Cheap PlayStation Cheat Carts

Whenever I think of PlayStation, nothing excites me more than plugging something new into it. And what could be more exciting than one of those cheap ass cheat carts from AliExpress.

There are a lot of these around on various auction sites. I bought one to see if it could be flashed with unirom and to see exactly what’s inside it. They are around £7.50! on eBay UK, which is pretty much what you end up paying from AliExpress.

The device itself


First thing to notice is the lack of comms port. Don’t be upset, you wouldn’t have used it anyway. The 74hc245 that is used to drive the port is also missing.

We can see we have a Am29F010 1megabit EEPROM which means it’s flashable. Also the standard PAL/GAL that handles the chip select for the eeprom, data link (if it were present) and logic for the switch. All pretty much standard fayre for an Action Replay clone.

We also have pads on the PCB for a PLCC EEPROM which could be used in lieu of the TSOP32 on the board.

Software wise.. first boot gets you this. It’s in NTSC. If you are PAL like me you can change this by pressing L1+R1 and SELECT. Then press O to confirm. Standard Caetla rip off like you see on most of these carts.

High Speed Golden Finger. Ouff sir!

So can it be flashed with something else? Sure, Unirom supports this EEPROM and successful flashed it (you need to use unirom_standalone). See below for this in action

You can also probably flash something like the original AR/GS ROMs to them too if you wanted to. All these ROMs are available on the unirom disc itself.

In summary.. for what they cost delivered to the UK you can get one of these and they aren’t bad at all! I’d rather buy one of these than line some scalpers pockets on eBay for something *rare*.

xpp – Raspberry Pi – PSX/N64 Xplorer Utility

I was having a bit of a tidy up and found a simple app I put together for the Raspberry Pi. It allows you to communicate with the standard Xplorer/Xplorer64 rom software for a handful of useful functions.

The software will work on any of the 40 pin GPIO Pi’s from the b+ upwards. I use this software on a ZeroW and it works perfectly on both PSX and N64.

Currently supported commands :-

CommandFX4.2PRO 2.0XP_1.9XP_64
/status****
/mcstatus**XXX
/reboot***X
/freeze****X
/unfreeze****X
/peek***X
/view***X
/upload***X
/download***X
/execbin****
/exe***X
  • = Tested OK X = Incompatible ? Untested

This was my test setup. You really need to be using level shifters due to the Pi being 3.3v and Xplorer being 5v. However, in the image below I modded the cart so the 74’373/245s are running at 3.3v.

Raspberry Pi Connected to a 3.3v modded Xplorer

For more info – repo is here https://github.com/danhans42/xpp_psx

PSX PIO Breakout Shield

So the image at the top of this blog is the cart I use as a basis for many of my experiments since last year. Nicolas Noble was kind enough to design a simple ‘shield’ like board PCB for me so I did not have to suffer the pain of dupont cables. This board attaches to his PIO Breakout board, which you can find in the pcsx-redux repository https://github.com/grumpycoders/pcsx-redux/wiki/PIO-Breakout.

It provides a eeprom you can boot from (useful for unirom/whatever) and also with the addition of the ATF22v10c and CH375/6 can be a useful tool for USB experimentation.

I haven’t done much with its development or documentation and thought I would make a start – https://github.com/danhans42/pio_breakout_shield. Not much there at the moment but I will start chipping away at the documentation and also add a few different configurations.

Fake PS1 Memory Cards – The Great AliExpress/Amazon/eBay Swindle

I keep seeing loads of messages, posts and whatnot of people having issues with aftermarket Playstation 1 memory cards they have purchased online from various marketplaces. For example here https://www.ebay.co.uk/itm/-/192410771741

fake card
card purchased from AliExpress

There can be many reasons for this but the general one is.. you got scammed!

Basically a lot of the cards coming out of China have the wrong capacity flash part fitted inside. PS1 memory cards are supposed to be 1 megabit (128kilobytes), however these cheap cards have a 29EE512 fitted to them, which is half a megabit (64kilobytes).

Card teardown

This is not to say these cards are useless, you can use the first 7 blocks if you are careful, just beware using them for that epic FF IV or GT2 save you have, and make sure you backup. They are also a great candidate for installing freepsxboot to if you know what you are doing.


To install freepsxboot to one of these cards we basically need to duplicate the lower 64k of the .mcd image we are using into the upper 64kb. Reason being we dont have a high address line in use (A16) as used on a 128k part, so when the card goes beyond 64k it just writes over the start again rather than writing to what would have been the upper 64kb. Only other thing you could do is to source a 29EE010 in the same package and retro fit it – probably not worth the hassle but A16 is used by the ‘blob’ on the card so theoretically it should work.

Moral of the story.. dont buy these unless you know what you are doing. There are plenty of second hand and aftermarket cards out there that will be the correct capacity.

On a positive note though, these can be had for as little as 37pence on Aliexpress, so its a cheap source of 29EE512’s 🙂

Find me on psx.dev discord https://www.psx.dev/



Xplorer64 + Raspberry Pi Comms

Thinking about the lonely Xplorer64 I have had in the corner of my office for the past 11 months, I thought it time it got some attention.

See above. You can upload your homebrew code to an Xplorer64 using a raspberry pi kinda like so..

I’m using a raspberry pi for its gpio to do the pin twiddling. Xplorer protocol on the N64 version of the cart is broadly the same as the PSX version.

I’ve setup a GitHub repo with the details and the code will be up shortly when it’s more polished.

https://github.com/danhans42/xplorer64

I’ve done some test code using the amazing N64 Assembly tutorials by Peter Lemon (krom) and had it running via the Xplorer.

Thanks on this to to Tim Schuerewegen, krom and Martin “nocash” Korth for his psx-spex doc

CH-376 + PSX

Just a bit of a video of the setup in action.

Still plenty to do :-

  • Directory Support –
  • PSX-EXE checking/detection using header
  • Data loading support (so can be used for loading data to a RAM address)
  • Speed.. more of it (old memory sticks are a pain in the arse)
  • Improve the USB mode/disk mount code – sometimes takes a few attempts to init the USB drive correctly when freshly inserted.
  • File loading progress bar

More to follow.. at some point.. soonish.

Still on with it 😂

Not a lot to say really.

I’ll add more when I find time but have moved away from using PsyQ on dosbox and am now using sicklebricks bare GPU+pad example code as a base for these experiments. So far so very bloody good. Check it out (I’ll add the link soon)

Have had to switch back to sio for code upload duty as the usb controller is in use for host duties. I’ve got data transfer to pc working reliably in both directions now.

Also, am fleshing out the code with a usb stick browser using the inbuilt support offered by the ch376.

Thanks go out to sicklebrick for the examples and help, Nicolas noble for pcsx-redux openbios stuff. Also, big mention for Team Shinra.. they are an Amstrad demo group who have used the ch376 with the CPC.. their basic examples were invaluable in early tests.. thanks – I’ll be rigging one up to my CPC464 soon 🙂

(add links)

Few screenshots below.

Oh.. and I made pong from scratch using the same code stuff.. I’m in the process of tidying it up and ill stick it up on GitHub. Be a easy thing to understand for anyone new to PSX home-brewing.

More USB Fun

Since my last update haven’t done a great deal other than adding a second CH376 to my setup.

Main reason being, I can use one for Comms as a device and use the other as a host for connecting devices to. It was getting tricky juggling things around so thought this would make life easier.

The usb controller for Comms is working pretty well, psx-pc uploads are flakey but I can sort that later when I actually draft up some sort of packet based protocol to resend stuff when usb is busy. Sure it’s something simple, but chipping away at it was boring me so I needed to change to something else.

So got back to usb mass storage. Initially I was looking at using the 375.. however the 376 supports FAT12/16/32 so meant less work psx side. However, the documentation is difficult to read which has slowed progress.

So far I’ve got it mounting the usb stick fine, reads the size of the first partition and returning its size and free space. Also getting a directory listing. Next up is to get it to open a file and load it into memory. The screenshot below shows the debug output into a serial monitor. Nothing major.. but progress nevertheless 😁

Playstation USB Device (WCH CH375)

Further to my previous post on using the CH375 as a USB host to enable the use of USB Mass Storage on the Playstation – so I thought I would look at device mode for a bit and see how hard it was. Idea being that this could be a faster alternative to using something with a PC Parallel port or SIO cable etc.

Here is the work I’ve done so far. First video was the first attempt at this. The CH372 datasheet is thankfully a lot easier to read, and more accurate than the CH375. I reference the CH372 as that is essentially the command set that is used by the 375 for device mode.

Video below is first attempt. Literally safe mode timing – didnt do anything other than ‘get it working’ Not exactly breaking speed records.

Whilst improving the linux client side of things – that naturally left me looking back at improving things PSX side. After a few attempts,I got trimming some values right down when reading the buffer.

The client is written in C using libusb. Current features are data upload to address, or upload EXE.. Playstation side of things is a small program that just loads the data into memory. It is currently running from the EEPROM on the Xplorer so can be loaded instantly at boot

Started to tidy up the code a bit and add some more features and error handling, and managed to quicken it up quite a bit… see below. Waay faster than the initial experiment.

Thanks again to the people over on the psxdev discord, especially Grumpycoder who helped with libusb examples and talking through endpoints and whatnot.