Planet MAMEdev

An aggregator of MAME development weblogs

  • Essentials

    • News
    • Latest Release
    • Development Tools
    • Development wiki
  • Subscriptions

    • (feed) Aaron Giles
    • (feed) Angelo Salese
    • (feed) Charles MacDonald
    • (feed) David Haywood
    • (feed) Frank Palazzolo
    • (feed) Luca Elia
    • (feed) MAME Plus!
    • (feed) MAMEdev Main Page
    • (feed) Manuel Abadia
    • (feed) Nicola Salmoria
    • (feed) Norbert Kehrer
    • (feed) Paul Priest
    • (feed) R. Belmont
    • (feed) Ville Linde
    • (feed) smf
    • (feed) Syndicate This
  • Legal

    • About MAME
    • MAME License
    • MAME Trademark
    • MAME Logo
    • Legal FAQ
  • Powered by

    • Planet

    Edited by

    • Chris Cunningham

    Thanks to

    • Andrea Musuruane
  • Last updated

    • July 04, 2008 11:00 PM
    • All times are UTC.
  • Planetarium

    • Planet Apache
    • Planet Debian
    • Planet freedesktop.org
    • Planet GNOME
    • Planet Sun
    • Fedora People
    • more...
  • July 04, 2008

    Charles MacDonald

    pop ss mov sp, $F800 ; or mov ss, [si+0] mov sp, [si+2] It seems less important to have DS and ES register loads delay interrupts as well, I did not expect this behavior.

    July 04, 2008 05:00 PM

  • If anyone does something cool like sticking a RAMDAC chip on the color bus outputs, do let me know. :)

    Here is a mostly complete pinout for the 315-5313 VDP.

    July 04, 2008 04:00 PM

  • July 03, 2008

    Charles MacDonald

    Uncategorized error

    An error has occured. It has been logged by Dapper.

    July 03, 2008 06:00 PM

  • MAMEdev Main Page

    MAME 0.125u9

    Just posted over at the Source Updates page is hopefully the final update to the MAME 0.125 dev cycle. It’s been a long road! Now is the time to check this out and ensure that all your favorites are still in fine working order before we lock down for MAME 0.126.

    Posted by Aaron at July 03, 2008 04:16 PM

  • R. Belmont

    Two steps forward, one back

    The SH-2 DRC successfully got Cyvern past the on-screen POST last night, but that revealed a problem with cycle counting that was making MAME timing and interrupts work poorly at best. I fixed that, but there’s now a bug where it crashes trying to resume after handling an interrupt. Never a shortage of fun with this stuff!

    Posted by site admin at July 03, 2008 03:11 PM

  • July 02, 2008

    R. Belmont

    Step 1: underpants

    I’ve been working on a MAME UDRC frontend for the SH-2 for just under a week now. Last night it finally made it all the way through the suprnova BIOS and into the Cyvern boot code without errors (including handling interrupts). There are still several instructions left to implement before it actually shows something, but so far so good so what, right?

    Before someone asks, this will speed up ST-V (and Saturn in MESS), Kaneko SuperNova, Psikyo SH-2, and CPS3. And SH-2 is a pure subset of SH-4 (aside from different boot vector semantics) so once done this frontend will make a fine starting point for an SH-4 UDRC.

    Posted by site admin at July 02, 2008 02:17 PM

  • June 30, 2008

    Ville Linde

    The following error was encountered:

    June 30, 2008 12:00 PM

  • This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that:

    June 30, 2008 12:00 PM

  • June 29, 2008

    Luca Elia

    Uncategorized error

    An error has occured. It has been logged by Dapper.

    June 29, 2008 04:00 PM

  • June 27, 2008

    Luca Elia

    The game suffers from several issues as things stand, and is not playable. However, here are some preliminary screenshots:, Again, to get it to boot I had to add a dozen unemulated instructions, and add support for the different internal registers of the 3007. I also started to implement the slightly different timers of this model., Despite that, the game does not write to the OKI sound chip (must be the timers), it does not clear the tilemaps properly (hence the corrupt layers), plus it does not populate the tiles table of the 14300 correctly (tile 0 is not transparent)., The images above were in fact taken using a few hacks in the video emulation, and some disabled layers., It is almost fully working, but I had to resort to a few hacks in the video emulation, that I'll have to investigate further and implement properly., Plus, it's obviously trying to play the crash / hit sounds by driving two I/O ports, but not like DAC's. Indeed, some other games on this platform use a custom sample player in place of the DAC's, but in this case there are no sample roms. So that will require some more work.

    June 27, 2008 04:00 PM

  • MAMEdev Main Page

    MAME 0.125u8

    Oops, a major bug crept into the last release at the last second, so without further ado, please grab the small update to MAME 0.125u8 from the Source Updates page. There will still be a u9 next week, and hopefully a 0.126 to follow shortly thereafter.

    Posted by Aaron at June 27, 2008 04:47 AM

  • June 25, 2008

    David Haywood ([Haze])

    Wonderleague ‘96

    This one ended up on the backburner when I had CPS3 to work on. I’ve finally got back to it, and now it appears to work fine. Just one unemulated game in this SemiCom series now (the original ‘Magicball Fighting’)


    WonderLeague '96

    WonderLeague '96

    WonderLeague '96

    WonderLeague '96

    and just as a bonus.. some nice rear action
    WonderLeague '96

    Posted by Haze at June 25, 2008 08:33 PM

  • June 19, 2008

    Luca Elia

    Again, to get it to boot I had to add a dozen unemulated instructions, and add support for the different internal registers of the 3007. I also started to implement the slightly different timers of this model., Despite that, the game does not write to the OKI sound chip (must be the timers), it does not clear the tilemaps properly (hence the corrupt layers), plus it does not populate the tiles table of the 14300 correctly (tile 0 is not transparent)., The images above were in fact taken using a few hacks in the video emulation, and some disabled layers.

    June 19, 2008 03:00 PM

  • David Haywood ([Haze])

    Entirely Stolen Drawings?

    As pointed out on Mameworld, the backgrounds used in Swat Police shown on my pages here have all been lifted from other games, mostly it would seem NeoGeo ones. (I think some of the explosions are taken from Metal Slug too)


    Mutation Nation vs. Swat Police
    Mutation Nation
    Swat Police

    Aggressors of Dark Kombat vs. Swat Police
    Agressors of Dark Kombat
    Swat Police

    Burning Fight vs. Swat Police
    Burning Fight
    Swat Police

    Art of Fighting 2 vs. Swat Police
    Art Of Fighting 2
    Swat Police

    so.. here’s the fun part, can anybody tell me where the rest of the graphics come from?


    Contra 3 (SNES) + ???? vs Swat Police
    Swat Police
    Various people pointed out that the Red buildings are
    from Contra 3 : Alien Wars on the Snes (x-flipped)

    Judge Dredd (Snes) vs Swat Police
    Swat Police
    Kitsune Sniper pointed out that the Logo is a modified version of the
    one from Judge Dredd on the SNES

    ???? vs Swat Police
    Swat Police

    ???? vs Swat Police
    Swat Police

    Burning Fight vs Swat Police
    Swat Police
    From Burning Fight (thanks BBH)

    Burning Fight vs Swat Police
    Swat Police
    From Burning Fight (thanks BBH)

    Burning Fight vs Swat Police
    Swat Police
    BBH shows that this is a (fairly modified) version of the Burning Fight stage 1

    Burning Fight vs Swat Police
    Swat Police
    BBH pointed out that this was from a Burning Fight Bonus Stage

    Burning Fight vs Swat Police
    Swat Police

    Another from Burning Fight pointed out by BBH

    Posted by Haze at June 19, 2008 07:38 AM

  • May 12, 2008

    Manuel Abadia

    World Rally emulation completed

    This post is first in English and then in Spanish
    Esta noticia está primero en inglés y luego en español

     

    World Rally emulation is complete. I implemented priorities (that were trickier than I thought), shadows/highlights and a few missing bits in the video hardware. Here are some screenshots of the finished driver:

     

    The game is fully playable from beginning to end without any problem as far as I can tell. I thought there was a bug in the video hardware emulation somewhere when I saw this:

    So I plugged my PCB and compared it to the driver:

    The problem is also in the original arcade game. Because of the way an arcade monitor works, the problem is nearly unnoticeable in the original game. I also checked if the original PCB had the same “shadow effect” for the tiles:

    As you can see, the hardware works that way:


     
    Something curious about the protection... Javier told ElSemi that the protection of this game took 8 months of work, so imagine how complicated it was… even the dallas has some code that performs some pseudorandom dummy accesses to the shared RAM to make black box attacks even more difficult.

    To clarify a question about the other protected games, having the World Rally dallas code does not help to emulate the protection of them.  As MAME now has a DS5002FP core and the other games are almost fully emulated, if we get the dallas code for a game, it will be playable quickly.

    Finally, I want to thank to all the people that made this possible. It was cool to be part of this. It has brought me some good memories and healed my wounds with Gaelco.

    Update: Gaelco made public the ROMs for World Rally. You can get them from their web page

    For reference here are all the posts about World Rally emulation:

    Part 1
    Part 2
    Part 3
    Part 4



    La emulación del World Rally está completada. He implementado las prioridades (que han sido más difíciles de lo que pensaba), los focos y sombras, y algún detalle que faltaba del hardware gráfico. A continuación se muestran unas pantallas del driver:

     

    Es completamente  jugable sin que haya podido observar ningún problema. Pensé que había algún fallo en la emulación del hardware gráfico cuando vi esto:

    Así que enchufé mi placa y la comparé al driver:

    Como se observa, el problema también está presente en el juego original. Debido a la forma en la que funciona un monitor de recreativa, el pequeño fallo gráfico es prácticamente inapreciable en el juego original. También comprobé si el juego original hacía el mismo “efecto de sombra” de los puentes:

    Como se puede apreciar, el hardware funciona de esa manera:

    Algo curioso sobre la protección… Javier le dijo a ElSemi que la desarrollar protección del juego llevó 8 meses de trabajo. Inmaginad cómo de complicada es la protección… Incluso el dallas tiene código para realizar accesos pseudoaleatorios a la memoria compartido con el único motivo de hacer que los ataques de tipo caja negra sean incluso más difíciles.

    Sobre la pregunta de si tener el código del dallas para el World Rally sirve para emular la protección de los otros juegos, la respuesta es que no. Se necesita el código de cada uno para hacerlo funcionar. Como ahora el MAME ya dispone de un emulador de DS5002FP y los juegos de Gaelco protegidos están ya emulados completamente, una vez que obtengamos el código del dallas para un juego, será jugable rápidamente.

    Por último, me gustaría darle las gracias a toda la gente que ha hecho esto posible. Ha sido muy interesante poder formar parte de esto. Me ha traído muy gratos recuerdos y ha cerrado viejas heridas con Gaelco.

    Actualización: Gaelco ha hecho públicas las ROMs del World Rally. Puedes obtenerlas desde su página web

    A modo de referencia, aquí están todas las noticias sobre la emulación del World Rally:

    Parte 1
    Parte 2
    Parte 3
    Parte 4

    Posted by Your DisplayName here! at May 12, 2008 09:13 AM

  • May 10, 2008

    Manuel Abadia

    Playable status reached

    This post is first in english and then in spanish.
    Esta noticia está primero en inglés y luego en castellano.

    Javier sent us (via ElSemi) detailed information about how the encryption process worked. However, he told us that the sheets of paper that contained the encryption info were a bit difficult to read in some places (remember that this protection was designed 15 years ago) so probably there was some mistakes in the excel file he sent us. ElSemi and I tried to add it with the information he gave us but we didn’t have success. Nicola Salmoria did an excellent work (as always) consolidating the information and obtaining the missing information. He generated a working decryption function that not only works for World Rally, but also for Squash and Thunder Hoop.

    Mike Coates also completed the interface to get the data from a World Rally PCB, so he was able to supply the encrypted/decrypted data that was needed to get the specific details to decrypt World Rally properly.

    Special mention to Andreas Naive too. The high level information Javier told us a few days ago was already discovered by Andreas and posted in his page a couple of months ago. Before Javier sent us detailed information about how the encryption worked I contacted Andreas Naive about the encryption and he told me that he didn’t have free time at the moment to look at it. However he told me an intuition he had about the algorithm:

    "I remember that my last feeling was that to decipher each 16 bits block, it was done in 3 chunks: a first 6 bits chunk and then two 5 bits chunks, each of them based in a/some bits of the first chunk. I don't remember exactly which ones, but the first chunk was the one with a simple structure (based on the tables I published), while the other two were the ones that shown a more complex structure (and carry effects)".
    He was completely right as that was how it worked the encryption that Javier sent us.
     
    It is good to have geniouses around ;-)

    After adding the decryption to the driver the game looks like this:

    It has a few graphic glitches that will be fixed soon but it seems to be PLAYABLE ;-)

    Update: more progress has been made. You can read about it here


    Javier nos ha mandado (via ElSemi) información detallada sobre cómo funciona el proceso de encriptación. Sin embargo, las hojas donde tenía detallado el funcionamiento del algoritmo eran difíciles de leer en algunos sitios (ya que la protección fue diseñada hace 15 años) por lo que probablemente habría alguna errata en el fichero Excel que nos mandó.  ElSemi y yo intentamos en vano añadir la información de Javier. Nicola Salmoria ha realizado un trabajo excelente (como siempre) terminando de pulir esa información y descubrir los detalles que faltaban. El ha implementado una función de desencriptación que funciona no solo para el World Rally, sino también para el Squash y el Thunder Hoop.

    Mike Coates terminó el interfaz para obtener datos de la placa del World Rally, suministrando valores encriptados y sus correspondientes valores desencriptados, que permitieron obtener los datos específicos necesarios para la correcta desencriptación del World Rally.

    Mención especial a Andreas Naive. La información de alto nivel que Javier nos dio hace unos días ya había sido descubierta por Andreas, que la publicó en su página hace unos meses. Antes de que Javier nos diera la información detallada sobre cómo funcionaba la encriptación, contacté con Andreas Naive sobre el tema. Me dijo que ahora mismo no tenía tiempo disponible para mirarlo. Sin embargo, me dijo que tenía un pálpito:

    “Al descifrar cada bloque de 16 bits, se hacía en tres trozos: un primer bloque de 6 bits y luego dos bloques de 5 bits, cada uno de ellos basados en un/unos bits del primer bloque. No recuerdo cuáles eran cuáles, pero el primer bloque era el que tenía una estructura más sencilla (según las tablas que publiqué), mientras que los otros dos son los que mostraban estructura más compleja (y efectos de acarreo debidos a alguna suma).”

    El algoritmo que nos había mandado Javier funciona exactamente de esa forma.

    Está bien estar rodeado de genios ;-)

    Después de añadir el algoritmo para desencriptar los datos, el juego mostraba este aspecto:

    El juego tiene algunos fallos gráficos que se corregirán pronto pero es JUGABLE (lo poco que he probado) ;-)

    Update: se ha completado la emulación del World Rally. Puedes leer sobre ello aquí

    Posted by Your DisplayName here! at May 10, 2008 06:52 PM

  • April 07, 2008

    smf

    1 on 1 Government Revisited

    Most of my work recently has been to improve the accuracy of the PlayStation CPU emulation. This hasn’t made much of a difference to any games, though if you write your own code and it runs on the emulator then it’s more likely to run on the real thing.

    I’ve now moved onto writing GTE unit tests, there were a couple of games with geometry issues & I wanted to have some visible sign of progress.

    This is the result of improving the data transfer between the CPU and the GTE:

    1 on 1 Government Character Select1 on 1 Government

    There are a few GPU issues, but I’ll get to them some other time. Someone will need to write a cheat for this though, or explain to me how to beat the computer.

    Posted by smf at April 07, 2008 11:19 PM

  • January 16, 2008

    smf

    Putting the clocks forward.

    The clockspeed of the PSX based games in MAME has always been a little on the low side.
    Mainly to make up for the lack of cache emulation and bus contention, also partly because the GTE timing isn’t emulated yet.

    Due to the recent attention to crystals, there has been some investigation as to what the real clock speed should be.

    Thanks to Guru’s probing we are able to say for definate what is going on.

    The CPU has an internal divider and on the majority of boards is fed a 67.7376mhz clock. I have currently got MAME to report this frequency, with an internal divider of 4 to keep it roughly the same as before ( it should be 2 but I’ll leave that until the rest of the timing issues are sorted ).

    Some information has been floating around for a while that has never been confirmed & now seems to be a good time. The 67mhz clock doesn’t appear on the namco system 12 or the later system 10 boards. It appears they have their own higher rated part. System 12 runs on a 100mhz clock, while system 10 runs on a 101.4912mhz clock. So system 12 being faster has been elevated from rumour, to probable.

    The GPU clock is the same across all hardware. I’d have thought they’d have done something about that, especially as all the system 12 games like to run in interlace. Maybe it’s more efficient or has faster ram, we’ll leave that one for another day.

    Posted by smf at January 16, 2008 08:33 AM

  • October 14, 2007

    Angelo Salese (Kale)

    Find Love

    Well,got some new ST-V games to boot thanks to a better understanding of the IC13 rom loading:


    Find Love

    find0000.png

    find0004.png

    find0006.png

    Posted by Kale at October 14, 2007 07:03 PM

  • Filetto Debug Snap

    Well this is just to post something,as I got several complainings about not being in MAME for a while… :D

    This is Filetto running past the title screens,I guess that this game is missing IRQs so it’s not working due of that.

     

    Posted by Kale at October 14, 2007 06:59 PM

  • February 17, 2007

    Nicola Salmoria

    CPS2 not much left to do

    When I originally wrote the key searching program, that was on the assumption that the key for the second Feistel network was 96 bits long.

    Each (E,D) pair reduces the key space by a factor of about 216, so to isolate the correct key with good confidence one would need at least 96/16 = 6 (E,D) pairs.

    The big problem is finding those pairs. Remember that they must be at compatible addresses, that is addresses whose bottom 17 bits are the same. This is a serious limitation, because the code of several games only covers a range of 0x80000 bytes, which would give a maximum of 4 pairs at any address. For the Super Puzzle Fighter 2 games, the range is just 0x40000 bytes, giving just 2 pairs per address.
    One can find hundreds, even thousands of of (E,D) pairs, but if they are not at compatible addresses they are of no use to find the key using this attack.

    However, now we know that the key actually has only 64 significant bits, some of which are repeated. I therefore rewrote the program to take that into account. This means that only 4 (E,D) pairs are needed to isolate the key.

    Also, I made several important optimisations that I missed the first time around, like caching intermediate results and speeding up the s-boxes calculations by using precalculated tables (this last optimisation also made into MAME so the decryption when loading a game is now faster).

    The end result is a program that is orders of magnitude faster than the previous one.
    Now it takes just 15 seconds to find the key given 8 (E,D) pairs. With 5 pairs, which was just plain impossible before, it takes 5 minutes. With 4 pairs, 35 minutes.

    These improvement made it simple to find most of the remaining keys, even for games that didn't have a matching revision already decrypted (most notably some of the Steeet Fighter Zero versions).

    But there's more: the program is now fast enough to go one step further, and look for the key with just 3 pairs. Of course 3 pairs are not enough to isolate the right key: they only reduce the key space by about 248, therefore leaving about 216 keys which are compatible with the data. Once a 64-bit key for the second Feistel network is selected, the compatible 64-bit master keys can then be easily generated, and used to verify other (E,D) pairs at different addresses. This allows to find the correct key in less than one day, and I had to use this extended attack for a couple of the most problematic games.

    In the meantime, Andreas Naive has been busy implementing the attack he had described on his blog, and was able to find the keys for two of the Super Puzzle Fighter 2 games. Unfortunately, the attack failed on the third. Work is still in progress on that one, and there is some hope that the key will eventually be found.

    The only other games that are missing a key are the two CPS2 versions of Mega Man. There is no decrypted CPS2 version of that game to compare with, and the CPS1 version seems to be too different to be able to find good pairs.

    Posted by Nicola Salmoria (noreply@blogger.com) at February 17, 2007 12:39 PM

  • CPS2 Key Bit Order

    As previously mentioned, the 64-bit keys I'm currently using should be the same as the hardware ones, except for a fixed permutation of the bits.

    The permutation is actually irrelevant as far as the algorithm is concerned, since it is already taken into account when generating subkeys. The difference that it does make, however, is that there are strong suspicions that some of the keys are not random numbers, so what looks like random gibberish currently would show some order if we had the correct permutation.

    Take the ssf2 versions for example. There are currently 6 different versions supported: World, USA, Asia, Japan, Tournament World, Tournament Japan. Here are the keys (in a different order):

    3D9E1E15A58C32CE
    3599DF35AD98284C
    B74433502F4653D7
    8758E3923FFA1A50
    F0AE3D08420DD6BF
    6260014FD857F7A7

    there is something immediately obvious about those keys: they all contain exactly 32 0s and 32 1s.
    When picking one random 64-bit numbers, the likelihood of this happening is about 1 in 10, so it's ok. But the likelihood of it happening for SIX numbers is about 1 in 1 million! So we can be pretty sure that those keys are not random numbers.

    What is one particularly simple sequence that has exactly 32 1s? Well, of course 0123456789ABCDEF. And sure enough, after looking at the bits for a while and applying an appropriate permutation, here is what the above keys become:

    0123456789ABCDEF
    1032547698BADCFE
    45673210CDEFAB89
    67451032FEDC98BA
    89ABDCEF45672301
    CDEFBA9823016754

    looks much better doesn't it?
    Though there's no way to tell how close it is to the real thing.

    Posted by Nicola Salmoria (noreply@blogger.com) at February 17, 2007 10:33 AM

  • May 08, 2006

    Frank Palazzolo

    The Road to Reality

    I have been interesting in Physics as a hobby for a very long time. Back in the mid-90's, I was reading about Quantum Mechanics and Relativity on a fairly regular basis. I had to really dig to find books that were deeper than a purely "popular" treatment, but not so deep that an engineer could actually make sense of them. Some math, not all math.

    Having been trained as an engineer is "almost enough" to handle "some" of the math, but I ended up with an awfully long road ahead. I eventually got a bit discouraged, but never quite gave up. (Emulation came along and I got a bit distracted for a number of years.)

    In 2004 Roger Penrose wrote a giant book on Math and Physics, call "The Road to Reality: A Complete Guide to the Universe". It is a highly mathematical, modern treatment, but it builds on itself such that, theoretically, someone with some math background can actually understand it all. (At least, they'll be able to self-direct to other resources as needed.) There are 16 chapters of Math (the first 1/3 or so), followed by as many on Physics. For comparison, my formal math training ended at chapter 7. I now find myself in chapter 15, nearly finished with the math section. It is definitely not for everyone, but it's exactly what I needed.

    Finally, I have found that discussing the details of the book can help a lot with the understanding. I recently created a Yahoo Group called RTRFANS, for just this purpose. With this book, and with internet resources that weren't available in the mid-90's, I've now got a shot at understanding truly modern physics.

    Posted by Knarfian (noreply@blogger.com) at May 08, 2006 02:32 PM

  • Some porting work

    I really need to post more often!

    For a while now, I've been wanting to experiment with new methods of high-speed circuit simulation. The idea would be to prototype some discrete-audio stuff, possibly for MAME, using something like Python.

    After looking into the requirements, I realized that I needed to handle polynomials with a single variable, and ratios of these polynomials. Also, I needed to be able to handle real or complex variables. I looked around on the web, and I found that SciPy is finally coming along nicely on Windows. However, I wasn't entirely happy with the root finder they use.

    Along the way, I also found the ratfun package, which looked perfect, but was unsupported on Windows. I dug in and in a couple weekends, got it building under Windows. I think I'll be using it for the experiments, whenever I get back to it.

    Posted by Knarfian (noreply@blogger.com) at May 08, 2006 02:30 PM

  • January 15, 2005

    Paul Priest (Tourniquet)

    Testing... 1.. 2.. 3..

    Testing... 1.. 2.. 3..

    January 15, 2005 12:45 PM

  • May 23, 2004

    Paul Priest (Tourniquet)

    MAME 0.82u2 'fishsalad' (don't ask me :) is over a...

    MAME 0.82u2 'fishsalad' (don't ask me :) is over at Haze's. It features all manner of ZN goodness.

    May 23, 2004 07:30 PM