Anbernic RG35XX h


2024-10-28

Anbernic RG35XX H

I have a RG35XX H, Horizontal handheld console. Here are some (hehe) notes.Definitly a mess, please try a custom OS instead of whatever im writing here.

It uses Linux as its basis, uboot as its bootloader. its Aarch64, ARM.

Specs

Rg35xx H

Allwinner H700 quad-core ARM Cortex-A53,1.5GHz frequency

Dual- core G31 MP2

LPDDR4 1GB

WIFI/Bluetooth

HDMI output

2 OTG

Datasheet?https://bbs.16rd.com/thread-609669-1-1.html

H700_Datasheet_V1.0.pdf7.35 MB

USB-C fix?

I dunno yet if this would fix the peoples powerfull charger breaking their handhelds, its might.

https://www.reddit.com/r/SBCGaming/comments/1ccuod5/rg35xxh_has_resistors_on_the_usbc_cc_pins_for/

https://www.hackster.io/news/james-ide-s-usb-c-to-c-power-mod-flex-pcb-fixes-usb-type-c-charging-incompatibilities-65f173eea3c0

https://github.com/ide/usb-c-to-c-power-mod?tab=readme-ov-file

Analog joysticks

A 74HC4052 seems to be used for 1 or 2 joysticks?it has 2 analog output or inputs that you connect using S0 and S1 to 8 analog output/inputs?https://www.eeweb.com/four-channel-oscilloscope-adaptor-2/ example

https://coolcapengineer.wordpress.com/2013/01/04/electronics-serial-expansion-using-74hc4052/shows the basics to read 2 analog channels at the same time (thus, we have 2 analog inputs on the main soc?it might read 4 sets, selectivly.

Each joycon has 2 analog sliders/wheel thingies

Yes that’s the mux. The mux is connected to one of the SoC SARADC channels, a 1.8v regulator, and 3 GPIO pins. One of the GPIO pins is used to enable or disable the mux, and the other 2 GPIO pins are used to switch the input from channel 0, 1, 2, or 3 on the mux. What’s supposed to happen is every cycle (which should be around 60/100hz) the GPIO pins should switch so that all 4 channels can be read, and each of the 4 channels corresponds to the X or Y on either the left or right joystick.

Based on what I see one of two things is possibly happening. Either 1) the channel on the mux is getting switched, but the driver is doing something wrong reporting the X or Y axis (bad deadzone code, bad flat code, whatever) or 2) the ADC mux needs a few microseconds to settle after switching channels and it’s not getting enough time.

Again just my assumptions, but these are both fixable in code. There’s nothing fundamentally different about the joysticks on the Cube than there are on any other Anbernic device from the past few years.“https://www.reddit.com/r/ANBERNIC/comments/1dmwkor/comment/lag15kf/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

CPU

sunxi (arm cores) sunxiwx (soc id) p (rev id) soc name coressun50i (cortex-a53 smp) sun50iw9 (0x1823) sun50iw9p1 H313, H503, H513, H616, H618, H700, T507, T517 4xCortex-A53

Boot process and working

https://devdotnet.org/post/rabota-s-gpio-na-primere-banana-pi-bpi-m64-chast-2-device-tree-overlays/

Above mighgt have been stolen from somewhere, but basicly it makes sense. we might need to do the reverse to recover some files, but once we got them.We can build the new boot partition (which isntg detected by neither windows nor linux (and Apple for that matter).

Yoran asked if it was uboot, I havent seen the strings for this yet but maybe. basicly a kernel needs a bootloader to get itself into ram and a device tree.

https://linux-sunxi.org/Boot0internal to the soc, 2 parts get run:https://linux-sunxi.org/BROM interal romhttps://linux-sunxi.org/FELhttps://linux-sunxi.org/EGON#eGON.BRMthe two parts.which will then load boot0 in our case

general boot processhttps://linux-sunxi.org/Boot_Process

Get boot0

https://knulli.org/guides/h700-firmware-extract/

TODO: read and try «———————

dd if=sdcard-image.bin of=boot0.bin bs=1024 skip=8 count=32

test, by ejecting sd, start in FEL mode, insert sd, run following(optionally check)

sudo ./sunxi-tools/sunxi-fel version

kay, so we have FEL mode

sudo ./sunxi-tools/sunxi-fel -p spl mine/boot0.img 

dint work, or whatever i dumped fails.

Sunxi

There are some tools we can run, without a sdcard inserted, using https://github.com/linux-sunxi/sunxi-toolswe can run:

./sunxi-fel version

and get:

AWUSBFEX soc=00001823(H616) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000
sudo ./sunxi-fel sid33806c00:DEADBEEF:DEADBEEF:DEADBEEF sudo ./sunxi-fel sid-dumpchipid          33806c00 deadbeef deadbeef deadbeefunknown         deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef deadbeef                00000000 00000000 00000000 00000000 00000000 deadbeef 00000000 00000000                00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000                00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000                00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000                00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000                00000000 00000000 00000000 00000000

where deadbeef is not really what I got, you get the idea when i say i protect my uniqe data? altho the unkown bits might be general settings and not uniqe tho.https://linux-sunxi.org/SID_Register_Guide

an intresting way to debug a system nowhttps://linux-sunxi.org/FEL/USBBoot#Boot_the_system_over_USB

uboot

have git, base devel and swig

git clone git://git.denx.de/u-boot.gitgit clone https://github.com/armbian/rkbincd u-bootmake CROSS_COMPILE=aarch64-linux-gnu- anbernic_rg35xx_h700_defconfigmake CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) BL31=../rkbin/rk35/rk3588_bl32_v1.15.bin sudo ../../sunxi-tools/sunxi-fel uboot u-boot-sunxi-with-spl.bin

now time out if i do version, no boot yet, (doesnt find sd?)uboot dint change boot mode yet

this dint seem to work:

sudo dd if=u-boot-sunxi-with-spl.bin of=/dev/sda bs=512 seek=64
sunxi-fel -v uboot u-boot-sunxi-with-spl.bin \             write 0x40200000 Image \             write 0x4fa00000 sun50i-a64-pine64-lts.dtb \             write 0x4fc00000 boot.scr \             write 0x4ff00000 rootfs.cpio.lzma.uboot

this seems promising

sudo ./sunxi-tools/sunxi-fel -v uboot test/u-boot/u-boot-sunxi-with-spl.bin \write 0x40200000 tools/boot_image/sda4_boot.bin-zImage \write 0x4fa00000 tools/boot_image/sda4_boot.bin-dtb \write 0x4ff00000 tools/boot_image/sda4_boot.bin-ramdisk.gz

results in:

found DT name in SPL header: allwinner/sun50i-h700-anbernic-rg35xx-2024Stack pointers: sp_irq=0x00021400, sp=0x00053FD4MMU is not enabled by BROM=> Executing the SPL... done.loading image "ARM Trusted Firmware" (465312 bytes) to 0x40000000loading image "U-Boot" (600768 bytes) to 0x4a000000loading DTB "allwinner/sun50i-h700-anbernic-rg35xx-2024" (29696 bytes)Starting U-Boot (0x40000000).Store entry point 0x40000000 to RVBAR 0x08100040, and request warm reset with RMR mode 3... done.

no boot yet tho :(

sudo ./sunxi-tools/sunxi-fel -v uboot mine/boot0.img \write 0x40200000 tools/boot_image/sda4_boot.bin-zImage \write 0x4fa00000 tools/boot_image/sda4_boot.bin-dtb \write 0x4ff00000 tools/boot_image/sda4_boot.bin-ramdisk.gz Stack pointers: sp_irq=0x00021400, sp=0x00053FD4MMU is not enabled by BROM=> Executing the SPL... done.usb_bulk_send() ERROR -7: Operation timed out

the sunxi tools:https://linux-sunxi.org/Sunxi-toolshttps://linux-sunxi.org/FEL

uboot hints:This one should be read more closely and adapted?https://docs.u-boot.org/en/v2024.01/board/anbernic/rgxx3.html#building-u-boot

the usb boot thing i still havent got workinghttps://linux-sunxi.org/FEL/USBBoot#Mainline_U-Boot_.28v2015.04_and_newer_versions.29

https://linux-sunxi.org/Anbernic_RG35XX_H

Firmware

https://knulli.org/guides/h700-firmware-extract/https://github.com/YuzukiTsuru/OpenixCard

to extract, dd and binwalk are fun. but OpenixCard apparently the best

Official:

Custom software/os

https://tinyhack.com/2023/12/31/reverse-engineering-rg35xx-stock-firmware/he also made a custom app/dash:https://github.com/yohanes/rg35xx-stock-sdl-demousing the sdk:https://github.com/rg35xx-cfw/s500_kernel/tree/rg35xxand they figured out how to compile a working gpu?https://ko-fi.com/post/RG35XX-Getting-the-GPU-to-work-Part-1-T6T0JCHY2

CFW, or just Distro’s

Why are people such lazy folks? these aint no CFW, it isnt jailbreaking ofcourse but also, am I installing a CFW when I install Linux on a windows PC? I dunno man, I think most of the folks just roll with what others been saying.

Your running a different distro on your handheld.Options:

Adding desktop to stock OS:

Stock OS

A recovery file?https://support.anbernic.com/support/solutions/articles/150000176088-rg35xx-h-rg35xx-plus-rg35xx-2024-stuck-in-anbernic-logo

It runs a fork of armbian I think.uname -aLinux deeplay 4.9.170 #276 SMP PREEMPT Thu Apr 11 12:12:08 CST 2024 aarch64 aarch64 aarch64 GNU/Linux

using apt-get, it uses mirror:https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports/

hostname was deeplay, renamed to gameboy

Anoying thing, not all packages can be installed?

debconf: delaying package configuration, since apt-utils is not installeddpkg: warning: 'ldconfig' not found in PATH or not executabledpkg: warning: 'start-stop-daemon' not found in PATH or not executabledpkg: error: 2 expected programs not found in PATH or not executableNote: roots PATH should usually contain /usr/local/sbin, /usr/sbin and /sbinE: Sub-process /usr/bin/dpkg returned an error code (2)

Kernel

intresting read:https://github.com/rg35xx-cfw/rg35xx-cfw.github.io/issues/205

/home/flower/cc_share/allwinner/h700/rg35xxh/sdk/rg35xxh/kernel/linux-4.9

CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=yCONFIG_PREVENT_FIRMWARE_BUILD=yCONFIG_EXTRA_FIRMWARE=""CONFIG_USB_NET_DRIVERS=yCONFIG_V4L_PLATFORM_DRIVERS=yCONFIG_SND_DRIVERS=y

lsmodmali_kbase8821csrtl_btlpm

Mali

https://docs.mesa3d.org/drivers/lima.htmlhttps://docs.mesa3d.org/drivers/panfrost.htmlhttps://gitlab.freedesktop.org/panfrost/mali-isa-docshttps://gitlab.freedesktop.org/panfrost/mali_kbasehttps://github.com/fxlin/mali

https://bootlin.com/blog/mali-opengl-support-on-allwinner-platforms-with-mainline-linux/>https://linux-sunxi.org/Mali

8821cs

https://github.com/alireza-tabatabaee/RTL8821CS?tab=readme-ov-file

https://fccid.io/TX2-RTL8821CE/User-Manual/User-Manual-3223929

https://github.com/morrownr/8821cu

https://github.com/morrownr/8821cu-20210916

rtl_btlmp

https://github.com/Poco-Ye/rtl-btmp_tool

??https://blog.csdn.net/kerhac/article/details/121163876

Dumping of parts

$ android-unpackbootimg/unpackbootimg -i ../mine/sda4_boot.bin  -o boot_image/BOARD_KERNEL_CMDLINE BOARD_KERNEL_BASE 40078000BOARD_NAME sun50i_arm64BOARD_PAGE_SIZE 2048BOARD_HASH_TYPE sha1BOARD_KERNEL_OFFSET 00008000BOARD_RAMDISK_OFFSET 01f88000BOARD_SECOND_OFFSET 00e88000BOARD_TAGS_OFFSET fff88100BOARD_DT_SIZE 2

user root

localeLANG=LANGUAGE=LC_CTYPE=”POSIX”LC_NUMERIC=”POSIX”LC_TIME=”POSIX”LC_COLLATE=”POSIX”LC_MONETARY=”POSIX”LC_MESSAGES=”POSIX”LC_PAPER=”POSIX”LC_NAME=”POSIX”LC_ADDRESS=”POSIX”LC_TELEPHONE=”POSIX”LC_MEASUREMENT=”POSIX”LC_IDENTIFICATION=”POSIX”LC_ALL=

localectl status System Locale: LANG=zh_CN.UTF-8 LANGUAGE=zh_CN:zh VC Keymap: n/a X11 Layout: us X11 Model: pc105

user game

Seems to be the default user for where the gameshell and games are run from.``$ localbash: local: 只能在函数中使用game@deeplay:/$ localeLANG=zh_CN.UTF-8LANGUAGE=zh_CN:zhLC_CTYPE=”zh_CN.UTF-8”LC_NUMERIC=”zh_CN.UTF-8”LC_TIME=”zh_CN.UTF-8”LC_COLLATE=”zh_CN.UTF-8”LC_MONETARY=”zh_CN.UTF-8”LC_MESSAGES=”zh_CN.UTF-8”LC_PAPER=”zh_CN.UTF-8”LC_NAME=”zh_CN.UTF-8”LC_ADDRESS=”zh_CN.UTF-8”LC_TELEPHONE=”zh_CN.UTF-8”LC_MEASUREMENT=”zh_CN.UTF-8”LC_IDENTIFICATION=”zh_CN.UTF-8”LC_ALL=

$ localectl status System Locale: LANG=zh_CN.UTF-8 LANGUAGE=zh_CN:zh VC Keymap: n/a X11 Layout: us X11 Model: pc105``

GarlicOS

https://github.com/GarlicOShttps://github.com/orgs/GarlicOS/repositories

It seems to use a dmenu.bin and calls it a bootloader. Is this uboot that runs this or the stock kernel?

muOS

“So you’ve decided to try out the muOS custom firmware for the various Anbernic handhelds”Are you firmware? you sure?

https://muos.dev/

According to: https://www.rg35xx.com/en/firmwares-2/muos/

“MuOs is a Custom Firmware based on GarlicOs, but it lacks the graphical environment and focuses mainly on the use of RetroArch. Originally called MustardOS”If it replaces the real bootloader and kernel, and OS is borrowed. sure, its a CFW based on Garlic.

MyFinUI

https://github.com/Turro75/MyFinUI_RG35XXOGCorrectly calling itself a “custom launcher”

Koriki

https://github.com/rg35xx-cfw/Koriki/releases It runs over stock firmware and brings mainly the SimpleMenu frontend to this device.

Batocera

https://batocera.org/downloadhttps://github.com/rg35xx-cfw/rg35xx-cfw.github.io/releases“Batocera.linux is an open-source and completely free retro-gaming distribution”

Knulli

“KNULLI is a custom firmware for retro gaming devices (handhelds, bartops, etc.). It’s developed as a fork of Batocera.”https://knulli.org/Yeah, so a distro, with maybe custom blobs, not a CFW.https://knulli.org/guides/h700-firmware-extract/

Generic Linux

https://github.com/mporrato/alpine-h700

Device tree

https://marketplace.visualstudio.com/items?itemName=plorefice.devicetree

Extraction:

using the C variant, I ran:

$ ./split-appended-dtb ../../mine/sda0.bin 

And got a bunch of dtb files and a “kernel”. I wonder if this works

Virtual?

Can we?https://romanrm.net/a10/qemu

fileshttps://wp.dejvino.com/2020/07/orange-pi-zero-running-in-qemu/

Running x86 games

Maybe emulation like qemu user might help, but if a mono game:https://web.archive.org/web/20200115233340/https://ur.gs/post/stardew-valley/

SSH

For now, this is simple and cool:https://www.reddit.com/r/ANBERNIC/comments/1d65q4q/figured_out_how_to_wirelessly_access_rg35xxsp/https://github.com/xgbox/rg35xxsp-ssh-samba

Terminal

https://github.com/haoict/SimpleTerminal

Tree overlays, firmware modding

extra orangepi stuff

https://github.com/orangepi-xunlong/orangepi-build

Toolchain to build stuff

games

PS1 iso to a readable format

More resources

sw blog anbernic RG35XX