Topic: IQ's PGM WIP

[SuperPang]

Cool
if I'm not asking too much, it would be possible to see a video in game?

[Evrain]

Ahh, I understand it a bit more now. I can see where the ASIC comes in.

Pretty amazing how they have so many sprites and animations on screen, running on a Motorola 68000 @ 20 MHz, and the ASIC.

And you should see the DS version: each and every larger enemy is composed of little less than ten different sprites, drawn on top of the "damaged" form of the vehicle; when you damage it enough, the "top" layer is removed and the "damaged" layer is shown. Pretty insane, they really took advantage of the DS, and the audio compartment is even more refined.

Oh, and splendid example of programming from both you and XingXing, IQ There was no doubt about how the game would not stand a chance. I will eagerly await for "complete" simulation, I'm eager to know exactly how Cave took advantage of the 027A, both protection and game-wise.

[iq_132]

Cool
if I'm not asking too much, it would be possible to see a video in game?

http://www.youtube.com/watch?v=9YqtLgfQxSU

Oh, and splendid example of programming from both you and XingXing, IQ There was no doubt about how the game would not stand a chance. I will eagerly await for "complete" simulation, I'm eager to know exactly how Cave took advantage of the 027A, both protection and game-wise.

Honestly, from what i can tell, the asic doesn't do much in the way of providing anything except protection to the game.  On boot, the game expects 3 values supplied from the asic (and is easy to bypass). In game, it reads 2 more values (frequently) that are calculated in the 68k and the asic and compared (it is easy to bypass this as well). Lastly, the 68k will read 2 values from the asic, these values are scrambled around a bit by the 68k and used as addresses to read/write to (I'm fairly certain this is related to the sprite issues in the game).  I have dumps of 3 revisions of the program rom, only the oldest one gets far, as the newer ones seem to actually check the values I'm using for the last bit of the protection (I think).

As for the status of the game, I think it is as far as I can get it. I'm going to pass it back off to XingXing and see if he has any more luck.
Right now, it is fairly playable, but there are random freezes, some sprite issues (positioning mostly), and the coin input is not read, so coins have to be inserted via the test button.

[CaptainCPS]

Hoooooly!!!! Amazing stuff IQ~!  Great progress!! and beautiful video! ^^ Thanks!

SeeYaa!
 

[Evrain]

http://www.youtube.com/watch?v=9YqtLgfQxSU
Honestly, from what i can tell, the asic doesn't do much in the way of providing anything except protection to the game.  On boot, the game expects 3 values supplied from the asic (and is easy to bypass). In game, it reads 2 more values (frequently) that are calculated in the 68k and the asic and compared (it is easy to bypass this as well). Lastly, the 68k will read 2 values from the asic, these values are scrambled around a bit by the 68k and used as addresses to read/write to (I'm fairly certain this is related to the sprite issues in the game).  I have dumps of 3 revisions of the program rom, only the oldest one gets far, as the newer ones seem to actually check the values I'm using for the last bit of the protection (I think).

As for the status of the game, I think it is as far as I can get it. I'm going to pass it back off to XingXing and see if he has any more luck.
Right now, it is fairly playable, but there are random freezes, some sprite issues (positioning mostly), and the coin input is not read, so coins have to be inserted via the test button.

So, if I can assume correctly:
- step 1 is "checking for authorized hardware components"
- step 2 is the usual "kicking the dog" as seen in TV... err Knights of Valor and the onset of PGM emulation, if I can recall correctly?
- step 3 is the infamous decryption of sprite and bullet display/movement routines
Quite interesting, a protection that breaks exactly the game's finest programming point. As for the newer revisions (I thought there were only 2 total released by Cave?) you say they hang up in step 2?
As I said, flawless work

[iq_132]

So, if I can assume correctly:
- step 1 is "checking for authorized hardware components"
- step 2 is the usual "kicking the dog" as seen in TV... err Knights of Valor and the onset of PGM emulation, if I can recall correctly?
- step 3 is the infamous decryption of sprite and bullet display/movement routines
Quite interesting, a protection that breaks exactly the game's finest programming point. As for the newer revisions (I thought there were only 2 total released by Cave?) you say they hang up in step 2?
As I said, flawless work

They hang on step 3. ^^ Basically they all work until in-game. After that, only the oldest revision works.  On that note...

XingXing pointed out that the way to tell revisions apart is through the periods in the version number at the bottom of the boot screen.
The oldest has none, the first revision has 1, and the second has 2. lol

[Evrain]

They hang on step 3. ^^ Basically they all work until in-game. After that, only the oldest revision works.  On that note...

XingXing pointed out that the way to tell revisions apart is through the periods in the version number at the bottom of the boot screen.
The oldest has none, the first revision has 1, and the second has 2. lol

That's some hawk eye XingXing has! I would've never guessed the entire "dots business"

[iq_132]

I got a little bored with looking at ketsui today, so I took a little look at ddpdoj and espgaluda (both of which only have the program roms dumped for them).  I decrypted both of them and hooked them up to the PGM driver in FBA. It pretty quickly became apparent that the protection in all three Cave games is almost identical in function (at least the parts that I've got figured out). ^^ So at this point, I've got the other two games running, but with completely borked graphics (I'm using the ketsui gfx roms lol).

[Evrain]

but with completely borked graphics (I'm using the ketsui gfx roms lol).

Care to share a screen? I haven't seen such a thing since the "let's run Progear without graphics ROMs at all" era - those purple blocks were sexy, if you ask me

[iq_132]

Not much to look at, but here ya go.

[Huggybaby]

I could swear I see one blob shooting at another. Why can't the blobs coexist peacefully? We may never know.

[iq_132]

Cracked the scrambling on kovassg

Code: [Select]

static void pgm_decode_kovassg_program()
{
int i, j;
unsigned short *rom = (unsigned short *)PGM68KROM;
unsigned short *tmp = (unsigned short *)malloc(0x400000);

for (i = 0; i < 0x400000/2; i++)
{
j = (i & ~0xffff) | (BITSWAP16(i, 15, 14, 13, 12,  11, 10, 7, 3,  1, 9, 4, 8,  6, 0, 2, 5) ^ 0x019c);

tmp[i] = BITSWAP16(rom[j], 13, 9, 10, 11, 2, 0, 12 ,5, 4, 1, 14, 8, 15, 6, 3, 7) ^ 0x9d05;
}

memcpy (rom, tmp, 0x400000);

free (tmp);
}


[80GSM]

I'm damn impressed. Was expecting it to take a bit longer.

[iq_132]

I'm damn impressed. Was expecting it to take a bit longer.

Yeah, I'm pretty amazing. lol

[80GSM]

Are there any PCB's you require to speed up the work on Ketsui?