049 4445 5665 ver:"u'nSP IDEVe
0000c20: 7220 312e 362e 3222 2075 7365 723a 2273 r 1.6.2" user:"s
0000c30: 756e 706c 7573 2220 626f 6479 3a22 5350 unplus" body:"SP
0000c40: 4732 3433 2200 0000 0000 0000 0000 0000 G243"...........
u’nSP? sunplus? What is this crap? Searching on Google didn’t find much (at the time — there’s a lot more now, partially by coincidence and partially as a consequence of the work we’ve done which we’ll get to shortly). We started digging, and, well, to make a long story shorter — it turns out that there is one Chinese company with several names that makes chips that you could probably find in devices you already own.
SPG
The SPG2xx series use a custom instruction set (“u’nSP”), and are designed for something like the TV Plug-n-Play games; they are used in most (if not all) of those, as well as the Vii and the V.smile (if nothing else). Segher took our dumped ROM and scant documentation and built a disassembler, and then a mostly-working emulator for this architecture (more on this below). The top of the line SPG290 uses a different “s+core” architecture, and is used in the Mattel Hyperscan.
SPMP
The SPMP series chips are ARM-based SoCs that are used in cheap Chinese “Personal Media Players” that also generally come bundled with NES or GameBoy emulators; see Marcan’s work on these.
I/O interfaces
I’ve seen a lot of use of these chips in random USB I/O applications. The external hard drive I use to back up my laptop has a SunPlus USB-SATA bridge. They make USB-to-CCD interfaces (aka webcams!).
Everything else
They make chips that go into digital picture frames and portable DVD players, too. In China, they’re used for more general control applications — they make general MCUs under the “GeneralPlus” name, and it was actually here where we found the most info. Although the datasheets for the SunPlus chips are pretty hard to find, the general-purpose chips have freely-available documentation, and many of them use the same instruction set. On the GeneralplusSunplus MCU site (this all gets very confusing), you can find datasheets for other chips that use the u’nSP instruction set, and even an IDE based on an old, hacked up, GPL-violating version of GCC that supports u’nSP!
Based on the ROMs we extracted from the Vii and some experiments, Segher was able to write a disassembler and then eventually an SPG emulator:
I can now play Vii games on my computer, woohoo! Sadly, sound and “Viimote” support have yet to be implemented. Further research showed that most (all?) of the Jakks Pacific TV Plug’n'Play games also use SPG chips, so after some hardware hacking, we were able to play a couple of them, too:
Work lately has focused mostly on the V.tech V.smile, which has the advantage of being cheaply and widely available, and it takes cartridges which are just simple ROMs (or occasionally NOR flash chips) on a PCB … with any luck, we will soon have a SPG development kit for the masses, a need that I’m sure everyone will agree went unfulfilled for quite some time.
Every once in a while, you stumble upon something that nobody else seems to have paid much attention to. This all started with my investigation into a glorious product named the Vii.
I can’t really give a great justification as to why this thing was so damned interesting to me, but it seemed weird and quirky and nobody really knew much about it. I thought it might be fun to try to emulate awesome games such as “Fry Egg” on the real Wii, but didn’t really know where to begin — aside from getting my hands on one. When it finally arrived in the mail from China, I opened it up to find myself faced with a couple of epoxy blobs:
http://farm5.static.flickr.com/4027/4530607942_957c886220.jpg
This was a bit depressing; there’s not much you can do with these, absent any sort of descriptive markings. Fortunately for us, the makers of this “console” decided to add a cartridge port and a 9-pin joystick controller, and then include a “VC-1″ cartridge full of crappy games (“Virtual Console”, I suppose). It was here that we got lucky; the cartridge contained a standard NOR flash chip, which I was able to read out with a standard chip programmer.
http://farm4.static.flickr.com/3421/3889584756_eb232d2d4a.jpg
Browsing through the contents of the flash chip, there was no recognizable text or known instruction set — but fortunately, we found this header:
0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
0000c00: 6368 6b73 756d 3a32 3441 3842 4339 4220 chksum:24A8BC9B
0000c10: 7665 723a 2275 276e 5350 2049 4445 5665 ver:"u'nSP IDEVe
0000c20: 7220 312e 362e 3222 2075 7365 723a 2273 r 1.6.2" user:"s
0000c30: 756e 706c 7573 2220 626f 6479 3a22 5350 unplus" body:"SP
0000c40: 4732 3433 2200 0000 0000 0000 0000 0000 G243"...........
u’nSP? sunplus? What is this crap? Searching on Google didn’t find much (at the time — there’s a lot more now, partially by coincidence and partially as a consequence of the work we’ve done which we’ll get to shortly). We started digging, and, well, to make a long story shorter — it turns out that there is one Chinese company with several names that makes chips that you could probably find in devices you already own.
SPG
The SPG2xx series use a custom instruction set (“u’nSP”), and are designed for something like the TV Plug-n-Play games; they are used in most (if not all) of those, as well as the Vii and the V.smile (if nothing else). Segher took our dumped ROM and scant documentation and built a disassembler, and then a mostly-working emulator for this architecture (more on this below). The top of the line SPG290 uses a different “s+core” architecture, and is used in the Mattel Hyperscan.
SPMP
The SPMP series chips are ARM-based SoCs that are used in cheap Chinese “Personal Media Players” that also generally come bundled with NES or GameBoy emulators; see Marcan’s work on these.
I/O interfaces
I’ve seen a lot of use of these chips in random USB I/O applications. The external hard drive I use to back up my laptop has a SunPlus USB-SATA bridge. They make USB-to-CCD interfaces (aka webcams!).
Everything else
They make chips that go into digital picture frames and portable DVD players, too. In China, they’re used for more general control applications — they make general MCUs under the “GeneralPlus” name, and it was actually here where we found the most info. Although the datasheets for the SunPlus chips are pretty hard to find, the general-purpose chips have freely-available documentation, and many of them use the same instruction set. On the GeneralplusSunplus MCU site (this all gets very confusing), you can find datasheets for other chips that use the u’nSP instruction set, and even an IDE based on an old, hacked up, GPL-violating version of GCC that supports u’nSP!
Based on the ROMs we extracted from the Vii and some experiments, Segher was able to write a disassembler and then eventually an SPG emulator:
I can now play Vii games on my computer, woohoo! Sadly, sound and “Viimote” support have yet to be implemented. Further research showed that most (all?) of the Jakks Pacific TV Plug’n'Play games also use SPG chips, so after some hardware hacking, we were able to play a couple of them, too:
Work lately has focused mostly on the V.tech V.smile, which has the advantage of being cheaply and widely available, and it takes cartridges which are just simple ROMs (or occasionally NOR flash chips) on a PCB … with any luck, we will soon have a SPG development kit for the masses, a need that I’m sure everyone will agree went unfulfilled for quite some time.