WIP: CPS 1.5 on CPS2 hardware

[Asure]

First off, i do not want to cause any drama, or have a trail of drama posts following up on this
(If any mods think this post should be locked, so be it.)

I am looking for experts on the following:
- CPS1.5 and CPS2 tile differences/gfx rom re-ordering
- CPS1.5 qsound.. Can't get it to run even with proper i/o mapped on the 68000 side.

So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
After an evening of looking where things stop, start, loop and hang in the mame debugger, i have The Punisher booting on cps2 hardware.
At least, in MAME. On real hardware it probably would hang on the qsound init, since it hangs in MAME as well on some return code.
Still waiting on my multicps2 to arrive soon, this will allow things to be checked on real hw much faster

I am by no means an 'expert' but i managed to get this far by a few NOP and memory range patches.
GFX rom encoding is now a major hurdle, even if i load the roms as they are on CPS1 i can see they are garbled in the GFX space.
Also it's clear there are no sprites. From the videos on youtube i could see this problem also existed in Neocps1's first attempts. But at least he had proper backgrounds.

So, what is done:

- CPS C board check causes game to hang at start, fixed
- RAM error (why?) causes game to hang at start, fixed (maybe sprite related?)
- Game enters test mode, loops around options (inputs), fixed (but not correctly, more a dirty hack.)
- 1p.2p joystick inputs fixed. Still need service/test/coin start 1 2 fixed, but can start and enter game now.
- Qsound i/o is patched to CPS2 but it fails to play any sounds, with decrypted kabukiless rom
- All patches done on the 'dead battery society' romset for usa, there is a ton of checks in the original it seems.

No romset available yet, but again, there is not much to see/hear. Take a look at what i have so far:
(GFX roms are a placeholder set from another game..)

[fluxcore]

Good stuff, I'm glad more people are tinkering with this kind of thing.

I'm wondering if maybe it'd be an idea to start with a simpler game (i.e. less protection) to get the basics down?

I'd also be very interested in more details on how you've gotten to where you are. I wouldn't mind trying my hand at a conversion of SF2WW or something like that.

I do believe there are some problems with the CPS1->CPS2 conversion that have been noted by other people trying the same, however I'm not entirely sure of the details.

[leonardoliveira]

Inspired by your effort, (I can see the game you picked for testing is The Punisher) I am trying to tackle the Z80 program and I am currently trying to apply the same ideas I use to decrypt 68000 code in it. I am currently trying to disassemble it in IDA.

Without a (properly) decrypted Z80 program you won't be able to have sound. The current decrypted ROMs use a trick where you double the rom size and keep two copies of the program in it.

[Asure]

Good stuff, I'm glad more people are tinkering with this kind of thing.
I'm wondering if maybe it'd be an idea to start with a simpler game (i.e. less protection) to get the basics down?
I'd also be very interested in more details on how you've gotten to where you are. I wouldn't mind trying my hand at a conversion of SF2WW or something like that.
I do believe there are some problems with the CPS1->CPS2 conversion that have been noted by other people trying the same, however I'm not entirely sure of the details.

These were the basic steps i took so far, i am on holiday right now, but documented most of the stuff back at home.
I started out with a desuicided romset from Dead Battery Society. This has all the checks patched and is not working with a crypted C board.
The CPS2 uses a B21 on the mainboard, just like a CPS1 does.
- On system reset, the q-sound system is checked from shared ram. (F1E000 - F1FFFF on cps1 and 61xxxx on cps2)
- RAM is checked, i just patched that out to never fail..
- CPS C board register is checked, i patched that out to always work. (B21_DEF setup is used on desuicided romsets)

With just those three done, the game boots up, and gets stuck immediately in test mode. The CPS2 inputs do not match with CPS1 so it thinks the TEST button is pressed.
When in test mode, it also thinks several other inputs are pressed, and mostly 'down' registers first, so you get a test screen with the stick down pressed all the time, and the cursor scrolls down all the options constantly. I pointed the IN0 IN1 and IN2 to other areas in i/o and then the game boots fully into game mode.

Since the Dead Battery romsets have all the security checks removed, it should be of similar 'easyness' for anyone with 68000 knowledge to get WOF or Cadillacs booting to a similar point. Main issue i have is with the gfx and Qsound. I used the decrypted set for the z80 space but it gets stuck in NOPs after a few seconds. The z80 on cps2 is not encrypted.(If you are long time Emulator user/follower, you might recall that cps2 music was working way before the main game battery encryption was figured out by Razoola.)

I have no idea if it's possible to get Streetfighter 2 to run, but if i read correctly, the SF2 games are heavily protected with all sorts of crc and self-checks in the code at random spots. Most likely candidates are SF2:CE and HF since they use the same B21 C-Board chip, but again, maybe some priority issues with sprites like i am seeing now, there's no sprites visible in the attract mode video i posted. Not even buggy sprites

Side note: I just noticed GFXDECODE_START and what it does different for cps1 and cps2. Time to learn more C

[Asure]

Inspired by your effort, (I can see the game you picked for testing is The Punisher) I am trying to tackle the Z80 program and I am currently trying to apply the same ideas I use to decrypt 68000 code in it. I am currently trying to disassembly it in IDA.

Without a (properly) decrypted Z80 program you won't be able to have sound. The current decrypted ROMs use a trick where you double the rom size and keep two copies of the program in it.

As i was sort of AFK for the last 7 days, i had thought about this too, and i think we can recycle the tricks i learned when i decrypted the NEC sound cpu program for UC Cops.
This is not all my work, but the suggestion was passed to me in private for the nec v3x cpu and nasty hacks by me can be seen in this pastie:
http://pastie.org/private/ry09o8dkbzmjepou3xydq

Basically, we just play all the sounds in sound test.
Then use INP to play the game in fast forward mode.. 200% unlimited whatever suits/works on your pc
The decrypted opcodes are stored in the new file, the more the game is played, the better the result is.
As source file, i used the original V3x nec code. (Reset vector needs manual patching.)
(The sample code on pastie re-encrypts it with a table for a different game, but that can be ignored)
The new file is saved when the user resets the game in mame (f2)

I have incorrectly assumed that the z80 program would 'just work' but i forgot, the hardware hack is not present in mame offcourse (M1 line).. that's stupid of me

[leonardoliveira]

The sound program is small, I think it's about three kilobytes so I think I can just do it by hand...

Or we could use:
http://arcadehacker.blogspot.com.br/201 ... art-3.html

Which is basically the same approach as you suggested.

[TylerDurden67]

So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.

Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)

And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too

[leonardoliveira]

So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.

Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)

And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too

Adding to what you say, several things make this complicated:

We have no dip switches in the CPS2
Video hardware registers layout is different
Video ROM data encoding is different
We need to deal with the CPS-B multiply protection
Sound hardware differences as it lacks YM2151 and OKI ADPCM
Sound program encryption on CPS-Q games

But hey this sounds like a interesting project.

[TylerDurden67]

Main problem is audio for sure

But for sure, it's a really great adventure to make it working

Some people think that if you don't own something it's a fake, we are not in the ps3 scene.

Just for fun, look at this

[Layer]

So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.

Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)

And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too

Adding to what you say, several things make this complicated:

We have no dip switches in the CPS2
Video hardware registers layout is different
Video ROM data encoding is different
We need to deal with the CPS-B multiply protection
Sound hardware differences as it lacks YM2151 and OKI ADPCM
Sound program encryption on CPS-Q games

But hey this sounds like a interesting project.

It's not a liar or a fake at all, he made a hard work to get the Gfx reordered.

First, you should try comparing SF Zero CPS Changer with Zero CPS-2 to get some points to compare. Btw, in Zero CPS Changer, the Gfx are already lineary adressed as CPS-2 games too.

[neocps1]

keep up the good work dudes It is cool to see talented programmers doing it !

[Asure]

I might have made a wrong quote on 'fake' or 'joke', but if i understand correcly, Neocps1 wrote on the french forum, 'it was a joke'.
Maybe i don't know what he means, he could mean, the 'trade offer' = it, or 'conversion from cps1' =it. My french is not too good (even if i am now in France, on holliday )
(I have high respect for French people, your language is very civilised, je vous en prie, s'il vous plait, and so on. No other language has this much civilry in it.)

Please, let us keep the drama away from this, and i'll put out my greetings and respect to the great hackers & modders from France who came before.. Neocps1, dlfrsilfer, aje_fr, layer,bonky, tyler, and anyone i forget in this matter!

[TylerDurden67]

He wrote it a joke just for people to let him away from this drama and alone

Good luck in your project BTW, I will continue reading it and contribute if I can

[Asure]

The sound program is small, I think it's about three kilobytes so I think I can just do it by hand...

Or we could use:
http://arcadehacker.blogspot.com.br/201 ... art-3.html

Which is basically the same approach as you suggested.

I've looked around Eduardo's blog, and i may seem stupid, but can't we use kabuki-decode from
http://arcadehacker.blogspot.fr/2014/12 ... art-2.html
Since the Punisher key is known from kabuki.c in mame?

Code: Select all

Known games:
                                         swap_key1 swap_key2 addr_key xor_key
Warriors of Fate                         01234567  54163072    5151     51
Cadillacs and Dinosaurs                  76543210  24601357    4343     43
Punisher                                 67452103  75316024    2222     22
Slam Masters                             54321076  65432107    3131     19

My only excuse for no progress is that i'm on vacation and have some crap 0.5Mbit wireless, no vmware linux around. Plus i'm packing up (sorta) for an 8 hour drive tomorrow

[leonardoliveira]

I have punisher sound rom "somewhat" running but I can't test it properly because the way CPS2 send sound codes to the sound hardware is different.

By what I understood from looking at the driver code is that there's 4096 bytes of shared RAM at 0xC000 (Z80 side)/0x00618000 (68k side).
On the CPS1 it's at 0xc000(Z80 side) and 0x00F18000(68k side).

I tried using a CPS2 game to send the commands but it writes stuff on the shared memory in a completely different format.

Could you share the work you already done with the 68000 code with me ? I could test whatever I have here of the sound driver (it's still partially encrypted).

I just need it booting and going to the sound test.

Edit: about using kabuki decode we need to build a working copy of the emulator which makes the mask files.

[leonardoliveira]

So, I tried to build the modded MAME that is used to build the mask files for decrypting the KABUKI ROMs and I got this:

Code: Select all

Generating TMS57002 source file...
Compiling src/emu/cpu/tms57002/tms57002.c...
Compiling src/emu/cpu/tms57002/tms57kdec.c...
Compiling src/emu/cpu/tlcs90/tlcs90.c...
Compiling src/emu/cpu/tlcs900/tlcs900.c...
Compiling src/emu/cpu/z80/z80.c...
src/emu/cpu/z80/z80.c:129: error: 'uint16_t' does not name a type
src/emu/cpu/z80/z80.c:134: error: 'uint8_t' does not name a type
src/emu/cpu/z80/z80.c:135: error: 'uint8_t' does not name a type
src/emu/cpu/z80/z80.c: In function 'void dump(INT8, unsigned int)':
src/emu/cpu/z80/z80.c:140: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:140: error: expected ';' before 'byte8'
src/emu/cpu/z80/z80.c:141: error: expected ';' before 'byte16'
src/emu/cpu/z80/z80.c:145: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:147: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:155: error: 'banked_region' was not declared in this scope

src/emu/cpu/z80/z80.c:171: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c:171: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:173: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c:173: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:180: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:180: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:182: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:182: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:187: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:188: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c: In member function 'void z80_device::out(UINT16, UINT8)':

src/emu/cpu/z80/z80.c:510: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:510: error: expected ')' before 'port'
src/emu/cpu/z80/z80.c: In member function 'virtual void z80_device::device_start
()':
src/emu/cpu/z80/z80.c:3370: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:3370: error: expected ';' before 'onebyte'
src/emu/cpu/z80/z80.c:3371: error: 'onebyte' was not declared in this scope
make: *** [obj/windows/emu/cpu/z80/z80.o] Error 1

Wrong defines. So I added:

Code: Select all

#include <stdint.h>

At the includes portion of the file. Now I have this:

Code: Select all

Compiling src/emu/cpu/z80/z80.c...
cc1plus.exe: warnings being treated as errors
src/emu/cpu/z80/z80.c: In function 'void dump(INT8, unsigned int)':
src/emu/cpu/z80/z80.c:148: error: large integer implicitly truncated to unsigned type
src/emu/cpu/z80/z80.c:151: error: large integer implicitly truncated to unsigned type
src/emu/cpu/z80/z80.c:152: error: large integer implicitly truncated to unsigned type
make: *** [obj/windows/emu/cpu/z80/z80.o] Error 1

pfft. I'll just go sleep for now.

[Spectre]

Very cool to see you guys working on this, good luck

[neocps1]

[leonardoliveira]

Have you tried putting SSFII sound program with that?

I think you just need to change how the 68k writes the codes on the shared RAM. (the offsets of the writes)

The sound code IDs seem to match.

[Asure]

@Leo: Punisher bootable roms are here:
https://dl.dropboxusercontent.com/u/677 ... onv0.1.zip

This one is modded at 0x674 to cmpi.b #$0, D0
First boot will be OK on Mame, but if you reset, the BNE will fail as D0 then holds something else as '0'
I wasn't sure what is supposed to be at 0x619ffe, so 'dirty patch'.

Inputs are also dirty: p1/p2/p3 start will trigger coinup. Test mode is not accessable.. at least it should produce some sound in game right.

Edit: I also asked Edcross how and what version he compiled with. Win32 with 1.53 source does not build

Also we probably need to set some sort of digital volume otherwise the game will be silent still..
AM_RANGE(0x804030, 0x804031) AM_READ(cps2_qsound_volume_r)
Something like 0xe210 should produce sound at a reasonable volume..