A deep dive into reverse-engineering of VPlay20K handheld platform – an unexpected fusion of vape and NES-on-a-chip technology. Part vape mod, part gaming console, all curiosity-driven hacking.
- Type: 1.77" TFT LCD
- Resolution: 128x160 pixels
- Interface: 20-pin parallel MCU
- Driver IC: ST7735
- Operating Voltage: 2.6V ~ 3.0V
- Datasheet: hicenda.com
- Model: Winbond W25Q32JV
- Capacity: 32M-bit (4MB)
- Interface: Dual/Quad SPI
- Operating Voltage: 3V
- Datasheet: winbond.com
- Battery Type: 18650 Li-ion
- Capacity: 850mAh
- Charging Circuit: Unknown (Currently reverse-engineering 🔍)
- Main Chip: NES-on-a-chip variant (likely an NOAC)
- Microcontroller: Manages:
- Vape functionality (still unclear how)
- LCD display driving
- Audio output through small speaker
- Potential microphone input
- Display pinout successfully identified
- SPI Flash dump from W25Q32 extracted
- Extract 3 base ROMS
- Recover the other assets in the dump
- Determine how NES mappers are implemented in flash to support every possible NES ROM
- The SPI dump was obtained by desoldering the chip with a hot air gun and then reading the flash using an Arduino UNO.
(0x000000, 0x05FFFF, "Unknown data 1"),
(0x060000, 0x065FFF, "Test program"),
(0x066000, 0x07FFFF, "Unknown data 2"),
(0x080000, 0x0BFFFF, "F-22 hacked ROM", 262144),
(0x0C0000, 0x0C5FFF, "Pac-Man hacked ROM", 24576),
(0x0C6000, 0x0C7FFF, "Harry Tetris hack CHR ROM", 8192)
(0x0C8000, 0x0CFFFF, "Harry Tetris hack PGR ROM", 32768)
(0x0C6000, 0x3FFFFF, "Unknown data 3")
- Mapper: NROM (0)
- PRG-ROM: 16 KB
- CHR-ROM: 8 KB
- Mirroring: Horizontal
- Hidden test rom: test input, screen and speaker
- Mapper: CNROM (4)
- PRG-ROM: 128 KB
- CHR-ROM: 128 KB
- Mirroring: Horizontal
- Mapper: NROM (0)
- PRG-ROM: 16 KB
- CHR-ROM: 8 KB
- Mirroring: Horizontal
- Mapper: NROM (0)
- PRG-ROM: 32 KB
- CHR-ROM: 8 KB
- Mirroring: Horizontal
- Note: On this ROM, the CHR ROM is swapped with the PRG ROM, which is uncommon.
This tool will assist in extracting ROMs from the dump and creating the correct iNES header to be fully playable with emulators.
Run the script with vplay20k_dump.bin as an argument:
python vplay_rom_extractor.py /path/to/vplay20k_dump.bin
The script will check the MD5 hash of the SPI dump and generate the following ROM files if the hash matches:
- test_program.nes
- f22.nes
- pacman.nes
- harry_tetris.nes
This tool allows you to replace the 3 original games of the VPlay20K vape dump, preserving the original structure of the file. The tool ensures the correct placement of PRG and CHR data, with the appropriate iNES headers for NES compatibility. Please report to rom[X]_compatibility.txt for compatibility list.
Run the script with vplay20k_dump.bin and the three ROMs you wish to inject as arguments:
python vplay_rom_injector.py /path/to/vplay20k_dump.bin /path/to/rom1.nes /path/to/rom2.nes /path/to/rom3.nes