Teardown: E-Mods RS-1 handheld game

I recently bought a cheap NES-knockoff handheld off Amazon for $15.99 to tinker with, pull apart, and eventually reverse the flash image.

The initial teardown showed an unsurprisingly simple collection of components; amongst a small handful of SMT caps & resistors and switches of a few varieties is the LCD screen, an audio chip, an epoxy blob hiding the main processor, and finally a flash 128 Mbit flash chip.

OLYMPUS DIGITAL CAMERA
The glorious E-mods RS-1
OLYMPUS DIGITAL CAMERA
Case open, +ve wire already snapped off at solder joint
OLYMPUS DIGITAL CAMERA
Front side showing LCD
OLYMPUS DIGITAL CAMERA
The fun bits – 56 pin TSOP Flash & the main processor
flashchip
The 128GBit NOR flash chip

The datasheet for the flash chip is here

In order to see what I might be up against trying to sit a logic analyzer on the flash data bus, I had a poke with my scope and saw the string of obvious initial boot reads followed by periodic read/writes at the menu screen.

DS1Z_QuickPrint3
Chip Enable line on the flash chip

Taking a closer look at the signal, it all seems fairly slow with nothing over 500kHz, easily sniffable even with a low-end logic analyzer.

DS1Z_QuickPrint1
Access to the flash chip was relatively slow

The next step will be to pull the flash chip and dump the contents.