topaz wagon
Horizontal Q3 (~$20-40) is an X7 look-alike mostly popular in Brazil, while vertical Q2 (~$10-20) is a bit more obscure. Single core Cortex-A8 at 864 MHz (Allwinner A13) + 256MB of DDR3.
Q3 https://youtu.be/PvBdFYcFN3U
Q2 https://youtu.be/tOn2YqNS3LY
Version-20230821-v2.0 https://youtu.be/PLWtqp7MH70?t=216 hints it must have something (AllWinner A31 / sun6i CPU?) in common with v2.0 HDMI sticks, also known as X6 box https://youtu.be/I4nz9ObeIYk
swift cloud
I found one Brazilian listing for the Q2 as well https://br.shein.com/Game-Consoles-p-29438370.html
ah and an amazon listing and a video for a version under the brand "WeLohas" https://www.amazon.com/WeLohas-Electronic-Preloaded-360°Rocker-Rechargeable/dp/B0CRH53781?th=1 https://www.youtube.com/watch?v=tOn2YqNS3LY
topaz wagon
Oh nice. I'm quite sure it's the same CPU just menu software a bit different. Think SF2000 vs GB300 kind 🙂
My Q3's is box branded OFFLINE lol (snapped from the seller's video)
swift cloud
lol. well at least that's true
topaz wagon
Just realised I've seen this Q3 exactly a year after I've first seen SF2000
topaz wagon
Got it. It's an AllWinner A13, single core Cortex-A8. Runs PCSX-ReARMed r22 built on Nov 4 2022
And yeah it's virtually identical to v2.0 sticks. Cracking eCryptfs open would be a pain
How come it's so fast with PS1 games is beyond me in all honesty, it's a slow chip
Can't even get how it starts, they're always obfuscating each and every part of their devices, up to laser relabelled SoCs. Frog's milling must be laughable for their R&D
topaz wagon
It's my second handheld I don't actually need to open up (maybe I will some day to laugh at the laser marks like RK3328 on the sticks): sunxi-fel makes everything clear. FEL is engaged without the microSD since the internal ZB25VQ40 lacks the bootloader. It's only there to host encrypted board ID and authentication tokens in Security Register 2
The screen is a fine IPS. Its brightness is a bit lower than SF2000 but that's ok
Quite expectedly Tekken 3 is slow and stuttering
The only thing I haven't checked yet is the headphone port
It naturally lacks TV output due to the chip used, A13 was a cost-reduced A10
The "Re" buttons resets the SoC immediately 🙂 and it's conveniently placed right nearby volume + and - for the added frustration
The sound is stereo and rather clean. SNES is totally unfiltered, the highs pierce my ears >_< but that's not what bothers me the most but unconditional 4:3 to 16:9 stretching and scaling filter. The console has non-configurable backlight timeout, I can't watch Chrono Trigger intro in full, but there are some audible skips
Guess I expected too much of a thing that probably costs $15 to make 🙂
Too bad fixing most issues will require cracking eCryptfs but I'll get there some day
FEL is the root access, after all, I can simulate whatever it does to derive the key
topaz wagon
The alternative box (still branded OFFLINE) says QX-800ZY leading to more Arabian sellers and this Chinese one https://youtu.be/GD4rQJE6jfY
This makes it a fairly old console, just never made it to AliExpress I guess
No wonder with a main chip c. 2011
topaz wagon
And now the same seller came and lowered the price to absurdly low $15. Is he that desperate for sales I wonder?
The screen itself justifies $20 at least, it's real good
topaz wagon
The seller also offers X6 box for absurdly $12, too, so I ordered one to compare PSX performance and eCryptfs implementation
topaz wagon
This exact X6 box was delivered with most famous trash microSD I ever encountered. It can only be read in specific cardreaders, and even then some files are silently corrupted
Thankfully 4pda had a no games backup which is identical
I opted not to use sunxi-fel on this one with the internal microUSB not installed unlike Wicked's vid, but read ZB25VQ40 through the clip instead
And yeah, the main area is not programmed at all! Only Security Register 2 is there, and it's different. I suppose they rely on Unique ID just as SF2000 does
Internals. There's a good deal of flux splattered around the RAM chip, they're reflowing by hand
The files are dated 2022, too, which probably explains microSD failing
topaz wagon
Q2 to be sold at the same store soon, too. They've told they produce the thing
Meanwhile I've had some success in understanding how these machines start. They've added a line to the Linux kernel mounting eCryptfs then running their encrypted init https://github.com/linux-sunxi/linux-sunxi/blob/sunxi-3.4/init/main.c#L816
That means all of the userspace is encrypted
Had a thought how much GPL had deteriorated if they can arbitrarily modify the kernel binary
The init path is xor 0x36 and reads /usr/data_mnt/bin/init
Through obscurity...
eCryptfs is set up for AES 128 bit encryption
The key is read elsewhere (they've added an initcall or two) and mentions SPI flash, confirming my earlier suspicions
The same yellow Q2 box from an obviously fake review, they don't sell the thing yet. There's also a kid in other pics and it's perfectly Caucasian, with the seller being Chinese; maybe it's their friends?
Q2 looks rather cute btw
I wish they were selling this one for Western audience, it would've been more popular than GB300
Ah not, it's not a D-Pad
swift cloud
also those L and R buttons in the middle....
swift cloud
Q2 has appeared on ali but it's not cheap https://www.aliexpress.com/item/1005006832677796.html
but it's that CCC store that resells a lot of stuff from chinese marketplaces so it's probably not exactly "official" international distribution
wow this must be the best handheld ever made
topaz wagon
"operation experience" out of box is pretty good to me tbf. As for the polishing... well yeah, I've seen their Linux device drivers. No thank you🤮
Should be half this price at my side, but they're preparing the pictures or such
The specified upper limit seems to be quite a lot, though https://www.google.com/search?q=1000+RMB
Quad core my ass, they've xored "A13_" string right inside the kernel 🙂
And A31 is way, way too hot for a handheld
"Automatic rest screen" is so true. It engages in less than a minute
They're touting Linux for no specific reasons, yet the system is intentionally hard to mod just like it was with Actions Semi
Although the SoC itself is pretty open by nature
Today's discovery is full Linux kernel symbol naming; they apparently failed to understand how exactly open Linux kernels are to outside developers
I'll learn how they named their obfuscations pretty soon lol
topaz wagon
My naming: mount_ecryptfs_and_exec. Theirs: mount_ecrytfs_and_exec_it. I seem to know my stuff 🙂
(and I try not to mistype, too)
Likewise, spi_get_unique_id to get_spi_flash_uid
Couldn't have thought this one doubled becomes kernel_get_cpuid (although the SoC has an OTP area, and it's actively used, too; this one is called get_local_chip_id_enc_data)
topaz wagon
The full model is A13_4C. I've known this from the ext partition with the resources, but this is from the Security Register 2, AES decrypted
But these are just two checks. I'm yet to find eCryptfs key 🙂
And they employ the same for X6, it's A31S_X6 just as expected
I think I'm just a minute away of cracking the actual AES key
Thanks heavens we don't have DMCA around here 🙂
topaz wagon
Yup it's a success! The key is in the clear, and never modified between kernel revisions I know of. The files are now available for analysis and modifications!
The main executable seems to be packed with UPX but throws NotPackedException just as usual. This should be a breeze, nothing like VirBox on the RK3126C stick
topaz wagon
Yep the same old story with UPX! signature replacement (to axzc this time, might be a subtle hint to the dev team), seen it a bazillion times. They didn't even care to strip the copyrights
topaz wagon
A swap file? on a trash microSD these are shipping with? ```sh
swapon /mnt/res/DATA06 &> /dev/null
This one is 128M thus the thingie is rather RAM-limited
topaz wagon
"Automatic rest screen" is so true. It engages in less than a minute
Exactly one minute. The amount is specified in res/settings/setting.txt, key lcd_save_time
pearl remnant
https://www.aliexpress.us/item/3256806634118961.html
Looks like the Q3 is available.
topaz wagon
The same CCC reseller with the 2x price offer: https://detail.1688.com/offer/745235297401.html lists Q3 at https://www.google.com/search?q=168+RMB
Buying one can only make sense if it's in $25 range. $30+ are R36s (and friends) territory, single core Cortex-A8 with closed-source software is no match
topaz wagon
Q3 and Q2 have an overclock/underclock setting built-in: create res/settings/cpu_frq.txt with a number in kHz (it's echoed to scaling_setspeed on startup). The default is 864000; I've (somewhat arbitrary) tried 1200000 and 600000 and the effects are observable, but it doesn't solve all the Tekken 3 stutters. 1488000 hangs the machine - no wonder, it's a 55 nm chip
30000 48000 60000 72000 84000 96000 108000 120000 132000 144000 156000 168000 180000 192000 204000 216000 240000 264000 288000 300000 336000 360000 384000 408000 432000 480000 528000 576000 600000 648000 672000 696000 720000 744000 768000 816000 864000 912000 960000 1008000 1056000 1104000 1152000 1200000 1248000 1296000 1344000 1392000 1440000 1488000 are supported https://github.com/linux-sunxi/linux-sunxi/blob/d47d367036be38c5180632ec8a3ad169a4593a88/arch/arm/mach-sun5i/clock/ccmu/pll_cfg_tbl.c
topaz wagon
Q3 running on Q2's menu binary
The hardware is identical save for the screen, so they're rolling out a universal solution. Even the Linux kernel is on the card, only the U-Boot is not
topaz wagon
Q3's screen is controllerless CONFIG_LCD_TYPE_RGB 480x800; this forces libsys_hdmi_common.so to rotate via OpenGL (sun5i lacks G2D). As a result, only the fine vertical tearing line is sometimes visible akin to the SF2000's rotate fix. For some reason the LCD output hardware is displaying at half the physical resolution (480x400), I assume it's a misconfiguration in their kernel driver since the framebuffer is full 480x800. There's also a single column of glitchy pixels, must be bad bonding or whatever these reject screens are rejected for 🙂
Q2's is plain old CONFIG_LCD_TYPE_CPU 320x240 (and judging by the colors in the review, of awful GB300-like non-IPS type), rotated by its controller with the frame rate mismatch
I had to patch bits and pieces of both the binary (it checked the board ID) and library (for the 4:3 scaling), and couldn't figure out how to move the GL texture to the center nor disable the texture filter (it looks very weird with column doubling, too), but it's playable
I'm not buying this Q2, the community won't gain anything and it's boring
I'm not sure if it's worth trying to compile the U-Boot or the Linux kernel since they have init hooks for the factory testing, and the FAT partition is executable with even the LD_LIBRARY_PATH set up, so all it takes is a symlink or two back to FAT from the ext3 partition mounted at /usr/res to run just about anything. Still I'd like to figure out how to enable full screen resolution, and I never compiled a kernel before
topaz wagon
Huh GBA's https://hiddenpalace.org/R-3D_Demo_(Tech_Demo) stutters a lot today, even on the stock card. I can swear it ran full speed when I got the console
I could've mixed this up with X6 or A3100 stick, though (the latter definitely runs everything I threw at it full speed, should have tried SMW2 really)
Also measured the power draw somehow: takes 3.7W from the charger switched off and 5.6W running Tekken 3 thus it's around 2W. Neat
3.7W hints at the venerable LTC4054 for the charger
The Genesis emu is set up for the 3 button controller
It's a Genesis Plus GX, not PicoDrive
topaz wagon
Same 2W running at 1344000. Seems stable, but I won't risk overheating with no temp monitoring
Doesn't solve all of R-3D stutters, though. No wonder; it's mGBA https://github.com/search?q="Savestate+created+using+a+different+version+of+the+BIOS"&type=code not gpSP lol
Pretty impressive for the in-order CPU
It's a dual issue, though, probably putting this one in direct competition with 74k in HCSEMI A3100
The frog guys are using Dingoo's PSX and (non-dynarec) gpSP to gain some speed
topaz wagon
They've added a tiny libretro frontend to each of libemul*.so. Here's one in almost full glory ```c
do {
retro_run();
if (process_key_event() < 0) break;
} while (game_runing);
winter kettle
Nice try Osaka, you're not gonna make me buy this one 😝 or will I? 🤔🤣
topaz wagon
Nice try Osaka, you're not gonna make me buy this one 😝 or will I? 🤔🤣
You'd better not unless you can snatch it for $20 like I did 🙂
topaz wagon
Ever heard of https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm or https://en.wikipedia.org/wiki/Xuejia_Lai ? me neither, but the algo is used in all of the line-up (Y2 HD/SG 3.0, release-<yyyymmdd>-v2/6.0 sticks and these two). Unamuzingly, they screwed up on trying to pass the key and all-zeroes are used instead
topaz wagon
Their NES emu is of an unusual kind: a Nofrendo, which is mostly employed for MCU type devices (G&W etc)
topaz wagon
Finally found their Q2 offer, it's via another marketplace. But Q3 is priced almost $30 there with Q2 $20, so meh
Khaki looks fairly fresh, much better than what https://detail.1688.com/offer/745235297401.html showed
Samsung lol 😄
They also sell a Game Stick Lite there, and it's very cheap for what I usually expect of the local marketplaces ($11). I bet it's a v2.0 stick, too
A vid from the seller showing the abysmal screen quality. They don't show the menu interface, but Battle City speaks for itself
topaz wagon
Hacked in a little screenshot routine on a volume button for the title page image doctoring on a local forum. Never could have thought Tekken 3 renders in 368x480
Quite a good match for perfect pixel 2x scaling, probably explaining why PS1 looks so fine
Learned of https://www.google.com/search?q=lazy+binding in process, it threw SIGILL if I tried to call the import directly. I wish our froggy was as debuggable as Linux handhelds. I'm even getting stack traces with names!
Should switch to an ARM compiler next, but my distro lacks arm-gnu-eabi-linux iirc, only the bare metal is there. They've built with Linaro toolchain, but maybe I should buildroot my own
topaz wagon
There were also Version-20230624-v2.0 in the wild https://youtu.be/m8000LTHFdE?t=115
lyric stump
That camo vertical with the bright coloured buttons looks so soviet to me it's unreal
If you played on that during the constitutional crisis nobody would bat an eye
Thanks for this write up BTW Osaka I don't know why I decided to read this thread but I'm glad I did
topaz wagon
Welp I'm just trying to CFW the thing up
Had a bright though today for just trying to start up a stock RetroArch maybe
I'm no good as far as it goes for the different retro launchers, don't know which is popular
topaz wagon
Q2 for $13. I'll pass
topaz wagon
The guy couldn't lol. He've done Q3 in the past, too. Sorry for the language, but it's the only Q2 review available in the wild https://youtu.be/E3KgPYGLS3w
topaz wagon
Another two, showing both green https://youtu.be/f0-4eEtbICM and red one https://youtu.be/Dyh6l040LgY (same excuse for the language)
Army green actually looked better in renders so I'm still passing on this one
BTW the guy who reviewed both Q3 and Q2 told Q2 feels quite a bit more sluggish. I really wonder why considering both to run off the very same system
He's a great handheld player but boy he's struggling with such an awkward L and R placement
still crest
Anyone can help with finding image for Q3 with version in version_4c marked as "Version-20230624-v2.0" ? Or mabe at least "res" folder.