The Dumping Union recently found a board for a game called Casanova. Some sources list this as a Promat game from 1994, but I’m not 100% convinced this is the same game and no manufacturer information is displayed.

What is known is that it runs on the same hardware as 3×3 Puzzle by Ace Enterprise (actually I didn’t know this at first, but after adding it the addresses matched up and it became obvious)

This PCB is a mess, it has a 10Mhz OSC just tacked on in the middle there with wires going to it!

Mariusz Wojcieszek fixed a few things based on new findings from this in the 3×3 Puzzle driver to get the game working once I’d identified it as that hardware.

Like 3×3 Puzzle it has few redeeming qualities. It’s a tile matching game, it has an awful pre-rendered intro featuring amateurish glitches with parts of the tilemaps not being copied correctly causing bits of the character’s hat to vanish (confirmed on the real PCB) and in addition to that the background colours inexplicably change in places between frames!

Music is just cheesy samples, and about the only noteworthy thing about the entire game is the goofy Superman character who wipes out tiles for you if you get stuck after doing a little dance to more cheesy sampled music. I’d make a video but the hardware does resolution changes and MAME can’t handle that, nor has any way I’m aware of to record a fixed resolution scaled avi for cases like that (snapsize doesn’t work for such cases)

Usual bikini girls included, maybe they strip, that would mean actually playing the game to find out tho. The game also has a number of other stupid bugs, like some of the credit modes ending up with >9 credits and corrupting the display (again happens on real hardware) This really is bottom of the barrel quality!

This is possibly a bit of a premature announcement because I don’t consider the game to be working yet but I’ve spent a large amount of the past week looking at the IGS game ‘Puzzli 2’ with some real hardware assistance from rtw.

As with almost all IGS games of this period there is an MCU on the board providing certain functions for use by the main game code. The ultimate goal is to find a way to trick the MCU into spilling out it’s internal ROM and simply emulate the ARM CPU program contained inside but in some cases that isn’t possible because the MCU is not using any commands with unchecked lookups into internal ROM.

After running a data logger on the Puzzli 2 board and watching what it wrote to and read from the device it quickly appeared Puzzli 2 was one of those cases, all functions were work on the data passed in, transform it and give it back in another format.

There are 3 main functions the Puzzli 2 MCU provides, first, descrambling of the addresses where the Z80 code is stored for sound / music, this was the first thing I hooked up after studying the logs (albeit with hardcoded addresses because the scramble isn’t clear) It was also confirmed that the device provides the correct addresses for Puzzli 2 or Puzzli 2 Super depending on which game code you have running, so clearly the addresses returned are derived from the data passed to the device at startup.

The second function is providing offsets to where graphics / palettes are stored. This is used for the random tiles shown during the intro animation and all the backgrounds. In the end this turned out to be a two step operation, the first step multiplying the two nibbles of data passed by 0x19 and 0x5, the second step being the addition of a 4-bit value to the final result.

The third, and by far most complex thing it does is descramble and decompress the level data structure for each level. Before each level starts the 68k passes in a stream of data from ROM, the MCU then applies a loop of 16 8-bit xor values to that data (from a 256 byte table, the first value passed is the 8-bit offset into that table) Having done that, in the same step (without revealing the intermediate results to the 68k) the MCU fills in a 10×8 structure for the level data as well as a few misc variables based on the input stream. The MCU is also responsible for flagging to the 68k when it has received enough data to build a level.

The level structure is then read back with another command, again with the MCU signaling when enough data has been returned based on the data passed earlier.

What this means is to simulate the protection device I had to understand the format of the source level data, and the format of the level data the game expects (sizes, object types etc.) as well as find a way to figure out the scrambling, easier said than done because you can’t see the descrambled data directly, only the final level structure after the MCU has also expanded / decompressed that descrambled data. Understanding this was by far the most time consuming part and is where work still really needs to be done.

The work done so far has however seen the game emulation improve significantly, many level structures are built correctly, although currently if I look at all the levels the game has several contain what appear to be invalid elements (if you put them in a level the level becomes impossible to finish) interestingly many of these are stripped from the Puzzli 2 Super rom, so I don’t know if they’re unused data, game bugs, or if they do something else on the level they’re meant to be used (they could also be errors in my descrambling, but the xor addresses on which they fall are confirmed with other levels so that’s unlikely)

Needless to say this is a lot of work, and while I took a lot of joy from being able to clean up and remove all the per-game simulations of the Data East 104 / 156 chips there are still cases like this where we have no choice but to simulate things (unless a way for the MCUs to be decapped becomes available)

There are also problems with my interpretation of the ‘depth’ data, I think I see where it’s passed and read but what I’m doing to it is clearly wrong, the width data passed at the same time appears to be processed correctly by the simulation. Depth is one of the level difficulty factors and it being wrong is causing the black bars at the bottom of some screens because it’s drawing everything too high up / for an easier difficulty setting.

Hopefully I can figure out the remaining issues and we can get this one marked as working in the near future. Interestingly it also points at there being a background colour register we’re not emulating on PGM, unless some of the backgrounds are just glitchy on real hardware (it happens more often on games than you’d think). Even if things aren’t fully working yet this felt like promising enough progress to mention it, and should give some insight into just how tricky even the easier cases can be sometimes. Also for those wondering Puzzli 2 Super is quite a significant upgrade, it adds the entire VS CPU mode, the regular Puzzli 2 only has a VS. mode for 2 players.

One thing I really like about this game is the music, I find many of the tunes to be catchy and perfectly fitting for a game of this kind. I don’t know if like with Bee Storm they’re not all exactly original creations but I have a feeling we might find out with time if people end up matching them to source mods ;-) The intro music I’d hope is original because it syncs up so well with the intro animation and is delightfully bouncy!

In other PGM news XingXing dumped the internal ROM of a Knights of Valor 2 Nine Dragons or ‘kov2plus’ as it’s otherwise known, that was actually next on my todo list but it looks like some time has been saved. Instead I’ll bump Puzzle Star to the #1 spot after this one is done, and hopefully figure out how that one manages the level data properly so that it’s playable beyond the first world.

*edit* after some further work I’ve made some more improvements and fixes to the emulation, including fixing the backgrounds, and what seems to be an additional region protection that was causing resets when you attempted to insert coins to continue. I’ve uploaded a video to YouTube showing gameplay plus the various attract cycles for each region at the end.

Content not available.
Please allow cookies by clicking Accept on the banner

When Charles got things moving with the Data East 146 I/O & protection chip emulation it quickly became clear that the 104 chip was different to the other repackaged versions of the chip in that the tables it used internally differed from the 146, although it was also very obvious that the basic functionality was the same.

Luckily Smitdogg had a PCB with a 104 Chip on, an ideal test case to study in the form of the Dream Ball board (previously covered here) This board provided possibly the easiest test bed for the 104 chip because it doesn’t use any of the additional Data East security measures (encrypted CPUs etc.) I’d also determined that the chip was hooked up in a direct way without any additional line scrambling, again making it easier to work with.

The Dream Ball board was quickly shipped to Charles for studying, and after a couple of days of work he was able to use his knowledge from the 146 along with a list of what I felt to be the basic differences in terms of ports the 104 used compared to the 146 to produce a complete set of tables describing the behavior of the 104 chip, just as he did for the 146.

I’d already prepared MAME for this, restructuring all the existing protection and I/O handlers in the 104 based games to go through the same basic code as the 146 so slotting in the new data was fairly easy.

As a result of this Caveman Ninja, Wizard Fire, Pocket Gal Deluxe, Boogie Wings, Rohga, Diet GoGo, Tattoo Assassins, Dream Ball, Night Slashers, Schmeiser Robo and Double Wings now all go through a single implementation of the DECO104 emulation.

Now not all of those games are actually protected; Boogie Wings, Tattoo Assassins, Dream Ball, Night Slashers and Diet GoGo use the chip for nothing but the I/O ports, none of the protection features are used at all.

Caveman Ninja, Wizard Fire, Rohga and Schmeiser Robo on the other hand had rather complex partial implementations of the protection handled on a per-game basis, so by using the new 104 code we were able to kill off all of those and provide a much cleaner and more accurate solution. Pocket Gal Deluxe is only lightly protected, but actually provided one of the more annoying challenges because they hooked the chip up with some very different address line swapping to any other games, but in the end I managed to figure that out so we could kill the old simulation code there too and use the new stuff.

The most significant improvement from all of this is however Mitchell’s Double Wings. Until now Double Wings only had a very buggy incomplete protection simulation meaning the game had incorrect boss behavior (including hangs in places if you didn’t kill the bosses etc.) With the new code all these problems are fixed and the game can finally be considered as working. It’s a fairly generic Raiden type game, with similar weapons / weapon upgrade system and your standard selection of levels, 2 loops with the 2nd loop presenting some extended versions of the levels. There are 3 characters to choose from, each with a different first level and default shot type (the power-up ships will always drop that colour by default although like Raiden they do cycle if left) There is a terrible quality 1CC of it from original hardware on YouTube if you want to see an original reference.

It’s possible you’ve played through the game before and not noticed the problems, but the old emulation simply couldn’t be trusted, and was known to have flaws, hence the not working flag it’s had all these years.

I’ve also been doing bits of other Data East work too, studying Dragon Gun a little more. I haven’t managed to decode the FMV backgrounds yet, but I did stop the game hanging on the last boss. I plan on looking at a few other issues too, for example the sound banking on Wizard Fire.

Sorry for the lack of a proper writeup on the last release, I’ve been a bit tied up with some actual emulation work and emulation work always takes priority over the write-ups.

UME (Universal Machine Emulator) combines the features of MAME and MESS into a single multi-purpose emulator. The project represents a natural course of development for the emulators which already share large amounts of code and is part of an ongoing effort to unify development efforts and provide a single emulation platform for users and developers alike.

As an end user this means that the software provided here is not only capable of emulating arcade machines like the baseline versions of MAME, but in addition can emulate a large number of home computers and consoles from across the world using the very same code, developed by the very same team of developers.

What’s New

You can read the various whatsnew files on mamedev.org
From MAME, From MESS

UME binaries (Windows)

0.149u1 UME Windows binaries (32-bit and 64-bit) (Self Extracting 7-zip) (all MAME / MESS tools included, both 32-bit and 64-bit versions in tool32/tools64)

The source is identical to that found on mamedev.org (SVN revision SVN 24476/ 0.149u1)

Non-UME binaries (Windows)

In addition to providing the UME binaries I’ve also included a package with the individual legacy MAME/MESS executables as an option. Personally I prefer the everything under one exe UME solution but I’ve noticed it’s not always easy to find binaries of the regular u builds with them not being offered from the official site so this is my attempt to address that.
0.149u1 MAME/MESS Windows binaries (32-bit and 64-bit) (Self Extracting 7-zip) (UME above is more highly recommended)

Latest U release binaries for UME, as well as MAME & MESS can also always be found on the page linked in the box on the left
These binaries are coming from Mamedev (me) so are as official as you’re going to get for a u update.

Points of Interest

In addition the everything mentioned in the last 2 posts here there have been a number of other changes, I’ll cover some of the highlights here.

One thing I forgot to mention in the previous post is that hap improved collisions in Birdie King 2, another one of the long-standing games marked as working, but with such severe issues you’d probably be right for thinking it was a mistake.

(more)

I feel it’s time again for another catch-up of what’s been going on, including the things I’ve been working on.

A couple of days ago Charles MacDonald posted some notes on Data East’s 146 protection chip, a chip found on a number of Data East boards sometimes used for strong protection systems, other times simply as an I/O interface.

The board he was studying was Super Shanghai Dragon’s Eye, one of the few games using the chip where the original set in MAME was still non-functional (only a bootleg version has ever worked)

After a handful of emails back and forth, and a couple of misunderstandings concerning the formatting of the data I’d been presented with I managed to use the information provided by Charles (as well as a test program he’d written to check his results on the original PCB) to get the original Super Shanghai set booting in MAME. It’s possible there are a few graphical errors due to differences between the original hardware and the bootleg, but it is now functional and playable. This is the Japanese version of the game, the bootleg is an English version.

The difference between the data Charles recovered from the protection device and previous attempts to emulate the chip is that Charles provided an exhaustive set of data and analysis covering every possible value and address the chip covers, far beyond what Shanghai actually uses. Naturally I wanted to make use of this data to improve / replace the other per-game simulations of the chip found in MAME.

Strangely the first thing I noticed is that the behavior was the same as the ’60’ and ’66’ chips, used by Edward Randy and Mutant Fighter respectively. The new code actually dropped straight in as a replacement, and the games were still happy with the results. Interestingly it appears there was at least one minor oversight with the older Edward Randy protection simulation with some writes being ignored because they looked like bugs in the code, when in reality the protection device does see them, and even responds to them.

What was more of a mystery however was the way I couldn’t relate the information we had to a number of other games that were known to use 146, of note, Funky Jet, Nitro Ball and Fighters History. Some notes in the code (and board tracing from Smitdogg) did confirm that Fighters History had some extra address line swapping leading up to the chip, but even with that applied the addresses didn’t match up. I did however find that applying the same information to Funky Jet gave a correct mapping, and allowed me to get rid of another old per-game simulation.

A bit of research later (and some heavy work in refactoring and re-ordering the existing Fighters History protection simulation) and I quickly saw that with the address bits in a consistent order between games the missing element for Fighters History was an extra XOR applied to the address lines at some point during the protection operation. It isn’t clear how or why this occurs (there is no obvious configuration byte attached to it happening) but it solved the remaining mystery of how to hook up Fighters History, Nitro Ball, Robocop 2 and Lemmings to the new implementation.

Fighters History was the main one of interest for me however because I know the game has NEVER worked properly in MAME. It has been tagged as ‘Unemulated Protection’ for many years now, and the reason it is tagged like that is because the protection tables for the last 2 bosses (Clown and Karnov) had never been extracted, leading to the game crashing / glitching when those characters performed certain moves (the game has a lot of character specific protection)

After hooking up the new simulation and playing through the game is seems those issues are now fixed thanks to the quality and completeness of the data supplied by Charles. This pleases me because the game is an important part of history due to being the subject of a legal battle with Capcom who considered it nothing but a rip-off of Street Fighter 2 (Capcom lost)

Note, my current feeling is that the ‘104’ chip (Rohga, Double Wings etc.) uses different internal tables, and isn’t simply a simple remapping of this, so those games are unlikely to benefit for now. These Data East chips had the potential to be very nasty, so it’s good to have them understood much better now :-)

I revisited another old issue too in the past couple of days. While casually reading a Hardcore Gaming 101 article on Cabal I noticed it mentioned that the Level 2 boss on Hard Times (a hack of Blood Bros) was glitched. While this is mentioned in the source I’d never put much time into figuring out why, so I decided it was something I should look at. In the end it was an easy fix, that level needs a wider tilemap with a custom page layout (it isn’t clear how wide the tilemaps are, there’s a lot more RAM than it seems to need) I can’t fix the sound on the game because it’s driven by an undumped (protected) PIC, but at least the graphical issue is cleared up now.

I’ve also been very busy trying to clean up, refactor and bring together a lot of the Konami video code as preparation for working on the Tasman titles (with a view to maybe using any information found to further improve the GX emulation, because they’re very similar platforms) This is on the back of a lot of work done by Osso to modernize many of the Taito and Konami chip implementations and is work that is many years overdue.

Moving on to work other people have been doing another previously unknown classic era game turned up, this one called ‘Desert Dan’ and claiming to be by a company called ‘Video Optics’ This rare game was found by Alberto Grego (who was previously involved with finding Planet Probe and Grasspin)

It’s a simple vertical scroller with several different sections, a regular desert scene, a further desert scene where movement is much harder (looks like ice with the current palette), a cave section where movement is more restricted due to rocks at the side, a darkened cave section where you can’t see the internal walls, and a river full of crocodiles. The PROM isn’t dumped yet, so the colours are wrong, the driver currently uses the colour PROM from The Pit which is the closest thing in terms of hardware to this. This one was added to MAME by Mariusz Wojcieszek with some help from hap. Some (unused?) tiles seem to contain ‘BMC’ text, although I doubt it is related to the BMC company we know today.

will cover other work done recently when u1 hits tomorrow

There won’t be another MAME / UME update for roughly 2-3 weeks because Micko is on holiday. Due to this delay I’ve decided to do a bit of an interim update showing some of what has been added since the 0.149 release.

First up there is Hidden Catch 2000, a previously unknown title in Eolith’s Hidden Catch series. It appears to be based on a similar codebase to New Hidden Catch, but with some additional features. This was dumped / bought by Brian Troha and ANY.

Adding support was a little trickier compared to some of the other Eolith games, because like 2 of the other sets in the driver it uses an MCU with internal ROM instead of a compatible CPU operating in external mode for the Sound CPU. The MCU hasn’t been dumped, and the MCUs also appear to provide some kind of basic startup protection.

The actual sound CPU programs are very simple, so to get sound we can at least substitute it with a program rom from another game in the driver, although I doubt it’s 100% correct. Additionally the main program rom requires a small patch to bypass whatever the extra check they do on the protected sets is. You can see the MCU and empty socket where there would otherwise be a ROM in the picture below.

(Hidden Catch 2000 sound MCU)

In addition the game has an extra sound board with an AD-65 (OKI 6295) chip, although so far I haven’t been able to map this properly, looking at the writes made by the game I wonder if there isn’t a hyperstone CPU core bug, it seems to be writing to 2 different 8-bit ports on one address, but the memory mask is always 32-bit meaning every write will also end up writing 00 to the port it isn’t trying to access. I could have misread it, or there might be a genuine bug.

(Hidden Catch 2000 extra OKI)

Possibly the most ambitious progress of the cycle so far is Samuele Zannoli‘s work on Chihiro. Chihiro is an arcade Xbox (original Xbox) which is close to a ‘high end’ PC relative to the other work shown on PC based platforms in MESS recently. Of course it doesn’t hold up well to anything released since, but compared to anything MAME / MESS emulates it definitely comes in at the high end of the spectrum. What he’s actually manage to do is implement enough of the system emulation that OutRun 2 is now capable of getting through the BIOS sequence, loading the actual game code, initializing all the DirectX code and displaying an error message to tell you the JVS unit is missing. In a debug build this process takes roughly 20 minutes to complete (it’s running at 2% speed even in a non-debug) but still really amazing to see something like this boot so far! Tells you a lot about the recent x86 PC work done for MESS and how far along the cores have come.

(Outrun 2 booting up to an error in the Chihiro driver)

Flipping from new to old, Mariusz Wojcieszek spent some time hooking up much of the video for Sea Battle, although some graphical issues remain, and collision might not be quite right (much like so many of the other Zaccaraia games) It’s also got discrete sound hardware due to being such an old game, so currently has nothing resembling the correct sounds at all, but at least it runs and progress is being made.

Brian Troha also managed to come up with the English (US) release of Shanghai 3, previously MAME only supported the Japanese version. The US version is both in English and gives you a selection of 3 possible tile-sets to make it more appealing to non-Japanese audiences.

System11 dumped a version of Rapid Hero showing the original NMK copyright, this alternate version is called ‘Arcadia’ I’m not sure what the full story is on this one, because while I’d assume it is an NMK made game the ‘Arcadia’ title shown alongside the NMK logo isn’t the trademarked name, and the Rapid Hero set has a more advanced attract intro where the ‘Rapid Hero’ title flashes during it while Arcadia simply shows the ships without that added effect. Who was ‘Media Trading Corporation’ and why does only their name appear on the ‘Rapid Hero’ version? The actual PCB has always been an odd one too, unlike all the other NMK boards this has the same type of CPU as the NMK004 MCUs are thought to contain, but with a fully external program. Sound was also massively improved in this during a previous release, so 0.149u1 might be a good time to give it a try when it comes out!

You can see screenshots of both versions below.

The same contributor also dumped a version of Afega’s Guardian Storm, this time one for a Germany region. This was a bit of work to add because it uses a slightly different lineswapping to the other set. The interesting thing about these games is that all the builds we’ve seen seem to be actual recompiles, possibly slightly minor different revisions of the base code. Afega must have absolutely flooded the markets with these low-budget shooters which seem somehow related to NMK’s output (the hardware is clearly derived) Not only are there multiple versions of these but you have things like ESD’s Fire Hawk and the extraordinarily buggy Spectrum 2000 based on the same codebase again. There’s a story to untangle somewhere with these.

Barry Rodewald isn’t a name I mention too often here because a lot of the work done is important work that slips under the radar, but he’s been working hard on improving the emulation of the display parts of several Data East Pinball machines since 0.149. While I consider it unlikely that MAME will ever emulate the full tables it could still one day become a good replacement to PinMame for use with other applications.

There have been the usual share of modernizations too, with Osso modernizing a lot of video devices and learning the importance of initialization along the way. Plenty of CPU cores and the like were also modernized, although completion of that task is still very distant on the horizon. I did take care of the M68000 as part of that process, giving it a modern interface, possibly one of the riskier changes to go in considering how widespread use of it is and some of the changes that were needed (it took a week of pulling apart, putting back together and testing) I know that one was scaring a lot of people, so I was glad to do my part for the modernization process by getting it out the way, and hopefully showing that even the difficult ones CAN be done with minimal disruption.

hap has been busy improving the YMF271 (the sound chip used by Seibu SPI) too, I’m told the Raiden Fighters Jet music was significantly improved in 0.149 and will see even more improvements in the 0.149u1 release, something I’m sure a lot of people are happy to hear!

Another curious clone is the new P47 Freedom Fighter addition from Porchy, what can only be described as a censored set. I say curious because apparently its an ‘export’ version with the crosses removed from the planes, as you can see on the bottom two rows of the screenshots below (left is the new set, right is the old set) the strange part is that both sets boot up as ‘For Use In Japan’ The actual Export version we have as the parent is uncensored (assuming it isn’t a frankenset) to add to the confusion. Either way, must have taken a keen eye to notice this.

Another finding from Brian Troha was some loose ROMs from a Zombie Raid prototype, hand-dated etc. Unfortunately then turned out to not be quite as interesting as was hoped because the actual program code is an identical game revision to the final game, the graphics are simply split differently. All was not lost however because the set contained ROMs for both the English version, and the Japanese version, both were added (even if the English one is technically identical once loaded) and it does mean that there is now a set with a plain Sammy copyright (rather than American Sammy) and Japanese text; turns out it’s just 3 bytes different tho.

Chris Hardy and Charles MacDonald combined to sort out and decrypt one of the non-working Wonder Boy 3 clones, using the correct ROMs from the ‘wb35’ and ‘wb35a’ sets (I think just wb35a, wb35 was bad) and also fixing / creating a suitable decryption key based on code analysis so that the set can run, like much of this update, nothing you haven’t seen before, but good to have another original set running, this one being an FD1089A based set whereas all the other working sets are FD1094 based, or use a plain 68k with 8751 protection.

Sega’s Tetris is a game that got around, Alex Meijer uncovered yet another version of it this time on the Taito H system (68K, Z80, YM2610) with this version apparently being a conversion kit for a ‘Go For Gold’ board. This is the 3rd Taito platform for the game to be seen on with 2 previous ‘B’ system versions known one also with 68K, Z80, YM2610 but a very different video system and another ‘B’ system board with a YM2203 instead. Interestingly the ‘B’ version with the YM2610 has bad sound in MAME at the moment, it attempts to play samples from a sample ROM, but none was present on the board. For the H system version the samples (drums) get played from the leftover Go For Gold board. It’s possible the B system 2610 version was some kind of botched conversion because while the sample roms were removed it still had 2 graphic roms from Master of Weapon (which cause corrupt graphics in places if loaded into the regular region). In addition to the Taito platforms it was also released on both Sega’s System 16A and System16B platforms (with the 16A version having some corrupt backgrounds even on original hardware due to tile banking limits)

If you’re counting close in presentation, but not the same codebase ports there was also the Megatech version (which is much more common than the ultra rare Genesis cartridge, even if the game code would have been the same) The System E version is of course completely different because it’s z80 based, even if it was released around the same period.

There was apparently a version for at least one of the ‘Taito F2’ boards, although that hasn’t surfaced yet.