David Haywood's Homepage
MAME work and other stuff

Hunting Alligators

August 29, 2017 Haze Categories: General News. 16 Comments on Hunting Alligators

Again, working with Morten Shearman Kirkegaard and Peter Wilhelmsen on this, so any time I say ‘we’ I mean those 2 with me doing the MAME / emulation side of things.

Tracking down Alligator Hunt boards where the Co-processor (DS5002FP) battery was still alive and the SRAM intact was no easy task. Due to the amount of time unprotected / hacked roms of the game have been available, and the fragility of the boards, a lot had already died, or unfortunately have been converted over prematurely by people wanting to avoid them dying, making it impossible to know if they still had valid code in the SRAM or not.

Alligator Hunt

Things got off to a good start when DarkSoft donated an Alligator Hunt PCB to the cause, the battery on that one was showing a worryingly low voltage, but the SRAM was still intact, and we managed to get a dump (complete with Highscores of a previous owner) However, as the dumping process still damages random bytes, a single board was not enough to be confident in enough in the dumped SRAM to say it was good; infact a number of bytes in a data table had to be handfixed just to get it to pass an internal checksum, luckily those bytes all came from one big table which was also present in the unprotected version, however, the code area of the DS5002FP SRAM had no such checksum.

Many sellers of the game were contacted, all but one were selling boards that had already been converted to use the unprotected set, something that is easy to tell from the program checksum printed on the startup screen of the game. The one board that didn’t match the checksum of the unprotected set was however still something of a mystery, it didn’t match the known checksum of the protected set either, so we weren’t exactly sure what it was going to be, but decided to take a gamble on buying it.

When it was arrived, it was dumped, and it turned out to be another unprotected set, which would have been a bit of a downer except for the fact that it was actually a very different set to the one in MAME. The new set has a different background on the title screen and skips the first 2 levels with the skateboarding kids, instead jumping straight to the ship launch and space levels. Obviously my first thought was that it might be some kind of hack, but all the code / data offsets in the ROM strongly indicate it’s compiled / assembled from scratch. Possibly a set used for a show or competition?

Alligator Hunt
Alligator Hunt Alligator Hunt

What was more curious about this set however, is despite being an unprotected set, not making use of the DS5002FP or SRAM, the voltage on the battery still showed good and the DS5002 box looked like it had never been opened or tampered with. This again makes me wonder if the ROMs on the PCB had been swapped on for a specific event, and then never swapped back to the protected set.

So, come the weekly dumping session it was decided that an attempt would be made to dump the SRAM on this board, to see if it actually contained anything valid. To cut the story short, it did, so this unknown version of Alligator Hunt, despite having an unprotected ROMset on the PCB, actually still contained the original code in the SRAM and gave us the 2nd dump we needed to verify the dump from the board DarkSoft provided. With the 2 dumps I was able to construct what I’m confident is a 100% correct version of the SRAM content which can be used to emulate the protected version of the game with certainty that the correct code is running and correct data is being provided by it.

The protected version we had was actually interesting for other reasons too, it’s has Spanish ‘win-quotes’ between levels, and Spanish subtitles on the cutscenes. Maybe not too surprising because Gaelco is a Spanish developer, but unexpected. I did for a while wonder if the DS5002FP might provide the region as it’s not unheard of for protection devices to supply a region byte; IGS did that all the time for example. You can see an English quote, and a Spanish quote on the screenshots below.

Alligator Hunt Alligator Hunt

Anyway, my uncertainty over what determined the language was quickly put to rest when I checked my email and found an email from a long-time MAME user who wishes to be identified as ‘Pablo’ saying that they’d dumped the program ROMs from a dead Alligator Hunt they had and one of them didn’t match MAME. The new dump quickly pointed at a byte in the main program ROM controlling the game region thus giving us a new parent set in MAME and making the Spanish set a clone.

Being the curious kind, I decided to see if the byte in question controlled anything else, and to my surprise it did. The byte in question not only controls the game language, but also the region warning (US, NON-US, or none) and maybe most interestingly the title screen. One bit in the byte causes the game to identify as ‘Lizard Hunt’ instead of Alligator Hunt. I’ve not heard of the game actually being released with this title, and no ROM using that title has ever been dumped, but it certainly existed as a possibility, maybe it was intended to be released to the US market with this title instead?

Lizard Hunt

Anyway, here are some videos, first from the newly emulated protected set, second from the new unprotected set.

Hopefully next in line is Glass, we have one SRAM dump from that which works, but like Alligator Hunt, we need to verify it with a 2nd. That would have been done already, except one of our PCBs was in too bad condition to cleanly attach the dumping device, so even if that PCB was working before we started, it didn’t survive the process. We’ve got another PCB on the way, hopefully that one is better, and hopefully we don’t need a 3rd to be 100% sure on it (there’s a possibility of that, Glass uses a lot of data tables, they’re not easy to verify against the unprotected set either)

We’ve still not managed to locate a single working PCB for ‘Play 2000’ which is worrying. Gambling titles are some of the most ‘at risk’ out there due to regulation etc. and ones like this where we know in a few years they’ll definitely all be dead due to the battery are especially at risk. Again, if there’s any possibility you might have one in your collection, please consider donating it.

Go to article.. »

Spike Heels

August 26, 2017 Haze Categories: General News. 1 Comment on Spike Heels

Darksoft, Sean Sutton, Surgeville & Smitdogg in association with The Dumping Union recently picked up a Korean game from 1998 called ‘Kick Ball’ developed by the otherwise unknown ‘Seoung Youn’

I looked into emulating it, and quickly found that most of the memory addresses being accessed by the 68k corresponded to those found on the Video System game Power Spikes, suggesting at very least that like most piece of Korean hardware it had been roughly cloned from something else.

Further work showed that this was actually one of those special Korean games where not only was the hardware cloned, but the entire game is actually a well disguised hack of the original title, in this case a hack of Power Spikes.

It’s not a straight graphic swap, the developer behind the hack actually attempted to turn what was a plain 2D game into a 2.5D game by adding vertical movement, otherwise it plays just like Power Spikes but with the players doing flips and backheels to hit the ball. Here are some comparison shots, note, the graphic priorities are currently incorrect.

Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes
Kick Ball Power Spikes

Go to article.. »

TH Strikes Back is now WORKING

August 15, 2017 Haze Categories: General News. 22 Comments on TH Strikes Back is now WORKING

We picked up 2 more TH Strikes Back PCBs (thanks to Kevin Eshbach for providing one of them) and dumped the DS5002FP SRAM on each of them.

Using the existing read, and these 2 new reads we were able to apply a ‘majority wins’ rule on each byte and obtain a correct dump. (about 5 or 6 bytes differed from each board but never the same bytes)

These bytes have all been hand verified, so now I’m confident we now have a 100% good dump of the DS5002FP SRAM for TH Strikes Back (Thunder Hoop 2) as a result the game works fine in MAME (aside from some video priority glitches on the title screen but these are unrelated to the protection)

Note, we still need another PROTECTED (not converted to de-suicide ROMS) Alligator Hunt to verify the dump we did of that before releasing it and at least one additional Target Hits (we only have 1 copy) before we can confidently release that also. It’s fairly clear at this point that random bytes get corrupted during the process, so without multiple copies to dump we can’t trust the data.

Also the call still goes out for anybody with a working Play 2000, ideally 2 people.

It’s easy enough to tell if you have an Alligator Hunt where the battery still works as the protected sets will save the Top 2 high scores to the SRAM so those scores are retained even after powering down the PCB. The desuicide sets have nowhere to save it so the top 2 scores reset to default when you power off. We need another working copy of the protected version (ie the one that saves the top 2 scores)

The other way to identify the protected version is if it shows ‘CHKSUM ROM: 2B34128B’ on startup, these boards are useful to us.

A board that’s already been hacked to not use the battery will show ‘CHKSUM ROM: F9C6891D’ instead, such boards are useless to us as the SRAM on them is already dead.

There are no known unprotected versions of Target Hits or of Play 2000, so if you have either of those in working condition we could do with them.

We currently have a number of Glass boards, and hopefully 2 Maniac Square boards and will tackle those soon.

Please note that once we have reads we’re happy with they can be used to repair dead boards, but we don’t want to release dumps until we’re confident about them as there becomes a risk of people trying to repair boards with bad data, making it more difficult to obtain the PCBs we need to verify it.

Here’s a video of TH Strikes Back

TH Strikes Back
TH Strikes Back TH Strikes Back
TH Strikes Back TH Strikes Back
TH Strikes Back TH Strikes Back
TH Strikes Back TH Strikes Back
TH Strikes Back TH Strikes Back

Go to article.. »

The Third Angry Leader Bee

August 3, 2017 Haze Categories: General News. 6 Comments on The Third Angry Leader Bee

“neohyphengeo productions” picked up a rather rare clone a few months back and has kindly had it dumped. This, luckily for us means it’s not going to end up becoming one of those clones that seems more like a myth than a reality.

The clone in question is a rare version of “DoDonPachi Dai-Ou-Jou” that simply goes by the title “DoDonPachi III” and was meant for non-Japanese markets.

Revision-wise it sits somewhere between the original release of DoDonPachi Dai-Ou-Jou and the Black Label version, and apparently incorporates some of the gameplay mechanics from the latter. I’m not however versed on the actual details.

Some strings, such as the character select page have elements translated to English, the ending appears to have been as well, although a lot of text remains in Japanese.

This will be supported in MAME 0.189, thanks again to “neohyphengeo productions”
I believe more details will be released over at the neo-geo.com forums fairly soon.

DoDonPachi III DoDonPachi III DoDonPachi III
DoDonPachi III
The new DoDonpachi III set, aimed at Non-Japan markets

DoDonPachi Dai-Ou-Jou DoDonPachi Dai-Ou-Jou DoDonPachi Dai-Ou-Jou
DoDonPachi Dai-Ou-Jou
The better known Japanese release ‘DoDonPachi Dai-Ou-Jou’ for comparison

Go to article.. »

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.