WIP: CPS 1.5 on CPS2 hardware
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
WIP: CPS 1.5 on CPS2 hardware
First off, i do not want to cause any drama, or have a trail of drama posts following up on this
(If any mods think this post should be locked, so be it.)
I am looking for experts on the following:
- CPS1.5 and CPS2 tile differences/gfx rom re-ordering
- CPS1.5 qsound.. Can't get it to run even with proper i/o mapped on the 68000 side.
So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
After an evening of looking where things stop, start, loop and hang in the mame debugger, i have The Punisher booting on cps2 hardware.
At least, in MAME. On real hardware it probably would hang on the qsound init, since it hangs in MAME as well on some return code.
Still waiting on my multicps2 to arrive soon, this will allow things to be checked on real hw much faster
I am by no means an 'expert' but i managed to get this far by a few NOP and memory range patches.
GFX rom encoding is now a major hurdle, even if i load the roms as they are on CPS1 i can see they are garbled in the GFX space.
Also it's clear there are no sprites. From the videos on youtube i could see this problem also existed in Neocps1's first attempts. But at least he had proper backgrounds.
So, what is done:
- CPS C board check causes game to hang at start, fixed
- RAM error (why?) causes game to hang at start, fixed (maybe sprite related?)
- Game enters test mode, loops around options (inputs), fixed (but not correctly, more a dirty hack.)
- 1p.2p joystick inputs fixed. Still need service/test/coin start 1 2 fixed, but can start and enter game now.
- Qsound i/o is patched to CPS2 but it fails to play any sounds, with decrypted kabukiless rom
- All patches done on the 'dead battery society' romset for usa, there is a ton of checks in the original it seems.
No romset available yet, but again, there is not much to see/hear. Take a look at what i have so far:
(GFX roms are a placeholder set from another game..)
(If any mods think this post should be locked, so be it.)
I am looking for experts on the following:
- CPS1.5 and CPS2 tile differences/gfx rom re-ordering
- CPS1.5 qsound.. Can't get it to run even with proper i/o mapped on the 68000 side.
So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
After an evening of looking where things stop, start, loop and hang in the mame debugger, i have The Punisher booting on cps2 hardware.
At least, in MAME. On real hardware it probably would hang on the qsound init, since it hangs in MAME as well on some return code.
Still waiting on my multicps2 to arrive soon, this will allow things to be checked on real hw much faster
I am by no means an 'expert' but i managed to get this far by a few NOP and memory range patches.
GFX rom encoding is now a major hurdle, even if i load the roms as they are on CPS1 i can see they are garbled in the GFX space.
Also it's clear there are no sprites. From the videos on youtube i could see this problem also existed in Neocps1's first attempts. But at least he had proper backgrounds.
So, what is done:
- CPS C board check causes game to hang at start, fixed
- RAM error (why?) causes game to hang at start, fixed (maybe sprite related?)
- Game enters test mode, loops around options (inputs), fixed (but not correctly, more a dirty hack.)
- 1p.2p joystick inputs fixed. Still need service/test/coin start 1 2 fixed, but can start and enter game now.
- Qsound i/o is patched to CPS2 but it fails to play any sounds, with decrypted kabukiless rom
- All patches done on the 'dead battery society' romset for usa, there is a ton of checks in the original it seems.
No romset available yet, but again, there is not much to see/hear. Take a look at what i have so far:
(GFX roms are a placeholder set from another game..)
-
- Please Continue...
- Posts: 40
- Joined: January 13th, 2014, 9:18 am
- Location: New Zealand
Re: WIP: CPS 1.5 on CPS2 hardware
Good stuff, I'm glad more people are tinkering with this kind of thing.
I'm wondering if maybe it'd be an idea to start with a simpler game (i.e. less protection) to get the basics down?
I'd also be very interested in more details on how you've gotten to where you are. I wouldn't mind trying my hand at a conversion of SF2WW or something like that.
I do believe there are some problems with the CPS1->CPS2 conversion that have been noted by other people trying the same, however I'm not entirely sure of the details.
I'm wondering if maybe it'd be an idea to start with a simpler game (i.e. less protection) to get the basics down?
I'd also be very interested in more details on how you've gotten to where you are. I wouldn't mind trying my hand at a conversion of SF2WW or something like that.
I do believe there are some problems with the CPS1->CPS2 conversion that have been noted by other people trying the same, however I'm not entirely sure of the details.
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Inspired by your effort, (I can see the game you picked for testing is The Punisher) I am trying to tackle the Z80 program and I am currently trying to apply the same ideas I use to decrypt 68000 code in it. I am currently trying to disassemble it in IDA.
Without a (properly) decrypted Z80 program you won't be able to have sound. The current decrypted ROMs use a trick where you double the rom size and keep two copies of the program in it.
Without a (properly) decrypted Z80 program you won't be able to have sound. The current decrypted ROMs use a trick where you double the rom size and keep two copies of the program in it.
Last edited by leonardoliveira on June 20th, 2015, 10:24 pm, edited 1 time in total.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
These were the basic steps i took so far, i am on holiday right now, but documented most of the stuff back at home.fluxcore wrote:Good stuff, I'm glad more people are tinkering with this kind of thing.
I'm wondering if maybe it'd be an idea to start with a simpler game (i.e. less protection) to get the basics down?
I'd also be very interested in more details on how you've gotten to where you are. I wouldn't mind trying my hand at a conversion of SF2WW or something like that.
I do believe there are some problems with the CPS1->CPS2 conversion that have been noted by other people trying the same, however I'm not entirely sure of the details.
I started out with a desuicided romset from Dead Battery Society. This has all the checks patched and is not working with a crypted C board.
The CPS2 uses a B21 on the mainboard, just like a CPS1 does.
- On system reset, the q-sound system is checked from shared ram. (F1E000 - F1FFFF on cps1 and 61xxxx on cps2)
- RAM is checked, i just patched that out to never fail..
- CPS C board register is checked, i patched that out to always work. (B21_DEF setup is used on desuicided romsets)
With just those three done, the game boots up, and gets stuck immediately in test mode. The CPS2 inputs do not match with CPS1 so it thinks the TEST button is pressed.
When in test mode, it also thinks several other inputs are pressed, and mostly 'down' registers first, so you get a test screen with the stick down pressed all the time, and the cursor scrolls down all the options constantly. I pointed the IN0 IN1 and IN2 to other areas in i/o and then the game boots fully into game mode.
Since the Dead Battery romsets have all the security checks removed, it should be of similar 'easyness' for anyone with 68000 knowledge to get WOF or Cadillacs booting to a similar point. Main issue i have is with the gfx and Qsound. I used the decrypted set for the z80 space but it gets stuck in NOPs after a few seconds. The z80 on cps2 is not encrypted.(If you are long time Emulator user/follower, you might recall that cps2 music was working way before the main game battery encryption was figured out by Razoola.)
I have no idea if it's possible to get Streetfighter 2 to run, but if i read correctly, the SF2 games are heavily protected with all sorts of crc and self-checks in the code at random spots. Most likely candidates are SF2:CE and HF since they use the same B21 C-Board chip, but again, maybe some priority issues with sprites like i am seeing now, there's no sprites visible in the attract mode video i posted. Not even buggy sprites
Side note: I just noticed GFXDECODE_START and what it does different for cps1 and cps2. Time to learn more C
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
As i was sort of AFK for the last 7 days, i had thought about this too, and i think we can recycle the tricks i learned when i decrypted the NEC sound cpu program for UC Cops.leonardoliveira wrote:Inspired by your effort, (I can see the game you picked for testing is The Punisher) I am trying to tackle the Z80 program and I am currently trying to apply the same ideas I use to decrypt 68000 code in it. I am currently trying to disassembly it in IDA.
Without a (properly) decrypted Z80 program you won't be able to have sound. The current decrypted ROMs use a trick where you double the rom size and keep two copies of the program in it.
This is not all my work, but the suggestion was passed to me in private for the nec v3x cpu and nasty hacks by me can be seen in this pastie:
http://pastie.org/private/ry09o8dkbzmjepou3xydq
Basically, we just play all the sounds in sound test.
Then use INP to play the game in fast forward mode.. 200% unlimited whatever suits/works on your pc
The decrypted opcodes are stored in the new file, the more the game is played, the better the result is.
As source file, i used the original V3x nec code. (Reset vector needs manual patching.)
(The sample code on pastie re-encrypts it with a table for a different game, but that can be ignored)
The new file is saved when the user resets the game in mame (f2)
I have incorrectly assumed that the z80 program would 'just work' but i forgot, the hardware hack is not present in mame offcourse (M1 line).. that's stupid of me
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
The sound program is small, I think it's about three kilobytes so I think I can just do it by hand...
Or we could use:
http://arcadehacker.blogspot.com.br/201 ... art-3.html
Which is basically the same approach as you suggested.
Or we could use:
http://arcadehacker.blogspot.com.br/201 ... art-3.html
Which is basically the same approach as you suggested.
-
- Please Continue...
- Posts: 25
- Joined: December 13th, 2014, 11:01 am
- Location:
Re: WIP: CPS 1.5 on CPS2 hardware
Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.Asure wrote: So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)
And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Adding to what you say, several things make this complicated:TylerDurden67 wrote:Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.Asure wrote: So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)
And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too
We have no dip switches in the CPS2
Video hardware registers layout is different
Video ROM data encoding is different
We need to deal with the CPS-B multiply protection
Sound hardware differences as it lacks YM2151 and OKI ADPCM
Sound program encryption on CPS-Q games
But hey this sounds like a interesting project.
-
- Please Continue...
- Posts: 25
- Joined: December 13th, 2014, 11:01 am
- Location:
Re: WIP: CPS 1.5 on CPS2 hardware
Main problem is audio for sure
But for sure, it's a really great adventure to make it working
Some people think that if you don't own something it's a fake, we are not in the ps3 scene.
Just for fun, look at this
But for sure, it's a really great adventure to make it working
Some people think that if you don't own something it's a fake, we are not in the ps3 scene.
Just for fun, look at this
-
- Posts: 162
- Joined: March 6th, 2013, 5:38 pm
- Location: France
Re: WIP: CPS 1.5 on CPS2 hardware
It's not a liar or a fake at all, he made a hard work to get the Gfx reordered.leonardoliveira wrote:Adding to what you say, several things make this complicated:TylerDurden67 wrote:Neocps1 work isn't a fake, I know him really well and be sure it real. And not easy.Asure wrote: So, after seeing neocps1 did his work and said it was just a fake, just a joke, i figured i would take a stab at it. Surely, it couldn't be so hard.
It's not just putting somes stuffs here Somes others there, that means that you know both hardwares and how to code on 68000 as well,i helped him a bit too to inject 68000 code to make it working( but he did it without my lines of code)
And oh, just in case , not all games can be converted Due to hardware limit and punisher can't be at 100% too
We have no dip switches in the CPS2
Video hardware registers layout is different
Video ROM data encoding is different
We need to deal with the CPS-B multiply protection
Sound hardware differences as it lacks YM2151 and OKI ADPCM
Sound program encryption on CPS-Q games
But hey this sounds like a interesting project.
First, you should try comparing SF Zero CPS Changer with Zero CPS-2 to get some points to compare. Btw, in Zero CPS Changer, the Gfx are already lineary adressed as CPS-2 games too.
-
- Banned
- Posts: 83
- Joined: May 5th, 2012, 8:55 am
- Location: France
Re: WIP: CPS 1.5 on CPS2 hardware
keep up the good work dudes It is cool to see talented programmers doing it !
Last edited by neocps1 on June 21st, 2015, 10:11 am, edited 1 time in total.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
I might have made a wrong quote on 'fake' or 'joke', but if i understand correcly, Neocps1 wrote on the french forum, 'it was a joke'.
Maybe i don't know what he means, he could mean, the 'trade offer' = it, or 'conversion from cps1' =it. My french is not too good (even if i am now in France, on holliday )
(I have high respect for French people, your language is very civilised, je vous en prie, s'il vous plait, and so on. No other language has this much civilry in it.)
Please, let us keep the drama away from this, and i'll put out my greetings and respect to the great hackers & modders from France who came before.. Neocps1, dlfrsilfer, aje_fr, layer,bonky, tyler, and anyone i forget in this matter!
Maybe i don't know what he means, he could mean, the 'trade offer' = it, or 'conversion from cps1' =it. My french is not too good (even if i am now in France, on holliday )
(I have high respect for French people, your language is very civilised, je vous en prie, s'il vous plait, and so on. No other language has this much civilry in it.)
Please, let us keep the drama away from this, and i'll put out my greetings and respect to the great hackers & modders from France who came before.. Neocps1, dlfrsilfer, aje_fr, layer,bonky, tyler, and anyone i forget in this matter!
-
- Please Continue...
- Posts: 25
- Joined: December 13th, 2014, 11:01 am
- Location:
Re: WIP: CPS 1.5 on CPS2 hardware
He wrote it a joke just for people to let him away from this drama and alone
Good luck in your project BTW, I will continue reading it and contribute if I can
Good luck in your project BTW, I will continue reading it and contribute if I can
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
I've looked around Eduardo's blog, and i may seem stupid, but can't we use kabuki-decode fromleonardoliveira wrote:The sound program is small, I think it's about three kilobytes so I think I can just do it by hand...
Or we could use:
http://arcadehacker.blogspot.com.br/201 ... art-3.html
Which is basically the same approach as you suggested.
http://arcadehacker.blogspot.fr/2014/12 ... art-2.html
Since the Punisher key is known from kabuki.c in mame?
Code: Select all
Known games:
swap_key1 swap_key2 addr_key xor_key
Warriors of Fate 01234567 54163072 5151 51
Cadillacs and Dinosaurs 76543210 24601357 4343 43
Punisher 67452103 75316024 2222 22
Slam Masters 54321076 65432107 3131 19
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
I have punisher sound rom "somewhat" running but I can't test it properly because the way CPS2 send sound codes to the sound hardware is different.
By what I understood from looking at the driver code is that there's 4096 bytes of shared RAM at 0xC000 (Z80 side)/0x00618000 (68k side).
On the CPS1 it's at 0xc000(Z80 side) and 0x00F18000(68k side).
I tried using a CPS2 game to send the commands but it writes stuff on the shared memory in a completely different format.
Could you share the work you already done with the 68000 code with me ? I could test whatever I have here of the sound driver (it's still partially encrypted).
I just need it booting and going to the sound test.
Edit: about using kabuki decode we need to build a working copy of the emulator which makes the mask files.
By what I understood from looking at the driver code is that there's 4096 bytes of shared RAM at 0xC000 (Z80 side)/0x00618000 (68k side).
On the CPS1 it's at 0xc000(Z80 side) and 0x00F18000(68k side).
I tried using a CPS2 game to send the commands but it writes stuff on the shared memory in a completely different format.
Could you share the work you already done with the 68000 code with me ? I could test whatever I have here of the sound driver (it's still partially encrypted).
I just need it booting and going to the sound test.
Edit: about using kabuki decode we need to build a working copy of the emulator which makes the mask files.
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
So, I tried to build the modded MAME that is used to build the mask files for decrypting the KABUKI ROMs and I got this:
Wrong defines. So I added:
At the includes portion of the file. Now I have this:
pfft. I'll just go sleep for now.
Code: Select all
Generating TMS57002 source file...
Compiling src/emu/cpu/tms57002/tms57002.c...
Compiling src/emu/cpu/tms57002/tms57kdec.c...
Compiling src/emu/cpu/tlcs90/tlcs90.c...
Compiling src/emu/cpu/tlcs900/tlcs900.c...
Compiling src/emu/cpu/z80/z80.c...
src/emu/cpu/z80/z80.c:129: error: 'uint16_t' does not name a type
src/emu/cpu/z80/z80.c:134: error: 'uint8_t' does not name a type
src/emu/cpu/z80/z80.c:135: error: 'uint8_t' does not name a type
src/emu/cpu/z80/z80.c: In function 'void dump(INT8, unsigned int)':
src/emu/cpu/z80/z80.c:140: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:140: error: expected ';' before 'byte8'
src/emu/cpu/z80/z80.c:141: error: expected ';' before 'byte16'
src/emu/cpu/z80/z80.c:145: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:147: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:155: error: 'banked_region' was not declared in this scope
src/emu/cpu/z80/z80.c:171: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c:171: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:173: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c:173: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:180: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:180: error: 'byte8' was not declared in this scope
src/emu/cpu/z80/z80.c:182: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:182: error: 'byte16' was not declared in this scope
src/emu/cpu/z80/z80.c:187: error: 'mainrom' was not declared in this scope
src/emu/cpu/z80/z80.c:188: error: 'bankedrom' was not declared in this scope
src/emu/cpu/z80/z80.c: In member function 'void z80_device::out(UINT16, UINT8)':
src/emu/cpu/z80/z80.c:510: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:510: error: expected ')' before 'port'
src/emu/cpu/z80/z80.c: In member function 'virtual void z80_device::device_start
()':
src/emu/cpu/z80/z80.c:3370: error: 'uint8_t' was not declared in this scope
src/emu/cpu/z80/z80.c:3370: error: expected ';' before 'onebyte'
src/emu/cpu/z80/z80.c:3371: error: 'onebyte' was not declared in this scope
make: *** [obj/windows/emu/cpu/z80/z80.o] Error 1
Code: Select all
#include <stdint.h>
Code: Select all
Compiling src/emu/cpu/z80/z80.c...
cc1plus.exe: warnings being treated as errors
src/emu/cpu/z80/z80.c: In function 'void dump(INT8, unsigned int)':
src/emu/cpu/z80/z80.c:148: error: large integer implicitly truncated to unsigned type
src/emu/cpu/z80/z80.c:151: error: large integer implicitly truncated to unsigned type
src/emu/cpu/z80/z80.c:152: error: large integer implicitly truncated to unsigned type
make: *** [obj/windows/emu/cpu/z80/z80.o] Error 1
- Spectre
- By Spectre
- Posts: 1695
- Joined: January 22nd, 2009, 5:42 pm
- Location: Suffolk, UK
- eBay: spectre-uk
- Initials: JIM
Re: WIP: CPS 1.5 on CPS2 hardware
Very cool to see you guys working on this, good luck
Marquees: http://spectre.myartsonline.com/
-
- Banned
- Posts: 83
- Joined: May 5th, 2012, 8:55 am
- Location: France
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Have you tried putting SSFII sound program with that?neocps1 wrote:
I think you just need to change how the 68k writes the codes on the shared RAM. (the offsets of the writes)
The sound code IDs seem to match.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
@Leo: Punisher bootable roms are here:
https://dl.dropboxusercontent.com/u/677 ... onv0.1.zip
This one is modded at 0x674 to cmpi.b #$0, D0
First boot will be OK on Mame, but if you reset, the BNE will fail as D0 then holds something else as '0'
I wasn't sure what is supposed to be at 0x619ffe, so 'dirty patch'.
Inputs are also dirty: p1/p2/p3 start will trigger coinup. Test mode is not accessable.. at least it should produce some sound in game right.
Edit: I also asked Edcross how and what version he compiled with. Win32 with 1.53 source does not build
Also we probably need to set some sort of digital volume otherwise the game will be silent still..
AM_RANGE(0x804030, 0x804031) AM_READ(cps2_qsound_volume_r)
Something like 0xe210 should produce sound at a reasonable volume..
https://dl.dropboxusercontent.com/u/677 ... onv0.1.zip
This one is modded at 0x674 to cmpi.b #$0, D0
First boot will be OK on Mame, but if you reset, the BNE will fail as D0 then holds something else as '0'
I wasn't sure what is supposed to be at 0x619ffe, so 'dirty patch'.
Inputs are also dirty: p1/p2/p3 start will trigger coinup. Test mode is not accessable.. at least it should produce some sound in game right.
Edit: I also asked Edcross how and what version he compiled with. Win32 with 1.53 source does not build
Also we probably need to set some sort of digital volume otherwise the game will be silent still..
AM_RANGE(0x804030, 0x804031) AM_READ(cps2_qsound_volume_r)
Something like 0xe210 should produce sound at a reasonable volume..