Pandora's box 4S game list entries

Now that we know where the game list is, we can try to deduce some things.
Facts:

1. Libnsxsa.so does not contain any driver for 80's game "zerotime".
2. Galaga3 is in the list. as 'xxxxx' for some reason, but who cares.
3. There has to be an emu capable of running "galaga3".
4. There are config files for this game. They appear to be for MAME, in xml format.
5. Candidates for this are libnsxnsa and libnsxnx (nsa is an unknown.. nx=xmame)
6. $GAME can be 3 for libnsxnsa, 4 for libnsxnsap or 5 for libnsxnx
7. There must be some identifying mark(s) in the list, to ensure proper launches of games.
8. The game name and/or coins could somehow be preserved between the switching of emulators.

It is likely that the current running instance of libnsx* writes its emu/game type(s) into /tmp/configfile. Coin data perhaps in /tmp/config/data.so.
We need value 5 for xmame launching.

00601EE8 9B 17 00 00 │ 67 61 6C 61 │ 67 61 33 00 │ 00 00 00 00  ›↨..galaga3.....
00601EF8 00 00 00 00 │ 00 00 00 00 │ 78 78 78 78 │ 78 78 78 78  ........xxxxxxxx
00601F08 78 78 78 78 │ 78 78 00 00 │ 00 00 00 00 │ 00 00 00 00  xxxxxx..........
00601F18 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00  ................
00601F28 78 78 78 78 │ 78 78 78 78 │ 78 78 78 78 │ 78 78 78 78  xxxxxxxxxxxxxxxx
00601F38 78 78 00 00 │ 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00  xx..............
00601F48 00 00 00 00 │ 00 00 00 00 │ 00 01 00 00 │ 01 02 03 04  .........☺..☺☻♥♦
00601F58 00 00 00 00 │ 00 00 00 00 │ 58 02 00 00 │ 01 00 00 00  ........X☻..☺...
00601F68 0F 00 00 00 │ 05 00 00 00 │ 9C 17 00 00 │ 71 69 78 00  ☼...♣...œ↨..qix.

Looking at it in an hex editor:
Kind of difficult to see, but there is a numbering scheme: "9B 17"for Galaga3 and 9C 17" for Qix followed by xxxx's for the Chinese and English names of the game. There is an unmistakeable 05 at 0x601F6C.

Let's look at a neo geo game. 601EE8-601F6C = +0x84 hex offset could have some number..

005EE578 EA 03 00 00 │ 6B 6F 66 39 │ 37 00 00 00 │ 00 00 00 00  ê♥..kof97.......
005EE588 00 00 00 00 │ 00 00 00 00 │ E6 8B B3 E7 │ 8E 8B 39 37  ........拳王97
005EE598 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00  ................
005EE5A8 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00  ................
005EE5B8 4B 6F 66 39 │ 37 00 00 00 │ 00 00 00 00 │ 00 00 00 00  Kof97...........
005EE5C8 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00 │ 00 00 00 00  ................
005EE5D8 00 00 00 00 │ 00 00 00 00 │ 00 01 00 00 │ 01 00 00 00  .........☺..☺...
005EE5E8 00 00 00 00 │ 04 00 00 00 │ 68 01 00 00 │ 01 00 00 00  ....♦...h☺..☺...
005EE5F8 00 00 00 00 │ 00 01 00 00 │ EB 03 00 00 │ 6B 6F 66 39  .....☺..ë♥..kof9

Hmm. Could be a '00' value there.

I need to test more when i get the box.
For now, if people want, they can change some roms as well. The Galaga/Galaxian games could be switched with say, Psychic 5, Toki.. and so on. You'll need some roms, use sets for Mame 0.106 as this is the one they use in the box.

So what about libnsxs.so..

Let's dig a bit deeper into libnsxs.so

Without having the box, it's difficult to see what it actually does, and where the symlink in /tmp/libnsxs.so actually points to. But we can deduct it.

Step 1, a look at /usr/emu/runGame

rm -f /tmp/libnsxs.so
cp /tmp/configfile /usr/sd1/configfile.last.$GAME; sync
EMU0=`od -t d -N 1 -j 538 /tmp/configfile |  head -n 1 | awk '{print $2}`
EMU=$(( $EMU0 & 15 ))

In case of pb4s configfile i have on the dump, the value is '0'. which means

if [ $EMU -eq  0 ]; then
ln -sf /lib/$GAME/libnsxas.so    /tmp/libnsxs.so

So we need to look a libnsxas.so.

This is a copy of Final Burn with a menu tacked in front of it. Could be a heavily modded FBA since most ports have some sort of menu, like for example the Xbox 360 version(s).

Game list

Look at 0x005EE4F0 in a hex editor. Or search for "END_OF_THE_LIST"..
It should be possible to inject a new gamelist or at least edit existing entries, once we figure out the format. Perhaps it is similar to the older list.dat from PB3.

How the emu is switched is unclear, it would need to write configfile and exit out to a new instance.
It has to switch. libnsxas.so does not contain drivers for say, galaga or galaxian.

More soon :)

A closer look at Pandora's box 4S

A closer look at these chinese boxes.
For this example i will use a public dump called pb4sfix.img. This one appears to be unencrypted.

The SD card.

Disk pb4sfix.img: 7,2 GiB, 7744782336 bytes, 15126528 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x14e65c89

Device Boot Start End Sectors Size Id Type
pb4sfix.img1 2048 609929 607882 296,8M 83 Linux
pb4sfix.img2 609930 15126527 14516598 6,9G 83 Linux

Quick and dirty mounter script:

mount -o rw,loop,offset=1048576 pb4sfix.img ./test
mount -o rw,loop,offset=312284160 pb4sfix.img ./test2

You can calculate the offset by doing start * 512. (2048*512=1048576 for example.)

Kernel Boot

The first partition holds kernels, configfiles and script.bin. The last one is a parameter file for the A13 platform that the Pandora's run on. Sectors 0-2048 of this SD card are reserved for u-boot. (I have seen a few different Pandora SD cards where the first partition starts later on, but that is beyond the scope of this post.)

At boot, the script inside U-boot you can see here reads the GAME parameter and boots the kernel accordingly. This parameter is possible to change at boot by holding 1p start & 1p shot 1 at boot until a board selection screen appears.

There are several other parameter files
bi = 4 bytes, function unknown
forcevga = 4 bytes, 1 or 0.
game = 4 bytes, pb4s, kzbw, or mame
lang =
xmame.game = may contain a romname for launching. 

For now, let's assume we're booting pb4s

Init

After kernel is loaded, and booting, the second partition will be mounted as root filesystem (/dev/mmcblk02). It is a basic Busybox system. Then /etc/init.d/rcS is parsed.

mount -t vfat /dev/mmcblk0p1 /usr/sd1
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
export QWS_DISPLAY=LinuxFb:/dev/fb0
export QTDIR=/root/real210/qt3
/usr/emu/runGame &

Nothing special. Let's see about runGame. this is a big beast of a file. So i only include the parts relevant for $GAME=pb4s at this point.

  # main loop
  while true;
  do
          rm -f /tmp/libnsxs.so
      cp /tmp/configfile /usr/sd1/configfile.last.$GAME; sync
        EMU0=`od -t d -N 1 -j 538 /tmp/configfile |  head -n 1 | awk '{print $2}`
        EMU=$(( $EMU0 & 15 ))
        #switch game emulator
        if [ $EMU -eq  0 ]; then
                ln -sf /lib/$GAME/libnsxas.so    /tmp/libnsxs.so
        elif [ $EMU -eq  1 ]; then
          ln -sf /lib/$GAME/libnsxcs.so    /tmp/libnsxs.so
        elif [ $EMU -eq  2 ]; then
          ln -sf /lib/$GAME/libnsxns.so    /tmp/libnsxs.so
        elif [ $EMU -eq  3 ]; then
          ln -sf /lib/$GAME/libnsxnsa.so   /tmp/libnsxs.so
        elif [ $EMU -eq  4 ]; then
          ln -sf /lib/$GAME/libnsxnsap.so  /tmp/libnsxs.so
        elif [ $EMU -eq  5 ]; then
          ln -sf /lib/$GAME/libnsxnx.so  /tmp/libnsxs.so
        else
                ln -sf /lib/$GAME/libnsxas.so    /tmp/libnsxs.so
        fi
      if [ "`cat /lib/pb4s/home `" -eq "1" ]; then
        if [ $EMU -eq  5 ]; then
          (cd /tmp && ./libnsxs.so btime )
        else
              if [ $MODE -eq 0 ];  then
          ( cd /tmp  && ./libnsxs.so -qws 52 800 600 )
              else
          ( cd /tmp  && ./libnsxs.so -qws 52 384 224)
              fi
        fi
      else
        if [ $EMU -eq  5 ]; then
          (cd /tmp && ./libnsxs.so tankfrce )
        else
              if [ $MODE -eq 0 ];  then
          ( cd /tmp  && ./libnsxs.so -qws 54 800 600 )
              else
          ( cd /tmp  && ./libnsxs.so -qws 54 384 224)
              fi
        fi
     fi
  done
}

There are some interresting things before we get to this point that i skipped over. The binary /usr/emu/gameselectmenu is called, (with -m $MODE), and also the binary /usr/emu/testHD.
The gameselectmenu allows switching between pandora/xmame/pb4s mode. The testHD binary is likely for HDMI implementation. A HDMI version of PB4S exists, built into a control panel for direct use on a HDTV

Of more interest is the file '/usr/emu/getkey3m' which runs as part of the init.
Earlier versions of Pandora used a 'jamma.ko' loadable kernel object, and getkey seems to use gpio to get input keys, or perhaps transfer coins or something. It reads/writes to /usr/sd1/bi , /dev/mem, /dev/i2c-0 and /dev/ttyS1. The exact use of this is unclear, as i don't have the box yet :)

With all that out of the way, we are on our way to /tmp/libnsxs.so.. Or whatever is linked symbolically at that point. See you next post!