Forums

I've gone through my collection, which unfortunately isn't complete but should highlight this weird issue. It seems games should initialize the PSG with a sequence of :-
8000A000C000E49FBFDFFF

It's sets the frequencies all to 0, the noise to a default, and the volumes to silence. However some roms do this

80009000C000E49FBFDFFF

Which doesn't set tone1 frequency to 0, instead sets the volume of tone0 to full volume, twice, and then sets it back to silence within the space of a few PSG samples. This results in weird popping sounds.

Here is a list of the roms which do this latter "bad" thing.

12-05-1996 - After Burner (UE) [!].sms at 00070b79
24-09-1995 - Basket Ball Nightmare (E) [!].sms at 0000c949
09-05-1997 - Blade Eagle 3D (UE) [!].sms at 00039870
25-11-2003 - Bock's Birthday 2003 by Maxim (PD).sms at 00008878
07-04-1997 - Bomber Raid (UE) [!].sms at 0001c9e5
16-04-1997 - Captain Silver (E) [!].sms at 00008a08
22-08-2000 - Captain Silver (U) [!].sms at 00008a08
20-06-1998 - Chouon Senshi Borgman (J) [!].sms at 00009fb6
15-06-1997 - Cloud Master (UE) [!].sms at 00008a13
14-04-1997 - Cyborg Hunter (UE) [!].sms at 00009fb6
07-05-1997 - Dead Angle (UE) [!].sms at 0003c825
12-11-1998 - Double Hawk (E) [!].sms at 0003ca13
07-04-1997 - Dynamite Dux (E) [!].sms at 0003d59a
07-01-1998 - Hoshi wo Sagasite... (J) [!].sms at 00014ae0
23-09-1999 - Kenseiden (J) [!].sms at 000090f8
31-07-1996 - Kenseiden (UE) [!].sms at 000092f8
22-12-1998 - Megumi Rescue (J) [!].sms at 0001cd6e
20-09-1998 - Nekyuu Kousien (J) [!].sms at 000389e4
07-05-1997 - Poseidon Wars 3D (UE) [!].sms at 0003c852
15-06-1997 - Psycho Fox (UE) [!].sms at 00028949
22-03-2003 - Rambo III (UE) [!].sms at 00034940
01-08-1996 - Rampage (UE) [!].sms at 00008c78
07-05-1997 - Sapo Xule vs. os Invasores do Brejo (B).sms at 00028949
17-11-1999 - Shanghai (UE) [!].sms at 00014990
10-11-1995 - Summer Games (E) [!].sms at 0001c839
25-12-1996 - Super Basketball (Demo) [!].sms at 0000895e
20-09-1998 - Super Racing (J) [!].sms at 00008bd4
07-01-1998 - Tensai Bakabon (J) [!].sms at 0001ca03
10-09-2000 - Thunder Blade (J) [!].sms at 0000893c
01-08-1996 - Thunder Blade (UE) [!].sms at 00008b42
16-10-1999 - Treinamento Do Mymo (B).sms at 00028949
07-04-1997 - Vigilante (UE) [!].sms at 00024a3e
30-10-2002 - Wanted (UE) [!].sms at 0001c85f
04-06-2001 - Where in the World is Carmen Sandiego (U) [!].sms at 000071be
01-09-2003 - Ys (J).sms at 00008878
07-04-1997 - Ys - The Vanished Omens (UE) [!].sms at 00008878

And here is a list which does it the way it should

22-03-2003 - Aerial Assault (UE) [!].sms at 0001c82e
22-09-1998 - Alex Kidd in Shinobi World (UE) [!].sms at 0000872e
13-11-1992 - Altered Beast (UE) [!].sms at 00030ac3
01-08-1999 - American Pro Football (E) [!].sms at 00008818
24-10-2001 - Assault City - Light Phaser Version (E) [!].sms at 0001c865
07-12-2001 - Assault City - Pad Version (E) [!].sms at 0001c865
21-06-1998 - Battle Out Run (E) [!].sms at 0003c8aa
22-03-1997 - California Games (UE) [!].sms at 0001507a
23-09-1998 - Danan the Jungle Fighter (E) [!].sms at 0000a2c8
12-11-1992 - Double Dragon (UE) [!].sms at 0002cc22
15-06-1997 - E-SWAT - City Under Siege (UE) [!].sms at 0001c5ac
12-11-1998 - Forgotten Worlds (E) [!].sms at 0001c7a6
28-09-1998 - Gain Ground (UE) [!].sms at 0001c57d
01-01-2002 - Galaxy Force (E) [!].sms at 000088f6
19-03-1997 - Galaxy Force (U) [!].sms at 000088f6
04-07-1999 - Game Box Esportes Radicais (B) [!].sms at 0000a24c
24-06-1998 - Golden Axe (UE) [!].sms at 000088e8
25-06-1996 - Golden Axe (UE) [b1].sms at 000088e8
25-07-1999 - Golf Mania (E) [!].sms at 0001c8d6
22-03-2003 - Golf Mania (Prototype) [!].sms at 0001c8d6
25-12-1996 - Kujaku Ou (J) [!].sms at 00008bd7
28-10-1998 - Kujaku Ou (J) [b1].sms at 00008bd7
04-06-2001 - OutRun 3D (E) [!].sms at 00006f7b
15-06-1997 - Scramble Spirits (UE) [!].sms at 0000c9bf
10-09-2003 - Scramble Spirits (UE) [b1].sms at 0000c9bf
25-12-1996 - Shinobi (J) [!].sms at 00018add
12-11-1992 - Shinobi (UE) [!].sms at 00018cdd
11-11-1998 - Shinobi (UE) [b1].sms at 00018add
11-05-2006 - Shinobi (UE) [b3].sms at 00018add
19-10-2003 - Slap Shot (E) [!].sms at 0001c4f1
01-06-1997 - Slap Shot (U) (V1.0) [!].sms at 0001c4f1
23-08-2006 - Slap Shot (U) (V1.1) [!].sms at 0001c4f1
09-04-1997 - Spellcaster (UE) [!].sms at 00008bd7
28-09-1998 - Tennis Ace (E) [!].sms at 00018131
25-12-1996 - Walter Payton Football (U) [!].sms at 000087f9
25-12-1996 - World Games (E) [!].sms at 0000d7f8
30-10-2002 - World Games (Prototype) [!].sms at 0000d7f8

I'd guess it's a bad code sample or some common codebase for all the music engines. Comparing them further may yield evidence either way.

The official Sega docs don't suggest setting the frequencies to 0 on startup, just the volumes:

Sega official docs (English) wrote

LD HL,CLRTB ; clear table
LD C,PSG_PRT ; psg port is $7F
LD B,4 ; load four bytes
OTIR ; write them
(etc.)

CLRTB defb $9F,$BF,$DF,$FF

This code turns the four sound channels off.

I don't think we have any Japanese docs.

I also believe it was originally just a typo and got carried from game to game.
Those dumps are correct, so the 'bad dumps' subject is misleading. Perhaps you could resubject like "List of buggy PSG initialization games".

It is interesting because somehow it tells us that those games are linked. Note how that they are all Japanese games published by Sega. The guys at GDRI might want to use that information.

Bock wrote

they are all Japanese games published by Sega

Is Where in the World is Carmen Sandiego a Japanese game? I'd assumed all those crappy USA releases were developed there. It seems to have compressed text so any credits may not be in clear view. Isn't Psycho Fox considered to be a non Sega game?

Maxim wrote

Bock wrote

they are all Japanese games published by Sega

Is Where in the World is Carmen Sandiego a Japanese game? I'd assumed all those crappy USA releases were developed there. It seems to have compressed text so any credits may not be in clear view. Isn't Psycho Fox considered to be a non Sega game?

I missed Carmen Sandiego from that list, hmm, I don't know. I would say it was developed at Sega of USA.

It's difficult to tell for Psycho Fox. Although it had an AIMO logo at some point, most games were reprogrammed for the account of other developers, so perhaps AIMO/VicTokai did some work and Sega assisted them, shared code, even perhaps programmed the whole thing. Also note that this kind of initialization code is one likely to be first ripped by someone reverse engineering the system.

Bock wrote

I missed Carmen Sandiego from that list, hmm, I don't know. I would say it was developed at Sega of USA.

Carmen Sandiego was developed by Venture Technologies. I interviewed the programmers Bob Halliday and Chase Sebor (of course, we didn't really talk much about SMS Carmen Sandiego - I should probably ask some follow-up questions - if you can think of any, let me know).

Bock wrote

It's difficult to tell for Psycho Fox. Although it had an AIMO logo at some point, most games were reprogrammed for the account of other developers, so perhaps AIMO/VicTokai did some work and Sega assisted them, shared code, even perhaps programmed the whole thing. Also note that this kind of initialization code is one likely to be first ripped by someone reverse engineering the system.

Psycho Fox was developed by VIC Tokai/Seibu Lease. Shouichi Yoshikawa recognized some of the staffers.

But music engines are very commonly outsourced and/or bought in. Perhaps this was a Sega standard music engine that was bugfixed at some point; although the inclusion of Ys makes me doubt that, just because its music is of such an outstanding quality one would expect it to have a different engine.

(
Btw some of your date seems completely off, eg:
25-12-1996 - Super Basketball (Demo) [!].sms at 0000895e
I dumped this one in 2004, my file date says 12/10/2004.
Some other dates are off.
)

Maxim wrote

But music engines are very commonly outsourced and/or bought in. Perhaps this was a Sega standard music engine that was bugfixed at some point; although the inclusion of Ys makes me doubt that, just because its music is of such an outstanding quality one would expect it to have a different engine.

Would it be possible to put together a list of sound engines ala this one for the MD/Gen?

It would require examining the music engine code and/or data, and looking for architectural similarities and data structure similarities. As far as I know, nobody's done much work in this are for the SMS. I was under the impression the MD list was helped by things like embedded file format markers (eg. "SMPS") which are less likely to appear on the SMS.

On the less morbidly pessimistic side, SMS games usually have their music engines and data embedded in a single 16KB page, rather than the possibly random filling/binpacking in a MD game. Carmen Sandiego seems to be an exception to that rule, its music engine seems to start at $6800.

Here's a prototype signature:

- At the start of the music engine, there are 3 jumps
- The first seems to be "update engine"
- The second seems to be "stop music"
- The third is "silence sound", is fallen-through-into by the second, and consists of

push hl
push bc
ld hl,data
ld c,$7f
outi
outi
outi
outi
outi
outi
outi
outi
outi
outi
outi
pop bc
pop hl
ret
data:
.db $80,$00,$90,$00,$C0,$00,$E4,$9F,$BF DF FF

which is the code outputting the magic (broken) byte sequence referred to in the first post.

Would it be worthwhile verifying that these pops and weird noises occur on real master systems to put this to rest then? ie Non modified, real cartridges. I don't remember static inbetween Rampage levels on the SMS, but it has been a while!

It almost seems a weird coincidence that these bugs occur in games dumped nearly at the same time, or by the same person.

Double Dragon was a game which was much earlier than a lot of the ones with the broken code, so why where they updated but not others? An interesting thing to ponder if the code is correct.

I have personnally redumped the whole SMS library and can assure you that the available dumps are correct. Also take note that most SMS games were originally dumped (at least released publicly) between 1996 and 2000.

Quote

Double Dragon was a game which was much earlier than a lot of the ones with the broken code, so why where they updated but not others? An interesting thing to ponder if the code is correct.

Dumping date is not the game development data. See smsallj.txt for some dates.

The best way to detect pops on a real system is probably to make a "Prosound" modification, to avoid the output filtering. The Game Gear's headphone socket output seems to be remarkably unfiltered too.

Bock wrote

Dumping date is not the game development data. See smsallj.txt for some dates.

Also noting that the release date is not the game development date. Some might have been rushed to market in a few months, some might have been in development for more than a year.

Bock wrote

I have personnally redumped the whole SMS library and can assure you that the available dumps are correct. Also take note that most SMS games were originally dumped (at least released publicly) between 1996 and 2000.

Sorry, I don't want to offend you at all. Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess.

Bock wrote

Dumping date is not the game development data. See smsallj.txt for some dates.

Yeah, those dates are simply the modification dates of the roms I have. What I meant about double dragon is that the game was most likely developed in 1987, yet a game like Double Hawk developed 2-3 years later has the bug. Why was the bug fixed in at least 1987, then not passed on to other companies in 1989/1990? Seems weird.

PoorAussie wrote

Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess.

I'd estimate the probability is somewhere around 10^-100. The same flaw affecting only a certain sequence of data - that's data, not code where the bug would be more catastrophic, and causing only a pop, not even corruption - in multiple dumpers built independently by multiple people, years apart, thousands of miles apart? The same flaw affecting the checksum in the ROM to make it verify as correct?

PoorAussie wrote

Sorry, I don't want to offend you at all. Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess.

There's a checksum in SMS ROM header.

Quote

Yeah, those dates are simply the modification dates of the roms I have. What I meant about double dragon is that the game was most likely developed in 1987, yet a game like Double Hawk developed 2-3 years later has the bug. Why was the bug fixed in at least 1987, then not passed on to other companies in 1989/1990? Seems weird.

Game development is a mess. Information is poorly transmitted, people are busy, change company, sources code are copied, error are propagated, etc. Just like the internet. It's risky to try extrapolating too much information from this bit of code (but it's an interesting hint).

Yeah, I realize it is very unlikely just had to ask. I think I'm going to hotfix this code in my emulator, it's a simple fix for a simple problem that shouldn't exist... whether it's accurate or not. :)

The next step is why I don't remember it on the real machine, need an upgrade to my memory I think.

Examining Captain Silver code, we find that there is no jump table at the start of the music engine - code just calls directly into the routine to mute audio. The routine itself does more work because it is supporting FM.

Kenseiden is next (I'm only looking at SMS Power releases because my roms are on another machine). Again there is no jump table, just direct calls. The code is identical to Captain Silver, again muting the YM2413 after muting the PSG.

One side note: a wait is inserted between YM2413 accesses, totalling roughly 60 cycles (17μs), so presumably the YM2413 must be accessed more slowly than the PSG.

After Burner has the same 3-function music engine structure again, but again also without the jump table, and with FM support.

update_music is at 0x70000 and is 0x909 bytes long.
stop_music is at 0x70909 and is 0x39 bytes long, falling through into:
mute_sound is at 0x70943 and is 0x46 bytes long
Some more code lives at 0x70987.
Data seems to start at 0x70b42, starting with a table of numbers in the range $3ff..$11 which seem to be PSG values for regular notes. This might be a useful signature, or it might be a table of numbers they gave to multiple developers. It doesn't match the table in the official GG docs.

.dw $0000
.dw $03FF $03C7 $0390 $035D $032D $02FF $02D4 $02AB $0285 $0261 $023F $021E $0200 $01E3 $01C8 $01AF
.dw $0196 $0180 $016A $0156 $0143 $0130 $011F $010F $0100 $00F2 $00E4 $00D7 $00CB $00C0 $00B5 $00AB
.dw $00A1 $0098 $0090 $0088 $0080 $0079 $0072 $006C $0066 $0060 $005B $0055 $0051 $004C $0048 $0044
.dw $0040 $003C $0039 $0036 $0033 $0030 $002D $002B $0028 $0026 $0024 $0022 $0020 $001E $001C $001B
.dw $0019 $0018 $0016 $0015 $0014 $0013 $0012 $0011

After that is another table that looks like the corresponding FM values:

.dw $0000
.dw $1157 $116B $1181 $1198 $11B0 $11CA $11E5 $1301 $1310 $1320 $1331 $1343 $1357 $136B $1381 $1398
.dw $13B0 $13CA $13E5 $1501 $1510 $1520 $1531 $1543 $1557 $156B $1581 $1598 $15B0 $15CA $15E5 $1701
.dw $1710 $1720 $1731 $1743 $1757 $176B $1781 $1798 $17B0 $17CA $17E5 $1901 $1910 $1920 $1931 $1943
.dw $1957 $196B $1981 $1998 $19B0 $19CA $19E5 $1B01 $1B10 $1B20 $1B31 $1B43 $1B57 $1B6B $1B81 $1B98
.dw $1BB0 $1BCA $1BE5 $1D01 $1D10 $1D20 $1D31 $1D43

They are presumably a mixture of F-num/block for the YM2413 - I'm not particularly familiar with that any more.

After that is of course yet more data (10KB of it) which isn't immediately obvious.

The PSG table appears identically in:

Action Fighter
Aerial Assault
After Burner
Alien Syndrome
Assault City
Captain Silver
Forgotten Worlds
Kenseiden
Carmen Sandiego

which is over 50% of the roms I have on this machine, so it very much looks like a lump of data provided to developers. Others can finish searching the complete ROM library.

Bear in mind byte ordering when searching; the hex string is

FF03C70390035D032D03FF02D402AB02850261023F021E020002E301C
801AF01960180016A015601430130011F010F010001F200E400D700CB00C000
B500AB00A1009800900088008000790072006C00660060005B00550051004C0
04800440040003C0039003600330030002D002B00280026002400220020001E0
01C001B0019001800160015001400130012001100

(line-broken to avoid destroying the forums)

Yeah, it's tuned down. When I use the magic 437.2 Hz or what it was, I get very similar numbers =) (I like how the A1 is at the max value of 3FF and not at 400 or higher, because then it would be out of range.)

Martin wrote

Yeah, it's tuned down. When I use the magic 437.2 Hz or what it was, I get very similar numbers =) (I like how the A1 is at the max value of 3FF and not at 400 or higher, because then it would be out of range.)

They seem to have used floor rounding resulting in the table frequently being 1 off a more in-tune value.

I did a search for that table signature... it was found in nearly every SMS game. In my bunch of roms which has a few clones/overdumps/sg1000 games, it is about 600 matches to the signature, out of 1000 possible.

I really need to get my collection in some form of order.

http://www.smspower.org/maxim/smschecker/

I really need to update the datafiles. And rewrite it...

Does the table show up in third party releases? (Any SMS game with a high nibble of 2 at location 0x7ffe.) It suggests it, and the PSG silencing table, were standard data - the latter being less commonly implemented using the "standard" routine. That supports the theory that it's just something from the SDK that had a typo.

Thanks for the link to your program maxim, very helpful.

Here is the list, out of 441 "good" commercial roms your program lists I have 244 or so matches.

001 - Action Fighter (JP).sms at 00007548
002 - Action Fighter.sms at 00007548
003 - Aerial Assault.sms at 0001ca0d
004 - After Burner.sms at 00070b44
005 - Alex Kidd - High Tech World.sms at 00008617
006 - Alex Kidd - The Lost Stars.sms at 0000cbb2
007 - Alex Kidd in Miracle World [v0] (US).sms at 00009e1e
008 - Alex Kidd in Miracle World [v1].sms at 00009e1e
009 - Alex Kidd in Shinobi World.sms at 0000875c
010 - Alex Kidd no Miracle World (JP).sms at 00009e1e
011 - Alien 3.sms at 0003edbb
012 - Alien Syndrome (JP).sms at 0001cc11
013 - Alien Syndrome.sms at 0001cc11
014 - Altered Beast.sms at 00030ab1
015 - American Baseball.sms at 00038adb
016 - American Pro Football.sms at 000089f7
017 - Anmitsu Hime (JP).sms at 00008617
018 - Arcade Smash Hits.sms at 00003b3d
019 - Ashura (JP).sms at 00005ed3
020 - Assault City [Light Phaser].sms at 0001ca44
021 - Assault City.sms at 0001ca44
022 - Asterix and the Great Rescue.sms at 0005965c
023 - Astro Flash (JP).sms at 00003478
024 - Astro Warrior & Pit Pot.sms at 00003a28
025 - Astro Warrior & Pit Pot.sms at 0001c5c1
026 - Astro Warrior.sms at 00003960
027 - Aztec Adventure.sms at 000149a5
028 - Back to the Future Part III.sms at 0003ddab
029 - Bank Panic.sms at 000077d9
030 - Basketball Nightmare.sms at 0000cb37
031 - Battle Out Run.sms at 0003ca89
032 - Battlemaniacs (BR).sms at 0000d868
033 - Black Belt.sms at 00006993
034 - Blade Eagle 3-D.sms at 00039a52
035 - BMX Trial - Alex Kidd (JP).sms at 0000a967
036 - Bomber Raid.sms at 0001cbd3
037 - California Games.sms at 00015268
038 - Captain Silver (US).sms at 00008bea
039 - Captain Silver.sms at 00008bea
040 - Chapolim x Dracula - Um Duelo Assustador (BR).sms at 00004994
041 - Cheese Cat-astrophe.sms at 00003f30
042 - Choplifter [Proto] (JP).sms at 0000ed4b
043 - Choplifter.sms at 0000ed54
044 - Chouon Senshi Borgman (JP).sms at 0000a1a4
045 - Chuck Rock II - Son of Chuck (BR).sms at 00001279
046 - Chuck Rock II - Son of Chuck.sms at 00001279
047 - Chuck Rock.sms at 0007ead2
048 - Cloud Master.sms at 00008bf5
049 - Comical Machine Gun Joe (JP).sms at 00003c6c
050 - Cool Spot.sms at 000081dd
051 - Cyborg Hunter.sms at 0000a1a4
052 - Daffy Duck in Hollywood.sms at 00070242
053 - Danan - The Jungle Fighter.sms at 0000a2ee
054 - Dead Angle.sms at 0003ca07
055 - Double Dragon.sms at 0002cc04
056 - Double Hawk.sms at 0003cbf5
057 - Double Target - Cynthia no Nemuri (JP).sms at 000149f4
058 - Dragon - The Bruce Lee Story.sms at 0003ec3c
059 - Dragon Crystal.sms at 0001c3ff
060 - Dynamite Dux.sms at 0003d779
061 - E-SWAT [A].sms at 0001c797
062 - E-SWAT [B].sms at 0001c797
063 - Enduro Racer (JP).sms at 000033bf
064 - Enduro Racer.sms at 00003141
065 - F-16 Fighter.sms at 000053a9
066 - F-16 Fighting Falcon (JP).sms at 00005578
067 - F-16 Fighting Falcon (US).sms at 000053a9
068 - Fantasy Zone - The Maze.sms at 0001cb28
069 - Fantasy Zone II (JP).sms at 0001cc79
070 - Fantasy Zone II.sms at 0001cc79
071 - Fantasy Zone.sms at 0001e3fa
072 - Forgotten Worlds.sms at 0001c985
073 - Fushigi no Oshiro Pit Pot (JP).sms at 000049dc
074 - Gain Ground.sms at 0001c768
075 - Galactic Protector (JP).sms at 00007896
076 - Galaxy Force (US).sms at 00008ae4
077 - Galaxy Force.sms at 00008ae4
078 - Game Box Serie Esportes Radicais (BR).sms at 0000a43a
079 - Gangster Town.sms at 0001c5f8
080 - Geraldinho (BR).sms at 000051ed
081 - Ghost House (JP).sms at 00004e69
082 - Ghost House [Proto].sms at 00004d69
083 - Ghost House.sms at 00004d82
084 - Ghostbusters.sms at 0001c56d
085 - Global Defense [Proto].sms at 000189b9
086 - Global Defense.sms at 000189b9
087 - Global Gladiators.sms at 000381dd
088 - Gokuaku Doumei Dump Matsumoto (JP).sms at 00008528
089 - Golden Axe.sms at 000088cc
090 - Golfamania [Proto].sms at 0001cac4
091 - Golfamania.sms at 0001cac4
092 - Great Baseball [JP] (JP).sms at 00007962
093 - Great Baseball.sms at 00005c99
094 - Great Basketball.sms at 0001c5e8
095 - Great Football.sms at 0001c522
096 - Great Golf [JP] (JP).sms at 00006ea5
097 - Great Golf [Proto] (JP).sms at 00006cf7
098 - Great Golf.sms at 00006cc4
099 - Great Ice Hockey.sms at 00006116
100 - Great Soccer (JP).sms at 000077e1
101 - Great Soccer.sms at 000077ff
102 - Great Tennis - Super Tennis (JP).sms at 000075d1
103 - Great Volleyball (JP).sms at 00018531
104 - Great Volleyball.sms at 00018531
105 - Haja no Fuuin (JP).sms at 0003d48c
106 - Hang On & Astro Warrior (US).sms at 00003a23
107 - Hang On & Astro Warrior (US).sms at 0001f80d
108 - Hang On & Safari Hunt.sms at 0000335a
109 - Hang On & Safari Hunt.sms at 0001780d
110 - Hang On (JP).sms at 00004642
111 - Hang On.sms at 0000770d
112 - High School! Kimengumi (JP).sms at 00003c05
113 - Hokuto no Ken (JP).sms at 00006da0
114 - Home Alone.sms at 0003e4dc
115 - Hook [Proto].sms at 0000787e
116 - Hoshi wo Sagashite... (JP).sms at 00014cc3
117 - Incredible Crash Dummies, The.sms at 0003e3ec
118 - Incredible Hulk, The.sms at 0005e341
119 - Kenseiden (JP).sms at 000092da
120 - Kenseiden.sms at 000092da
121 - Kujakuou (JP).sms at 00008db9
122 - Kung Fu Kid.sms at 0000e977
123 - Lemmings [Proto].sms at 0000afe6
124 - Lemmings.sms at 0000b4d4
125 - Lion King, The.sms at 0001a5c0
126 - Lord of Sword (JP).sms at 0000cbe6
127 - Lord of The Sword.sms at 0000cbe6
128 - Loretta no Shouzou (JP).sms at 000079be
129 - Mahjong Sengoku Jidai (JP).sms at 0001c5bc
130 - Mahjong Sengoku Jidai [Proto] (JP).sms at 0001c5bc
131 - Makai Retsuden (JP).sms at 0000ebf7
132 - Marble Madness.sms at 00007a72
133 - Marksman Shooting & Trap Shooting & Safari Hunt.sms at 0000317e
134 - Marksman Shooting & Trap Shooting.sms at 00002db2
135 - Maze Hunter 3-D.sms at 000125e1
136 - Maze Walker (JP).sms at 00012381
137 - Megumi Rescue (JP).sms at 0001cf50
138 - Miracle Warriors - Seal of the Dark Lord.sms at 0003d48c
139 - Missile Defense 3-D [BIOS].sms at 00012481
140 - Missile Defense 3-D [BIOS].sms at 0001772f
141 - Missile Defense 3-D.sms at 00012481
142 - Monica no Castelo do Dragao (BR).sms at 000298c8
143 - Mortal Kombat II.sms at 0007ea4b
144 - My Hero.sms at 00003368
145 - Nekyuu Kousien (JP).sms at 00038bdc
146 - Ninja, The (JP).sms at 0001c538
147 - Ninja, The.sms at 0001c538
148 - Opa Opa (JP).sms at 0001cb28
149 - Out Run 3-D.sms at 00007169
150 - Out Run Europa.sms at 00009f92
151 - Out Run.sms at 00005cce
152 - Penguin Land (JP).sms at 00005a42
153 - Penguin Land.sms at 00005a5b
154 - Phantasy Star (BR).sms at 00030876
155 - Phantasy Star (JP).sms at 00030cdd
156 - Phantasy Star (KR).sms at 00030cdd
157 - Phantasy Star [Megadrive] (JP).sms at 00030cdd
158 - Phantasy Star [v2].sms at 00030876
159 - Phantasy Star [v3].sms at 00030876
160 - Poseidon Wars 3-D.sms at 0003ca31
161 - Predator 2.sms at 0003c1d2
162 - Prince of Persia.sms at 000294ec
163 - Pro Wrestling.sms at 0000858e
164 - Pro Yakyuu Pennant Race, The (JP).sms at 00007772
165 - Psycho Fox.sms at 00028b37
166 - Quartet.sms at 000149f4
167 - Rambo - First Blood Part II.sms at 00005f00
168 - Rambo III.sms at 00034b22
169 - Rampage.sms at 00008c5a
170 - Reggie Jackson Baseball (US).sms at 00038adb
171 - Rescue Mission.sms at 00006876
172 - Road Rash.sms at 0007ddad
173 - RoboCop 3.sms at 00019016
174 - Rocky.sms at 00006e37
175 - Sapo Xule O Mestre do Kung Fu (BR).sms at 0000e977
176 - Sapo Xule S.O.S. Lagoa Poluida (BR).sms at 00003960
177 - Sapo Xule Vs Os Invasores do Brejo (BR).sms at 00028b37
178 - Satellite 7 (JP).sms at 00003c7e
179 - Scramble Spirits.sms at 0000cbad
180 - Secret Command.sms at 00005e6a
181 - Sega Chess.sms at 00024ddf
182 - Seishun Scandal (JP).sms at 0000338c
183 - Shanghai.sms at 00014b72
184 - Shinobi (JP).sms at 00018cbf
185 - Shinobi.sms at 00018cbf
186 - Shooting Gallery.sms at 0000495a
187 - Slap Shot (US).sms at 0001c6d0
188 - Slap Shot [A].sms at 0001c6d0
189 - Slap Shot [B].sms at 0001c6d0
190 - Space Harrier 3-D.sms at 00006ed2
191 - Space Harrier 3D (JP).sms at 00006ed2
192 - Space Harrier [50 & 60 Hz].sms at 00005abb
193 - Space Harrier [50 Hz].sms at 00005b0c
194 - SpellCaster.sms at 00008db9
195 - Sports Pad Football (US).sms at 0001c522
196 - Sports Pad Soccer (JP).sms at 0001c5c6
197 - Spy vs Spy (JP) [Hack].sms at 00007ef9
198 - Spy vs Spy (JP).sms at 00007ef9
199 - Spy vs Spy [Display Unit].sms at 00007d6a
200 - Spy vs Spy.sms at 00007d6a
201 - Strategic Defense Initiative (JP).sms at 000189b9
202 - Sukeban Deka II - Shoujo Tekkamen Densetsu (JP).sms at 000085c1
203 - Summer Games.sms at 0001ca18
204 - Super Basketball [Demo].sms at 00008b4c
205 - Super Racing (JP).sms at 00008e97
206 - Super Smash T.V..sms at 0000b8a6
207 - Super Tennis.sms at 00007df4
208 - Super Wonder Boy (JP).sms at 0000716c
209 - Super Wonder Boy Monster World (Super Wonder Boy Monster Land) (JP).sms at 000298c8
210 - Teddy Boy Blues (JP).sms at 00004bef
211 - Teddy Boy Blues [EP-MyCard] (JP).sms at 00004bef
212 - Teddy Boy.sms at 000051ed
213 - Tennis Ace.sms at 0001cb28
214 - Tensai Bakabon (JP).sms at 0001cbe5
215 - Terminator, The.sms at 0001a444
216 - Thunder Blade (JP).sms at 00008b1e
217 - Thunder Blade.sms at 00008b24
218 - TransBot.sms at 000034db
219 - Trivial Pursuit - Genus Edition.sms at 00004558
220 - Trivial Pursuit - Genus Edition.sms at 000057e5
221 - Vigilante.sms at 00024c2c
222 - Walter Payton Football (US).sms at 000089d8
223 - Wanted.sms at 0001ca50
224 - Where in the World is Carmen Sandiego (BR).sms at 000073a0
225 - Where in the World is Carmen Sandiego (US).sms at 000073a0
226 - Wolfchild.sms at 00004714
227 - Wonder Boy in Monster Land.sms at 000298c8
228 - Wonder Boy.sms at 0000717e
229 - Woody Pop - Shinjinrui no Block Kuzushi (JP).sms at 0000262e
230 - World Games [Proto].sms at 0000d9e6
231 - World Games.sms at 0000d9e6
232 - World Grand Prix (JP).sms at 00006a00
233 - World Grand Prix (US).sms at 00006a07
234 - World Grand Prix.sms at 00006a13
235 - World Soccer.sms at 0001c5c6
236 - WWF Wrestlemania Steel Cage Challenge.sms at 00001c80
237 - Y's - The Vanished Omens.sms at 00008a5a
238 - Ys (JP).sms at 00008a5a
239 - Zaxxon 3-D [Proto].sms at 000167e9
240 - Zaxxon 3-D.sms at 000167e9
241 - Zillion (US).sms at 0001665e
242 - Zillion II - The Tri Formation.sms at 00008b2b
243 - Zillion.sms at 0001665e
244 - Zool.sms at 000077bc

Did you try the "fix" button?

There are 3rd party games on the list, for example Alien 3, Arcade Smash Hits...

I don't understand what you mean by third party? I fixed the roms, and it says I have 441 out of 469 "commercial roms".

So I scanned that list for the table you found, and the 244 matches are listed.

Third party developed games as opposed to Sega-developed ones. Sega -developed ones might be expected to have common code but you'd expect third-party games to have been built based on a smaller SDK.

The fact that the table shows up so much suggests that it was part of the SDK and the internal library. The initialisation table may also have been part of that, but while they'd be unlikely to modify the notes table, developers might have chosen to implement silencing/initialisation in a different way. A lot of games with the buggy table also silence the chips in other ways in certain situations, and if the developers were understanding the chip on a low enough level to do that, they might have fixed the typo independently. Alternatively, the official documentation may have been updated but they didn't bother sending out errata information and thus it would depend on how old your copy was as to whether you got the old or new table.

Regarding whether you can hear a glitch in the games:

As you said, the effect is to set tone0 volume to maximum and then silence within a few ms. Judging from the code I looked at, this will happen very rarely, probably once on startup and then each time it pauses or stops the music (eg. end of a level). It requires tone1 to be set to an audible frequency at that moment; the music engine may have parked it at frequency 0, but I haven't checked if that's likely.

Personally, I have no doubt that the real game will exhibit this behaviour, but I also think it will be practically inaudible. I'm sure someone can record a game from that list on a real system (no devcart needed), unfortunately I can't.

Maxim wrote

Regarding whether you can hear a glitch in the games:

As you said, the effect is to set tone0 volume to maximum and then silence within a few ms. Judging from the code I looked at, this will happen very rarely, probably once on startup and then each time it pauses or stops the music (eg. end of a level). It requires tone1 to be set to an audible frequency at that moment; the music engine may have parked it at frequency 0, but I haven't checked if that's likely.

Personally, I have no doubt that the real game will exhibit this behaviour, but I also think it will be practically inaudible. I'm sure someone can record a game from that list on a real system (no devcart needed), unfortunately I can't.

Well if it's highly audible in the emulators (every one that I tried), and not highly audible on the real system then it's an interesting thing. It happens between every rampage level (iirc) and at the startup of Rampage and Kenseiden, among many other games. It's quite an annoying noise in emulators.

If it's not very audible on the real system it explains how the bug crept through, however it means emulators are handling that aspect in a manner which is obviously not true to the real machine.

Author	Message
PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	List of games with buggy PSG initialisation (was: possible bad_dumps or buggy roms) Posted: Mon Sep 15, 2008 1:53 am
	I've gone through my collection, which unfortunately isn't complete but should highlight this weird issue. It seems games should initialize the PSG with a sequence of :- 8000A000C000E49FBFDFFF It's sets the frequencies all to 0, the noise to a default, and the volumes to silence. However some roms do this 80009000C000E49FBFDFFF Which doesn't set tone1 frequency to 0, instead sets the volume of tone0 to full volume, twice, and then sets it back to silence within the space of a few PSG samples. This results in weird popping sounds. Here is a list of the roms which do this latter "bad" thing. 12-05-1996 - After Burner (UE) [!].sms at 00070b79 24-09-1995 - Basket Ball Nightmare (E) [!].sms at 0000c949 09-05-1997 - Blade Eagle 3D (UE) [!].sms at 00039870 25-11-2003 - Bock's Birthday 2003 by Maxim (PD).sms at 00008878 07-04-1997 - Bomber Raid (UE) [!].sms at 0001c9e5 16-04-1997 - Captain Silver (E) [!].sms at 00008a08 22-08-2000 - Captain Silver (U) [!].sms at 00008a08 20-06-1998 - Chouon Senshi Borgman (J) [!].sms at 00009fb6 15-06-1997 - Cloud Master (UE) [!].sms at 00008a13 14-04-1997 - Cyborg Hunter (UE) [!].sms at 00009fb6 07-05-1997 - Dead Angle (UE) [!].sms at 0003c825 12-11-1998 - Double Hawk (E) [!].sms at 0003ca13 07-04-1997 - Dynamite Dux (E) [!].sms at 0003d59a 07-01-1998 - Hoshi wo Sagasite... (J) [!].sms at 00014ae0 23-09-1999 - Kenseiden (J) [!].sms at 000090f8 31-07-1996 - Kenseiden (UE) [!].sms at 000092f8 22-12-1998 - Megumi Rescue (J) [!].sms at 0001cd6e 20-09-1998 - Nekyuu Kousien (J) [!].sms at 000389e4 07-05-1997 - Poseidon Wars 3D (UE) [!].sms at 0003c852 15-06-1997 - Psycho Fox (UE) [!].sms at 00028949 22-03-2003 - Rambo III (UE) [!].sms at 00034940 01-08-1996 - Rampage (UE) [!].sms at 00008c78 07-05-1997 - Sapo Xule vs. os Invasores do Brejo (B).sms at 00028949 17-11-1999 - Shanghai (UE) [!].sms at 00014990 10-11-1995 - Summer Games (E) [!].sms at 0001c839 25-12-1996 - Super Basketball (Demo) [!].sms at 0000895e 20-09-1998 - Super Racing (J) [!].sms at 00008bd4 07-01-1998 - Tensai Bakabon (J) [!].sms at 0001ca03 10-09-2000 - Thunder Blade (J) [!].sms at 0000893c 01-08-1996 - Thunder Blade (UE) [!].sms at 00008b42 16-10-1999 - Treinamento Do Mymo (B).sms at 00028949 07-04-1997 - Vigilante (UE) [!].sms at 00024a3e 30-10-2002 - Wanted (UE) [!].sms at 0001c85f 04-06-2001 - Where in the World is Carmen Sandiego (U) [!].sms at 000071be 01-09-2003 - Ys (J).sms at 00008878 07-04-1997 - Ys - The Vanished Omens (UE) [!].sms at 00008878 And here is a list which does it the way it should 22-03-2003 - Aerial Assault (UE) [!].sms at 0001c82e 22-09-1998 - Alex Kidd in Shinobi World (UE) [!].sms at 0000872e 13-11-1992 - Altered Beast (UE) [!].sms at 00030ac3 01-08-1999 - American Pro Football (E) [!].sms at 00008818 24-10-2001 - Assault City - Light Phaser Version (E) [!].sms at 0001c865 07-12-2001 - Assault City - Pad Version (E) [!].sms at 0001c865 21-06-1998 - Battle Out Run (E) [!].sms at 0003c8aa 22-03-1997 - California Games (UE) [!].sms at 0001507a 23-09-1998 - Danan the Jungle Fighter (E) [!].sms at 0000a2c8 12-11-1992 - Double Dragon (UE) [!].sms at 0002cc22 15-06-1997 - E-SWAT - City Under Siege (UE) [!].sms at 0001c5ac 12-11-1998 - Forgotten Worlds (E) [!].sms at 0001c7a6 28-09-1998 - Gain Ground (UE) [!].sms at 0001c57d 01-01-2002 - Galaxy Force (E) [!].sms at 000088f6 19-03-1997 - Galaxy Force (U) [!].sms at 000088f6 04-07-1999 - Game Box Esportes Radicais (B) [!].sms at 0000a24c 24-06-1998 - Golden Axe (UE) [!].sms at 000088e8 25-06-1996 - Golden Axe (UE) [b1].sms at 000088e8 25-07-1999 - Golf Mania (E) [!].sms at 0001c8d6 22-03-2003 - Golf Mania (Prototype) [!].sms at 0001c8d6 25-12-1996 - Kujaku Ou (J) [!].sms at 00008bd7 28-10-1998 - Kujaku Ou (J) [b1].sms at 00008bd7 04-06-2001 - OutRun 3D (E) [!].sms at 00006f7b 15-06-1997 - Scramble Spirits (UE) [!].sms at 0000c9bf 10-09-2003 - Scramble Spirits (UE) [b1].sms at 0000c9bf 25-12-1996 - Shinobi (J) [!].sms at 00018add 12-11-1992 - Shinobi (UE) [!].sms at 00018cdd 11-11-1998 - Shinobi (UE) [b1].sms at 00018add 11-05-2006 - Shinobi (UE) [b3].sms at 00018add 19-10-2003 - Slap Shot (E) [!].sms at 0001c4f1 01-06-1997 - Slap Shot (U) (V1.0) [!].sms at 0001c4f1 23-08-2006 - Slap Shot (U) (V1.1) [!].sms at 0001c4f1 09-04-1997 - Spellcaster (UE) [!].sms at 00008bd7 28-09-1998 - Tennis Ace (E) [!].sms at 00018131 25-12-1996 - Walter Payton Football (U) [!].sms at 000087f9 25-12-1996 - World Games (E) [!].sms at 0000d7f8 30-10-2002 - World Games (Prototype) [!].sms at 0000d7f8

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 8:39 am
	I'd guess it's a bad code sample or some common codebase for all the music engines. Comparing them further may yield evidence either way. The official Sega docs don't suggest setting the frequencies to 0 on startup, just the volumes: Sega official docs (English) wrote LD HL,CLRTB ; clear table LD C,PSG_PRT ; psg port is $7F LD B,4 ; load four bytes OTIR ; write them (etc.) CLRTB defb $9F,$BF,$DF,$FF This code turns the four sound channels off. I don't think we have any Japanese docs.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Sep 15, 2008 9:23 am
	I also believe it was originally just a typo and got carried from game to game. Those dumps are correct, so the 'bad dumps' subject is misleading. Perhaps you could resubject like "List of buggy PSG initialization games". It is interesting because somehow it tells us that those games are linked. Note how that they are all Japanese games published by Sega. The guys at GDRI might want to use that information.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 10:01 am
	Bock wrote they are all Japanese games published by Sega Is Where in the World is Carmen Sandiego a Japanese game? I'd assumed all those crappy USA releases were developed there. It seems to have compressed text so any credits may not be in clear view. Isn't Psycho Fox considered to be a non Sega game?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Sep 15, 2008 10:26 am
	Maxim wrote Bock wrote they are all Japanese games published by Sega Is Where in the World is Carmen Sandiego a Japanese game? I'd assumed all those crappy USA releases were developed there. It seems to have compressed text so any credits may not be in clear view. Isn't Psycho Fox considered to be a non Sega game? I missed Carmen Sandiego from that list, hmm, I don't know. I would say it was developed at Sega of USA. It's difficult to tell for Psycho Fox. Although it had an AIMO logo at some point, most games were reprogrammed for the account of other developers, so perhaps AIMO/VicTokai did some work and Sega assisted them, shared code, even perhaps programmed the whole thing. Also note that this kind of initialization code is one likely to be first ripped by someone reverse engineering the system.

CRV Joined: 02 Jan 2005 Posts: 668	Posted: Mon Sep 15, 2008 10:53 am
CRV Joined: 02 Jan 2005 Posts: 668	Bock wrote I missed Carmen Sandiego from that list, hmm, I don't know. I would say it was developed at Sega of USA. Carmen Sandiego was developed by Venture Technologies. I interviewed the programmers Bob Halliday and Chase Sebor (of course, we didn't really talk much about SMS Carmen Sandiego - I should probably ask some follow-up questions - if you can think of any, let me know). Bock wrote It's difficult to tell for Psycho Fox. Although it had an AIMO logo at some point, most games were reprogrammed for the account of other developers, so perhaps AIMO/VicTokai did some work and Sega assisted them, shared code, even perhaps programmed the whole thing. Also note that this kind of initialization code is one likely to be first ripped by someone reverse engineering the system. Psycho Fox was developed by VIC Tokai/Seibu Lease. Shouichi Yoshikawa recognized some of the staffers.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 11:20 am
	But music engines are very commonly outsourced and/or bought in. Perhaps this was a Sega standard music engine that was bugfixed at some point; although the inclusion of Ys makes me doubt that, just because its music is of such an outstanding quality one would expect it to have a different engine.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Sep 15, 2008 11:26 am
	( Btw some of your date seems completely off, eg: 25-12-1996 - Super Basketball (Demo) [!].sms at 0000895e I dumped this one in 2004, my file date says 12/10/2004. Some other dates are off. )

CRV Joined: 02 Jan 2005 Posts: 668	Posted: Mon Sep 15, 2008 12:35 pm
CRV Joined: 02 Jan 2005 Posts: 668	Maxim wrote But music engines are very commonly outsourced and/or bought in. Perhaps this was a Sega standard music engine that was bugfixed at some point; although the inclusion of Ys makes me doubt that, just because its music is of such an outstanding quality one would expect it to have a different engine. Would it be possible to put together a list of sound engines ala this one for the MD/Gen?

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 1:37 pm
	It would require examining the music engine code and/or data, and looking for architectural similarities and data structure similarities. As far as I know, nobody's done much work in this are for the SMS. I was under the impression the MD list was helped by things like embedded file format markers (eg. "SMPS") which are less likely to appear on the SMS. On the less morbidly pessimistic side, SMS games usually have their music engines and data embedded in a single 16KB page, rather than the possibly random filling/binpacking in a MD game. Carmen Sandiego seems to be an exception to that rule, its music engine seems to start at $6800. Here's a prototype signature: - At the start of the music engine, there are 3 jumps - The first seems to be "update engine" - The second seems to be "stop music" - The third is "silence sound", is fallen-through-into by the second, and consists of push hl push bc ld hl,data ld c,$7f outi outi outi outi outi outi outi outi outi outi outi pop bc pop hl ret data: .db $80,$00,$90,$00,$C0,$00,$E4,$9F,$BF DF FF which is the code outputting the magic (broken) byte sequence referred to in the first post.

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Mon Sep 15, 2008 2:26 pm
	Would it be worthwhile verifying that these pops and weird noises occur on real master systems to put this to rest then? ie Non modified, real cartridges. I don't remember static inbetween Rampage levels on the SMS, but it has been a while! It almost seems a weird coincidence that these bugs occur in games dumped nearly at the same time, or by the same person. Double Dragon was a game which was much earlier than a lot of the ones with the broken code, so why where they updated but not others? An interesting thing to ponder if the code is correct.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Sep 15, 2008 2:42 pm
	I have personnally redumped the whole SMS library and can assure you that the available dumps are correct. Also take note that most SMS games were originally dumped (at least released publicly) between 1996 and 2000. Quote Double Dragon was a game which was much earlier than a lot of the ones with the broken code, so why where they updated but not others? An interesting thing to ponder if the code is correct. Dumping date is not the game development data. See smsallj.txt for some dates.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 2:49 pm
	The best way to detect pops on a real system is probably to make a "Prosound" modification, to avoid the output filtering. The Game Gear's headphone socket output seems to be remarkably unfiltered too.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 2:53 pm
	Bock wrote Dumping date is not the game development data. See smsallj.txt for some dates. Also noting that the release date is not the game development date. Some might have been rushed to market in a few months, some might have been in development for more than a year.

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Mon Sep 15, 2008 3:57 pm
	Bock wrote I have personnally redumped the whole SMS library and can assure you that the available dumps are correct. Also take note that most SMS games were originally dumped (at least released publicly) between 1996 and 2000. Sorry, I don't want to offend you at all. Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess. Bock wrote Dumping date is not the game development data. See smsallj.txt for some dates. Yeah, those dates are simply the modification dates of the roms I have. What I meant about double dragon is that the game was most likely developed in 1987, yet a game like Double Hawk developed 2-3 years later has the bug. Why was the bug fixed in at least 1987, then not passed on to other companies in 1989/1990? Seems weird.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Sep 15, 2008 4:47 pm Last edited by Maxim on Mon Sep 15, 2008 4:48 pm; edited 1 time in total
	PoorAussie wrote Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess. I'd estimate the probability is somewhere around 10^-100. The same flaw affecting only a certain sequence of data - that's data, not code where the bug would be more catastrophic, and causing only a pop, not even corruption - in multiple dumpers built independently by multiple people, years apart, thousands of miles apart? The same flaw affecting the checksum in the ROM to make it verify as correct?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Mon Sep 15, 2008 4:47 pm
	PoorAussie wrote Sorry, I don't want to offend you at all. Is it possible there is a bug in the dumping hardware/software which could bring about an error like this? Unlikely I guess. There's a checksum in SMS ROM header. Quote Yeah, those dates are simply the modification dates of the roms I have. What I meant about double dragon is that the game was most likely developed in 1987, yet a game like Double Hawk developed 2-3 years later has the bug. Why was the bug fixed in at least 1987, then not passed on to other companies in 1989/1990? Seems weird. Game development is a mess. Information is poorly transmitted, people are busy, change company, sources code are copied, error are propagated, etc. Just like the internet. It's risky to try extrapolating too much information from this bit of code (but it's an interesting hint).

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Mon Sep 15, 2008 5:01 pm
	Yeah, I realize it is very unlikely just had to ask. I think I'm going to hotfix this code in my emulator, it's a simple fix for a simple problem that shouldn't exist... whether it's accurate or not. :) The next step is why I don't remember it on the real machine, need an upgrade to my memory I think.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Music engine signatures Posted: Tue Sep 16, 2008 9:31 am
	Examining Captain Silver code, we find that there is no jump table at the start of the music engine - code just calls directly into the routine to mute audio. The routine itself does more work because it is supporting FM. Kenseiden is next (I'm only looking at SMS Power releases because my roms are on another machine). Again there is no jump table, just direct calls. The code is identical to Captain Silver, again muting the YM2413 after muting the PSG. One side note: a wait is inserted between YM2413 accesses, totalling roughly 60 cycles (17μs), so presumably the YM2413 must be accessed more slowly than the PSG.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Tue Sep 16, 2008 6:55 pm Last edited by Maxim on Wed Sep 17, 2008 10:11 am; edited 2 times in total
	After Burner has the same 3-function music engine structure again, but again also without the jump table, and with FM support. update_music is at 0x70000 and is 0x909 bytes long. stop_music is at 0x70909 and is 0x39 bytes long, falling through into: mute_sound is at 0x70943 and is 0x46 bytes long Some more code lives at 0x70987. Data seems to start at 0x70b42, starting with a table of numbers in the range $3ff..$11 which seem to be PSG values for regular notes. This might be a useful signature, or it might be a table of numbers they gave to multiple developers. It doesn't match the table in the official GG docs. .dw $0000 .dw $03FF $03C7 $0390 $035D $032D $02FF $02D4 $02AB $0285 $0261 $023F $021E $0200 $01E3 $01C8 $01AF .dw $0196 $0180 $016A $0156 $0143 $0130 $011F $010F $0100 $00F2 $00E4 $00D7 $00CB $00C0 $00B5 $00AB .dw $00A1 $0098 $0090 $0088 $0080 $0079 $0072 $006C $0066 $0060 $005B $0055 $0051 $004C $0048 $0044 .dw $0040 $003C $0039 $0036 $0033 $0030 $002D $002B $0028 $0026 $0024 $0022 $0020 $001E $001C $001B .dw $0019 $0018 $0016 $0015 $0014 $0013 $0012 $0011 After that is another table that looks like the corresponding FM values: .dw $0000 .dw $1157 $116B $1181 $1198 $11B0 $11CA $11E5 $1301 $1310 $1320 $1331 $1343 $1357 $136B $1381 $1398 .dw $13B0 $13CA $13E5 $1501 $1510 $1520 $1531 $1543 $1557 $156B $1581 $1598 $15B0 $15CA $15E5 $1701 .dw $1710 $1720 $1731 $1743 $1757 $176B $1781 $1798 $17B0 $17CA $17E5 $1901 $1910 $1920 $1931 $1943 .dw $1957 $196B $1981 $1998 $19B0 $19CA $19E5 $1B01 $1B10 $1B20 $1B31 $1B43 $1B57 $1B6B $1B81 $1B98 .dw $1BB0 $1BCA $1BE5 $1D01 $1D10 $1D20 $1D31 $1D43 They are presumably a mixture of F-num/block for the YM2413 - I'm not particularly familiar with that any more. After that is of course yet more data (10KB of it) which isn't immediately obvious. The PSG table appears identically in: Action Fighter Aerial Assault After Burner Alien Syndrome Assault City Captain Silver Forgotten Worlds Kenseiden Carmen Sandiego which is over 50% of the roms I have on this machine, so it very much looks like a lump of data provided to developers. Others can finish searching the complete ROM library. Bear in mind byte ordering when searching; the hex string is FF03C70390035D032D03FF02D402AB02850261023F021E020002E301C 801AF01960180016A015601430130011F010F010001F200E400D700CB00C000 B500AB00A1009800900088008000790072006C00660060005B00550051004C0 04800440040003C0039003600330030002D002B00280026002400220020001E0 01C001B0019001800160015001400130012001100 (line-broken to avoid destroying the forums)

Martin Joined: 04 Nov 2004 Posts: 273	Posted: Tue Sep 16, 2008 7:06 pm
Martin Joined: 04 Nov 2004 Posts: 273	Yeah, it's tuned down. When I use the magic 437.2 Hz or what it was, I get very similar numbers =) (I like how the A1 is at the max value of 3FF and not at 400 or higher, because then it would be out of range.)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Tue Sep 16, 2008 7:20 pm
	Martin wrote Yeah, it's tuned down. When I use the magic 437.2 Hz or what it was, I get very similar numbers =) (I like how the A1 is at the max value of 3FF and not at 400 or higher, because then it would be out of range.) They seem to have used floor rounding resulting in the table frequently being 1 off a more in-tune value.

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Wed Sep 17, 2008 8:22 am
	I did a search for that table signature... it was found in nearly every SMS game. In my bunch of roms which has a few clones/overdumps/sg1000 games, it is about 600 matches to the signature, out of 1000 possible. I really need to get my collection in some form of order.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Wed Sep 17, 2008 8:29 am Last edited by Maxim on Wed Sep 17, 2008 8:52 am; edited 1 time in total
	http://www.smspower.org/maxim/smschecker/ I really need to update the datafiles. And rewrite it... Does the table show up in third party releases? (Any SMS game with a high nibble of 2 at location 0x7ffe.) It suggests it, and the PSG silencing table, were standard data - the latter being less commonly implemented using the "standard" routine. That supports the theory that it's just something from the SDK that had a typo.

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Wed Sep 17, 2008 8:50 am
	Thanks for the link to your program maxim, very helpful. Here is the list, out of 441 "good" commercial roms your program lists I have 244 or so matches. 001 - Action Fighter (JP).sms at 00007548 002 - Action Fighter.sms at 00007548 003 - Aerial Assault.sms at 0001ca0d 004 - After Burner.sms at 00070b44 005 - Alex Kidd - High Tech World.sms at 00008617 006 - Alex Kidd - The Lost Stars.sms at 0000cbb2 007 - Alex Kidd in Miracle World [v0] (US).sms at 00009e1e 008 - Alex Kidd in Miracle World [v1].sms at 00009e1e 009 - Alex Kidd in Shinobi World.sms at 0000875c 010 - Alex Kidd no Miracle World (JP).sms at 00009e1e 011 - Alien 3.sms at 0003edbb 012 - Alien Syndrome (JP).sms at 0001cc11 013 - Alien Syndrome.sms at 0001cc11 014 - Altered Beast.sms at 00030ab1 015 - American Baseball.sms at 00038adb 016 - American Pro Football.sms at 000089f7 017 - Anmitsu Hime (JP).sms at 00008617 018 - Arcade Smash Hits.sms at 00003b3d 019 - Ashura (JP).sms at 00005ed3 020 - Assault City [Light Phaser].sms at 0001ca44 021 - Assault City.sms at 0001ca44 022 - Asterix and the Great Rescue.sms at 0005965c 023 - Astro Flash (JP).sms at 00003478 024 - Astro Warrior & Pit Pot.sms at 00003a28 025 - Astro Warrior & Pit Pot.sms at 0001c5c1 026 - Astro Warrior.sms at 00003960 027 - Aztec Adventure.sms at 000149a5 028 - Back to the Future Part III.sms at 0003ddab 029 - Bank Panic.sms at 000077d9 030 - Basketball Nightmare.sms at 0000cb37 031 - Battle Out Run.sms at 0003ca89 032 - Battlemaniacs (BR).sms at 0000d868 033 - Black Belt.sms at 00006993 034 - Blade Eagle 3-D.sms at 00039a52 035 - BMX Trial - Alex Kidd (JP).sms at 0000a967 036 - Bomber Raid.sms at 0001cbd3 037 - California Games.sms at 00015268 038 - Captain Silver (US).sms at 00008bea 039 - Captain Silver.sms at 00008bea 040 - Chapolim x Dracula - Um Duelo Assustador (BR).sms at 00004994 041 - Cheese Cat-astrophe.sms at 00003f30 042 - Choplifter [Proto] (JP).sms at 0000ed4b 043 - Choplifter.sms at 0000ed54 044 - Chouon Senshi Borgman (JP).sms at 0000a1a4 045 - Chuck Rock II - Son of Chuck (BR).sms at 00001279 046 - Chuck Rock II - Son of Chuck.sms at 00001279 047 - Chuck Rock.sms at 0007ead2 048 - Cloud Master.sms at 00008bf5 049 - Comical Machine Gun Joe (JP).sms at 00003c6c 050 - Cool Spot.sms at 000081dd 051 - Cyborg Hunter.sms at 0000a1a4 052 - Daffy Duck in Hollywood.sms at 00070242 053 - Danan - The Jungle Fighter.sms at 0000a2ee 054 - Dead Angle.sms at 0003ca07 055 - Double Dragon.sms at 0002cc04 056 - Double Hawk.sms at 0003cbf5 057 - Double Target - Cynthia no Nemuri (JP).sms at 000149f4 058 - Dragon - The Bruce Lee Story.sms at 0003ec3c 059 - Dragon Crystal.sms at 0001c3ff 060 - Dynamite Dux.sms at 0003d779 061 - E-SWAT [A].sms at 0001c797 062 - E-SWAT [B].sms at 0001c797 063 - Enduro Racer (JP).sms at 000033bf 064 - Enduro Racer.sms at 00003141 065 - F-16 Fighter.sms at 000053a9 066 - F-16 Fighting Falcon (JP).sms at 00005578 067 - F-16 Fighting Falcon (US).sms at 000053a9 068 - Fantasy Zone - The Maze.sms at 0001cb28 069 - Fantasy Zone II (JP).sms at 0001cc79 070 - Fantasy Zone II.sms at 0001cc79 071 - Fantasy Zone.sms at 0001e3fa 072 - Forgotten Worlds.sms at 0001c985 073 - Fushigi no Oshiro Pit Pot (JP).sms at 000049dc 074 - Gain Ground.sms at 0001c768 075 - Galactic Protector (JP).sms at 00007896 076 - Galaxy Force (US).sms at 00008ae4 077 - Galaxy Force.sms at 00008ae4 078 - Game Box Serie Esportes Radicais (BR).sms at 0000a43a 079 - Gangster Town.sms at 0001c5f8 080 - Geraldinho (BR).sms at 000051ed 081 - Ghost House (JP).sms at 00004e69 082 - Ghost House [Proto].sms at 00004d69 083 - Ghost House.sms at 00004d82 084 - Ghostbusters.sms at 0001c56d 085 - Global Defense [Proto].sms at 000189b9 086 - Global Defense.sms at 000189b9 087 - Global Gladiators.sms at 000381dd 088 - Gokuaku Doumei Dump Matsumoto (JP).sms at 00008528 089 - Golden Axe.sms at 000088cc 090 - Golfamania [Proto].sms at 0001cac4 091 - Golfamania.sms at 0001cac4 092 - Great Baseball [JP] (JP).sms at 00007962 093 - Great Baseball.sms at 00005c99 094 - Great Basketball.sms at 0001c5e8 095 - Great Football.sms at 0001c522 096 - Great Golf [JP] (JP).sms at 00006ea5 097 - Great Golf [Proto] (JP).sms at 00006cf7 098 - Great Golf.sms at 00006cc4 099 - Great Ice Hockey.sms at 00006116 100 - Great Soccer (JP).sms at 000077e1 101 - Great Soccer.sms at 000077ff 102 - Great Tennis - Super Tennis (JP).sms at 000075d1 103 - Great Volleyball (JP).sms at 00018531 104 - Great Volleyball.sms at 00018531 105 - Haja no Fuuin (JP).sms at 0003d48c 106 - Hang On & Astro Warrior (US).sms at 00003a23 107 - Hang On & Astro Warrior (US).sms at 0001f80d 108 - Hang On & Safari Hunt.sms at 0000335a 109 - Hang On & Safari Hunt.sms at 0001780d 110 - Hang On (JP).sms at 00004642 111 - Hang On.sms at 0000770d 112 - High School! Kimengumi (JP).sms at 00003c05 113 - Hokuto no Ken (JP).sms at 00006da0 114 - Home Alone.sms at 0003e4dc 115 - Hook [Proto].sms at 0000787e 116 - Hoshi wo Sagashite... (JP).sms at 00014cc3 117 - Incredible Crash Dummies, The.sms at 0003e3ec 118 - Incredible Hulk, The.sms at 0005e341 119 - Kenseiden (JP).sms at 000092da 120 - Kenseiden.sms at 000092da 121 - Kujakuou (JP).sms at 00008db9 122 - Kung Fu Kid.sms at 0000e977 123 - Lemmings [Proto].sms at 0000afe6 124 - Lemmings.sms at 0000b4d4 125 - Lion King, The.sms at 0001a5c0 126 - Lord of Sword (JP).sms at 0000cbe6 127 - Lord of The Sword.sms at 0000cbe6 128 - Loretta no Shouzou (JP).sms at 000079be 129 - Mahjong Sengoku Jidai (JP).sms at 0001c5bc 130 - Mahjong Sengoku Jidai [Proto] (JP).sms at 0001c5bc 131 - Makai Retsuden (JP).sms at 0000ebf7 132 - Marble Madness.sms at 00007a72 133 - Marksman Shooting & Trap Shooting & Safari Hunt.sms at 0000317e 134 - Marksman Shooting & Trap Shooting.sms at 00002db2 135 - Maze Hunter 3-D.sms at 000125e1 136 - Maze Walker (JP).sms at 00012381 137 - Megumi Rescue (JP).sms at 0001cf50 138 - Miracle Warriors - Seal of the Dark Lord.sms at 0003d48c 139 - Missile Defense 3-D [BIOS].sms at 00012481 140 - Missile Defense 3-D [BIOS].sms at 0001772f 141 - Missile Defense 3-D.sms at 00012481 142 - Monica no Castelo do Dragao (BR).sms at 000298c8 143 - Mortal Kombat II.sms at 0007ea4b 144 - My Hero.sms at 00003368 145 - Nekyuu Kousien (JP).sms at 00038bdc 146 - Ninja, The (JP).sms at 0001c538 147 - Ninja, The.sms at 0001c538 148 - Opa Opa (JP).sms at 0001cb28 149 - Out Run 3-D.sms at 00007169 150 - Out Run Europa.sms at 00009f92 151 - Out Run.sms at 00005cce 152 - Penguin Land (JP).sms at 00005a42 153 - Penguin Land.sms at 00005a5b 154 - Phantasy Star (BR).sms at 00030876 155 - Phantasy Star (JP).sms at 00030cdd 156 - Phantasy Star (KR).sms at 00030cdd 157 - Phantasy Star [Megadrive] (JP).sms at 00030cdd 158 - Phantasy Star [v2].sms at 00030876 159 - Phantasy Star [v3].sms at 00030876 160 - Poseidon Wars 3-D.sms at 0003ca31 161 - Predator 2.sms at 0003c1d2 162 - Prince of Persia.sms at 000294ec 163 - Pro Wrestling.sms at 0000858e 164 - Pro Yakyuu Pennant Race, The (JP).sms at 00007772 165 - Psycho Fox.sms at 00028b37 166 - Quartet.sms at 000149f4 167 - Rambo - First Blood Part II.sms at 00005f00 168 - Rambo III.sms at 00034b22 169 - Rampage.sms at 00008c5a 170 - Reggie Jackson Baseball (US).sms at 00038adb 171 - Rescue Mission.sms at 00006876 172 - Road Rash.sms at 0007ddad 173 - RoboCop 3.sms at 00019016 174 - Rocky.sms at 00006e37 175 - Sapo Xule O Mestre do Kung Fu (BR).sms at 0000e977 176 - Sapo Xule S.O.S. Lagoa Poluida (BR).sms at 00003960 177 - Sapo Xule Vs Os Invasores do Brejo (BR).sms at 00028b37 178 - Satellite 7 (JP).sms at 00003c7e 179 - Scramble Spirits.sms at 0000cbad 180 - Secret Command.sms at 00005e6a 181 - Sega Chess.sms at 00024ddf 182 - Seishun Scandal (JP).sms at 0000338c 183 - Shanghai.sms at 00014b72 184 - Shinobi (JP).sms at 00018cbf 185 - Shinobi.sms at 00018cbf 186 - Shooting Gallery.sms at 0000495a 187 - Slap Shot (US).sms at 0001c6d0 188 - Slap Shot [A].sms at 0001c6d0 189 - Slap Shot [B].sms at 0001c6d0 190 - Space Harrier 3-D.sms at 00006ed2 191 - Space Harrier 3D (JP).sms at 00006ed2 192 - Space Harrier [50 & 60 Hz].sms at 00005abb 193 - Space Harrier [50 Hz].sms at 00005b0c 194 - SpellCaster.sms at 00008db9 195 - Sports Pad Football (US).sms at 0001c522 196 - Sports Pad Soccer (JP).sms at 0001c5c6 197 - Spy vs Spy (JP) [Hack].sms at 00007ef9 198 - Spy vs Spy (JP).sms at 00007ef9 199 - Spy vs Spy [Display Unit].sms at 00007d6a 200 - Spy vs Spy.sms at 00007d6a 201 - Strategic Defense Initiative (JP).sms at 000189b9 202 - Sukeban Deka II - Shoujo Tekkamen Densetsu (JP).sms at 000085c1 203 - Summer Games.sms at 0001ca18 204 - Super Basketball [Demo].sms at 00008b4c 205 - Super Racing (JP).sms at 00008e97 206 - Super Smash T.V..sms at 0000b8a6 207 - Super Tennis.sms at 00007df4 208 - Super Wonder Boy (JP).sms at 0000716c 209 - Super Wonder Boy Monster World (Super Wonder Boy Monster Land) (JP).sms at 000298c8 210 - Teddy Boy Blues (JP).sms at 00004bef 211 - Teddy Boy Blues [EP-MyCard] (JP).sms at 00004bef 212 - Teddy Boy.sms at 000051ed 213 - Tennis Ace.sms at 0001cb28 214 - Tensai Bakabon (JP).sms at 0001cbe5 215 - Terminator, The.sms at 0001a444 216 - Thunder Blade (JP).sms at 00008b1e 217 - Thunder Blade.sms at 00008b24 218 - TransBot.sms at 000034db 219 - Trivial Pursuit - Genus Edition.sms at 00004558 220 - Trivial Pursuit - Genus Edition.sms at 000057e5 221 - Vigilante.sms at 00024c2c 222 - Walter Payton Football (US).sms at 000089d8 223 - Wanted.sms at 0001ca50 224 - Where in the World is Carmen Sandiego (BR).sms at 000073a0 225 - Where in the World is Carmen Sandiego (US).sms at 000073a0 226 - Wolfchild.sms at 00004714 227 - Wonder Boy in Monster Land.sms at 000298c8 228 - Wonder Boy.sms at 0000717e 229 - Woody Pop - Shinjinrui no Block Kuzushi (JP).sms at 0000262e 230 - World Games [Proto].sms at 0000d9e6 231 - World Games.sms at 0000d9e6 232 - World Grand Prix (JP).sms at 00006a00 233 - World Grand Prix (US).sms at 00006a07 234 - World Grand Prix.sms at 00006a13 235 - World Soccer.sms at 0001c5c6 236 - WWF Wrestlemania Steel Cage Challenge.sms at 00001c80 237 - Y's - The Vanished Omens.sms at 00008a5a 238 - Ys (JP).sms at 00008a5a 239 - Zaxxon 3-D [Proto].sms at 000167e9 240 - Zaxxon 3-D.sms at 000167e9 241 - Zillion (US).sms at 0001665e 242 - Zillion II - The Tri Formation.sms at 00008b2b 243 - Zillion.sms at 0001665e 244 - Zool.sms at 000077bc

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Wed Sep 17, 2008 8:54 am
	Did you try the "fix" button? There are 3rd party games on the list, for example Alien 3, Arcade Smash Hits...

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Wed Sep 17, 2008 9:33 am
	I don't understand what you mean by third party? I fixed the roms, and it says I have 441 out of 469 "commercial roms". So I scanned that list for the table you found, and the 244 matches are listed.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Wed Sep 17, 2008 10:01 am
	Third party developed games as opposed to Sega-developed ones. Sega -developed ones might be expected to have common code but you'd expect third-party games to have been built based on a smaller SDK. The fact that the table shows up so much suggests that it was part of the SDK and the internal library. The initialisation table may also have been part of that, but while they'd be unlikely to modify the notes table, developers might have chosen to implement silencing/initialisation in a different way. A lot of games with the buggy table also silence the chips in other ways in certain situations, and if the developers were understanding the chip on a low enough level to do that, they might have fixed the typo independently. Alternatively, the official documentation may have been updated but they didn't bother sending out errata information and thus it would depend on how old your copy was as to whether you got the old or new table.

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Mon Nov 10, 2008 2:11 pm
	Regarding whether you can hear a glitch in the games: As you said, the effect is to set tone0 volume to maximum and then silence within a few ms. Judging from the code I looked at, this will happen very rarely, probably once on startup and then each time it pauses or stops the music (eg. end of a level). It requires tone1 to be set to an audible frequency at that moment; the music engine may have parked it at frequency 0, but I haven't checked if that's likely. Personally, I have no doubt that the real game will exhibit this behaviour, but I also think it will be practically inaudible. I'm sure someone can record a game from that list on a real system (no devcart needed), unfortunately I can't.

PoorAussie Joined: 26 Aug 2008 Posts: 292 Location: Australia	Posted: Mon Nov 10, 2008 3:07 pm
	Maxim wrote Regarding whether you can hear a glitch in the games: As you said, the effect is to set tone0 volume to maximum and then silence within a few ms. Judging from the code I looked at, this will happen very rarely, probably once on startup and then each time it pauses or stops the music (eg. end of a level). It requires tone1 to be set to an audible frequency at that moment; the music engine may have parked it at frequency 0, but I haven't checked if that's likely. Personally, I have no doubt that the real game will exhibit this behaviour, but I also think it will be practically inaudible. I'm sure someone can record a game from that list on a real system (no devcart needed), unfortunately I can't. Well if it's highly audible in the emulators (every one that I tried), and not highly audible on the real system then it's an interesting thing. It happens between every rampage level (iirc) and at the startup of Rampage and Kenseiden, among many other games. It's quite an annoying noise in emulators. If it's not very audible on the real system it explains how the bug crept through, however it means emulators are handling that aspect in a manner which is obviously not true to the real machine.

Forums

View topic - List of games with buggy PSG initialisation (was: possible bad_dumps or buggy roms)