Anbernic RG35XX H
I have a RG35XX H, Horizontal handheld console. Here are some (hehe) notes.Definitly a mess, please try a custom OS instead of whatever im writing here.
It uses Linux as its basis, uboot as its bootloader. its Aarch64, ARM.
Specs
Rg35xx H
Allwinner H700 quad-core ARM Cortex-A53,1.5GHz frequency
Dual- core G31 MP2
LPDDR4 1GB
WIFI/Bluetooth
HDMI output
2 OTG
Datasheet?https://bbs.16rd.com/thread-609669-1-1.html
H700_Datasheet_V1.0.pdf7.35 MB
USB-C fix?
I dunno yet if this would fix the peoples powerfull charger breaking their handhelds, its might.
https://www.reddit.com/r/SBCGaming/comments/1ccuod5/rg35xxh_has_resistors_on_the_usbc_cc_pins_for/
https://www.hackster.io/news/james-ide-s-usb-c-to-c-power-mod-flex-pcb-fixes-usb-type-c-charging-incompatibilities-65f173eea3c0
https://github.com/ide/usb-c-to-c-power-mod?tab=readme-ov-file
Analog joysticks
A 74HC4052 seems to be used for 1 or 2 joysticks?it has 2 analog output or inputs that you connect using S0 and S1 to 8 analog output/inputs?https://www.eeweb.com/four-channel-oscilloscope-adaptor-2/ example
https://coolcapengineer.wordpress.com/2013/01/04/electronics-serial-expansion-using-74hc4052/shows the basics to read 2 analog channels at the same time (thus, we have 2 analog inputs on the main soc?it might read 4 sets, selectivly.
Each joycon has 2 analog sliders/wheel thingies
”
Yes that’s the mux. The mux is connected to one of the SoC SARADC channels, a 1.8v regulator, and 3 GPIO pins. One of the GPIO pins is used to enable or disable the mux, and the other 2 GPIO pins are used to switch the input from channel 0, 1, 2, or 3 on the mux. What’s supposed to happen is every cycle (which should be around 60/100hz) the GPIO pins should switch so that all 4 channels can be read, and each of the 4 channels corresponds to the X or Y on either the left or right joystick.
Based on what I see one of two things is possibly happening. Either 1) the channel on the mux is getting switched, but the driver is doing something wrong reporting the X or Y axis (bad deadzone code, bad flat code, whatever) or 2) the ADC mux needs a few microseconds to settle after switching channels and it’s not getting enough time.
Again just my assumptions, but these are both fixable in code. There’s nothing fundamentally different about the joysticks on the Cube than there are on any other Anbernic device from the past few years.“https://www.reddit.com/r/ANBERNIC/comments/1dmwkor/comment/lag15kf/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
CPU
sunxi (arm cores) sunxiwx (soc id) p (rev id) soc name coressun50i (cortex-a53 smp) sun50iw9 (0x1823) sun50iw9p1 H313, H503, H513, H616, H618, H700, T507, T517 4xCortex-A53
Boot process and working
https://devdotnet.org/post/rabota-s-gpio-na-primere-banana-pi-bpi-m64-chast-2-device-tree-overlays/
Above mighgt have been stolen from somewhere, but basicly it makes sense. we might need to do the reverse to recover some files, but once we got them.We can build the new boot partition (which isntg detected by neither windows nor linux (and Apple for that matter).
Yoran asked if it was uboot, I havent seen the strings for this yet but maybe. basicly a kernel needs a bootloader to get itself into ram and a device tree.
https://linux-sunxi.org/Boot0internal to the soc, 2 parts get run:https://linux-sunxi.org/BROM interal romhttps://linux-sunxi.org/FELhttps://linux-sunxi.org/EGON#eGON.BRMthe two parts.which will then load boot0 in our case
general boot processhttps://linux-sunxi.org/Boot_Process
Get boot0
https://knulli.org/guides/h700-firmware-extract/
TODO: read and try «———————
dd if=sdcard-image.bin of=boot0.bin bs=1024 skip=8 count=32
test, by ejecting sd, start in FEL mode, insert sd, run following(optionally check)
sudo ./sunxi-tools/sunxi-fel version
kay, so we have FEL mode
sudo ./sunxi-tools/sunxi-fel -p spl mine/boot0.img
dint work, or whatever i dumped fails.
Sunxi
There are some tools we can run, without a sdcard inserted, using https://github.com/linux-sunxi/sunxi-toolswe can run:
and get:
AWUSBFEX soc=00001823(H616) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000
sudo ./sunxi-fel sid33806c00:DEADBEEF:DEADBEEF:DEADBEEF sudo ./sunxi-fel sid-dumpchipid 33806c00 deadbeef deadbeef deadbeefunknown deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef 00000000 00000000 00000000 00000000 00000000 deadbeef 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
where deadbeef is not really what I got, you get the idea when i say i protect my uniqe data? altho the unkown bits might be general settings and not uniqe tho.https://linux-sunxi.org/SID_Register_Guide
an intresting way to debug a system nowhttps://linux-sunxi.org/FEL/USBBoot#Boot_the_system_over_USB
uboot
have git, base devel and swig
git clone git://git.denx.de/u-boot.gitgit clone https://github.com/armbian/rkbincd u-bootmake CROSS_COMPILE=aarch64-linux-gnu- anbernic_rg35xx_h700_defconfigmake CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) BL31=../rkbin/rk35/rk3588_bl32_v1.15.bin sudo ../../sunxi-tools/sunxi-fel uboot u-boot-sunxi-with-spl.bin
now time out if i do version, no boot yet, (doesnt find sd?)uboot dint change boot mode yet
this dint seem to work:
sudo dd if=u-boot-sunxi-with-spl.bin of=/dev/sda bs=512 seek=64
sunxi-fel -v uboot u-boot-sunxi-with-spl.bin \ write 0x40200000 Image \ write 0x4fa00000 sun50i-a64-pine64-lts.dtb \ write 0x4fc00000 boot.scr \ write 0x4ff00000 rootfs.cpio.lzma.uboot
this seems promising
sudo ./sunxi-tools/sunxi-fel -v uboot test/u-boot/u-boot-sunxi-with-spl.bin \write 0x40200000 tools/boot_image/sda4_boot.bin-zImage \write 0x4fa00000 tools/boot_image/sda4_boot.bin-dtb \write 0x4ff00000 tools/boot_image/sda4_boot.bin-ramdisk.gz
results in:
found DT name in SPL header: allwinner/sun50i-h700-anbernic-rg35xx-2024Stack pointers: sp_irq=0x00021400, sp=0x00053FD4MMU is not enabled by BROM=> Executing the SPL... done.loading image "ARM Trusted Firmware" (465312 bytes) to 0x40000000loading image "U-Boot" (600768 bytes) to 0x4a000000loading DTB "allwinner/sun50i-h700-anbernic-rg35xx-2024" (29696 bytes)Starting U-Boot (0x40000000).Store entry point 0x40000000 to RVBAR 0x08100040, and request warm reset with RMR mode 3... done.
no boot yet tho :(
sudo ./sunxi-tools/sunxi-fel -v uboot mine/boot0.img \write 0x40200000 tools/boot_image/sda4_boot.bin-zImage \write 0x4fa00000 tools/boot_image/sda4_boot.bin-dtb \write 0x4ff00000 tools/boot_image/sda4_boot.bin-ramdisk.gz Stack pointers: sp_irq=0x00021400, sp=0x00053FD4MMU is not enabled by BROM=> Executing the SPL... done.usb_bulk_send() ERROR -7: Operation timed out
the sunxi tools:https://linux-sunxi.org/Sunxi-toolshttps://linux-sunxi.org/FEL
uboot hints:This one should be read more closely and adapted?https://docs.u-boot.org/en/v2024.01/board/anbernic/rgxx3.html#building-u-boot
the usb boot thing i still havent got workinghttps://linux-sunxi.org/FEL/USBBoot#Mainline_U-Boot_.28v2015.04_and_newer_versions.29
https://linux-sunxi.org/Anbernic_RG35XX_H
Firmware
https://knulli.org/guides/h700-firmware-extract/https://github.com/YuzukiTsuru/OpenixCard
to extract, dd and binwalk are fun. but OpenixCard apparently the best
Official:
- (v1.1.7 (20240923)) Kernel 4.9.170
Custom software/os
https://tinyhack.com/2023/12/31/reverse-engineering-rg35xx-stock-firmware/he also made a custom app/dash:https://github.com/yohanes/rg35xx-stock-sdl-demousing the sdk:https://github.com/rg35xx-cfw/s500_kernel/tree/rg35xxand they figured out how to compile a working gpu?https://ko-fi.com/post/RG35XX-Getting-the-GPU-to-work-Part-1-T6T0JCHY2
CFW, or just Distro’s
Why are people such lazy folks? these aint no CFW, it isnt jailbreaking ofcourse but also, am I installing a CFW when I install Linux on a windows PC? I dunno man, I think most of the folks just roll with what others been saying.
Your running a different distro on your handheld.Options:
- Anbernic Stock
- GarlicOS
- muOS
- MinUI (see MyFinUI)
- MyFinUI (a fork of MinUI)
- Koriki/Batocera Lite (by ED Torres, no Plus or H support) also, in Spanish ?!
- Batocera (acmeplus based?)
- Koriki (acmeplus based? unlocked GPU?)
- Knulli
Adding desktop to stock OS:
Stock OS
A recovery file?https://support.anbernic.com/support/solutions/articles/150000176088-rg35xx-h-rg35xx-plus-rg35xx-2024-stuck-in-anbernic-logo
It runs a fork of armbian I think.uname -aLinux deeplay 4.9.170 #276 SMP PREEMPT Thu Apr 11 12:12:08 CST 2024 aarch64 aarch64 aarch64 GNU/Linux
using apt-get, it uses mirror:https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports/
hostname was deeplay, renamed to gameboy
Anoying thing, not all packages can be installed?
debconf: delaying package configuration, since apt-utils is not installeddpkg: warning: 'ldconfig' not found in PATH or not executabledpkg: warning: 'start-stop-daemon' not found in PATH or not executabledpkg: error: 2 expected programs not found in PATH or not executableNote: roots PATH should usually contain /usr/local/sbin, /usr/sbin and /sbinE: Sub-process /usr/bin/dpkg returned an error code (2)
Kernel
intresting read:https://github.com/rg35xx-cfw/rg35xx-cfw.github.io/issues/205
/home/flower/cc_share/allwinner/h700/rg35xxh/sdk/rg35xxh/kernel/linux-4.9
CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=yCONFIG_PREVENT_FIRMWARE_BUILD=yCONFIG_EXTRA_FIRMWARE=""CONFIG_USB_NET_DRIVERS=yCONFIG_V4L_PLATFORM_DRIVERS=yCONFIG_SND_DRIVERS=y
lsmodmali_kbase8821csrtl_btlpm
Mali
https://docs.mesa3d.org/drivers/lima.htmlhttps://docs.mesa3d.org/drivers/panfrost.htmlhttps://gitlab.freedesktop.org/panfrost/mali-isa-docshttps://gitlab.freedesktop.org/panfrost/mali_kbasehttps://github.com/fxlin/mali
https://bootlin.com/blog/mali-opengl-support-on-allwinner-platforms-with-mainline-linux/>https://linux-sunxi.org/Mali
8821cs
https://github.com/alireza-tabatabaee/RTL8821CS?tab=readme-ov-file
https://fccid.io/TX2-RTL8821CE/User-Manual/User-Manual-3223929
https://github.com/morrownr/8821cu
https://github.com/morrownr/8821cu-20210916
rtl_btlmp
https://github.com/Poco-Ye/rtl-btmp_tool
??https://blog.csdn.net/kerhac/article/details/121163876
Dumping of parts
$ android-unpackbootimg/unpackbootimg -i ../mine/sda4_boot.bin -o boot_image/BOARD_KERNEL_CMDLINE BOARD_KERNEL_BASE 40078000BOARD_NAME sun50i_arm64BOARD_PAGE_SIZE 2048BOARD_HASH_TYPE sha1BOARD_KERNEL_OFFSET 00008000BOARD_RAMDISK_OFFSET 01f88000BOARD_SECOND_OFFSET 00e88000BOARD_TAGS_OFFSET fff88100BOARD_DT_SIZE 2
user root
localeLANG=LANGUAGE=LC_CTYPE=”POSIX”LC_NUMERIC=”POSIX”LC_TIME=”POSIX”LC_COLLATE=”POSIX”LC_MONETARY=”POSIX”LC_MESSAGES=”POSIX”LC_PAPER=”POSIX”LC_NAME=”POSIX”LC_ADDRESS=”POSIX”LC_TELEPHONE=”POSIX”LC_MEASUREMENT=”POSIX”LC_IDENTIFICATION=”POSIX”LC_ALL=
localectl status System Locale: LANG=zh_CN.UTF-8 LANGUAGE=zh_CN:zh VC Keymap: n/a X11 Layout: us X11 Model: pc105
user game
Seems to be the default user for where the gameshell and games are run from.``$ localbash: local: 只能在函数中使用game@deeplay:/$ localeLANG=zh_CN.UTF-8LANGUAGE=zh_CN:zhLC_CTYPE=”zh_CN.UTF-8”LC_NUMERIC=”zh_CN.UTF-8”LC_TIME=”zh_CN.UTF-8”LC_COLLATE=”zh_CN.UTF-8”LC_MONETARY=”zh_CN.UTF-8”LC_MESSAGES=”zh_CN.UTF-8”LC_PAPER=”zh_CN.UTF-8”LC_NAME=”zh_CN.UTF-8”LC_ADDRESS=”zh_CN.UTF-8”LC_TELEPHONE=”zh_CN.UTF-8”LC_MEASUREMENT=”zh_CN.UTF-8”LC_IDENTIFICATION=”zh_CN.UTF-8”LC_ALL=
$ localectl status System Locale: LANG=zh_CN.UTF-8 LANGUAGE=zh_CN:zh VC Keymap: n/a X11 Layout: us X11 Model: pc105``
GarlicOS
https://github.com/GarlicOShttps://github.com/orgs/GarlicOS/repositories
It seems to use a dmenu.bin and calls it a bootloader. Is this uboot that runs this or the stock kernel?
muOS
“So you’ve decided to try out the muOS custom firmware for the various Anbernic handhelds”Are you firmware? you sure?
https://muos.dev/
According to: https://www.rg35xx.com/en/firmwares-2/muos/
“MuOs is a Custom Firmware based on GarlicOs, but it lacks the graphical environment and focuses mainly on the use of RetroArch. Originally called MustardOS”If it replaces the real bootloader and kernel, and OS is borrowed. sure, its a CFW based on Garlic.
MyFinUI
https://github.com/Turro75/MyFinUI_RG35XXOGCorrectly calling itself a “custom launcher”
Koriki
https://github.com/rg35xx-cfw/Koriki/releases It runs over stock firmware and brings mainly the SimpleMenu frontend to this device.
Batocera
https://batocera.org/downloadhttps://github.com/rg35xx-cfw/rg35xx-cfw.github.io/releases“Batocera.linux is an open-source and completely free retro-gaming distribution”
Knulli
“KNULLI is a custom firmware for retro gaming devices (handhelds, bartops, etc.). It’s developed as a fork of Batocera.”https://knulli.org/Yeah, so a distro, with maybe custom blobs, not a CFW.https://knulli.org/guides/h700-firmware-extract/
Generic Linux
https://github.com/mporrato/alpine-h700
Device tree
https://marketplace.visualstudio.com/items?itemName=plorefice.devicetree
Extraction:
using the C variant, I ran:
$ ./split-appended-dtb ../../mine/sda0.bin
And got a bunch of dtb files and a “kernel”. I wonder if this works
Virtual?
Can we?https://romanrm.net/a10/qemu
fileshttps://wp.dejvino.com/2020/07/orange-pi-zero-running-in-qemu/
Running x86 games
Maybe emulation like qemu user might help, but if a mono game:https://web.archive.org/web/20200115233340/https://ur.gs/post/stardew-valley/
SSH
For now, this is simple and cool:https://www.reddit.com/r/ANBERNIC/comments/1d65q4q/figured_out_how_to_wirelessly_access_rg35xxsp/https://github.com/xgbox/rg35xxsp-ssh-samba
Terminal
https://github.com/haoict/SimpleTerminal
Tree overlays, firmware modding
https://github.com/orangepi-xunlong/orangepi-build
games
PS1 iso to a readable format
More resources