David Haywood's Homepage
MAME work and other stuff
October 16, 2012 Haze Categories: General News. 17 Comments on The Next Puzzle..

I know a lot of people want to see the later PGM games working in MAME, but I still deem them to be basically impossible to emulate properly, however, Smitdogg & Tormod did just pick up a more interesting / viable emulation target, a Puzzli 2 board.

What’s interesting about the board he picked up is that it’s the original release, simply titled Puzzli 2, rather than the Puzzli 2 Super set we have in MAME. This version is from 1999, whereas the existing version was a 2001 release.

At a glance the protection appears the same, with the Super version in MAME just being a program ROM upgrade.

I’m not sure if we’ll be able to get the actual internal ROM out of this one, because while it is one of the earlier IGS027A chips without the execute-only protection it lacks an external ROM, which means there is no real way to run your own code on it, you have to rely on finding weak table functions in the protection routines, and if a game doesn’t use table functions, or doesn’t have any with insufficient bounds checking & the ability to read a negative position from the intended table then you can’t really extract the ROM.

However, when the functions are simple enough (unlike the later games, where most of the game runs on the ARM) you can attempt to simulate the device, which is a logical first step anyway. At first glance it would appear that the first protection commands are used to get Z80 pointers for the attract music because even with Demo Sounds ON it lacks any music in MAME. It probably also fetches data pointers for the level data.

One other interesting thing about the new set is that it has an actual Japanese title screen, so it’s likely that this non-super version was distributed in Japan whereas the super version might not have been. The cart we have is a Hong Kong region tho, so who knows. Also of note is that when set to Taiwan it doesn’t show ‘Super’ for either version which might suggest either the Super version was the only actual release there, so didn’t need the Super subtitle, or it was never updated for release there. Knights of Valor Plus is similar in that the Korean region (which we know exists because we have the cart) also doesn’t show the PLUS subtitle. Naturally it’s quite hard to know which regions were actually released because the actual region code is supplied by the protection device, not the game code.

Here is the Japanese title screen (only present in this version) for reference.

Puzzli 2
and the English title screens side by side, so that you can see the different (c) year
Puzzli 2 Puzzli 2

I can’t give a time estimate for getting this done (and currently this set crashes exactly like the existing set in MAME) but having a working cart does bump it up the priority list.

The original post on Mameworld with hardware pics and an original hardware video is here.


You can follow any responses to this entry through the RSS 2.0 feed.

Very nice find, I hope you will have some succes with these ones too :)

PS : some progress with kov2p dump?

kov2p has a lower priority because it essentially already works, I don’t really expect the internal ROM to be anything but the same thing recoded for a different encryption table / game ID. It will get done eventually but it’s not really interesting work and things I deem as more important, or more in need of doing tend to get priority.

The original kovplus is more interesting because people say there are still glitches in the simulation which have got worse over time, but I’m not convinced there are any weak functions in it to actually exploit for dumping, IIRC ElSemi (who dumped the kovsh rom) seemed to indicate he couldn’t dump a kovplus at the time (but my memory might be wrong)

Impossible to emulate properly, but possible to play with it.

Thank you so much for this news!

What? No, I *won’t* be looking at the later games, not even a tiny bit.

When I say they can’t be emulated properly, I mean they can’t be emulated properly.

May I ask here about PGM2 driver status/WIP ?
What’s the difficulties (If any ?) and are those games fully dumped ? (is there any chips which need decaping)

Well, A simulation is still Better than ABSOLUTELY NOTHING….. Confound IGS and their big scary red boxes of hell! It’s so unorthodox that it makes SEIBU COP look more encouraging!… *sigh*.. I can only imagine how many people scratched there heads left in awe at the sight of those later games. Chances are there were a lot of facepalms.

PGM2 is like the later PGM games but worse, turned up to 11 if you like.

They boot from a CPU with internal ROM in the cartridge. They have code in external ROM too, but it’s highly likely the internal ROM is fully secured. In addition the external part of the ROM is encrypted.

The later PGM2 games (Kov3 at least) don’t even use a standard ROM for the program but have a custom protection module with the ROM in as well as the custom CPU with internal ROM.

Assuming IGS did a good job I don’t expect PGM2 to be emulated, ever.

This is a worse situation than say the Seibu COP because you don’t have access to the actual game code, and without that you have nothing to emulate. Decapping might sound like a magic word but so far it has delivered absolutely no results on anything other than bog standard parts with mask roms or known protection bits which can be zapped, the IGS parts are 100% custom non-mask parts.

I hate to sound defeatist but people are going to have to get used to hearing this, the latest digitial distribution stuff is highly unlikely to ever be emulated either because there’s nothing you can really dump, it’s all supplied on demand by company servers to ensure operators are always running the latest versions of games on secure cabs on a rental basis. The days of ‘it was an arcade PCB so we can emulate it’ are over.

Ah now that is diferrent :)
Thanks Haze.

Hi Haze,

About KOV2 Plus, does the a1201.rom and a1204.rom have been dumped (just ask because in MAME, these roms in kov2p are different from kov2).

On a side note have you check the problem for kov and clones reported at MAMETesters?


Best regards.

I don’t think KOV used to do that, so it’s probably started when MAME switched to using the FBA simulation code. Somebody with more interest in the game should look at it. I’m sorry, but I really don’t care about KOV at all, and it’s not my simulation code. This is one of those times when I really wish other people would help out, investigate the game code, look for potentially weak functions we can exploit on smit’s kovplus board to dump the real rom etc. This stuff isn’t rocket science.

As for rom redumps you should ask Smit, I’m not the one dumping anything.

I need to take a look at kov, I just can’t bring myself to play to level 6 or whatever to replicate the issue (and fba’s save state functions are horrifically broken atm)

Thanks for your reply Haze.

I know it’s not your simulation code but a hint and/or a clue for this introduced bug will be helpfull as for now we are a bit stuck.

And for rom redumps i will ask Smit…

Best regards.

ok, finally looked at kov’s issue.
Command CC should use an intermediate signed int for y rather than changing m_value (unsigned).

Haze, I have some romdumps I need analyzed. Can you contact me via email?

Hi David,

Actually I am trying to contact you directly in the hopes that you have some background info on Cinematronics EMBARGO entry into MAME. Looking for schematics, etc. for this game if anything exists.

John :-#)#

147u2 will be coming soon…

John> I’m not familiar with the Cinematronics hardware at all, sorry. From looking at the driver I don’t think it was developed using schematics, there are no telltale signs of it. That’s not to say there are none, but I wouldn’t count on Mamedev having any.

RCH3> Ok, will do

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.