26 Oct 2016

Karate Champ (1P) - Data East 1984 (repair log)

This game has a specific 44 pin connector and flat cables connecting the 2 boards were missing.
First thing to do was to build a converter to JAMMA and pull the missing cables from a known working game:

The game displayed OOOO on screen, colours were bad and there was no sound: 

Comparing the ROMs with the MAME romset I found 3 of them bad (n°23, 24 and 26). 
After replacing them sound came back to life.

Then I found a dead LS74 @ 11A of the top board. This changed the colours:

There wasn't any activity on one of the data lines of the RAM IC52. I found a dead LS157 @ 16B on the bottom board. Sprites were restored:

No activity on address lines A0 to A7 of EPROMs IC89 and 91 (27C64 type). I found a dead LS273 @ 6E on the bottom board. Background reappeared:

Game fixed.

(The label was tied to the top board when I got the game. It says "Karate, no back ground just OOOO, works". I guess sign of life = works in the evil world of arcade operators)

20 Oct 2016

1943 - Capcom 1987 (repair log)

First obvious thing to notice is +5V connectors were burnt on the JAMMA edge. Never a good sign. I checked for other burnt traces or components on the board and even blown capacitors but didn't find any. So it was time to power it... Nothing came on screen. One thing I always do in that case is checking if any IC is getting hot. And the sub Z80 (for sound) was. I replaced it but saw no improvement. I then started to check the main Z80 lines and the main RAM lines and while doing so I got some music. I replaced the main RAM and the game booted but with wrong text colors:

I replaced two 273s at positions 5E and 5F and the game played fine. For 30mn...

Then it started to reset every second, indicating the protection chip (i8751) has died. Unfortunately this chip is read-protected and hasn't been dumped. I had a look at the MAME file and discovered the protection was quite simple:

MAME wrote:46 READ8_MEMBER(_1943_state::c1943_protection_r)
47 {
48 // The game crashes (through a jump to 0x8000) if the return value is not what it expects..

With an hex editor I searched for C3 00 80 (JP 0x8000) in the program ROMs and found 3 locations. The game simply compares two registers (one coming from the protection mcu) if equal the game jumps relatively 0x11 addresses forward if not it clears some registers and jump (absolute) to 0x8000 (reset?). I replaced the cp b instruction (data coming from the protection chip being stored in b) by cp a (the data calculated by the main Z80 being stored in a). This correspond in hex by replacing 0xB8 by 0xBF. Now the patched game (only 3 bytes to modify) compares a with a so it's always equal. I burnt the patched code in a 27C256 and played the game to the end just to be sure everything was fine. With this patch the protection chip can be completely removed.
[Note]The same method may be applicable to other Capcom Commando based games.[/Note]

The day after I played the game again and after 15mn clouds in the background turned grey... This time I replaced the 273 at 13B and the game was fixed.
I let the game running for few hours without any new issue. Finally!