Again, working with Morten Shearman Kirkegaard and Peter Wilhelmsen on this, so any time I say ‘we’ I mean those 2 with me doing the MAME / emulation side of things.
Tracking down Alligator Hunt boards where the Co-processor (DS5002FP) battery was still alive and the SRAM intact was no easy task. Due to the amount of time unprotected / hacked roms of the game have been available, and the fragility of the boards, a lot had already died, or unfortunately have been converted over prematurely by people wanting to avoid them dying, making it impossible to know if they still had valid code in the SRAM or not.
Things got off to a good start when DarkSoft donated an Alligator Hunt PCB to the cause, the battery on that one was showing a worryingly low voltage, but the SRAM was still intact, and we managed to get a dump (complete with Highscores of a previous owner) However, as the dumping process still damages random bytes, a single board was not enough to be confident in enough in the dumped SRAM to say it was good; infact a number of bytes in a data table had to be handfixed just to get it to pass an internal checksum, luckily those bytes all came from one big table which was also present in the unprotected version, however, the code area of the DS5002FP SRAM had no such checksum.
Many sellers of the game were contacted, all but one were selling boards that had already been converted to use the unprotected set, something that is easy to tell from the program checksum printed on the startup screen of the game. The one board that didn’t match the checksum of the unprotected set was however still something of a mystery, it didn’t match the known checksum of the protected set either, so we weren’t exactly sure what it was going to be, but decided to take a gamble on buying it.
When it was arrived, it was dumped, and it turned out to be another unprotected set, which would have been a bit of a downer except for the fact that it was actually a very different set to the one in MAME. The new set has a different background on the title screen and skips the first 2 levels with the skateboarding kids, instead jumping straight to the ship launch and space levels. Obviously my first thought was that it might be some kind of hack, but all the code / data offsets in the ROM strongly indicate it’s compiled / assembled from scratch. Possibly a set used for a show or competition?
What was more curious about this set however, is despite being an unprotected set, not making use of the DS5002FP or SRAM, the voltage on the battery still showed good and the DS5002 box looked like it had never been opened or tampered with. This again makes me wonder if the ROMs on the PCB had been swapped on for a specific event, and then never swapped back to the protected set.
So, come the weekly dumping session it was decided that an attempt would be made to dump the SRAM on this board, to see if it actually contained anything valid. To cut the story short, it did, so this unknown version of Alligator Hunt, despite having an unprotected ROMset on the PCB, actually still contained the original code in the SRAM and gave us the 2nd dump we needed to verify the dump from the board DarkSoft provided. With the 2 dumps I was able to construct what I’m confident is a 100% correct version of the SRAM content which can be used to emulate the protected version of the game with certainty that the correct code is running and correct data is being provided by it.
The protected version we had was actually interesting for other reasons too, it’s has Spanish ‘win-quotes’ between levels, and Spanish subtitles on the cutscenes. Maybe not too surprising because Gaelco is a Spanish developer, but unexpected. I did for a while wonder if the DS5002FP might provide the region as it’s not unheard of for protection devices to supply a region byte; IGS did that all the time for example. You can see an English quote, and a Spanish quote on the screenshots below.
Anyway, my uncertainty over what determined the language was quickly put to rest when I checked my email and found an email from a long-time MAME user who wishes to be identified as ‘Pablo’ saying that they’d dumped the program ROMs from a dead Alligator Hunt they had and one of them didn’t match MAME. The new dump quickly pointed at a byte in the main program ROM controlling the game region thus giving us a new parent set in MAME and making the Spanish set a clone.
Being the curious kind, I decided to see if the byte in question controlled anything else, and to my surprise it did. The byte in question not only controls the game language, but also the region warning (US, NON-US, or none) and maybe most interestingly the title screen. One bit in the byte causes the game to identify as ‘Lizard Hunt’ instead of Alligator Hunt. I’ve not heard of the game actually being released with this title, and no ROM using that title has ever been dumped, but it certainly existed as a possibility, maybe it was intended to be released to the US market with this title instead?
Anyway, here are some videos, first from the newly emulated protected set, second from the new unprotected set.
Hopefully next in line is Glass, we have one SRAM dump from that which works, but like Alligator Hunt, we need to verify it with a 2nd. That would have been done already, except one of our PCBs was in too bad condition to cleanly attach the dumping device, so even if that PCB was working before we started, it didn’t survive the process. We’ve got another PCB on the way, hopefully that one is better, and hopefully we don’t need a 3rd to be 100% sure on it (there’s a possibility of that, Glass uses a lot of data tables, they’re not easy to verify against the unprotected set either)
We’ve still not managed to locate a single working PCB for ‘Play 2000’ which is worrying. Gambling titles are some of the most ‘at risk’ out there due to regulation etc. and ones like this where we know in a few years they’ll definitely all be dead due to the battery are especially at risk. Again, if there’s any possibility you might have one in your collection, please consider donating it.
