15 Aug 2018

Sega System 24 multi kit

It's a kit I designed for the Sega System 24 in order to play all games form one boardset.

I had to decrypt all floppy based encrypted games before (encrypted 68k CPU in FD1094 module):
- Crack Down
- Dynamic Country Club
- Gain Ground
- Quiz Syukudai wo Wasuremashita
- Rough Racer
- Super Masters Golf

And also patch romboard based games (security chip on romboard):
- Bonanza Bros
- Quiz Ghost Hunter
- Quiz Mekuromeku Story
- Quiz Rouka Ni Tattenasai
- Tokoro San no MahMahjan
- Tokoro San no MahMahjan 2

The kit is composed of 2 boards. A small one on that fits on the motherboard (contains all different "loaders"):

A bigger one that fits on the romboard:

And of course jumper cables to interconnect them:

And finally did test the whole library:

Few notes:
- Hot Rod and Rough Racer require the 834-6510 analog I/O board in order to boot
- The mah-jong games can only be played with the mah-jong panel
- Quiz Rouka ni Tattenasai requires the 837-7968 (or equivalent) 3/4p I/O board in order to boot

To fully use the kit you need:
- any System 24 motherboard with 2 standard 68000 CPU installed
- the floppy controller board (837-6643)
- any System 24 romboard (837-7187-xx)
- the System 24 analog I/O board (834-6510)
- the 3/4p I/O board (837-7968 or equivalent) if you want to play 3/4p player games (required by Quiz Rouka ni Tattenasai to boot) or the mah-jong games (it seems the dedicated panel needs to be connected through this expansion board)
- the mah-jong panel if you want to play the mah-jong games

9 Aug 2018

PGM slot - IGS (repair log)

This slot was given to me in exchange of my service for figuring out how to make Cave conversions on PGM hardware. Many thanks to the donator, my last PGM slot had been stored for too long with its original battery and leakage damage was extensive (way beyond repair) so ended up in the part bin.

The slot was said working if voltage was raised a little. This was indeed what I found too, slot required ~5.15V in order to boot otherwise it was stuck on a garbage screen:

This is absolutely not normal for any original hardware to not work correctly @ 5.00V (bootleg boards can be a different story due to shitty design and botched power supply planes). In the long term raised voltage can damage chips (RAM chips first especially after a lot of operating hours where their specs drop a lot, e.g. 5.5V max voltage can fall to only 5.2V). I've seen many old boards dying in front of me after the owner raised voltage to only 5.2V trying to clear a graphic fault when all of sudden KABOOM! More than often RAM chips die first. Also an increased voltage result in more heat having to be dissipated by all chips.

I started to have a look at the board and noticed a lot of corrosion points but nothing likely to cause a problem. After a while I found 2 traces which seemed severed. One was good but the other one showed a resistance of around 20Ω. This doesn't look much but probably enough to drop the carried signal to a critical point. I patched it with a bit of solder and booted the board again @ 5.00V:

Board fixed!

1 Aug 2018

Irem M72 multi kit - part 3

Small update.
Lightning Swords/Kengo is now supported by the M72 multi now. I've first decrypted it (originally runs on M84 with encrypted V35 CPU) and then converted it to M72 (work RAMs/video RAMs/palette RAMs offsets/mapping, IRQs handling, main CPU ports patching, sound CPU code loading and ports patching, flip/priority bits for tiles, samples playing, scrollx1 & scrollx2 offsets, etc.):


And of course thoroughly tested it to the end several times (different difficulty, 1P solo, 2P solo, both players, etc.):


25 Jul 2018

Capcom 85H001 (sound module) reproduction - part 2

After routing a small PCB for SMD parts I realised my supplier didn't have the targeted Z80 QFP chip I was planning to use... Boring.
So I had a look for an alternative and discovered SMD Z80s come with (too) many different pinouts.
Now I have to update my schematic and reroute a board...

Meantime I've routed a board for through hole parts (at least pinout is consistent). I'm quite happy with the result as the newly designed board is just slightly bigger than the plastic module:

The replacement module tested on Trojan:

The replacement module tested on Ghosts'n Goblins:

That's great to have a solution now for those evil modules!

18 Jul 2018

Street Fighter EX 2 - Arika/Capcom 1998 (repair log)

Game was working, sound effects were there but music was absent (in fact Q-Sound was missing).
I first swapped the CPU board with a known working one and problem followed the romboard.
It didn't take long before I noticed one tiny SMD part had been ripped off the romboard near the Q-Sound chip after a shock. Comparing with an other romboard I learned it was simply a 10k resistor bringing the clock signal to the Q-Sound chip from the nearby crystal.
I installed a new one and Q-sound was fully back.

Game fixed.

11 Jul 2018

Irem M72 multi kit - part 2

I've finally received the PCBs, assembled them and already made a small correction (2 yellow wires for the double size sprites ROMs of X-Multiply):

As you may have seen my projects are always a mix of software hack and hardware design, I repeated the process once again.

There are 10 known games on this hardware:
- Air Duel (Japanese version)
- Battle Chopper/Mr.Heli
- Dragon Breed (Japanese version)
- Gallop (a.k.a. Cosmic Cop)
- Daiku No Gensan (Japanese version of Hammerin' Harry)
- Image Fight
- Legend Of Hero Tonma
- Ninja Spirit/ Saigo No Nindou
- R-Type
- X-Multiply (Japanese version)

Hardware is identical between games except for R-Type which uses a simpler romboard with no samples capability.

Also the top board contains a different PAL chip between games and a protection chip (again, except R-Type which has no protection).
This PAL has 2 functions:
- work RAM offset
- program ROMs mapping
I probed it and discovered it was very simple in the way it works: address lines on one side, multiplexed /CE lines on the other side.
I chose to handcraft an "universal" PAL mapping RAM @ 0xA0000 (7 games out of 10 use that) and 4 consecutive banks of 128kB for program ROMs.
Then I patched the 3 games not using RAM @ 0xA0000: Dragon Breed, R-Type and X-Multiply.
And by arranging program ROMs correctly I could run all the games BUT...

There comes the protection: the MCU (i8751) used for protection does 2 things:
- boot up protection (prevent the game from running by throwing a RAM error on boot up)
- samples playing
I patched all games to boot without any MCU installed. This was a good start but games played without any sample now.
Thing is the sample playing mechanism isn't understood in MAME and instead is simulated.
I spent a good Saturday afternoon trying to fully figuring it out. It's not that often I can find so much time to work on my projects (i.e. 3 or 4 hours consecutively) so I had to succeed.
In fact when the game wants to play a sample it sends a command to the MCU which in turn sends a command to the sound CPU. I thought I could simply fork data to be sent directly to the sound CPU, bypassing the MCU, but on real hardware the needed port isn't accessible by the main CPU. It also thought of writing directly to the sound RAM but I was worried about synchronisation (were samples going to be played fully and at the right pitch without any cuts?) and it was probably a lot of work patching all games. Digging deeper I found the real problem: only the MCU has access to the samples ROMs so it had to be kept anyway.
I ended up handcrafting an universal MCU for samples playing! Yes the same MCU code supporting all the games for the sample part.
Anyway, this means a lot of great things:
- games with a faulty MCU can now be revived
- any game (except R-Type due to the specific romboard) can be converted to any other game (including R-Type)
So now you're asking yourself "Why not making a universal MCU for the protection part too?". Because internal ROM of the MCU is 4kB only. Of course I could use external ROM but:
- then my code would be visible
- I would have to design an additional daughter board for the MCU, external ROM and at least one LS373 in between to latch lower address lines as the 8751/8951 MCUs use the same port for lower address lines (A0~7) and data lines (D0~7).

So now that I have found a solution for each problem it was time for testing:

I was super excited to see games were playing fine: controls, graphics, sound effects, music and samples!

Now you think this is the end of this article? NOT! I was suggested to have a look if R-Type II could be ported from M84 to M72. And:

So not only the multi kit supports all M72 games but also R-Type II from M84 (with samples of course)!
I'm now thinking of adding an other M84 game to the list: Lightning Swords/Kengo. Not a great game to say the least, but it's an other challenge as it uses an encrypted V35 CPU (I have already decrypted it) with embedded IRQ controller when it's external on M72.