3 May 2017

Sega System C2 conversions (Thunder Force AC)

I've been asked by a member on a French forum if I could help him to make his Thunder Force AC conversion to work. I had never worked on the System C2 before so I was a bit curious to discover it.
The member had used the bootleg ROMs for his conversion and experienced colour issues. I preferred to base my work on the original ROMs.
I ran my conversion in MAME and the game would just start normally but then hung at the beginning of stage 1. In fact on this hardware protection is very weak and I quickly found how to patch the game: I reassembled the IC31 & IC32 ROMs together (interleaved odd & even bytes) and modified a jump conditioned by the result sent by the protection chip. At the end I only had to modify a single byte.







I also had a look at other games and the protection didn't appear to be much more complicated: only few instructions to modify or replace with NOP instructions. When protection check fails behaviour of the game can be:
- hanging
- resetting
- missing graphic elements
- wrong colours


[EDIT]
I thought it could be interesting to explain the method I used.

I first ran the original game in MAME (romset tfrceac) so as my "conversion" forcing MAME to use a different protection chip (in this case I used the one of Zunzunkyou No Yabou, romset zunkyou). I use the MAME debugger (e.g. mame -window -debug tfrceac) allowing me to view code execution, place break points, do step by step execution, etc.
I found that the "conversion" jumped at 0x4798, something the original game doesn't do:
004798: 60FE bra $4798
Using MAME disassembler (e.g. dasm tfrceac.txt,0,100000 in the debugger) I made a search for $4798. There are only 2 occurrences:
- the branch instruction to itself at 0x4798
- an other branch instruction at 0x4140
00413A: 4A38 8984 tst.b $8984.w
00413E: 6704 beq $4144
004140: 6000 0656 bra $4798
Which means a byte is tested and if result is equal game jumps to 0x4144 if not it continues to the next instruction which is a relative jump of +0x656 corresponding to address 0x4798.
I simply modified the conditional jump (beq) by a non conditional one (bra):
00413A: 4A38 8984 tst.b $8984.w
00413E: 6004 bra $4144
004140: 6000 0656 bra $4798
Voila!

P.S. : Files IC31 and IC32 have to be interleaved in order to work on the code. One contains odd bytes (LSB) and the other one even bytes (MSB). Once the modification made the file has to be de-interleaved into 2 files.




[EDIT 2]
It's been reported that the hack contained a bug where you never lose lives.
That was right, there's an other protection @ 0x27C2.
I've patched it too and updated the files.

[EDIT 3]
Patched a freeplay bug.

Also available:
- Columns
- Columns II
- Puzzle & Action: Ichidant-R
- Puzzle & Action: Tant-R
- Poto Poto
- Puyo Puyo
- Puyo Puyo 2
- Ribbit!
- Stack Columns
- Thunder Force AC
- Twin Squash (with joystick hack)
- Zunzunkyou No Yabou

18 comments:

  1. Replies
    1. Thanks. I've patched all the System C2 games and even hacked Twin Squash to be played with a standard joystick.

      Delete
  2. Many thanks apo!

    I burned your patched rom set and the game boots well, but the ship never dies, it plays for ever. have you encountered this as well?

    thanks for the patch!!
    frsj

    ReplyDelete
    Replies
    1. Check your dipswitches. One is invulnerability.

      Delete
    2. Are you sure that it's controlled by DIP switches?

      Doesn't seem to according to this: https://www.arcade-museum.com/manuals-videogames/T/Thunder%20Force%20AC%20pin%20%20DIP.pdf

      Delete
    3. Humm... Maybe not. I don't own the hardware, patch has been tested for real by different persons but none reported this bug.

      Delete
    4. Thanks for your feedback, I had a look and find an other protection @ 0x27C2. This is now corrected and files have been updated.

      Delete
    5. Awesome work Apocalypse, it works perfect now!!!!
      :) :) :)

      Delete
  3. What do you use to de-interleave the files?

    ReplyDelete
    Replies
    1. Home made tool with other useful options (simulate stuck bit, byte swap, word wap, etc.).
      I made it using Visual Studio.

      Delete
  4. Awesome work. So can I get any system C2 board and use your roms to convert it to Thunderforce AC?

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete
  6. The game started normally but it will be fixed with FREE PLAY MODE.
    Also, is the patch of Zunzunkyou No Yabou released?

    ReplyDelete
    Replies
    1. Not sure what you mean, the last version I made has been fully tested and reported as working perfectly by several persons.
      Maybe you should check your dipswitches.
      I did hack Zunzunkyou too and all the other System C2 games but never released them as I don't own the hardware to test my work.

      Delete
  7. hi there your post and article is very helping and nice keep it up
    Sega games free download

    ReplyDelete
  8. Can Bloxeed be used for TFAC? It's on c2 hardware but there's no eprom or socket where 13655 goes. I read on MJMoffit's site that there's no protection for Bloxeed so if I add a socket and the eprom do you think it'll work on this board?
    Thanks

    ReplyDelete
    Replies
    1. Bloxeed, Columns and Columns II are System C hardware not C2 thus they lack the audio µP chip. But that's not a problem to use a System C2 board, audio chip is just unused.
      There are also jumpers to set EPROMs size you might have to move.

      Delete