David Haywood's Homepage
MAME work and other stuff
January 3, 2016 Haze Categories: General News. 26 Comments on Extreme Sensation Exploit!

I was staring to think we weren’t going to get any Snow this year, only rain, lots and lots of rain….

However, even if there’s no snow outside, I can present you with some snow for MAME, in this case the news that Gaelco’s SnowBoard Championship is a step closer to being emulated.

Unlike most Gaelco games which used an evil Dallas protection device complete with suicide battery, SnowBoard Championship instead used a less complex device programmed to do some decryption tasks, and used as protection. The game was passing various things to the device, like text strings, sample numbers, and some directional direction used by the game, it expected correct data back in order for the game to run properly.

Previously in MAME the game would display corrupt text, hang during attract mode, play incorrect samples and have completely broken controls.

The operation of the device turned out to be simple, actually even less complex than I was first expecting. I’d already briefed Charles MacDonald (who purchased a PCB for running our tests) that the game writes 32-bits of data to an address, and reads 16-bits back from another address, and that it uses different pairs of addresses throughout execution, so naturally I was expecting the different addresses to use different encryption schemes, one of his first discoveries was that the address was completely irrelevant, done only to throw off anybody trying to understand it.

With this knowledge he made a few mods to the hardware and software running on the board to collect the 16-bit results for all possible 32-bit writes the game could make, resulting in an 8GB table.

I hooked this 8GB table up in MAME to verify the results and the game immediately started working.

We still need to reduce the 8GB table to actual equations, Olivier plans on looking at this, but rest assured the game is now very close to being playable in a public build of MAME. (RAR compression manages to reduce the table to a 180MB file, there are clear patterns all over the place, so I doubt even that is especially complex)

Here’s a video recorded from MAME, it’s recorded using the 2.1 parent set.


Content not available.
Please allow cookies by clicking Accept on the banner

Both the 2.1 and 2.0 sets use the same encryption, so here are some screenshots from the 2.0 set for anybody not wanting to watch the video.


SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship
SnowBoard Championship SnowBoard Championship

and for those wondering, yeah, I’ve still got more to add to the 0.169 article below, just this came up today, I’ve also got to at some point turn the yearly summary article into something publishable ;-)

26 Comments

You can follow any responses to this entry through the RSS 2.0 feed.

YAY! Fantastic news, and a a great write-up!

Nice work fellas!!!

Thanks for this article! This was very interesting.
The 8 GB table contains the 16-bit results for all possible 32-bit writes the game could make. But what about the game? Are all possible 32-bit writes actually written or only a smaller subset? Do all 32 bits of such a subset have an impact on the resulting 16 bits or are some not “looked at”? Are any of the resulting 16 bits invariant?
Would be great to hear how Olivier and you solved this! :)

the game only needs a small subset of the data (there are lists of dwords to write in ROM in order to get the values they really want from the device)

we dumped an entire 8GB set for studying, so we can know our equations are 100% correct.

as I said, it doesn’t look like the most complex of encryption schemes, there are clear patterns all over the place in the data, and the byte counts even out nicely over small regions and the data set as a whole (so an equal number of occurrences of 0x00 values, 0x01 values, 0x02 values .. 0xff values etc.) doubt it will actually take much time to figure out and turn into 5 or 6 lines of code ;-)

Excuse me Haze! The left green quadrant on the game title is a graphic glitches? (First screenshoot on the left)

Glitch not glitches ; forgive me my “Primal” english :)

I can’t see any glitches

I thought that the half green quadrant of title Snowboard was wrong. But i was in error,sorry!

I wish I had the time to take a look at the encryption. It sounds interesting! Good luck to Oliver!

Great work, on this game, Gaelco really has alot of great games that still need work and this one is much appreciated, hopefully the Gaelco game library will finally be fully emulated soon, awesome job.

First, happy new year and thank you for your continuous work on the improvment of our belove emululator.
This is a complete off topic comment.
I’ve notice a bug in the namco system 1 driver and it seems there is no entry in the MT database. It’s in the game Boxy Boy.
There is one bad tiles in the first quarter (top left side) of the screen.
This bad tiles is only presents in the Beginner level.

Do you think this is related to a bad dump or a problem with some kind of protection ?
I can make an entry in MT if needed.

I can’t see any bad tiles in Boxy Boy

I’ve checked the beginner level, everything looks fine?

It’s not really a bad tile, it’s additional contrast on the image.
I’ve upload a screenshot here :
http://imgur.com/VSz5I7a
The problem is circled in red.

it’s a cobweb?

No, it’s on the original png image generated by F12 in Mame.
How I can send you the original file ?

Excuse me, I just understand. You mean that this is a cobweb intentionnaly put in the game scenery. You are right, because some rounds later (3 or 4), the cobweb is not in the same place.
Sorry for the trouble, I had not thought of that.

Great work, sure wish you could work on those Naomi games, Marvel vs Capcom 2!, please!

Naomi and other modern systems are of no interest to me, just use Demul or something, Demul is always going to give a better experience than MAME ever will for those titles, they’re out of the range of what MAME can expect to do well with.

We’re better focusing on generations of things we can do well, which is why you’re seeing the project expand across a broad number of other systems from the era we can handle (home ones etc.) rather than devoting too much time to things that simply aren’t going to give satisfying results.

We’ll document things and assist others, sure, but playing them in MAME? seems unlikely to me.

Nooooo! I want suggest you Haze of use your experience for stronger emulators for example: Wii U emulator alias Decaf, XENIA,Dolphin,Arcade pc loader, pcsx2 and
throw the old MAME in the garbage.

Ehi Haze! I’m joking …:)

Hi Haze! Can you fix LDPlayer please? It doesn’t compile anymore :-/

Random thought: Why are there so few laserdiscs in MAME? Not even a single disc in dlair.cpp, dlair2.cpp, alg.cpp, segald.cpp, cops.cpp, thayers.cpp…

LDPlayer should probably be replaced by a driver that emulates a laserdisc player..

for the other question, that might change over the next year, we’ll see…

Nice to see all these fixes :)

What about the remaining not-working PGM games ?
Mostly thanks to your work, the latest ones which were said as ‘never playable’ are now working but some old ones like kov for example were working before but are now marked ‘not working’ from years. They can’t be fixed? They have to be redumped? They are quite commun and cheap… Could we know why all these PGM games have still not yet been fixed? Thanks :)

Haze, as far as the remaining Laserdiscs are concerned, Mamedev should stop messing around and just dump them already. The longer these games remain undumped, the higher the probably is that they will be lost forever.

I think the problem up to this point with Laserdiscs has been that “Perfection Is the Enemy of Good.” Pick a dumping method and get on with it. That’s just my opinion, anyway.

https://en.wikipedia.org/wiki/Perfect_is_the_enemy_of_good

Disclaimer: Haze, please do not interpret that to mean I want to play the games right now. I am speaking strictly from an emulation standpoint, as many of them are still not even dumped.

I’m not sure it’s even that, there’s simply nobody working on it, nobody with the equipment, and the existing stuff out there falls well short of ‘good’ to the point where you’ve got a lot of HLE holding things together.

There’s also the problem that if something that most people consider ‘good enough’ is released, people will stop actually trying to make it better, destroying original material that could help make it better because in their personal opinion what’s out there is ‘good enough’ (it’s taken YEARS to replace iso+mp3 dumps of some CD based games for this reason, and many PC games exist only as cracked files ripped from disks etc.) The Toaplan sound emulation suffered a similar fate, before there were shitty samples for a bunch of the games people were more interested in donating to get the real chips decapped (although, no guarantee that will succeed – but now we don’t even have funds coming in to try)

I think for LD stuff people consider ‘Daphne’ “good enough” (it really, really isn’t) and so aren’t as interested in moving things forward with MAME.

Again, I wasn’t talking about good enough for other emulators.

I was talking about Mamedevs deciding on the best available method that is good enough for dumping them so they are eventually emulated in MAME. Surely, something can be worked out.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close