20 Oct 2016

1943 - Capcom 1987 (repair log)

First obvious thing to notice is +5V connectors were burnt on the JAMMA edge. Never a good sign. I checked for other burnt traces or components on the board and even blown capacitors but didn't find any. So it was time to power it... Nothing came on screen. One thing I always do in that case is checking if any IC is getting hot. And the sub Z80 (for sound) was. I replaced it but saw no improvement. I then started to check the main Z80 lines and the main RAM lines and while doing so I got some music. I replaced the main RAM and the game booted but with wrong text colors:






I replaced two 273s at positions 5E and 5F and the game played fine. For 30mn...

Then it started to reset every second, indicating the protection chip (i8751) has died. Unfortunately this chip is read-protected and hasn't been dumped. I had a look at the MAME file and discovered the protection was quite simple:

MAME wrote:46 READ8_MEMBER(_1943_state::c1943_protection_r)
47 {
48 // The game crashes (through a jump to 0x8000) if the return value is not what it expects..


With an hex editor I searched for C3 00 80 (JP 0x8000) in the program ROMs and found 3 locations. The game simply compares two registers (one coming from the protection mcu) if equal the game jumps relatively 0x11 addresses forward if not it clears some registers and jump (absolute) to 0x8000 (reset?). I replaced the cp b instruction (data coming from the protection chip being stored in b) by cp a (the data calculated by the main Z80 being stored in a). This correspond in hex by replacing 0xB8 by 0xBF. Now the patched game (only 3 bytes to modify) compares a with a so it's always equal. I burnt the patched code in a 27C256 and played the game to the end just to be sure everything was fine. With this patch the protection chip can be completely removed.
[Note]The same method may be applicable to other Capcom Commando based games.[/Note]

The day after I played the game again and after 15mn clouds in the background turned grey... This time I replaced the 273 at 13B and the game was fixed.
I let the game running for few hours without any new issue. Finally!


No comments:

Post a Comment