13 Sep 2017

Twin Squash - Sega System C2 - Palette + Joystick/button hack

Twin Squash is a game based on the same principles as Breakout where you must brake bricks.
It uses rotary sticks to move the bars.


1) Palette shuffling hack



First this game is one of the two on System C2 which use a palette shuffling (see MAME source code below):


WRITE8_MEMBER(segac2_state::control_w)
{
 data &= 0x0f;
 /* bit 0 controls display enable */
 //segac2_enable_display(space.machine(), ~data & 1);
 m_segac2_enable_display = ~data & 1;
 /* bit 1 resets the protection */
 if (!(data & 2))
  m_prot_write_buf = m_prot_read_buf = 0;
 /* bit 2 controls palette shuffling; only ribbit and twinsqua use this feature */
 m_segac2_alt_palette_mode = ((~data & 4) >> 2);
 recompute_palette_tables();

}
Which means when you use a different protection chip, colours in game are wrong/absent:




Using MAME I dumped the palette RAM (dump file.txt,8c0000,fff) and made a comparison with a good dump (when the correct protection chip is used):


Bad dump:
8C0000:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0010:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0020:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0030:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0040:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0050:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0060:  0000 0000 009B 00CE 00FF 06FF 0FFF 0FFF  ................
8C0070:  0000 0000 0000 0444 0777 0AAA 0000 0DDD  .......D.w......
8C0080:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0090:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0100:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0110:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0120:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0130:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0140:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0150:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0160:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0170:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0180:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0190:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0200:  0000 0000 0B11 0F51 0F93 0FC7 0FFB 00FF  .......Q........
8C0210:  0000 0B11 0F51 0F93 0FC7 0FFB 00FF 7FFF  .....Q..........
8C0220:  0000 5597 2698 76A8 07B9 77B9 08CA 78CA  ..U.&.v...w...x.
8C0230:  09DB 79DB 0AEC 3BEC 0BFD 1CFD 0CFE 5CFE  ..y...;.......\.
8C0240:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0250:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0260:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0270:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0280:  0000 1995 6996 1AA6 6AA7 1BB7 6BB8 1CC8  ....i...j...k...
8C0290:  6CC9 1DD9 6DDA 1EEA 6EEB 1FFB 1FFC 1FFD  l...m...n.......
8C02A0:  0000 7ACC 4ADD 3CDD 0DEE 4DFF 0FFF FFFF  ..z.J.<...M.....
8C02B0:  FFFF FFFF FFFF 0ACC 0050 08F0 047A 00FF  .........P...z..
8C02C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0300:  0000 0B11 0F11 0F83 0FB7 0FF3 0FFB 0FFF  ................
8C0310:  0111 FFFF 047A 009B 00CE 00FF 0C2E 0258  .....z.........X
8C0320:  0000 7ACC 4ADD 3CDD 0DEE 4DFF 0FFF FFFF  ..z.J.<...M.....
8C0330:  FFFF FFFF FFFF 0ACC 0050 08F0 047A 00FF  .........P...z..
8C0340:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0350:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0360:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0370:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0380:  0000 2050 2360 0690 0DDD 0FFF 2780 0AB2  .. P#`......'...
8C0390:  0FF7 FFD0 09B0 08F0 08F0 7FFF 0EEE 0000  ................
8C03A0:  0000 0008 100B 000F 0444 0555 0666 0777  .........D.U.f.w
8C03B0:  0888 0999 0AAA 0CCC 0FFF 0000 0FFF 0000  ................
Good dump:
8C0000:  0000 0000 0B11 0F51 0F93 0FC7 0FFB 00FF  .......Q........
8C0010:  0000 0B11 0F51 0F93 0FC7 0FFB 00FF 7FFF  .....Q..........
8C0020:  0000 5597 2698 76A8 07B9 77B9 08CA 78CA  ..U.&.v...w...x.
8C0030:  09DB 79DB 0AEC 3BEC 0BFD 1CFD 0CFE 5CFE  ..y...;.......\.
8C0040:  0000 1995 6996 1AA6 6AA7 1BB7 6BB8 1CC8  ....i...j...k...
8C0050:  6CC9 1DD9 6DDA 1EEA 6EEB 1FFB 1FFC 1FFD  l...m...n.......
8C0060:  0000 0000 009B 00CE 00FF 06FF 0FFF 0FFF  ................
8C0070:  0000 0000 0000 0444 0777 0AAA 0000 0DDD  .......D.w......
8C0080:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0090:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C00F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0100:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0110:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0120:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0130:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0140:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0150:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0160:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0170:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0180:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0190:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C01F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0200:  0000 0B11 0F11 0F83 0FB7 0FF3 0FFB 0FFF  ................
8C0210:  0111 FFFF 047A 009B 00CE 00FF 0C2E 0258  .....z.........X
8C0220:  0000 7ACC 4ADD 3CDD 0DEE 4DFF 0FFF FFFF  ..z.J.<...M.....
8C0230:  FFFF FFFF FFFF 0ACC 0050 08F0 047A 00FF  .........P...z..
8C0240:  0000 2050 2360 0690 0DDD 0FFF 2780 0AB2  .. P#`......'...
8C0250:  0FF7 FFD0 09B0 08F0 08F0 7FFF 0EEE 0000  ................
8C0260:  0000 0008 100B 000F 0444 0555 0666 0777  .........D.U.f.w
8C0270:  0888 0999 0AAA 0CCC 0FFF 0000 0FFF 0000  ................
8C0280:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0290:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02C0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02D0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02E0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C02F0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0300:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0310:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0320:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0330:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0340:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0350:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0360:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0370:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0380:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C0390:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C03A0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
8C03B0:  0888 0888 0888 0888 0888 0888 0888 0888  ................
And discovered there were incorrect offsets in the bad dump:
8c0000 => 8c0200
8c0040 => 8c0280
8c0200 => 8c0300
8c0240 => 8c0380


So I set a watchpoint when a write was made to 8c0280 (wpset 8c0280,1,w) and found the following subroutine:


000E04: 41FA 00CC                  lea     ($cc,PC), A0; ($ed2)
000E08: 43F9 0002 8000             lea     $28000.l, A1
000E0E: 2458                       movea.l (A0)+, A2
000E10: 3E3C 000F                  move.w  #$f, D7
000E14: 3019                       move.w  (A1)+, D0
000E16: 34C0                       move.w  D0, (A2)+
000E18: 4E71                       nop
000E1A: 4E71                       nop
000E1C: 51CF FFF6                  dbra    D7, $e14
This gave me the information offsets were read from address 0xED2:



000ED2: 008C 0200
000ED6: 008C 0280
000EDA: 008C 0300
000EDE: 008C 0380
Bingo! I simply replaced the incorrect offsets by good offsets:

000ED2: 008C 0000
000ED6: 008C 0040
000EDA: 008C 0200
000EDE: 008C 0240
And colours were back:


2) Joystick hack



Then I made a hack to simply use a standard joystick and also remapped the only button for each player to make the game standard with other System C2 games.


Patched files for sale, contact apocalypse-mods@outlook.co.nz



Some technical information:
- Player 1 rotary value is stored in RAM @ 0xFF0124
- Player 2 rotary value is stored in RAM @ 0xFF0128
- Player 1 button input is readable @ 0x840009 bit 6 which I remapped to the conventional player 1 button A readable @ 0x840001 bit 0.
- Player 2 button input is readable @ 0x840009 bit 7 which I remapped to the conventional player 2 button A readable @ 0x840003 bit 0.



Also available:
- Columns
- Columns II
- Puzzle & Action: Ichidant-R
- Puzzle & Action: Tant-R
- Poto Poto
- Puyo Puyo
- Puyo Puyo 2
- Ribbit!
- Stack Columns
- Thunder Force AC
- Twin Squash (with joystick hack)
- Zunzunkyou No Yabou

No comments:

Post a Comment