WIP: CPS 1.5 on CPS2 hardware
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Need to put effort on finding these special versions, really. Better than have people hoard those on dark storage rooms...
Btw I really enjoy your stuff Jed.
Btw I really enjoy your stuff Jed.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
Took a stab at getting punisher to boot up.
Bypassed most memtests by jumping to 7D2 at reset, but the game still gives me a purple screen.
The only differences i could come up with are the memtests, compared to say, DDTOD which tests a lot less.
What is the proper layout for the cps2 multigame '02' file? right now i have 03 + 04 + 05 + 06 and then repeating this pattern.
Bypassed most memtests by jumping to 7D2 at reset, but the game still gives me a purple screen.
The only differences i could come up with are the memtests, compared to say, DDTOD which tests a lot less.
What is the proper layout for the cps2 multigame '02' file? right now i have 03 + 04 + 05 + 06 and then repeating this pattern.
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
03+04+05+06 and fill the rest with 0xFFFF. Do not mirror stuff.Asure wrote:What is the proper layout for the cps2 multigame '02' file? right now i have 03 + 04 + 05 + 06 and then repeating this pattern.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
Mirror would not cause the game to hang/not boot up right?
Debugging and following up on Punisher, compared the code to punisherbz (cps1 version with no qsound. -> sound is patched..)
The original game seems to have a sound-subroutine at $4DB4. (look at 0x0b16 for the jsr).
The bootleg has this patched into $1C11E8 and just sticks data into $800180 (cps1 sound latch).
I'm just running some scenarios here, as the original Punisher game would not boot (on 1.5 hardware) when the qsound cpu was dead (suicided). So i assume black screen/purple screen on CPS2 when something goes wrong there as well. Also leo gets to run Ghouls on real hw, so cps1 style or 'bypass' style might work..
Debugging and following up on Punisher, compared the code to punisherbz (cps1 version with no qsound. -> sound is patched..)
The original game seems to have a sound-subroutine at $4DB4. (look at 0x0b16 for the jsr).
The bootleg has this patched into $1C11E8 and just sticks data into $800180 (cps1 sound latch).
I'm just running some scenarios here, as the original Punisher game would not boot (on 1.5 hardware) when the qsound cpu was dead (suicided). So i assume black screen/purple screen on CPS2 when something goes wrong there as well. Also leo gets to run Ghouls on real hw, so cps1 style or 'bypass' style might work..
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
The problem is, with the sound roms I sent you, the Q-SOUND hardware is actually working properly and no checks need patching.
I'd guess the game is writing to a memory region which in CPS2 has no DTACK and that is stalling the game.
I'd guess the game is writing to a memory region which in CPS2 has no DTACK and that is stalling the game.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
I'll leave the z80 out of the equation for now then.leonardoliveira wrote:The problem is, with the sound roms I sent you, the Q-SOUND hardware is actually working properly and no checks need patching.
Do you ever write into 0x700000 with GnG (which runs)?leonardoliveira wrote:I'd guess the game is writing to a memory region which in CPS2 has no DTACK and that is stalling the game.
(I need to look at my current solution, but the writes must always go to 708000 and the latch at 8040e0 controls where the written data ends up.)
AM_RANGE(0x700000, 0x701fff) AM_WRITE(cps2_objram1_w) AM_SHARE("objram1") /* Object RAM, no game seems to use it directly */
AM_RANGE(0x708000, 0x709fff) AM_MIRROR(0x006000) AM_READWRITE(cps2_objram2_r, cps2_objram2_w) AM_SHARE("objram2") /* Object RAM */
AM_RANGE(0x900000, 0x92ffff) AM_RAM_WRITE(cps1_gfxram_w) AM_SHARE("gfxram") /* Video RAM */
AM_RANGE(0xff0000, 0xffffff) AM_RAM
On CPS1 there is also some ram at the f1xxxx region used for qsound which i already patched mostly, but i just noticed some writes to f1c006 from a subroutine 0x6f36 that i missed.Obviously these end up nowhere right now in my current hacked-up rom. (it's a mess..)
AM_RANGE(0xf1e000, 0xf1ffff) AM_READWRITE(qsound_sharedram2_r, qsound_sharedram2_w) /* Q RAM */
AM_RANGE(0xff0000, 0xffffff) AM_RAM AM_SHARE("mainram")
That might be the problem there (this sub 6f36 is called at boot/reset but not ingame, i missed it before..)
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Hm... Maybe the Z80 is stalled. Because that routine is supposed to reset the Z80. Writing to the QSOUND RAM with the Z80 stopped will stall the CPU as the DTACK will be generated after a handshake with the Z80 (for having it release the bus for the 68000 access) happen.
Likely that's why the 68000 is stalling. No DTACK when the game writes to QSOUND RAM.
Edit: Looking at other games, they write 0x00f0 to 0x804040, wait a couple of cycles doing other stuff then write 0x00f8 to 0x804040.
I am doing that on Ghouls'n Ghosts hence why it doesn't stall.
Likely that's why the 68000 is stalling. No DTACK when the game writes to QSOUND RAM.
Edit: Looking at other games, they write 0x00f0 to 0x804040, wait a couple of cycles doing other stuff then write 0x00f8 to 0x804040.
I am doing that on Ghouls'n Ghosts hence why it doesn't stall.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
Yay!
Great success with some new init code. Game now boots on real hw.
But, crashes after attract mode, and some gfx in the bg are wrong for some reason. Maybe i should not skip the memtest, ram could be in unknown state.
(Seems some kind of debugger is also present in the game as it spits out errors.)
https://www.dropbox.com/s/2iojndickqu55 ... 3.jpg?dl=0
Great success with some new init code. Game now boots on real hw.
But, crashes after attract mode, and some gfx in the bg are wrong for some reason. Maybe i should not skip the memtest, ram could be in unknown state.
(Seems some kind of debugger is also present in the game as it spits out errors.)
https://www.dropbox.com/s/2iojndickqu55 ... 3.jpg?dl=0
Code: Select all
1800a0:
move.w #$0, $8040a0.l
move.w #$7080, $fffff0.l
move.w #$807d, $fffff2.l
move.w #$2355, $fffff4.l
move.w #$0, $fffff6.l
move.w #$40, $fffff8.l
move.w #$10, $fffffa.l
move.w #$f00, $804040.l
nop
nop
move.w #$400, D0
dbra d0, $1800e8
move.w #$f08, $804040.l
nop
nop
move.w #$400, D0
dbra d0, $1800fc
move.w #$f08, $804040.l
nop
nop
nop
move.b #$0, $619ffb.l
cmpi.b #$77, $619fff.l
bne $1800F4
jmp $7d2.l
nop
nop
nop
nop
-
- Please Continue...
- Posts: 22
- Joined: June 25th, 2015, 9:37 pm
- Location: WV
- Initials: JLH
Re: WIP: CPS 1.5 on CPS2 hardware
I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.
Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.
Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.
Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
I decrypted SFA3 980616 sample version and delivered the results a couple of days ago. I am taking one of my scrap CPS2 B boards to check where the "MIF" chip is outputting a chip enable for the dipswitch memory address. If it is, it should not be hard to add a real hardware debug switch to a board with a CPS2multi installed in.jedpossum wrote:I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.
Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.
Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
I remember seeing photos of a board with debug switches and they were part of the B-Board. Which actually makes sense, since the CPU is on the B-Board, not on A-Board like on earlier systems.
Having dips on B-Board would allow them to have only one A-Board design but have means to use dedicated hardware where situations require (development, debugging and playtesting)...
-
- Please Continue...
- Posts: 22
- Joined: June 25th, 2015, 9:37 pm
- Location: WV
- Initials: JLH
Re: WIP: CPS 1.5 on CPS2 hardware
I wouldn't be surprised if there is other A board types for development that are closer to the black boards with 4mb SIMM since some of these tools have a save feature and not a memory dump like neo geo games.leonardoliveira wrote:I decrypted SFA3 980616 sample version and delivered the results a couple of days ago. I am taking one of my scrap CPS2 B boards to check where the "MIF" chip is outputting a chip enable for the dipswitch memory address. If it is, it should not be hard to add a real hardware debug switch to a board with a CPS2multi installed in.jedpossum wrote:I decided to work on the debug switches some more there is a byte that it reads that which is just a copy of the last switch, and is placed at FF8085.
Since, Vampire Savior and Alpha 2 pretty much use the same base engine as Alpha 3. I decided to see if any switches remained in the other games and versions. Alpha 2 and later versions of A3 only switch was the auto block dip switch.
Vsav, Vsav2, and Vhunter2 has nothing left of it other than constantly rewriting ff8085 as zero.
I remember seeing photos of a board with debug switches and they were part of the B-Board. Which actually makes sense, since the CPU is on the B-Board, not on A-Board like on earlier systems.
Having dips on B-Board would allow them to have only one A-Board design but have means to use dedicated hardware where situations require (development, debugging and playtesting)...
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
Lots of hacking on punisher, i could not get it to boot consistently. I also screwed up by not properly documenting my hex edits (oops) so i had a bunch of jmp and nops i forgot about. Sorted that out a bit, and now by killing the RAM checks in the FF0000-FFFFFF range (0x7e8) now gives me an (upside down) screen with an address error which reads
303c001B, but no clue yet what that means
Edit: Pressing some buttons also gives me memory on screen
303c001B, but no clue yet what that means
Edit: Pressing some buttons also gives me memory on screen
-
- Please Continue...
- Posts: 22
- Joined: June 25th, 2015, 9:37 pm
- Location: WV
- Initials: JLH
Re: WIP: CPS 1.5 on CPS2 hardware
You gotta find what reads the dipswitches and what reads them. At one point Capcom's code reads the switches performs a neg command on them and then moves it to some where around A5(0xFF8000).Asure wrote:Lots of hacking on punisher, i could not get it to boot consistently. I also screwed up by not properly documenting my hex edits (oops) so i had a bunch of jmp and nops i forgot about. Sorted that out a bit, and now by killing the RAM checks in the FF0000-FFFFFF range (0x7e8) now gives me an (upside down) screen with an address error which reads
303c001B, but no clue yet what that means
Edit: Pressing some buttons also gives me memory on screen
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
I'm skipping a lot of stuff atm but now it boots always, with some mem tests still enabled, and credits inserted to the player start screen. I think EEPROM needs some fixing. Also Z80/sound not working, but again i jmp straight into the 'all done, lets run the game' spot at 07d4 after setting some base values. Flying blind here, no debugger on the real hw is a bit annoying hehe..
Sorted out the address error. (d1 was not set properly, fixed this.)
The problem is somewhere between 0586 and 07d2.
Right now i do this
Boot -> jump to 1800A0
At 1800a0 a routine sets up some values, and toggles 804040, waits in loop to get 77 from the sound cpu.
Then it jumps to 7d2. at 7e8 there's a NOP to stop the game touching FF0000 -> FF3FFF (if it does, at this point the game will hang..)
Some writes happen in the ff8000 range, seems fine to do so, and the game does its thing. (ending up at player select w/ wierd credits cound ..)
If i correct my jmp back to 'normal' say $0586 after doing my things, the game will never boot up completely.
If i patch it back to 7d2 it works again. All on real hw.
In MAME, jmp back to $0586 and qsound works, no crashes.. all seems ok.
Because of my skipping, the dips/eeprom is in a bad state, and there are credits, screen is flipped, etc.
Also, qsound is not working properly in this state, some commands are missed. It's either silenced or not initialized properly still.
So, i need to figure out where the crap happens to stop the cpu.. But now i can guestimate a bit where it happens.
Vid+ Pics are coming. Figured out the debug controls as well.
Upside down debug..
Accidental 0-credit bootup, with no flipped screen bonus!
Second real-world (after the French) bootup of Punisher showing its attract mode on CPS-2 hardware!
No sprites yet: Because of sloppy work and no version control, there is no proper sprite code in these two vids. Yet.
Sorted out the address error. (d1 was not set properly, fixed this.)
The problem is somewhere between 0586 and 07d2.
Right now i do this
Boot -> jump to 1800A0
At 1800a0 a routine sets up some values, and toggles 804040, waits in loop to get 77 from the sound cpu.
Then it jumps to 7d2. at 7e8 there's a NOP to stop the game touching FF0000 -> FF3FFF (if it does, at this point the game will hang..)
Some writes happen in the ff8000 range, seems fine to do so, and the game does its thing. (ending up at player select w/ wierd credits cound ..)
If i correct my jmp back to 'normal' say $0586 after doing my things, the game will never boot up completely.
If i patch it back to 7d2 it works again. All on real hw.
In MAME, jmp back to $0586 and qsound works, no crashes.. all seems ok.
Because of my skipping, the dips/eeprom is in a bad state, and there are credits, screen is flipped, etc.
Also, qsound is not working properly in this state, some commands are missed. It's either silenced or not initialized properly still.
So, i need to figure out where the crap happens to stop the cpu.. But now i can guestimate a bit where it happens.
Vid+ Pics are coming. Figured out the debug controls as well.
Upside down debug..
Accidental 0-credit bootup, with no flipped screen bonus!
Second real-world (after the French) bootup of Punisher showing its attract mode on CPS-2 hardware!
No sprites yet: Because of sloppy work and no version control, there is no proper sprite code in these two vids. Yet.
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
In hardware, all the button inputs are wired like this:jedpossum wrote:You gotta find what reads the dipswitches and what reads them. At one point Capcom's code reads the switches performs a neg command on them and then moves it to some where around A5(0xFF8000).
(shamelessly stolen from a MCU development blog)
Basically, the inputs need to be inverted because the buttons circuitry are wired so they assume the value "1" when the switch is open (notice how the high value resistor puts +5v potential on the line when the switch is open) and when the switch is pushed, you get a "0" as the line will be shorted with GND.
That's the reason why you negate what is read from the input ports. You want a pushed button to read as "1" for the game engine. It could be coded to work with inverted values but we know humans don't work like that.
-
- Please Continue...
- Posts: 22
- Joined: June 25th, 2015, 9:37 pm
- Location: WV
- Initials: JLH
Re: WIP: CPS 1.5 on CPS2 hardware
I'm actually surprised some of the editors don't freak out on with out the extra inputs though.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
Debug related (cps-1) for Carrier airwing.
- Turn on TEST dip when in play. *
- Some debug data in the upper left corner will appear
- Dips now have alternate options to what is described in manual.
SWC-1 Unused -> Turbo mode, game runs unthrottled at max speed..
SWC-2 Unused -> Invincible (properly. You can still collide with enemies, but no health deduction..)
SWC-3 Free Play -> Show Hitboxes
SWB-4 Strength Easy/Normal - Stop scrolling (forever, no restart possible. For photo moments i'd say.)
*Found this by accident from a post on n-g.com forums from use 'Benthrottle' (brazil)
- Turn on TEST dip when in play. *
- Some debug data in the upper left corner will appear
- Dips now have alternate options to what is described in manual.
SWC-1 Unused -> Turbo mode, game runs unthrottled at max speed..
SWC-2 Unused -> Invincible (properly. You can still collide with enemies, but no health deduction..)
SWC-3 Free Play -> Show Hitboxes
SWB-4 Strength Easy/Normal - Stop scrolling (forever, no restart possible. For photo moments i'd say.)
*Found this by accident from a post on n-g.com forums from use 'Benthrottle' (brazil)
-
- Please Continue...
- Posts: 14
- Joined: June 16th, 2013, 8:21 pm
- Location:
Re: WIP: CPS 1.5 on CPS2 hardware
Just to curious if there is any progress on this, here or on another forum?
tnx
tnx
- leonardoliveira
- Please Continue...
- Posts: 692
- Joined: August 30th, 2012, 5:53 am
- Location: Brazil
- Initials: leo
Re: WIP: CPS 1.5 on CPS2 hardware
Not that I know, sadly.
This is a hobby so we're all taken by other stuffs atm. But sure enough we will be looking back into this.
My hack of GnG has palette problems, so does the Punisher hack.
This is a hobby so we're all taken by other stuffs atm. But sure enough we will be looking back into this.
My hack of GnG has palette problems, so does the Punisher hack.
-
- Posts: 573
- Joined: April 17th, 2013, 5:16 pm
- Location: Netherlands
- eBay: asure_nl
Re: WIP: CPS 1.5 on CPS2 hardware
I just thought about this whilst i was on the crapper yesterday.
Perhaps it would be good to release what there is so far (more of 'recap') the thread to the relative things that need to be done.
Main problem, i have too little time to get anything done, life is keeping me busy.
This also means that most of the stuff i did was done in a hacky, non-documented way
I cannot comment on Leo's work, he did the hard work on the sound code, sprites etc.
I just theorized stuff (reverse sprite order etc.) but he made it work
From what there is now, it seems in-game checks could be causing problems with the game mechanics. Some enemies are dying randomly, end bosses spawn with no energy and you do not fight them at all. I remember reading about the protection checks in french forums, dlfrsilver wrote about these before. I had assumed that the 'dead battery society' version had these checks patched, but it seems they are not 'NOP' out but modified to suit the dead battery roms.
Perhaps it would be good to release what there is so far (more of 'recap') the thread to the relative things that need to be done.
Main problem, i have too little time to get anything done, life is keeping me busy.
This also means that most of the stuff i did was done in a hacky, non-documented way
I cannot comment on Leo's work, he did the hard work on the sound code, sprites etc.
I just theorized stuff (reverse sprite order etc.) but he made it work
From what there is now, it seems in-game checks could be causing problems with the game mechanics. Some enemies are dying randomly, end bosses spawn with no energy and you do not fight them at all. I remember reading about the protection checks in french forums, dlfrsilver wrote about these before. I had assumed that the 'dead battery society' version had these checks patched, but it seems they are not 'NOP' out but modified to suit the dead battery roms.