I have no background in electronics or programming. Everything I have learnt over the years has been through self teaching and the help from other kind people willing to lend a hand.

Apr 232017

Its hard for me to believe that i’ve been maintaining this program since 2011.
I’ve added to this as I needed extra functionality and for the last 12 months or so its been untouched but for the last few weeks I’ve been rewriting some parts I wasn’t happy with and changing a few things around.
Its now got to the point where I think its pretty much complete (although i’ve said that before) so though it was about time I did a proper post on some of the things it does and how to use it.
I wont go into everything as I dont think I need to but let me know.

What does it do?
Back when I started this program I wanted a quick, easy and no fuss way of quickly interleaving, deinterleaving and byte swapping files. That’s exactly what it did but that’s all it did.
Take a look

What it does now:

  • Create a new files filled with recurring byte or word values
  • Analyse a file (8 bit or 16 bit) – check for stuck bits, upper and lower halfs matching, etc
  • Bit manipulation – simulate stuck bits in a file & swap bit order of address and/or data bus
  • Byte swap
  • Deinterleave
  • Invert the whole file
  • Reverse the file
  • Split the file in to smaller files
  • Swap the upper and lower half of the file
  • Concatenate up to 4 files at once
  • Interleave in 16 bit or 32 bit format
  • Compare 2 files – checks how many bytes match
  • Display CRC32, SHA1 and MD5 hash values

Creating a new file
Click the ‘Single File’ menu and select ‘Create a new file’
You should see this

You can fill the new file with a byte pattern or a word pattern.
To fill with a specified byte pattern you can enter something like this

This will fill each byte with a value of 0x55
To fill with a word pattern you will enter

This will fill the file with the word value 0x55AA

If the slot is empty you can also load a file by double clicking on the slot.
You can overwrite any loaded file by dragging and dropping a new file onto the slot.

Analysing a file
Analysing a file check for a few things.
First you will need to select from the menu whether the binary file you loaded is from an 8 bit or 16 bit source.
The output from the analysis will be displayed in the Log window.
In this example I have created a new file filled with 0x0

As you can see it has flagged up all the bits (8 bit) as being stuck LOW. This means that throughout the file non of the bits changed from logic state 0.
It also shows that the upper and lower half of the file are filled with 0x0. If the file (or half the file) was filled with 0xFF then this would be flagged instead.
Finally, we have flagged up that the upper half of the file is identical to the lower half of the file.

Viewing the file contents
There is a basic HEX viewer built in to the program. Just double click on any of the loaded slots to view it.

There are 3 different checksums that the program can show you.
The default is CRC32 but by clicking on the “CRC32” box you can cycle between CRC32, SHA-1 and MD5.

Compare files
If any loaded file is the same as another file that is already loaded you will get an instant notification in the Log window that is matches

If however the files are not a match, its sometimes nice to see how much of the file actually does match. For example, if you have a a new revision ROM dump of a game you might want to see how much has actually changed. If its just 1 byte different then it could be bit rot or a region code change.

I think the rest of the functionality is self explanatory so wont go into it.
The program is in the software section now.
Please do let me know if you find this program useful, find any bugs or maybe want to see something added or changed (no guarantees though).

 Posted by at 2:21 pm
Apr 222017

Quick repair this one.
Game booted to a black screen, sometimes garbage on screen and could see/hear the watchdog doing its thing.
This board was running the encrypted version of the game with its custom Z80 CPU.
As the CPU is socketed I just plugged the Fluke straight in and ran the usual tests.
All the ROM’s passed but work the RAM failed

The schematics are the same as for Star Jacker and the RAM could easily be located

Tested the RAM out of circuit and sure enough my tester flagged up address pin A8 as being disconnected so it matched the Fluke’s output too.
I replaced the RAM and fire up the game

The sound and controls both work fine and my work here is done.

 Posted by at 3:26 pm
Apr 072017

I’ve been working with a Popeye PCB recently and I wanted to figure out the hardware so I thought it would be good to document what I found.

The PCB uses some fairly simple obfuscation for the CPU address lines utilising what the schematics refer to as a PLA device. Further investigation revealed that the devices used on the address bus here are actually 74LS367 at locations 6F and 6H. I originally believed the IC at location 6E to be the same but in the decoding routine that MAME uses, the new address value returned after swapping the bits gets XOR’d by 0x3F.

Checking further I found this chip is actually a 74LS368 (inverting line driver). If you notice on the video PCB there is another chip with its markings removed at location 5U.

This is a 74LS04 inverter and is needed because the lower 6 address bits are inverted from the CPU by the 74LS368 at location 6E so we need to return them to their intended state. Inverting them again allows the video and background RAM to be addressed properly.
All these so called PLA’s are actually regular TTL with their markings etched off.

The data lines are also scrambled and can be easily followed from the schematics.
The code in the program EPROM’s is scrambled to accommodate the above methods.

There are 2 additional IC’s also marked as PLA’s attached to the outputs of 3 x 74LS161 counters at location 3E and 4E. These have been identified as a 74LS367 at location 4E and a 74LS368 at location 3E and are part of the DMA circuit.

The hardware doesn’t use any other interrupts, only the NMI.
The NMI vector is the same for all Z80 program and starts at address $66 in ROM.
It is triggered essentially by the /VBLANK signal and during this time all the on screen background and sprites are updated.

The main RAM for Popeye lies at address $8800 – $8FFF and is a TMM2016 located at 7H on the CPU PCB.
The main RAM doesn’t appear to invert the lower 6 bits of the address bus so the actual locations written to in RAM will be different to what the program actually expects however this is not an issue as all the accesses will give the correct data. In the event of fault finding though this could potentially cause confusion.
DMA accesses to this RAM are all correct.
Access to this RAM is controlled via a 74LS139 at location 8F.
The first demultiplexor of this IC is enabled when address bit A15 is HIGH (address $8000). Output Y0 connects to select input B of the second multiplexor and address bit A11 is connected to select input A. Output Y1 (pin 11) is connected to the /CS pin of the RAM.
In order for Y1 to be active A15 and A11 need to be HIGH (address $8800).

There are two pull-up resistors used on this RAM connected to AD10 and AD11. These are present for when DMA accesses are happening as it only uses 9 bits. Without these resistors AD10 and AD11 would be floating during these times.

As we only write nibbles to the RAM section but need to preserve the nibble value we currently are not writing too there is a system in place to deal with that.

/CSBW is generated when we write to anywhere in address $C000 – $CFFF.
This signal clears the DMA access to background RAM and sets the 74LS157 chips to use the address bus instead of DMA.

When a write to the background RAM is initiated the 74LS174 at 8U gets clocked before the write enable for the RAM goes low. This latches the current RAM nibble not being written to, onto the outputs of 8U which lets the RAM get updated without losing data.
The delay for latching the RAM data before writing is achieved by a 74LS20 at 5D on the CPU board. One of these signals is the /WR but goes through a 74LS74 in order to create a delay of 1 clock cycle. This gives enough time to latches the RAM data before the write enable is active on the RAM itself.

There is a security ALU that sits at address $E000 – $E001 in the memory map. It can be both read from and written to. MAME has functional behaviour for this emulated in the driver.
The various modes of the ALU are selected by an IC labelled as ‘Selected Decoder’. This is actually a 74LS139.

I wanted to implement this chip into one of the 28 pin CPLD modules I have. Being an amateur in HDL programming I wasn’t too sure whether the design could be implemented into an unclocked CPLD design so I asked my friend Charles MacDonald for some advice on Verilog.
He kindly sent me a draft code based on the MAME implementation. I have adapted this to reflect the real hardware and it is now implemented and seems to be working. The programming file can be found in the download section if anyone ever feels the need to use it. I would still like to get hold of an original chip to study as although the code for this works with the titles that use it, all the behaviours of the chip are not fully documented that I know of.

Without this chip present Popeye will reset when starting a game. There may be other issues as well but I cannot pinpoint them.
There is an unprotected version of Popeye available in MAME which does away with the requirement for this security chip so there isn’t much need to use a reproduction of this chip.

 Posted by at 8:01 pm
Apr 062017

I’ve been sat on these for a while but only just got around to adding them.
First are two PAL’s found on the RAM daughter board from a Data IO 29A PCB. They were unlocked so at present they are in native PAL16L8 format.

The second is unusual. It came from a Hung Hsi bootleg of Street Fighter II CE.
It goes where the BPRG1 PAL normally goes and is very similar to the original.
If you use the regular BPRG1 then the game reportedly resets and is not playable.

Thanks to Evan Korzon for supplying the chip and also for testing.

 Posted by at 4:49 pm

GameKing multicart

 Projects  Comments Off on GameKing multicart
Mar 122017

I seemed to be one of the first to get the ball rolling with Gameking dumping.

I had to make my own part for the cartridge connector. This allowed me to make the breakout PCB.

This worked well enough for my dumping needs but I also wanted to test the dumps on a real Gamking. This led me to the first cartridge test. It has a bunch on things on that weren’t really needed but I was just playing about with ideas at this point.

It sort of worked but would do with some refinement.

This one worked much better but after dumping some 4in1 cartridges we found they didn’t always work properly using the homebrew cartridge. This led to the analyser PCB.

I never did get hold of any 4in1 carts myself so thats as far as that project actually got, although I don’t think its required anymore.

The final product is this cartridge. I believe one of these was used to aid in dumping the internal ROM.

It works fine for single games and a few 4in1 titles.

 Posted by at 1:03 pm