CPU: AppoTech AX208 AXC51 (8051-compatible with 16-bit extended instruction set) microcontrolle @ ~~100MHz~~ 96MHz?
RAM: 15KB (12K IRAM + 1K Data RAM + 2K PRAM)
Display: 2.4" 320x240 TFT w/ backlight
Communication: Built-in IR port
USB: No (USB pinouts have been found on the motherboard, no tests have been performed yet)
Input Voltage: 4.5V (3x AA batteries)
(TODO: Verify if it actually uses the same ISA as
this SD controller that bunnie
talked about seems not)
Moonoon Color uses 25QXX series (more specifically, 25Q64 and 25Q128) SPI Flash chip as storage media for both ROM and savegame. ROM dumping and flashing have been successfully performed using a SPI programmer.
Background music is handled by the coprocessor microcontroller under the blob. The coprocessor outputs audio using 2-pin PWM similar to how HitClips work.
Coprocessor could be based on 6502 (specifically 65ce02) judging from the challenge/response command returning 6502 program fragments. (Blob, large enough EPROM that can hold audio samples, 6502, microcontroller, toy-oriented. Wild guess: GeneralPlus?)
See pwm2pcm_poc.py for a crude but pretty good quality software decoder for signals coming out of PWM1/2.
The ROM bus seems to run at 48/72MHz depending on the data being loaded. The coprocessor bus is running at around 4.8kHz.
The scanner itself is a simple reflective IR sensor. Exact part number is unknown.
The IR sensor is controlled by a separate microcontroller. This microcontroller seems to connect to the auxiliary bus alongside the coprocessor.
TODO: figure out the protocol.
Output can be easily spoofed via an IR blaster. Default parameter (38kHz carrier wave, 0.33 duty cycle) for Flipper Zero works reasonably well (as in 100% correct recognition out of around 10 tries) but just DC pulsing (high = constantly on, low = constantly off) might also work good.
The pulse timing rule is as follows:
- 10000us for preamble and tail (high pulses)
- tail pulse needs to be merged with the high pulse of the last line, e.g. 13000 for mark and 17000 for space
- (7000, 3000)us (low, high) for thick lines (mark)
- (3000, 7000)us (low, high) for thin lines (space)
Example for Roco Kingdom: The King's Badge:
Filetype: IR signals file
Version: 1
#
name: Sprigatito
type: raw
frequency: 38000
duty_cycle: 0.330000
data: 10000 7000 3000 3000 7000 3000 7000 3000 7000 3000 7000 3000 7000 3000 7000 3000 7000 3000 7000 7000 3000 7000 3000 3000 7000 3000 17000
Moonoon Color uses generic SATA socket (with both 7-pin data connector and 15-pin power connector) as its cartridge slot. However, the pinout is not compatible with the SATA standard.
The following figure shows the pinout of Moonoon Color cartidge slot:
- NC
- NC
- NC
- NC
- NC
- NC
- NC
- GND
- GND
- UNK1
- SPI_CLK
- SPI_MOSI
- SPI_MISO
- SPI_CS
- PWM1 (Positive half)
- PWM2 (Negative half)
- P25 (COPRO_CLK)
- VPP
- P27 (COPRO_DO)
- P21 (COPRO_DI)
- GND
- VDD
(TODO fill this)
0x00000000:0x00010000: Game script VM (AXC51 code)
0x0000e000:0x0000f000: Coprocessor challenge/response table (65ce02 code fragment)
0x00050000:0x00070000: Save area
1 <id:9> <parity:1> 00
(Here 1 means mark and 0 means space)
The barcode has a prologue pattern (fixed 1
) and an epilogue pattern (fixed 00
) used to detect the scanning orientation. The id is then simply encoded as bits (MSB first) and a single parity bit is calculated from XORing together all 9 bits in the id and added to the end of the id bitstream.
See mononcol_barcode.py
for a script that generates all possible barcodes (including the unused/invalid ones) as a single Flipper Zero IR signal file.