Tiger Leap / CXSD_H3 SNES Clone Research and Cheat Menu

This repository documents and extends a 2018-era SNES-style clone console sold with model identifiers including CXSD_H3. It uses an Allwinner H3-family SoC, 4 GB eMMC, Android 4.4.2/API 19, a Tiger Leap 21-card frontend, and an SNES9x 2010 libretro core.

The completed modification is a small, source-available libretro proxy. The Tiger Leap frontend loads the proxy at the original core path; the proxy loads the user's untouched stock core from a sibling path:

Tiger Leap / vendor RetroArch activity
                 |
                 v
hardware-tested proxy core
                 |
                 v
untouched stock SNES9x 2010 core

The proxy derives NN.cht from the active numbered NN.sfc, parses the RetroArch-format cheat file itself, maintains selection and enabled state, calls retro_cheat_reset()/retro_cheat_set() on the stock core, and draws a minimal menu into a copied game frame. It does not depend on the vendor RetroArch menu or frontend cheat manager.

Critical warning

This is not an official Nintendo SNES Classic. Hakchi and instructions for Nintendo mini consoles do not apply. Writing the wrong block device can destroy an SD card, corrupt the eMMC, or brick the console.

The scripts intentionally require the exact observed hardware topology:

• Lakka boot SD: /dev/mmcblk0, sysfs type SD
• internal eMMC: /dev/mmcblk1, sysfs type MMC
• system target: /dev/mmcblk1p7, ext4, exactly 671,088,640 bytes
• data target: /dev/mmcblk1p1, ext4, exactly 1,656,750,080 bytes

Dry runs, dual full backups/reads where applicable, explicit confirmation phrases, SHA-256 checks, copied working images, e2fsck -fn, unmount/process holder checks, writes limited to the verified target, synchronization, and full readback verification are mandatory safeguards—not optional suggestions.

Why Hakchi does not support this console

Hakchi targets Nintendo's mini-console hardware, boot chain, partition scheme, kernel/userspace, and deployment protocols. This clone is an unrelated Allwinner H3 Android device with an MBR/EBR eMMC layout, vendor APK frontend, Allwinner recovery container, and different controller plumbing. Visual similarity to an SNES Classic does not make its firmware compatible.

Firmware and partitions

The user-area capture is 3,909,091,328 bytes. Linux numbering reaches p16, but p3 is an extended container and p4 is unused; there are 14 data partitions. Important volumes are:

Partition	Role	Size	Content
p1	/data / UDISK	1,656,750,080 captured bytes	ext4 app data, saves, emulated storage
p2	bootloader assets	16 MiB	FAT16
p6	boot	16 MiB	Android boot image
p7	/system	640 MiB	ext4 OS, APKs, ROMs, cores, key layouts
p9	recovery	32 MiB	Android boot image
p10	sysrecovery	768 MiB	Allwinner IMAGEWTY recovery container
p12	Reserve0	16 MiB	FAT16
p16	/cache	512 MiB	ext4

See docs/PARTITION_LAYOUT.md and the machine-readable data/partition_scan.json.

Numbered ROM slots and menu launch chain

The Tiger Leap app com.tigerleap.gamebox scans /system/media/GAME, but its UI instantiates exactly 21 compiled resource cards. A card stem such as 15 resolves to /system/media/GAME/15.sfc, and Tiger Leap launches RetroActivityFuture with that ROM and:

/system/lib/cores/snes9x2010_libretro_android.so

Adding an arbitrary filename does not add a stock-menu card. Replacing one existing numbered slot while preserving the filename works without changing the APK, but adding cards requires rebuilding resources and the literal count. The repository contains only a metadata inventory—never ROM bytes: data/rom_inventory.csv.

Final cheat-menu implementation

The proxy:

1. forwards all 25 exported retro_* entry points;
2. opens the untouched stock sibling using an absolute path;
3. observes semantic RetroPad input used by the SNES9x core;
4. maps the active NN.sfc to /storage/emulated/0/RetroArch/cheats/Snes9x 2010/NN.cht;
5. parses cheats, cheatN_desc, and cheatN_code;
6. calls the stock core's cheat API;
7. draws only into a bounded copy of 0RGB1555, RGB565, or XRGB8888 frames;
8. fails open to normal stock gameplay when cheat data is absent or invalid.

The temporary PROXY ACTIVE startup diagnostic used during development is not present in the final source.

Hardware-tested controls

Control	Action	Core-visible mask
L+R	Open/close panel	0x0c00
L	Previous entry	0x0400
R	Next entry	0x0800
X	Toggle entry	0x0200

Physical Select always produced 0x0000; holding it with any other button also forced the whole core-visible mask to zero. Tiger Leap consumes Select before the libretro boundary, so no core wrapper can implement Select-based chords. Complete results are in docs/CONTROLLER_MAPPING.md.

Build

Requirements:

• Windows PowerShell
• Android NDK r25c (last NDK line used here with API 19 support)
• Python 3 for host tests

cd proxy-core
.\run_tests.ps1
.\build_android.ps1 -NdkRoot C:\path\to\android-ndk-r25c

The build targets armv7a-linux-androideabi19, checks ELF32 ARM EABI flags, requires every stock export, rejects a SONAME and text relocations, and permits only libc.so/libdl.so dependencies. Details: proxy-core/README.md.

The compiled binary is deliberately ignored and not included. Users must build it themselves.

Cheat files

Name cheat files after slots:

01.sfc -> 01.cht
...
21.sfc -> 21.cht

Use cheats/NN.cht.example as a syntax template. Supply only codes you are legally entitled to use. The project's private, console-specific cheat library is not redistributed.

Safe Lakka deployment and rollback

The Git repository contains source templates, not a ready-to-write bundle. scripts/prepare_deploy.ps1 combines:

• your locally built proxy;
• your own compatible static ARMv7 debugfs;
• your generated ext4 smoke fixture;
• your own .cht files;
• the guarded POSIX/BusyBox scripts.

It generates hashes and a private ignored bundle. The p1 installer records each cheat path that was present or absent and can remove newly added files or restore archived prior files. The p7 installer preserves the exact current partition as rollback, validates a copied working image, preserves the stock core byte-for-byte as .stock.so, checks metadata/xattrs/SELinux data, compares e2fsck -fn, writes only after a second confirmation, and verifies a complete readback.

See deploy/README.md. Do not run any installer until its dry run passes and its reported hardware matches your console exactly.

Analysis and reproducibility

Read-only firmware tools are under scripts/firmware-analysis. They parse the MBR/EBR chain, extract readable partitions into separate working files, analyze Android boot/IMAGEWTY/FAT content, inventory SNES headers, and build a copied full image while proving bytes outside one replacement partition remain unchanged.

See:

• docs/FIRMWARE_ANALYSIS.md
• docs/LAUNCH_CHAIN.md
• docs/FAILED_ATTEMPTS.md
• docs/VALIDATION.md

Known limitations

• Exact device geometry, hashes, filenames, paths and controller behavior are hardware-specific; other clone revisions may differ.
• Select is unavailable at the core boundary.
• The panel is intentionally minimal and does not expose the full RetroArch UI.
• Enabled state is runtime state; the proxy does not rewrite .cht files.
• Only numbered SNES slots 01 through 21 are supported by the parser.
• The public deployment workflow cannot supply or license vendor files for you.
• Recovery behavior and vendor signature enforcement may differ across units.

Legal and ethical use

You must dump and use your own legally obtained console files, stock core, firmware, ROMs, and cheats. No commercial ROM, firmware image, vendor APK, vendor shared library, emulator binary, recovery payload, or private cheat library is included. Trademarks belong to their owners. See docs/LEGAL_AND_SAFETY.md.

Repository map

proxy-core/  Original wrapper source, build script and host tests
deploy/      Source-only guarded deployment templates
scripts/     Bundle generator, fixture generator and analysis tools
cheats/      Non-game-specific .cht syntax template
docs/        Hardware, launch, controller and historical analysis
data/        Metadata-only partition and ROM inventories
examples/    Safe command examples with placeholders

CXSD_H3-SNES-Clone