Close

Part One - The hardware

A project log for Legends Pinball Plunger Reverse Engineering

Reverse engineering the protocol used for the legends pinball plunger and building software/hardware to allow re-use

jason-nelsonJason Nelson 08/17/2025 at 15:450 Comments

The Legends Pinball (I think it's called Legends Pinball 'HD', or ALP) is a decent way to get into the world of virtual pinball. It has a ton of built-in tables, it has a decent build and if one excuses the mish-mash artwork, looks good.

You can buy and download pinball packs that add many well known tables, but where it truly shines is in what they call "OTG," where a PC running PinballFX or PinballFX3 (or M, though I haven't tried it) takes over the playfield (and backglass if you have the board it should have included toi start, the Video Input Backglass something, or VIBS) and turns the RK chip into a glorified joystick and sound system.

But eventually, those RK boards die. Or they refuse to switch modes and allow you to play OTG. Or they just stop registering.

When that happens, people say "It's time for a full gut" in which one switches to a 32 inch monitor, rewires all the controls and adds a potentimeter based plunger.

The plunger kits cost ~50 bucks from Cleveland software design.

This is how I decided to spend way more than fifty bucks to save fifty bucks. Probably not smart financially but I love a good project and it just made no sense to change hardware that *should* work.

The plunger is essentially a magnet on the end of the plunger rod and a magnetometer chip that reads how far the plunger is away and produces a signal based on that.

It has a daughter board that's a MMA8451, though I have three plunger sets and one of them comes with a knockoff that's labled YJ<unreadable> but responds to the exact same responses, so a clone of the MMA8451.

The plunger IC has four pins coming off it and a separate I2C bus going to the accelerometer. Putting a logic analyzer on the accelerometer showed normal, boring I2C traffic with readings that made perfect sense.

The plunger IC runs on 5v and downconverts to 3.3v to talk to the accelerometer.

The four pins running back to the rockchip mainboard are labeled GND, VCC, SDA and SCL (the same as the pins that accelerometer runs on). 

The bus does not connect between the 3.3v and 5v sides, the unlabeled IC is the only thing speaking to the accelerometer. A LDO on the board generates the 3.3v and a level shifter makes sure the plunger IC doesn't cook the accelerometer.

Simple enough, so far.

Then I put the logic analyzer on the plunger, and that's where it got weird.

Discussions