Monster Land English : from Encryption to Decryption...

Coin-operated games and arcades.
Post Reply
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Monster Land English : from Encryption to Decryption...

Post by mpatou »

EDIT 09/25/2014: Here is the link to the Porchy's website downloading section, where you can find the decrypted files on the last page of that section.
And if you want, you can even make a donation to Porchy, so he'll be able to keep-up good work (I won't get any money of this ;) )

===============================================================================================

Hello there. I love Wonder Boy in Monster Land, and I'm sure I'm not the only one here. I made a topic on a french board concerning the recent work I achieved recently on that game (original topic is here, in french unfortunately).

What I want to do here, is to sum up my work, step by step.

As everyone knows, until recently there were no official release English version of the arcade Wonder Boy in Monster Land. That's pretty annoying, but that game has a strong RPG aspect (for an arcade game I mean), with some dialogs, shops, clues etc...

Some bootlegs were released in non-Japanese countries. Here are some samples of them

Image
Image
:sick:

For those who don't remeber, here is the Japanese title screen
Image

Well it's just a title screen, but translation is not really better


Image
"oh Fighter: Listen...c'mon bro!" :lol:

My favorite one:
Image
"You get sword and drug", amazing...

All the dialogs are as bad as those samples. Pretty sad isn't it? But an unexpected miracle happened...


Image

An English version has been release on the Virtual Console Arcade of the Nintendo Wii...with a gorgeous Title screen and a pretty descent translation. That version was confirmed to be 100% genuine by Ryuichi Nishizawa, who's the main programmer and the producer of WBML, and the head of Westone. You can read a very interesting interview here

Besides, some hackers managed to extract a romset from that version, that can be used on Mame...and of course on real hardware. At that point, my choice was made, I wanted to play that official Westone English version of the game on my original Japanese PCB... which happened to suicide as I was starting to work on that issue...
Of course, it was not that easy, some problem showed up...


ROM files size :


The original PCB was designed to be used with 32KB eproms (256Kbit), whereas 2 of the 6 rom files in the Virtual Console romset are 64kB (512kbit) : VC.IC90 and VC.IC91 . Why? That's because of the encryption/decryption method. We can't use them on an original PCB without modifying it.

Basically, rom files have two kinds of content : OPcodes and DATA. OPcodes are instructions, DATA are graphics, sounds etc... Both of them use the same decryption key, but OPcodes need it only once and DATAs need it twice. Besides, inside OPcodes some bytes coding for addresses or variables are encrypted like DATAs. Finally, one of the rom files (the one that has the game program) has those two kinds of info mixed together.

So, why 64KB? Just like the bootleg romsets, that's because to decrypted the game, each ROM has been decrypted first to get instructions bytes readable, then a second time to get DATA-like bytes readable. Then those two 32kbytes files have been put together into a 64 kbyte eprom, so the CPU can work it without any decryption key (that disappeared when the suicide battery is dies).

My work here? I had to take OPcodes and DATA correctly decrypted on the good half of each 64Kbyte rom file, and dump the rest in order to get nice and slim 32kbytes romfiles.

Using a hexadecimal editor, I took a look inside the VC.IC90 and VC.IC91 files, and It appeared that IC91 was only twice the same 32KBytes decrypted file. Nice! On the contrary, IC90 was pretty messy, with DATA and OPcodes together as described before. Well I did all the work manually, it took me almost 2 months and a half. Thankfully, a friend of mine gave me a small DOS-Command program, found on a Japanese website, that maps DATA and OPcodes on the original Japanese encrypted ROM images files, and decrypts them. Japanese IC90 and English IC90 are very similar, but not identical. That Japanese map helped me to map the English IC90, but I couldn't use it directly, neither the decryption DOS program.

At the end I finally got a romset with only 32Kbyte ROM image files that could be used on my PCB without modifying it. The end...? Not really...
Last edited by mpatou on September 25th, 2014, 4:41 pm, edited 6 times in total.
Image
User avatar
trev1976
Posts: 870
Joined: March 30th, 2009, 7:17 pm
Location: Southampton

Re: Monster Land English : from Encryption to Decryption...

Post by trev1976 »

Very interesting project. Ive never played it but noticed it was very popular while I was in Japan a few years back

Ill have to check it out one day
Check out my "1cc" YouTube Channel
YouTube
User avatar
pubjoe
Fosters Political Ambitions
Posts: 9836
Joined: August 19th, 2008, 8:58 am
Location:

Re: Monster Land English : from Encryption to Decryption...

Post by pubjoe »

I hope to do this myself one day, but there have been some mixed reports on the ease of conversion. Muddymusic (on here and Jamma+) apparently just did the swap with the existing roms with no issues or modification. [edit] And after searching, I notice you disagreed with that possibility, pointing to a modification ("green wire").

:-?

I have no idea on this, but thank you for the detailed write up, and well done completing what turned out to be a huge job.
User avatar
Shou
Posts: 757
Joined: August 25th, 2009, 4:45 am
Location: Central Tokyo, Japan, Asia, Earth, Solar System, Milky Way
Initials: SHO

Re: Monster Land English : from Encryption to Decryption...

Post by Shou »

I applaud your project but maybe I am reading this wrong, you're not finished???
User avatar
KmanSweden
KmanSweden
Posts: 1242
Joined: October 13th, 2010, 10:37 am
Location: Stockholm, Sweden
eBay: KmanSweden
Initials: PKK
Contact:

Re: Monster Land English : from Encryption to Decryption...

Post by KmanSweden »

I'd love to test this on my PCB.. Too bad your original topic needs a login. :(
Up the Irons!
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

Sorry for the login on the original topic, I'm always automatically logged-in, I couldn't know :P
Just sign-in, be nice with admins and you'll be able to read evertyhing 8-) . By the way, I haven't "spread" the romfiles themselves, I'm still thinking on how to do it. Just one thing you can be sure about, everyone will finally have free and total access to them.

Yes, I have finished making nice usable romfiles, but be patient, I'm currently working on the second half of the story ;)

Just to tease a little, the encryption was not the only problem of that version...
Image
User avatar
KmanSweden
KmanSweden
Posts: 1242
Joined: October 13th, 2010, 10:37 am
Location: Stockholm, Sweden
eBay: KmanSweden
Initials: PKK
Contact:

Re: Monster Land English : from Encryption to Decryption...

Post by KmanSweden »

Cool. Let me know when they're done. :D
Up the Irons!
User avatar
pubjoe
Fosters Political Ambitions
Posts: 9836
Joined: August 19th, 2008, 8:58 am
Location:

Re: Monster Land English : from Encryption to Decryption...

Post by pubjoe »

mpatou wrote:the encryption was not the only problem of that version...
Did you also fix the item autofire issue that you mentioned previously?
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

Yes I did, here the end of the story :



Autofire when throwing magics :


People who have played the VC version (and I mean really played, not just checked if the game works and stored it in a safe) on Mame, on actual Hardware or even on the Wii have noticed something strange when you try to cast a magic spell : it's impossible to throw just one. Here is a short video I captured to illustrate what happens with the VC romset :



*For tech info, I made that video before having completed decryption and making 32kbyte IC90 rom file, that's why you can see ugly wires on the PCB. I also set the dipswitches on TEST mode, so that to have 99 lightings in stock.

That happens only with VC romset. I believed that it could have been a result of the doubling memory method (described before) used to decrypted the game, but even with 32Kbyte IC90 rom, that autofire still occures. In fact, after having spotted the piece of code responsible for that, I understood that it's been added to the original rom before the Wii release, because it ease a glitch that gives 65-68 golds when throwing tornado before getting hidden coins. Some people could be happy with that, but I personally think I affects the gameplay too much.
So, I just removed that small piece of code, and I put back the original bytes, taken from another IC90 rom image (I used the decrypted Japanese one made with the small Ms-DOS program I talked about before).

Well, me happy?...not yet...




Sword problem :


At that point, I really though my job was finished. I said to myself "let's just enjoy the game now"... I started a game with that nice new romset on my beloved PCB. Everything was just perfect until I reached the boss called Gold Collector...
On WBML, you must defeat some bosses to get new swords. Gold Collector gives the fourth sword named "Excalibur". But not Here

Image
Here is the Gold Collector, he's the next boss you meet after the Sphynx.

Image
this is the sword you get after defeating him.

Well instead of Excalibur, here is what I got
Image
A G*$)à="#=*!!:ned Gauntlet ???!!!

The Gauntlet is a pretty nice item, dropped by some regular enemies that doubles damages on them. But here we really need the excalibur to continue the game and have a chance to defeat the final boss. I started a new game, Gauntlet again! and again! and again!...
I checked with an decrypted Japanese romset (got with MSdos program blablabla...), I got exactly the same result. Of course I tried with the uncorrected VC romset, and all the other bootlegs version, no problem. And I finally tried with Mame, ask what? Gauntlet

From here, Mame became my best friend. I managed to sort it out thanks to that wonderful software and its debug console. I want to describe a little the method I used to sort it out.
I made hybrid IC90 rom files, with my decrypted-autofire-corrected-IC90 romfile for the first half, and the second half of the original VC.IC90 with correctly decrypted DATAs, to have a 64KByte rom file with good opcodes on the first half and good DATAs on the second half. Here a schematic to illustrate:

1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
1111111111111111
----------------------
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
64kbyte romfile

I had it work with Mame, and I got the Excalibur when expected. Then I did 2 other hybrid romfiles with the second half cut in 2

1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
-------------------and--------------------
1111111111111111 0000000000000000
1111111111111111 0000000000000000
1111111111111111 0000000000000000
1111111111111111 0000000000000000
0000000000000000 1111111111111111
0000000000000000 1111111111111111
0000000000000000 1111111111111111
0000000000000000 1111111111111111

The left one worked normally, with Gold Collector dropping Excalibur when expected, and not the right one.
So, I made 2 more hybrid ROMs

1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
-------------------and---------------------
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 1111111111111111
1111111111111111 0000000000000000
1111111111111111 0000000000000000
0000000000000000 1111111111111111
0000000000000000 1111111111111111

and so on...until I manage to spot the wrong part. In fact, the guy how made ROMconvZ80 (the MS-Dos software to decrypted Japanese romset I can't stop to talk about..) commit a little mistake when he mapped DATAs and OPcodes on IC90 rom images. And of course, I committed the same mistake. As a results, some BYTEs that were actully coding for DATAs where treated as OPcodes. Thats a coincidence that the game didn't only crashed, and that's probably why nobody noticed it before.

Now I have debugged 32kbytes romfiles. Happy now?...almost :D



Language mistakes :


Some spelling mistakes weren't not corrected, as the English version never came-out on arcade and probably never got corrected.
For example, when the Sphynx asks what did he have for dinner the day before, you have the choice between Chicken Beef and Sarad(?). In Japanese, R and L sound exactly the same, so instead of Sarad, it should have been Salad. So the Sphynx eats Salad when he's dieting...it makes sens now.

Image
8-)

Another example : The Giant Kong boss is written Giant Cong. etc...




Conclusion

The English version is now perfectly working on my untouched original PCB. I also corrected the sword problem on Japanese decrypted roms (and because of that, I ad to disable the memory check on start-up to be able not to be stuck at "ROM ERROR" screen).

As I said before, I spend a huge amount of time working on that project, I would love that a large amount a people could enjoy it, but at the same time I'm afraid some people may take advantages making money on my work. I'm still looking for a solution to distribute those files widely, and get a little compensation for the time I spent on it.
Keep looking here...


Special Thanks to :
Runik, who helped me entering the magic world of coding, and gave me very precious clues when I was stuck.
HPman : who explained me how to deeply use Mame and it's debug console.
A-Team community : they really supported me as I was very slowly progressing on that project.

Without them, no such romset!
Last edited by mpatou on March 31st, 2014, 1:59 pm, edited 4 times in total.
Image
User avatar
geotrig
Potato!
Posts: 7494
Joined: December 5th, 2008, 1:14 pm
Location: ._.
eBay: ._.

Re: Monster Land English : from Encryption to Decryption...

Post by geotrig »

great stuff dude and some very nice skills and patience ,i wish i had those skills :awe: nice read also 8-)
Image

<trk>:I remember catching a big fat one and my friend said "throw it back in, that one already tastes like wood"
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

Thanks a lot :D . I'm not skilled, but I'm curious, patient... and stubborn :mad:
I would like to say that with a very small files modification, that romset works perfectly on most bootleg PCBs.

EDIT : I've added some credits, that result has been possible thanks to people who were with me when I was working on it.
Image
User avatar
cools
Armed Police Buttrider
Posts: 13455
Joined: August 17th, 2008, 4:49 pm
Location: Wales, United Kingdom
eBay: hordarian
Initials: CLS

Re: Monster Land English : from Encryption to Decryption...

Post by cools »

Whatever you do people will try to make money. Better to document it all and have it public than try to control and have one person abuse it.
Image
User avatar
emphatic
Breastfeeds when required
Posts: 5863
Joined: April 7th, 2009, 4:14 pm
Location: Alingsås, Sweden
eBay: jorgen_sjolander
Initials: JOR

Re: Monster Land English : from Encryption to Decryption...

Post by emphatic »

Awesome work. You've earned my respect.
User avatar
mozie
Posts: 51
Joined: August 10th, 2012, 11:27 pm
Location: Ireland
Initials: JON

Re: Monster Land English : from Encryption to Decryption...

Post by mozie »

Great work, love this game and was just playing it today! nice to know an english romset will be available should I ever get a board
User avatar
baddy
Please Continue...
Posts: 387
Joined: January 28th, 2010, 12:40 am
Location: Sweden, Stockholm
eBay: irishfrog89
Initials: CHI

Re: Monster Land English : from Encryption to Decryption...

Post by baddy »

Agreeing with Cools, even if you control the eeproms (burn them and send them out) they will be dumped and shared and yes, conversions will pop up after some time.

Sinon, super boulot! Félicitations ;).
User avatar
muddymusic
Posts: 324
Joined: June 13th, 2010, 8:39 am
Location: Cornwall, UK

Re: Monster Land English : from Encryption to Decryption...

Post by muddymusic »

I've checked my board and when I bought it I asked that it was desuicided which it was, so that's why I was able to simply pop the unencrypted roms on my original board. The green wire on mine is part of that process.
Repro artwork supplier, pm or visit http://www.arcadeartshop.com
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

Thanks again guys. I will probably give those files very soon...but I had a problem this morning...

I was playing my romset, and I was equipped with the second Shield only, in order to save money (and get more points at the game end), inside the Ice Palace. Just before entering the Boss room, there's a Gold Collector (again!) ; I beat him and miracle, he dropped the blue shield (not the last one, but the one's just below). As soon as I grabbed that shield, the game crashed and restarted...

The problem is that it's very rare to have a piece of equipment dropped by an enemy (I mean non-temporary equipment). I have to have that glitch happen again while playing Mame to see what's happening with the debug console. It's probably DATAs I interpreted as OPcodes that I have to spot and to correct.

I'm pretty sure that glithc exists in the Japanese decrypted romset I used to map DATAs and OPcodes. As it's hard to trigger it, nobody propably noticed it.

Besides, I don't know if it's only with that very specific piece of equipment, or shields only, or any piece of equipment dropped by an enemy.

Well, I have some work left to do before releasing that romset. Besides, I'm afraid to encounter some other bugs like that :oops:

Sorry guys, keep you advised shortly!



EDIT : I've checked the ASM files for that romset, and I found a wrong byte, maybe that's it. I will make some tests during the week-end, hoping to trigger the shield drop.
Image
User avatar
ALFARABI
Posts: 11
Joined: March 16th, 2014, 5:26 pm
Location: Paris
Initials: RAF
Contact:

Re: Monster Land English : from Encryption to Decryption...

Post by ALFARABI »

Wow that ´s a shame !

I was just planning to bring you my both pcb 's bootlegs in south of France :(

I hope you gonne make it dude, keep working on it, and dont forget :

SEGA c' est plus fort que toi ah ah :lol:
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

A little update :

I found 3 bytes that were wrong, it's a mistake I made when correcting the Gauntlet drop problem. I will make some tests now.

Concerning the release, I will contact RetroClinic and Dead Battery Society and ask them to spread the romsets.
Image
User avatar
mpatou
Please Continue...
Posts: 67
Joined: November 19th, 2013, 9:37 am
Location: Brest (France)
eBay: mpatard1

Re: Monster Land English : from Encryption to Decryption...

Post by mpatou »

Hello Guys

Sorry for those who are interested in my work on Wonder Boy in Monster Land, I've been pretty busy recently, and the shield issue was tricky to sort out. BUT I did it yesterday 8-)

To sum-up, I used a method with is quite similar to the one I used to spot the Excalibur dropping problem, and I finally discovered that on the mapping file generated by RomconvZ80 has other mistakes, making some OPcodes be treated like DATAs (contrary to the sword issue if you remember). Besides, I discovered another mistake, almost the same, few bytes after those which generated the shield issue. I must be responsible for another equipement dropping issue, but I haven't noticed it yet (and I think I won't :) )

I corrected those bytes in both decrypted Japanese roms and in "my" rom, everything looks good now...until I discover something due to decryption.

Keep you advised as soon as those decrypted romsets are released (I'm about to contact dead battery society and retro clinic).
Image
Post Reply