WIDE-BOY64 AGB (TS2) Dump

[Linkr2]

Hey @msinger!

First of all, excuse me if opening an issue is not the appropriate way to contact you, but I couldn't find any other means! Let me know if I should remove it, no prob.

I wanted to let you know that recently a dump of the "WIDE-BOY64 AGB (TS2)" was preserved:

https://archive.org/details/wide-boy-64-agb-ts2

I wonder if this might be helpful for your Wide-Boy 64 (or Wide-Boy64, as you mentioned on your website, haha) reverse engineering project. I noticed on the TODO list on your site that desoldering and dumping the WB64AGB Flash was one of the remaining tasks.

I also wanted to ask if any help or contact could help you! This is such a great piece of research, and as far as I know, it has never been documented like this before.

As time goes by, accessing information about these devices becomes increasingly difficult. Finding someone who not only has one but also shares technical information about them is incredibly valuable to the community. Thank you!

[msinger]

Hi,
of course it is okay to contact me this way. I just enabled discussions for this repository, so now there is an even more appropriate way.

I didn't know that there are ROM dumps on archive.org. Do you know how this works legally? Can anybody just upload a ROM there in the "image" category? I have a dump of the FPGA bitstream of the WB64AGB that I would like to archive somewhere for preservation. I didn't have the balls to put it on my website, because Nintendo is very well known for destroying the lives of people over stuff like that.

Once I dump the flash chip myself, I can compare it to the image on archive.org, to see if it is identical, or if there are different versions.

There are a few things I need to continue, maybe you can help in any way:

• I haven't found a datasheet for the BU9850 EEPROM that helps in understanding how to dump it's contents. I don't know much about N64 stuff, but from my understanding, this EEPROM is used in other cartridges too for save games. So there should be people out there that know how to access this chip.
• I need more Wide-Boys. If you see one on ebay, please inform me. There currently is a CGB variant:
  https://www.ebay.de/itm/285701522007?mkcid=16&mkevt=1&mkrid=707-127634-2357-0&ssspo=-HXJ8jCeSV6&sssrc=2047675&ssuid=LaVkz7NJQm6&widget_ver=artemis&media=COPY
  But it is too expensive in my opinion. Before this guy was selling it, the same device was sold by someone else. So he/she just bought it to sell it for even more money. I don't want to support that. It's sad.
• As I already said, I need a way to "archive" the FPGA bitstream somewhere without getting annihilated. If you want to contact me privately, my email can be seen in the commits when you clone the git repository.
• I assume the flash image that you found on archive.org was dumped like a regular N64 cartridge via a cartridge dumper. But I'm not sure. I would like to dump it in two ways. Like a cartridge, and by desoldering the flash chip and dumping it's contents directly. So we can be sure that there is not any hidden data on the flash that only the FPGA can see, but not the N64. I don't have hardware for either of those two dumping methods. I haven't decided yet if I want to build it myself or if I want to spend money and buy a flash/eeprom programmer for that. Maybe there are opensource projects? Any ideas?

If you can help in any way I'd appreciate it, but please don't feel pressured to. The flash image on archive.org is good information already and I still have a lot of work to do on the DMG Game Boy.

Thanks for getting in contact.

[Linkr2]

Thanks for moving the issue to a discussion! That's great. And thank you for the detailed reply!

I was going to reach the preservation group "Forest of Illusion" in order to find out more about their dump, as they are the ones that dumped and preserved the WIDE-BOY64 AGB (TS2), but I saw they announced their closure in 2023...

https://x.com/forestillusion/status/1615143069271330818

So I'm reaching some well-known preservation groups looking for advice, also asking about info on the BU9850 EEPROM dumping.

The amazing people at the preservation community Hidden Palace offered me some advice, the user togemet2 shared some very interesting info:

• They told me that they agree with what's written in your research document regarding the BU9850 EEPROM, thinking that it would probably don't contain anything at all.
• According to them, there's no reason you'd need any sort of saved data on the Wide Boy, except maybe for screen zoom and aliasing settings, but these always reset when you restart the console.
• They mentioned that it's possible it might have been used on another revision, as plenty were made that aren't widely known about, including the CGB version.
• They also noted that since it's socketed, you could probably pull it out and put it into a device that supports reading that EEPROM if you really needed to check. However, they pointed out that it would essentially be equivalent to dumping a save file on any retail game, so a dump wouldn't really be needed for reverse engineering or preservation. They explained that you can think of it as a battery-backed game save—anything on that EEPROM can be gained from the actual ROM.

Then togemet2 ran the TS2 Wide Boy dump and got the file for the BU9850 EEPROM, gaining it from a normal ROM dump:

They said you may get a slightly different result to this though because you aren't reverse engineering specifically the TS2 version.

On the preservation side of things, the user ICEknight recommended MAME, they said that even if it's not yet supported, 'skeleton drivers' are being made all the time to prevent the dumps and board documentation from being lost:

https://github.com/mamedev/mame/pulls?q=is%3Apr+sort%3Aupdated-desc

[Linkr2]

More good news! @msinger

I found new dumps! There are not only two versions of the AGB but also one of the CGB version:

• Wideboy AGB 0.02c
• Wideboy AGB 0.04c
• Wideboy CGB 1.02

The dumps were done by HCS, here is the site containing the dumps: https://hcs64.com/n64info.html

The readme notes say:

The CGB was dumped with ZiyalII on a V64jr. The CRC checks out but the ROM
doesn't boot, not sure if that's a problem with the dump or if it just needs the
hardware.

The AGBs were dumped with a Gameshark using GSCC2k. Oddly the 0.04c ROM came
from what seems like an older unit, with a AGB model CPU dated 0103, while the
0.02c ROM was from a unit with model AGB A dated 0217. I suppose the "older" one
was flashed more recently.

I tested them, and as the readme says, the AGB ones boot, showing the Intelligent Systems splash screen with the Game Boy Advance frame, but the CGB doesn't boot. Very interesting stuff—I wonder which version you have and if it happens to be one of these.

EDIT: The ROMs obviously don't do much without the Wide Boy hardware, but I noticed that out of all of them, the 0.04c allows me to perform the zoom function with the analog stick, while the others don't even respond to button presses.

EDIT2: It looks like the device lets you check the firmware version on its own. When you connect a second controller to the N64, you can bring up a small on-screen menu. This menu not only lets you change colors but also displays the firmware revision in the lower right corner. To access this menu, just press 'Start' on the second controller. Keep in mind, this feature only works when both controllers are plugged in.

Found this information here: https://www.nesworld.com/n64-wideboy.php

I tested this on both versions 0.02 and 0.04c, and it works; however, changing the numbers doesn't affect the image at all, presumably because no game is being displayed. Interestingly, version 0.02 shows 114c as the firmware number, whereas 0.04c shows 119c.

[msinger]

Thank you for the information.

I didn't know about the version menu with the second controller. Sadly I only have one N64 controller. When I plug it into the second port, nothing happens when I press Start or any other button. Maybe I have an older version. Or maybe it needs two controllers plugged in at the same time.

Unfortunately there are no pictures of the back side on that website that mentions the version menu. Mine has 'Ver. A' printed on the back and 'WIDEBOY AGB(A)' on the PCB. See here. But this could also be just the PCB version, not the software version.

[Linkr2]

I've tested it, and it only works when both controllers are plugged in before booting. Swapping the controllers or connecting the second controller after booting doesn't work. It seems both controllers must be connected before booting for the second controller to be able to trigger the menu.

[msinger]

I remembered that I had two non-original controllers that came with the console. I had stashed them away and forgot about them. Found them, and now I can open the menu on the second controller:

Version: 117c

When you increasing the first red number, the picture gets more red:

When you reduce the second red number, the picture gets less red:

Same goes for green and blue numbers of course. Increasing the white number at the end makes the picture darker.

And the best thing is: The numbers you configure in this menu are persistent over power cycles! They get stored in the EEPROM. These 31 numbers must be some of the 0x1F fields that you can see in the hex dump you posted above. But in the hex dump there are more 0x1F fields than in the menu. I wonder what the others are for.

[Linkr2]

Wow, that's an amazing finding! I wondered if that would be the case—this is awesome. I don't think this feature has ever been documented online; maybe not all revisions support saving these values.

It's also cool to see that yours says version 117c, which doesn't match any of the dumps available online.

[Linkr2]

By the way, I found some interesting information about dumping on the Hit Save organization's website. There is a specific section with information and solutions on how N64 dumping works, including Open Source solutions:

https://dumping.guide/carts/nintendo/n64

But that's not the best part—they have RetroBlaster cart dumping kits available for community members to borrow!

I contacted them and spoke with Jonas Rosland, the executive director at Hit Save. They found your project interesting and asked if their dumping kits would be useful for us.

If we are interested, they told me to use the application form, which you can find here: https://docs.google.com/forms/d/e/1FAIpQLSdYIz1PqaDrResuI4yz2Pcv9PCSUXc1lGhcKqWSeEfFM84sAw/viewform

If it seems like a good option for you, feel free to use the form at your convenience. Maybe you'll prefer to go down the Open Source route and build something yourself. In any case, they would be happy to help!

[msinger]

I still need to desolder the flash and dump it directly. There are two reasons for that:

1. We don't know if there is anything in the flash that the Spartan is hiding from the N64.
2. We don't know how the data lines are mapped. They could be mapped 0 to 0, ... and 15 to 15, but they could also be completely random. Theoretically the address lines could be scrambled too.

This is important for reproduction or repairs of the device, when the flash is defect and needs to be replaced or if bit rot kicks in after some decades and it needs to be reflashed.

Before I continue on the Wide-Boy though, I want to finish the layout of the Game Boy CPU first. This has taken a lot of time already and I want it finished.

[msinger]

Okay, I couldn't resist. I dumped the flash chip directly, like I did with the FPGA PROM chip. The first half of the chip is actually empty, and the data is byte swapped. I documented it on the website.

[Linkr2]

Wow, you are the GOAT! haha 🙌 Amazing progress and findings—congrats! I'm currently going through the documentation, and it's really interesting.

I wanted to ask again, purely out of curiosity and not to push in any way: What would be the next steps now? You've achieved so much already! Are you planning to build a reproduction now that you've reverse-engineered all this data?

Once again, I would be happy to help or contribute in any way. Thanks for sharing your insights! 👏 It's been really exciting to follow your progress.

[msinger]

I don't know what the next steps would be yet. At some point I want to build something to program the PROM chips I bought. They require a higher programming voltage that needs to be provided for a very specific amount of time for each row of bits that are being written. This makes it a bit more complicated. For building a repro I would also need to desolder all resistors and capacitors first, so that I'm able to measure their values. Depending on whether or not I want to reproduce the layout of the PCB 1:1, I would also need to remove all other parts, so that the shapes of all traces are visible. It's very likely that for some parts replacements have to be found. This then may require PCB changes.
Building a repro will only work if the Spartan FPGAs I bought on Aliexpress are actually genuine. With old chips like that there is always the chance that they scam you and sell relabeled chips that are something else. I could test them, but for that I will also need to desolder the original first. I could do that when I decide to recreate the PCB layout 1:1, when I have to remove all components anyway.
If the FPGAs don't work, then making a reproduction would be an entirely new product that has nothing to do with a Wide-Boy anymore. The core functionality of the Wide-Boy is done in the FPGA. Which is taking the Game Boy Advance video and audio output and converting them into textures and wave samples for the N64.
I would also like to try out if the other firmware variants run on my Wide-Boy, but this would require me to constantly resolder the flash chip in and out. I don't want to do that. Would be nice if someone knows if the firmware of the Wide-Boy can actually be updated through the N64 cartridge connector and how it works. As I explained, the main functionality is in the FPGA, and the FPGA configuration bitstream can't be updated. The PROM which holds it is only one-time programmable. So what a firmware update of the N64 code could fix is very limited.
I would also like to be able to read and write the EEPROM contents. I want to try changing the other values that are in there to see if they have any effect. If you accidentally find any description about the EEPROM, please let me know. :)

[Linkr2]

@msinger Thanks once again for the thorough insight!

As far as I know, there was indeed a way to update the Wide-Boy firmware through the N64 cartridge connector, but it required a specific device also created by Intelligent Systems:

https://www.youtube.com/watch?v=yKRxFmzJ6ek
(Amazing video from Behind The Code with Gerry)

The Wide-Boy had upgradeable firmware, which was freely available from Intelligent Systems' FTP site. However, the only way to upgrade the firmware was by using another Intelligent Systems product called the "Gang Writer," which was also used to program official N64 development flash cartridges.

If you had this device, you could access Intelligent Systems' FTP server and download updates for it. Here is an archived version of the FTP:

https://archive.org/details/IntelligentSystemsFTP-20081108