David Haywood's Homepage
MAME work and other stuff
August 3, 2013 Haze Categories: General News. 15 Comments on I’m gonna eat you little fishy… I’m gonna eat you little fishy

This is possibly a bit of a premature announcement because I don’t consider the game to be working yet but I’ve spent a large amount of the past week looking at the IGS game ‘Puzzli 2’ with some real hardware assistance from rtw.

As with almost all IGS games of this period there is an MCU on the board providing certain functions for use by the main game code. The ultimate goal is to find a way to trick the MCU into spilling out it’s internal ROM and simply emulate the ARM CPU program contained inside but in some cases that isn’t possible because the MCU is not using any commands with unchecked lookups into internal ROM.

After running a data logger on the Puzzli 2 board and watching what it wrote to and read from the device it quickly appeared Puzzli 2 was one of those cases, all functions were work on the data passed in, transform it and give it back in another format.

There are 3 main functions the Puzzli 2 MCU provides, first, descrambling of the addresses where the Z80 code is stored for sound / music, this was the first thing I hooked up after studying the logs (albeit with hardcoded addresses because the scramble isn’t clear) It was also confirmed that the device provides the correct addresses for Puzzli 2 or Puzzli 2 Super depending on which game code you have running, so clearly the addresses returned are derived from the data passed to the device at startup.

The second function is providing offsets to where graphics / palettes are stored. This is used for the random tiles shown during the intro animation and all the backgrounds. In the end this turned out to be a two step operation, the first step multiplying the two nibbles of data passed by 0x19 and 0x5, the second step being the addition of a 4-bit value to the final result.

The third, and by far most complex thing it does is descramble and decompress the level data structure for each level. Before each level starts the 68k passes in a stream of data from ROM, the MCU then applies a loop of 16 8-bit xor values to that data (from a 256 byte table, the first value passed is the 8-bit offset into that table) Having done that, in the same step (without revealing the intermediate results to the 68k) the MCU fills in a 10×8 structure for the level data as well as a few misc variables based on the input stream. The MCU is also responsible for flagging to the 68k when it has received enough data to build a level.

The level structure is then read back with another command, again with the MCU signaling when enough data has been returned based on the data passed earlier.

What this means is to simulate the protection device I had to understand the format of the source level data, and the format of the level data the game expects (sizes, object types etc.) as well as find a way to figure out the scrambling, easier said than done because you can’t see the descrambled data directly, only the final level structure after the MCU has also expanded / decompressed that descrambled data. Understanding this was by far the most time consuming part and is where work still really needs to be done.

The work done so far has however seen the game emulation improve significantly, many level structures are built correctly, although currently if I look at all the levels the game has several contain what appear to be invalid elements (if you put them in a level the level becomes impossible to finish) interestingly many of these are stripped from the Puzzli 2 Super rom, so I don’t know if they’re unused data, game bugs, or if they do something else on the level they’re meant to be used (they could also be errors in my descrambling, but the xor addresses on which they fall are confirmed with other levels so that’s unlikely)

Needless to say this is a lot of work, and while I took a lot of joy from being able to clean up and remove all the per-game simulations of the Data East 104 / 156 chips there are still cases like this where we have no choice but to simulate things (unless a way for the MCUs to be decapped becomes available)

There are also problems with my interpretation of the ‘depth’ data, I think I see where it’s passed and read but what I’m doing to it is clearly wrong, the width data passed at the same time appears to be processed correctly by the simulation. Depth is one of the level difficulty factors and it being wrong is causing the black bars at the bottom of some screens because it’s drawing everything too high up / for an easier difficulty setting.

Puzzli 2 Puzzli 2
Puzzli 2 Puzzli 2
Puzzli 2 Puzzli 2
Puzzli 2 Puzzli 2
Puzzli 2 Puzzli 2
Puzzli 2 Puzzli 2

Hopefully I can figure out the remaining issues and we can get this one marked as working in the near future. Interestingly it also points at there being a background colour register we’re not emulating on PGM, unless some of the backgrounds are just glitchy on real hardware (it happens more often on games than you’d think). Even if things aren’t fully working yet this felt like promising enough progress to mention it, and should give some insight into just how tricky even the easier cases can be sometimes. Also for those wondering Puzzli 2 Super is quite a significant upgrade, it adds the entire VS CPU mode, the regular Puzzli 2 only has a VS. mode for 2 players.

One thing I really like about this game is the music, I find many of the tunes to be catchy and perfectly fitting for a game of this kind. I don’t know if like with Bee Storm they’re not all exactly original creations but I have a feeling we might find out with time if people end up matching them to source mods ;-) The intro music I’d hope is original because it syncs up so well with the intro animation and is delightfully bouncy!

In other PGM news XingXing dumped the internal ROM of a Knights of Valor 2 Nine Dragons or ‘kov2plus’ as it’s otherwise known, that was actually next on my todo list but it looks like some time has been saved. Instead I’ll bump Puzzle Star to the #1 spot after this one is done, and hopefully figure out how that one manages the level data properly so that it’s playable beyond the first world.

*edit* after some further work I’ve made some more improvements and fixes to the emulation, including fixing the backgrounds, and what seems to be an additional region protection that was causing resets when you attempted to insert coins to continue. I’ve uploaded a video to YouTube showing gameplay plus the various attract cycles for each region at the end.

Content not available.
Please allow cookies by clicking Accept on the banner


You can follow any responses to this entry through the RSS 2.0 feed.

Nice work guys i always perk up when these IGS/PGM
WIP updates appear i always keep my fingers crossed
for a certain game that i wont mention :)

Once again, thanks for the interesting report Haze my man.

It was a little rushed, and like most things I post could probably do with me proofreading it, but I hope to provide more details once the remaining bits are figured out properly!

ah red dwarf :)

Thank you Mr. Haze. :)

The ‘depth’ issue turned out to be an issue with a different command instead, as did the background colour thing; it was incorrectly using the top half of the backgrounds duplicated in the bottom half for some levels.

it seems there is some remaining protection feature relating to inserting coins and the continue feature however.

if you insert a coin on the continue screen (or during gameplay later on) it dumps you back to the title screen.. need to investigate.

and that seemed to be a sneaky additional region protection, expecting the reset command to also return the region info.

So it’s KLAX with a Disney water theme. Hmm.

That Flinstone ho got some figure needs some attention, I tell ya.

Some attention indeed!

That game looks excellent. PGM continues to impress!

Haze, is there anything remaining to be done on this title, or have you nailed it all?

It needs more testing to be sure. I might flip it to working for the next update tho.

There are some levels in the ROM files containing what seem to be invalid elements, but I’ve never encountered on used by the game yet.

It’s possible those levels aren’t used, or behave differently when they are, it’s not easy to know tho because there are something like 500 levels defined, and you’ll only get about 25 of them on any given playthrough.

Well, what can I say then, except:

Testers of the world, unite!

I wish I could get the SO to play this, but she likes Hidden Object Games lately, to the point that I can’t support her habit. She finishes one in a couple of days, it’s ridiculous.

Very good job. I am very happy that this great game emulation has improved. I thank you with tears in my eyes.

Is a pgm2.c driver moved from ground zero ?

I don’t think PGM2 will ever be emulated.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.