| Asure |
|
MAME Fan
|
|
|
|
|
|
Reged: 11/29/04
|
|
Posts: 40
|
|
Loc: Nederland
|
|
|
|
Send PM
|
|
|
Interresting Taito F3 bug in MAME
#364801 - 03/31/17 09:33 PM
|
|
|
So, i have the single pcb versions of Taito Cup Finals and Super Cup finals. I remember these had 27C010. Noticed the Mame dump has 27C020 dumps for both cart and single PCB version. I dumped both the games, and all the roms match if i cut them in half. I put the roms back on the pcb's and play a test match of Cup Finals which complains about EEPROM but plays fine... after i reset it.. By the time i turn on the Super Cup pcb, this also complains and i realised i had swapped and put the roms in the wrong PCB.
Not a big deal. Until Super Cup gets stuck in a reset loop and will not enter the game. I can 'push test sw' and watch it count down, but the game will keep resetting afterwards.
I use the Mame debugger to figure out where the 'press test sw' message comes from, and patch out the code. Works in MAME with EEPROM data from Cup Finals. No more errors. Great!
I put the modified rom set onto the single PCB, but this now shows a nice ROM ERROR and will not boot further. I spent some time figuring out the problem, and patched that also. (The game wants 0000 into 0x408108 after checking the roms. It skips the region byte..)
Funny thing #1: MAME calculates this CRC as CF36 and the game does not throw a ROM ERROR. Nor does it seem to read the value at this location at any time after the check(?)
So, MAME always generates a wrong checksum (CF36) but never throws a ROM ERROR? Wierd. A similar routine works fine in Cup Finals and several other games i checked. Not all games have ROM test btw (trstar, pbobble2 and tcobra2 for example do not seem to care at all..)
Funny thing #2: Skipping the Rom error by stuffing 0000 into 0x408108 does indeed skip it on real hardware, but the reset loop is still present. (Both a proper F3 motherboard and single pcb will not boot the game..)
Bug: Mame F3 driver does not handle ROM ERROR for scfinals/scfinalso.
Observation: ROM dump for scfinalso is overdumped? Maybe the 'orange' single board uses 27C020, but not the 'white' single board i have here.
For giggles, i put the Super Cup Finals chips into a F3 cartridge and used a real F3 motherboard as another test, and this also ends up in a reset loop. It will complain and tell you to 'press test sw', seemingly write to nvram, but end up in a reset loop afterwards.
Question: Anybody have a real Super Cup Finals cartridge, which actually works on a F3 mother? Is the PCB different from standard? Does it use a different PAL perhaps? Maybe a suggestion to recover my SCfinals pcb? 
Edited by Asure (03/31/17 09:51 PM)
|
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Asure]
#364804 - 03/31/17 10:08 PM
|
|
|
Many rom checks in games only check if a rom is there, they don't check for a CRC match. Many games also had releases with multiple rom sizes but same data. You can try putting the original data back on your roms and go into test mode, choose load defaults option and then have it save to the eeprom. That should fix it in theory.
|
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Asure]
#364806 - 03/31/17 10:24 PM
|
|
|
> So, i have the single pcb versions of Taito Cup Finals and Super Cup finals. I
> remember these had 27C010. Noticed the Mame dump has 27C020 dumps for both cart and
> single PCB version. I dumped both the games, and all the roms match if i cut them in
> half. I put the roms back on the pcb's and play a test match of Cup Finals which
> complains about EEPROM but plays fine... after i reset it.. By the time i turn on the
> Super Cup pcb, this also complains and i realised i had swapped and put the roms in
> the wrong PCB.
>
> Not a big deal. Until Super Cup gets stuck in a reset loop and will not enter the
> game. I can 'push test sw' and watch it count down, but the game will keep resetting
> afterwards.
>
> I use the Mame debugger to figure out where the 'press test sw' message comes from,
> and patch out the code. Works in MAME with EEPROM data from Cup Finals. No more
> errors. Great!
>
> I put the modified rom set onto the single PCB, but this now shows a nice ROM ERROR
> and will not boot further. I spent some time figuring out the problem, and patched
> that also. (The game wants 0000 into 0x408108 after checking the roms. It skips the
> region byte..)
>
> Funny thing #1: MAME calculates this CRC as CF36 and the game does not throw a ROM
> ERROR. Nor does it seem to read the value at this location at any time after the
> check(?)
> So, MAME always generates a wrong checksum (CF36) but never throws a ROM ERROR?
> Wierd. A similar routine works fine in Cup Finals and several other games i checked.
> Not all games have ROM test btw (trstar, pbobble2 and tcobra2 for example do not seem
> to care at all..)
>
> Funny thing #2: Skipping the Rom error by stuffing 0000 into 0x408108 does indeed
> skip it on real hardware, but the reset loop is still present. (Both a proper F3
> motherboard and single pcb will not boot the game..)
>
> Bug: Mame F3 driver does not handle ROM ERROR for scfinals/scfinalso.
>
> Observation: ROM dump for scfinalso is overdumped? Maybe the 'orange' single board
> uses 27C020, but not the 'white' single board i have here.
>
> For giggles, i put the Super Cup Finals chips into a F3 cartridge and used a real F3
> motherboard as another test, and this also ends up in a reset loop. It will complain
> and tell you to 'press test sw', seemingly write to nvram, but end up in a reset loop
> afterwards.
>
> Question: Anybody have a real Super Cup Finals cartridge, which actually works on a
> F3 mother? Is the PCB different from standard? Does it use a different PAL perhaps?
> Maybe a suggestion to recover my SCfinals pcb?
I believe Super Cup Finals is a special case which also checks for a magic value in the EEPROM in order to boot, some kind of rom-swap protection they didn't use on anything else.
|
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Haze]
#364809 - 03/31/17 10:33 PM
|
|
|
Huh. I guess you could run it in mame and then program the nvram file into the eeprom with a programmer. If that doesn't work you'd have to get a dump from another PCB owner. I guess.
|
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Smitdogg]
#364810 - 03/31/17 10:35 PM
|
|
|
> Huh. I guess you could run it in mame and then program the nvram file into the eeprom
> with a programmer. If that doesn't work you'd have to get a dump from another PCB
> owner. I guess.
there's a default nvram file in the romset with the magic byte set, although you MIGHT have to byteswap that file to program it into hardware, MAME output byteswapped files for many years so a lot of the default nv files in the romsets are byteswapped.
but yes, for this game you need that magic byte in eeprom, it's security, the code clearly wants it there.
|
|
|
| Asure |
|
MAME Fan
|
|
|
|
|
|
Reged: 11/29/04
|
|
Posts: 40
|
|
Loc: Nederland
|
|
|
|
Send PM
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Smitdogg]
#364811 - 03/31/17 10:50 PM
|
|
|
Ok, my bad. I have been playing around in an older version of mame. I have moved to 184B now.
Behaviour in 184b is now identical to the real thing if i swap out the eep files with another game. Will try to deduce the magic byte & patch the rom to sort this out
Edit:
Code at 0x5AEC checks this byte and if it is zero triggers the reboot.
Edited by Asure (04/01/17 12:57 AM)
|
|
|
| Asure |
|
MAME Fan
|
|
|
|
|
|
Reged: 11/29/04
|
|
Posts: 40
|
|
Loc: Nederland
|
|
|
|
Send PM
|
|
|
Re: Interresting Taito F3 bug in MAME
[Re: Haze]
#364830 - 04/01/17 02:28 PM
|
|
|
> there's a default nvram file in the romset with the magic byte set, although you
> MIGHT have to byteswap that file to program it into hardware, MAME output byteswapped
> files for many years so a lot of the default nv files in the romsets are byteswapped.
>
>
> but yes, for this game you need that magic byte in eeprom, it's security, the code
> clearly wants it there.
This is present in scfinalso, which according to the comment is a cartridge dump on 27C020 program roms. However, if there was ever another cartridge inserted on that mobo/cart combo, the game would cease to work, just like my pcb did. The new game would demand the user to init NVRAM, overwriting the magic byte.
Are we sure this is a dump from a cart/mobo combo?
As it appears overdumped, and for the above reasons.
Perhaps there is a code/button trick to init that byte?
I've seen a lot of F3 carts/mobo's during my time, but never a Super Cup Finals cartridge. This makes me wonder.
|
|
|
Index 
Threaded 
Interresting Taito F3 bug in MAME
Reply
[Re: 