MAME WIP news
Dox
20.09.2006:
Preliminary emulation of Killer Instinct bootleg - (slightly) modified SNES version.
[UPDATE] Game is playable.
�
Real pics (title screen and pcb):
�
Charles MacDonald
News (9/19)
I was recently sent a Gaelco “Master Boy” PCB from ClawGrip to examine. It’s entirely implemented in TTL logic and a few PALs which I’ve desoldered, socketed, and dumped. All of the hardware functions have been mapped out except for the video timing and tilemap generation. One surprise was the inclusion of a Phillips SAA1099 stereo programmable sound generator which I haven’t seen before, to go along with MSM5205 ADPCM decoder. I can’t get sound out of the board, but it seems like quite a capable chip compared to other PSGs like the AY8910 or SN76489.
It uses a Hitachi HD647180 MCU, a Z80 clone with a number of features added such as I/O ports, a MMU, DMA, and so on. However none of the special function pins are not brought out to the connector that joins the CPU module to the main board. In effect, it’s just used as a Z80 with internal ROM. Some clever tweaking of the address lines (and assumed use of the MMU) allows the MCU to address 16K of internal ROM and 64K of external space, but the actual game board’s memory map only uses 48K with a 16K gap at the beginning.
Now that it’s known that the ROM data is accessed in banks rather than linearly (something I was sure the MMU would have allowed for) this means some trojaning methods won’t work, and others might. The game has several pointers and offset tables in the ROM which may be useful for accessing the internal ROM data. It all depends on the game doing any validity checks on the table contents before using them.
Thanks to ogoun and Stiletto the Namco C68 MCU has been positively identified as a M37450 and I now have some documentation for it. I modified an existing PC-Engine USB / flash memory card I made to interface with the MCU (hooking up through the EPROM and PAL sockets) which has allowed some experiments to be run, but didn’t result in the internal ROM being dumped. There are plenty of other things to try - one big advantage is that external memory can be mapped into the stack range (due to limited on-chip RAM) which may allow for a stack overflow technique to be used. Currently I am working on some better development hardware for the 68000 side so I can have external control of the dual port RAM the MCU has access to.
With the success of the Choko dump from a while ago, I’m working to get the CPS-2 dumping tools and instructions updated. Changes were made from the last version, mostly bugfixes and speed-ups to decrease the amount of time it takes to dump a full table set. There’s also a minor modification that needs to be done to the PCB, to ensure stability, though now that it’s known which features are absolutely needed, I might redesign it. Admittedly not many people have been interested in getting more of the games dumped, probably because all the popular ones we wasted tons of quarters on are already emulated! :)
