David Haywood's Homepage
MAME work and other stuff

Fall of the M68705

June 22, 2017 Haze Categories: General News. 9 Comments on Fall of the M68705

Have you ever played one of the following Taito titles in MAME?

Rumba Lumber Rumba Lumber
Rumba Lumber

Chack'n Pop Chack'n Pop
Chack’n Pop

Onna Sanshirou - Typhoon Gal Onna Sanshirou - Typhoon Gal
Onna Sanshirou – Typhoon Gal

Field Day Field Day
Field Day (The Undoukai)

Get Star Get Star
Get Star (Guardian)

or either of the following by Technos and Kaneko respectively.

Nekketsu Kouha Kunio-kun Nekketsu Kouha Kunio-kun
Nekketsu Kouha Kunio-kun (original Japanese release of Renegade)

Prebillian Prebillian

If you have played any of them it may (or may not) surprise you to hear that until now they’ve been relying on high level simulations of the protection devices present on the original PCBs, which may have resulted in inaccuracies in the emulation.

The protection devices used were M68705P5 MCUs, a secure part protected against reading. For some Taito games we got lucky and found parts without the security bits set, and for some we found bootlegs and have been unknowingly using bootleg versions of the MCU code for years (much as was the case with Bubble Bobble when we thought the M68705 protected set was the original) however for the above games we simply had no dumps at all of the MCUs and had to rely on simulations.

Thankfully due to new techniques + hardware developed by Brizzo (+ a team of collaborators including Sean Riddle) and access to the collections of ShouTime, Team Japump, and ‘Anonymous Donator’ a way was found to read out even protected M68705 chips with a reasonable degree of success. The technique isn’t perfect yet, as some games gave completely invalid results, but hopefully that’s just a case of further refinement.

As a result of the new techniques the MCUs for the games listed at the start of the article have been dumped, and added to MAME. The relevant Git commits can be seen below

Rumba Lumber
Onna Sanshirou – Typhoon Gal
Get Star
Field Day
Chack’n Pop
Nekketsu Kouha Kunio-kun

As you can see, this allows the removal of a large amount of simulation code, which has been simply replaced with emulation of the actual MCU using the freshly dumped code. In cases like Rumba Lumber the simulation was known to be inaccurate so the game is now emulated correctly, in others, the simulation code was doing things that simply wouldn’t reflect how the MCU would work (plucking values straight from main RAM etc.) so the new handling is a lot more correct to hardware.

In addition to the previously mentioned games the dumps have helped confirm the MCUs MAME is already using for ‘The Fairyland Story’, ‘The Legend of Kage’, ‘Buggy Challenge’, ‘Arkanoid’ (some versions), ’40 Love’, ‘Elevator Action’, ‘Puzznic’ and a number of others to be the correct original MCU code (the dumps MAME expects might change because the new technique can dump previously unreadable parts of the MCU)

The new technique also confirms something that was long suspected: the MCU we’re using for ‘Return of the Invaders’ is a bootleg reproduction. Unfortunately that’s one of the ones where the dumping technique didn’t give us a usable dump at this point, so for now we’re still depending on the bootleg MCU.

The M68705 was a widely used protection device, so having the ability to dump any of them without having to decap is an important step in the preservation of these systems.

Those who have been paying attention to MAME releases may have noticed that back in 0.181 ‘Tokio’ aka ‘Scramble Formation’ also had it’s M68750 dumped and emulated. This was part of the same process and got the ball rolling with some M68705 CPU CORE refactoring in MAME to make the addition of these new dumps a smoother process. Obviously that’s older news now, but a couple of people have asked me if it was related, and yes, it was, it was also one of the more important cases because until then there was no remotely correct simulation of the MCU, only a bootleg where the bootleggers had also failed to understand the protection properly, resulting in many game features not working in their bootleg. The dumping of that MCU was the first time anybody could experience the gameplay correctly outside of the original PCB.

Tokio / Scramble Formation Tokio / Scramble Formation
Tokio / Scramble Formation

The other piece of news worth writing about is the addition of a game called Jump-Kun. Ironically this comes from a Taito PCB with a socket for a M68705 but for this game, maybe due to it being a prototype, the socket was left unpopulated and the game unprotected. (The PCB is a Pit ‘n’ Run PCB, in the case of Pit ‘n’ Run the MCU is actually used) It’s believe to have been developed by Kaneko and plays like you’d expect a classic arcade platformer to play. Again, thanks to ShouTime, Team Japump and ‘Anonymous Donator’ for this one.

Jump Kun Jump Kun
Jump Kun Jump Kun
Jump Kun (prototype)

I also put a video of that one on my YouTube channel

Go to article.. »

A non-emulation post

February 17, 2017 Haze Categories: General News. 12 Comments on A non-emulation post

I haven’t really been doing much emulation work lately, even after trying to get back into it I found it to be even less enjoyable than before, just feels like all the fun has been sucked out of working on it, so decided to just delete my MAME account over at Github and get on with other things.

What I have been doing is looking more at the previous generation of games, building a nice collection of Playstation 3 games and trying to expand my knowledge and understanding of things. How games work, not just in terms of code, but logic, systems, balance etc. has always fascinated me, seeing how genres advance, get split up, get combined and how new ideas get thrown into the mix and evolve over time, all that type of thing; this more than anything else is what I’m passionate about researching and building an understanding of.

I always felt that I had a good knowledge for generations before the PS3, especially the arcade side of things from working on MAME for so long, and many of the home systems right from the 8-bit era through to 32-bit, but having been rather put off by some things I was seeing in newer generations I haven’t had that much interest in studying them until now.

I’m not sure why I value this kind of knowledge so greatly, maybe it’s because I do at some point see myself more in a ‘design’ role, looking at game mechanics, refining how the games actually play etc. supported by some programming skills, rather than primarily a programming one, but despite a huge depth to my knowledge already it’s definitely not an easy role to really get a foot in the door with. Maybe it’s just personal curiosity, maybe I just want to create the games in my head and play them out, I definitely do that all the time anyway.

Anyway, something I’ve been considering for a while is doing mini-reviews of the games I’ve picked up, highlighting things I enjoyed, things that irritated me about them, ways in which I feel they could have been improved, or ideas that weren’t used to their full potential, or cases where things have really stood out. I guess there’s potential for it to be a little controversial because some of the games that actually put me off the generation entirely for a long time are ones that others seem to cherish, Heavy Rain comes to mind.

Outside of building the PS3 collection and playing those games I’ve spent an awful lot of time with Terraria on the PC, there are very few games I’d describe as masterpieces, but that is one of them and on top of being an excellent game it has one of the most enthusiastic development teams I’ve seen, always putting out new feature updates, fixing bugs, it’s twice the game it was when I paid for it and probably the only game where I’d be quite happy to buy it again just because I can appreciate the work being done on it, definitely the kind of project I’d jump at the opportunity to be involved with the design of because there’s just so much potential.

Honestly tho, I don’t actually know exactly where my life is heading, I’m definitely good at doing emulation work, but I do need to be able to use the creative skills I have in some way and while the arts in a traditional sense aren’t my strong point I think creativity at a more technical, logical level is more my thing and emulation doesn’t really provide any kind of outlet for that.

For now, I’ll collect, analyse, learn, and hope to actually make use of that knowledge one day.

Go to article.. »

Your Shark is on Fire

December 22, 2016 Haze Categories: General News. 8 Comments on Your Shark is on Fire

There are 4 Toaplan games with no sound in MAME 0.180.

These games are Fire Shark, Vimana and Teki Paki and Ghox. The original Japanese release of Whoopee is lacking in sound too but in that case the Export version is not.

The reason these lack sound is simple, the chip shown below.


Each of the above games contains one of these chips. The chip is an MCU containing a Z(1)80 core and various peripherals as well as 16kb of internal ROM data. That ROM data contains all the sound information for the game, all the sound effects, all the music sequences, everything; it makes no use of external data.

Without the internal ROM for each game sound simply can’t be emulated properly, because there’s nothing to use to emulate it. Due to everything being squeezed into the internal ROM space there’s no exploit using external code / data that can be used to dump the roms either as was done for the NMK004 sound system and a number of others.

As a result, these have been considered ‘holy-grail’ targets by quite a large number of people. With that said, I present to you the following 3 videos.

Those videos are all showing proper emulation of the sound, not some ugly trick using samples from the PCB, but the actual sound code running in MAME, driving the emulated YM3812 sound chip.

This was made possible by the decapping work done by ‘Team Caps0ff’ who managed to acquire the various chips that had previously been sent for decapping, take stock, and resume work on them – identifying weaknesses and coming up with a solution, in this case clearing the security bit inside the chip and reading out the data. (They also provided the MCU hookups in the drivers meaning this ended up being a simple case of sitting back and enjoying the results)

Ghox and the Japanese Whoopee PCB using this chip have not been done yet because Caps0ff doesn’t currently have those chips, and has a backlog of other chips to process, but the method used to dump the ones you see is now proven and tested and will also work for those once they’ve been acquired.

The Caps0ff blog contains more detailed technical information on the process used, it’s a fascinating read and shows that these guys really know their stuff :-) Please check it out and show support if you can.

(and yes, this has been my favourite news of the year to wake up to, hence giving it a bit of coverage)

Go to article.. »

I didn’t know I had permission to murder and to maim

December 5, 2016 Haze Categories: General News. 25 Comments on I didn’t know I had permission to murder and to maim

So… we’re approaching the end of 2016. I haven’t even started a 2016 write-up article, but for the sake of continuing tradition I probably should do one. The problem is, as I’ve been mostly inactive this year, I haven’t even really been following progress. Considering I usually start writing it a month or two before now, and don’t usually have something I’m happy with until a few months into the new year I’m definitely behind schedule with that.

I’m not sure there are even many people viewing these pages, but let’s see anyway because Crowdsourcing could help here. What happened in 2016 that needs covering? Anything done in MAME, not just arcade bits, that you feel has improved the project. Write as much of little as you like, try not to cover things other people have already covered unless you feel they neglected to mention something important about them. If there is enough of a response I’ll try and piece things together.

(yeah, there’s a 3rd part to the Magnet system writeup to do too, but I got stuck with the ADPCM playback and a bit burnt out with it so ended up putting it on the backburner for a while)

Go to article.. »

Magnet Hardware

October 24, 2016 Haze Categories: General News. 13 Comments on Magnet Hardware

So I’m back from Brighton, 5 hours of travelling each way and 2 hours of queuing was definitely worth it for front row seats and a prime view of a cat that really wanted to be a part of the show, but that’s not what you came here to read about, so let’s look again at the Magnet system.

One thing that is always good to have when emulating a system are high quality pictures of the board. Arcadehacker provided these along with the dumps and a whole bunch of other information which was helpful in getting things up and running. Let’s have a look at the basic hardware of the Magnet System (click on images for better resolution)

The system uses 5 main PCBs in the cage, so let’s start with a quick view of each layer

1st Layer (Sound)

The top layer is the sound board. This contains a Z80 CPU, 2 Z80CTC peripheral chips (timers / interrupt generators), 2 AY 8910 sound chips and an OKI M5205 ADPCM playback chip for a single channel of sampled sound.

Board 1 - Sound Board

2nd Layer (Master)

The 2nd PCB is the master board, this board drives everything else. It contains a Z80 CPU, the BIOS rom, 2 Z80 PIO peripheral chips (used for configurable I/O ports) and a SAB 2797B (floppy drive controller) The Floppy drive also connects to this PCB. There’s also a small sub-board on here covering some of the PCB, this contains a selection of RAM chips, I’ll look at it in more detail later.

Board 2 - Master Board

3rd Layer (Plane PCB A)

The 3rd PCB is a ‘Plane’ board, it is used to generate a single background plane. Hardware-wise the main components are yet another Z80 CPU, and like the Master PCB, 2 Z80 PIO peripheral chips.

Board 3 - Plane Board 1

4th Layer (Plane PCB B)

The 4th PCB is another ‘Plane’ board, identical to the 3rd PCB. The only difference here is some jumper configuration.

Board 4 - Plane Board 2

5th Layer (Sprite PCB)

The Sprite PCB sits at the bottom of the stack. Again we have a Z80, bringing our total Z80 count to 5 (one for each PCB) and this time we have 3 Z80 PIO chips (bringing out total count of those up to 9) There’s also a memory sub-board, which again contains RAM.

Board 5 - Sprite

Holding it all together

Ribbon cables are the main way the boards are connected, as you can see from the following front/back/above views of the stack.

Front View

Back View

Above View

The Drive

The drive is a Mitsumi drive, there’s also an amusing warning on the panel above it telling you not to put Magnets near the Magnet system disks.

Front View Warning

Front View

Master Board – More Detail

The Top board / Sound board in the initial pictures was obscured by the memory sub-board, so here are some cleaner pictures of both the board, the underside of the board, and the memory sub-board. It’s interesting to note that there is a wire mod on the back of the board.

Master PCB unobscured

More interesting however is the memory sub-board which contains
1.5kbytes of memory in the form of 3x MOTOROLA MM2114N SRAM 4096 bit (4x1024bit each)
256kbytes of memory in the form of 8x SIEMENS HYB 41256-15 AA – 262,144 bit DRAM (32kbytes each)

These plug into the PCB where presumably memory chips would have originally been fitted, presumably offering a memory expansion over the initial base design.

Master Sub PCB

Sound / Plane Boards – Undersides

The Sound board and Plane boards have unremarkable undersides, there are no mods, and nothing was obscured by any memory sub-boards on the top views, so not much to show here.

Top PCB underside Plane PCB underside

Sprite PCB – more detail

The Sprite PCB was another with a memory sub-board. Like the one on the main board this sub-board contains 256KB of RAM, and appears to plug into the sprite board where regular RAM chips would have been places. In this case it definitely looks like an afterthought because there are wires soldered directly from the board to pins on one of the PIO chips as well as another chip on the PCB. There is also some glue holding it in place, meaning it more difficult to remove, so no clean PCB shot for this one. There is a small mod to the back of the sprite board too.

Sprite PCB underside
Sprite Sub PCB

Hardware Conclusion

5 Z80s, 9 Z80 PIO chips, 2 Z80 CTC chips, AY 8910s, an OKI M5205 and a floppy drive controlled by a SAB 2797B are the main features to note on this hardware. Also a fair amount of RAM, especially when you take all the extra memory on the plug-in boards into account. There are no known dedicated video chips on the PCB so everything is done with the logic you see.

Compared to the hardware the games that were ported run on the only thing that, on the surface, appears remotely close is Exzisus which had a 4x Z80 based setup, however in reality even the Exzisus hardware is very, very different to this, as I would find when I started to emulate it.

Go to article.. »

Magnetic Trinity ’87

October 22, 2016 Haze Categories: General News. 8 Comments on Magnetic Trinity ’87

Let’s start this story by taking 3 ‘classic’ arcade games.

Taito's Exzisus Sega's Time Scanner Technos' Xain'd Sleena

First there’s Taito’s Exzisus, an enjoyable, and, in my opinion incredibly underrated horizontal shooter. Second, Sega’s Time Scanner, a decent pinball game for the time, although once you’ve played better (Pinball Dreams, Fantasies etc.) it’s hard to go back to it. Finally Xain’d Sleena from Technos, an enjoyable walk along run and gun style game.

All decent titles, maybe not the first games that come to mind when talking about arcade classics, but better than a lot of the competition. In terms of hardware there’s quite a spread; Exzisus is a unique Taito platform that uses 4 Z80s and a YM2151 for sound. Time Scanner it on Sega’s System 16 board, so there’s a 68k driving the main game with a Z80, YM2151 and uPD7759 for sound. Xain’d Sleena is typical Technos hardware of the period using 3x M6809 to drive the game, an M68705 for protection and 2 YM2203 sound chips. The video capabilities of each platform differ too.

Now let’s look at…. something else.

Magnet Exzisus Magnet Time Scanner Magnet Xain'd Sleena

Some bootlegs you might say, big deal. How about this then.

Magnet Time Scanner Disk

Magnet Time Scanner Disk Magnet Time Scanner Disk

Floppy disks, and you’d probably be following a logical train of thought at this stage to be asking if the pictures on show are of some home ports. Floppies were not exactly a common sight when it comes to arcades. Sega used them with System 24 and some UK fruit machines used them for questions, but otherwise they weren’t exactly common and aren’t exactly known for being amazingly reliable.

So are these home ports? No, they’re not, the insert coin messages being displayed aren’t just for show, they really do want you to insert coins, these are arcade games.

Ports, yes, they’re ports, they’re also prototypes, because to the best of our knowledge the arcade system to which they were ported to didn’t actually get released, despite being well advertised in Spanish magazines; much of the advertising focused around original games on the platform, but ports were mentioned too. I doubt any of them were licensed, so yes, you could also count them as bootlegs.

So what is the platform? Well, it’s the ‘Magnet System’ by Electrónica Funcional Operativa SA,

Magnet Time Scanner Disk

and I’ll have more details later, for now I have to leave the house and travel half the country to Brighton to see Amanda Palmer….

Go to article.. »

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.