Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Master System Evolution 132 games (was: Received this in the mail this evening :)

Reply to topic Goto page Previous  1, 2
Author Message
  • Joined: 16 Mar 2006
  • Posts: 281
Reply with quote
Post Posted: Mon Jan 09, 2023 5:57 pm
Any chance of getting this to work on an Everdrive?
  View user's profile Send private message
  • Joined: 25 Feb 2006
  • Posts: 863
  • Location: Belo Horizonte, MG, Brazil
Reply with quote
Post Posted: Mon Jan 09, 2023 6:07 pm
The individual games will probably work; the whole package.. will probably require an update to the Everdrive's mapper support
  View user's profile Send private message Visit poster's website
  • Joined: 26 Feb 2021
  • Posts: 158
Reply with quote
Post Posted: Tue Jan 10, 2023 9:56 am
It's handled quite simply, the menu writes to ports $61 (LSB = A8~15) and $62 (MSB = A16~23) to set the higher address lines of the flash.
  View user's profile Send private message Visit poster's website
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Tue Jan 10, 2023 10:07 am
Apocalypse wrote
the menu writes to ports $61 (LSB = A8~15) and $62 (MSB = A16~23) to set the higher address lines of the flash.


thanks, you just saved me some time (I was going to investigate that now but I noticed there was a reply in here...)
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sun Jan 15, 2023 3:22 am
I've finished mapping the contents of the dump file, it's attached.

There is also an extract.py script that is able to extract each game from the dump file, with the map.txt file.

Most games run fine with an emulator.

In (ec4000 - edbfff) there is some content that I couldn't identify. It doesn't seem to be the rest of Icepost Rescue.
map.zip (4.02 KB)

  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Sun Jan 15, 2023 9:18 am
noza10b1 wrote
I've finished mapping the contents of the dump file, it's attached.

There is also an extract.py script that is able to extract each game from the dump file, with the map.txt file.

Most games run fine with an emulator.

In (ec4000 - edbfff) there is some content that I couldn't identify. It doesn't seem to be the rest of Icepost Rescue.

Script works fine, thank you ! Are there 106 games and not 132 ?
  View user's profile Send private message
  • Joined: 10 Jan 2021
  • Posts: 13
Reply with quote
Post Posted: Sun Jan 15, 2023 2:17 pm
You can get the whole evolution set, all fixed up here:
  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sun Jan 15, 2023 4:08 pm
asper wrote
Script works fine, thank you ! Are there 106 games and not 132 ?


There are actually 103 files that count.
The other 3 are not games:
- menu.sms - this is the game select menu
- color_and_switch.sms - this is a hidden test program in MSE
- unknown.sms - this is some unknown content

The 132 games are obtained by:
- counting "20 em 1" as 20 games (+19)
- counting "Pense Bem" as 10 games (+9)
- counting "Pit Pot / Astro Warrior" as 2 games (+1)

Then you have 103 + 19 + 9 + 1 = 132 games.
  View user's profile Send private message
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Sun Jan 15, 2023 5:02 pm
noza10b1 wrote
asper wrote
Script works fine, thank you ! Are there 106 games and not 132 ?


There are actually 103 files that count.
The other 3 are not games:
- menu.sms - this is the game select menu
- color_and_switch.sms - this is a hidden test program in MSE
- unknown.sms - this is some unknown content

The 132 games are obtained by:
- counting "20 em 1" as 20 games (+19)
- counting "Pense Bem" as 10 games (+9)
- counting "Pit Pot / Astro Warrior" as 2 games (+1)

Then you have 103 + 19 + 9 + 1 = 132 games.

Thank you !
  View user's profile Send private message
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Mon Jan 16, 2023 10:08 am
noza10b1 wrote
In (ec4000 - edbfff) there is some content that I couldn't identify.


seems to be uncompressed tiles, I tried importing that on Emulicious (using a random palette) but it's pretty hard to tell what I'm looking at.
  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Mon Jan 16, 2023 10:11 am
sverx wrote
noza10b1 wrote
In (ec4000 - edbfff) there is some content that I couldn't identify.


seems to be uncompressed tiles, I tried importing that on Emulicious (using a random palette) but it's pretty hard to tell what I'm looking at.

Are them at the end of the flash?
Maybe old flash non-erased content data, something at the end of a sms rom?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Mon Jan 16, 2023 10:45 am
Looking at it in Tile Layer Pro, the artwork above $ec4000 seems similar to that just before it. It looks like some full-screen artwork with a tilemap.

Address $eb0000 is raw tiles up to $eb2200, then raw tilemap for the Icepost Rescue title screen.

$eb4000 seems to be non-graphical data.

$eb8000 is code, followed by art from $eb8409, raw tiles followed by tilemap. Following 16KB pages have subsequent "screens" of art. Attached are some decoded versions, with a default palette. They seem to be later levels of Icepost Rescue, making it a 224KB game.
Image1.png (23.27 KB)
Image1.png
Image2.png (20.87 KB)
Image2.png
Image3.png (18.7 KB)
Image3.png

  View user's profile Send private message Visit poster's website
  • Joined: 25 Nov 2015
  • Posts: 143
Reply with quote
Post Posted: Mon Jan 16, 2023 12:22 pm
Maxim wrote
Looking at it in Tile Layer Pro, the artwork above $ec4000 seems similar to that just before it. It looks like some full-screen artwork with a tilemap.

Address $eb0000 is raw tiles up to $eb2200, then raw tilemap for the Icepost Rescue title screen.

$eb4000 seems to be non-graphical data.

$eb8000 is code, followed by art from $eb8409, raw tiles followed by tilemap. Following 16KB pages have subsequent "screens" of art. Attached are some decoded versions, with a default palette. They seem to be later levels of Icepost Rescue, making it a 224KB game.

So icepost dump obtained with the python script is wrong ?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Mon Jan 16, 2023 1:49 pm
I’d guess so. Maybe you can play through to check it.

It’s also with noting that the Master System Evolution implementation of the VDP does not have timing limitations during active display and without fixing these (as Révo has) many of these games, including Icepost Rescue, will produce garbled graphics on a real system or in Emulicious.

Révo's hacked ROM pack has it as a 224KB file, with the VDP fixes. I've mirrored it here. It has some garbled filenames, I guess due to using non-UTF-8 encoding of filenames.

Edit: indeed, stage 1 is the first image I made above (included in the too-small ROM) but stage 2 is the second image (cut off, presumably shows garbage).

  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Tue Jan 17, 2023 1:53 am
Nice analysis! I guess I didn't play Icepost Rescue enough to notice part of it was missing.
  View user's profile Send private message
  • Joined: 29 Jun 1999
  • Posts: 382
  • Location: Brazil
Reply with quote
Post Posted: Tue Jan 17, 2023 6:45 am
Some roms have a English version, were them translated by Révo by any chance or were they hidden in the dump? They are not mentioned in the map file.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Tue Jan 17, 2023 10:11 am
That's Révo's good work.
  View user's profile Send private message Visit poster's website
  • Joined: 03 Jan 2023
  • Posts: 14
Reply with quote
Post Posted: Wed Jan 18, 2023 4:22 pm
First all, thanks from the dumps, but I've playing Creature Capture, but for some reason after some moments is starting glitching, I didn't know if is because of emulator (Fusion) or other reasons.....
And yes, only happen in this game.

  View user's profile Send private message
  • Joined: 29 Jun 1999
  • Posts: 382
  • Location: Brazil
Reply with quote
Post Posted: Sat Jan 21, 2023 7:33 am
Seems like Tectoy used a few roms translated to Portuguese by the community.

Enduro Racer (https://romhackers.org/traducoes/console/master-system/enduro-racer-emuroms-translations/): check the year 1998 in the title screen.

Renegade (https://romhackers.org/traducoes/console/master-system/renegade-cbt/): check the year 1999 in the title screen.

Hang-On (https://romhackers.org/traducoes/console/master-system/hang-on-emuroms-translations/): again check the 1998 year in the title screen.

I wonder if any of the games that are hanging with a black screen were also translated.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sun Jan 22, 2023 7:37 pm
PrOfUnD Darkness wrote
I wonder if any of the games that are hanging with a black screen were also translated.


Hang-On is one of the translated games that hang on (pun intended) the title screen. Enduro Racer and Renegade work fine.

Some other games that are hanging were definitely not translated, such as Sonic and Alex Kidd in Miracle World. The games that hang, unmodified from the dump, are:
1- Sonic the Hedgehog
2- Shinobi
3- Fantasy Zone 2
4- Columns
5- Hang-On
6- Bonanza Bros
7- Black Belt
8- Alex Kidd in Miracle World
9- Chase H.Q.
10- Woody Pop

From what I remember from playing on the real system, and because of the small diff size, these games were not translated, with the exception of Hang-On.

It's interesting that games 1 to 8 are all next to each other in flash, from offset 0x01c000 to 0x183fff.
  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Sun Jan 22, 2023 7:42 pm
BTW, are there any plans to support these games that are hanging, unmodified, on Emulicious or on any other emulator?
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Sun Jan 22, 2023 10:13 pm
I covered the reason for the hanging games upthread - they are jumping back into the menu code on interrupts, but as the mapper is not emulated, they jump to unexpected places in their own code. Emulating the mapper would mean emulating the whole 16MB ROM image - which is definitely possible. If you want to play the games outside the menu then the extracted images need to be "unpatched", which means finding where they were hooked to go back to the menu (likely just after offset $0038) and undoing the hook.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Wed Feb 01, 2023 1:01 am
I have investigated the non-working games, to "unpatch" them, trying to follow what Maxim did for Sonic. I wanted to know what the other games were doing, but above that, I wanted to be able to play my own extracted roms.

Undoing the changes by comparing each rom to the original SMS version would be trivial. But then it would be better to just obtain those from somewhere else. So what I did was to inspect each rom, looking for the part that called the menu code (that I will call menu handler) and then I tried to replace it with instructions that performed the same work as the original rom. So, while I actually used other roms in this process, I concluded that it's possible to make the broken roms playable using only the dump data, by following each menu handler and using its instructions to reconstruct the replaced ones. This process didn't undo all modifications, but made the games playable and, from a player's perspective, identical to the original ones.

In summary, this was what I found:

Some of the games, like Alex Kidd in Miracle World, Bonanza Bros, Fantasy Zone 2 and Hang-On, were patched in a way that removed a couple original instructions, that were replaced by the code that jumps to one of the menu handlers, and then jumps back to after the removed instructions. These replaced instructions were found in the handler and/or caller code.

In other games, such as Columns, Shinobi and Sonic, the jump in 0x38 is simply replaced by a jump to the code that transfers control to a menu handler, placed in a previously unused rom area, that then jumps to the original location, or a bit further, if instructions such as "push af" were already executed.

Black Belt had only a jump in 0x38, so the menu handler caller code was placed directly there and it then exits by jumping to the original location.

In several games, instructions that load the stack pointer or that initialize RAM were modified to avoid writing to the last bytes of memory. I guess it's because they are used by Master System Evolution's mapper.

But the most interesting change was in Chase H.Q. It was patched to detect if Left, Right and Button 2 are pressed at the same time. If so, it calls the NMI handler at address 0x66, that has the same effect of pressing the pause/start button. It's not clear to me why it does this. Maybe in hybrid GG/SMS mode the start button doesn't cause a NMI, but generates this sequence instead? Who knows. BTW, I need to say that Emulicious' debugger is awesome and I just realized how amazing is the Development section of SMS Power, full of really nice technical info. But in the end, I found out that Chase H.Q. can be run without unpatching anything. The emulator just needs to be forced into SMS mode.

About Woody Pop, it wasn't working because I thought it was the same size of the one extracted from the Megadrive 4 (32K), but on MSE it actually has 48K (although just a bit over 32K is actually used). When it is extracted as a 48K rom it works fine.

Anyway, now I'm happy that I can play every game that I care about, directly from the dump, with just a few patches, without issues.

One thing that I'm still curious about, but that I won't go after, is how the
non-patched games are able to return to the menu.

In case anyone is interested, I've attached what I've found in details, in the .diff files. There are also .patch files and a patch.py script that can be used to make the necessary changes to make the extracted games playable. The updated and fixed map file is also in the attachment.

To extract and patch everything, use:

python3 bin/extract.py map.txt mse.bin
python3 bin/patch.py patches

toolkit_v2.zip (14.89 KB)

  View user's profile Send private message
  • Joined: 23 Jan 2010
  • Posts: 414
Reply with quote
Post Posted: Wed Feb 01, 2023 10:51 am
Thanks @noza10b1. Im interested in play Chase HQ. The rom that i used in my SMS dont worked. Title screen appear but dont work with my 6 button controller I have a SMS1 with everdrive. You could extract this ROM?
Interesting the game Aquaduto that is a pipedream type. The game is funny and recognized my 6 button controller.
  View user's profile Send private message
  • Joined: 20 Nov 2019
  • Posts: 13
  • Location: U.S.A.
Reply with quote
Post Posted: Thu Feb 02, 2023 3:10 am
I have streamed this system, and in color on NTSC tvs. Running it through a capture card fixes it for me. Sometimes when resetting the system or turning it on it takes a few seconds for it to update to color.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Thu Feb 02, 2023 1:16 pm
segarule wrote
Thanks @noza10b1. Im interested in play Chase HQ. The rom that i used in my SMS dont worked. Title screen appear but dont work with my 6 button controller I have a SMS1 with everdrive. You could extract this ROM?


It's attached, give it a try.
chase_hq.zip (56.99 KB)

  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Tue Feb 21, 2023 8:29 pm
Before assembling back my MSE, I tried to figure out what were the functions of Noza 1.0 B1 IC's pins and where they were connected to. Here is what I found:

-----------------------------
Pin | Func  | Connection
-----------------------------
  1- IN0    - J1.6 (BUTTON1)
  2- IN1    - J1.9 (BUTTON2)
  3- ?
  4- ?
  5- IN2    - J2.1 (UP)
  6- IN3    - J2.3 (LEFT)
  7- ?      - CM4.L
  8- ?      - GND
  9- ?
 10- X1.L   - X1.L
 11- X1.R   - X1.R
 12- ?
 13- ?      - 3V3
 14- IN4    - J2.2 (DOWN)
 15- IN5    - J2.4 (RIGHT)
 16- IN6    - J2.6 (BUTTON1)
 17- IN7    - J2.9 (BUTTON2)
 18- IN8    - J1.7/J2.7 (PAUSE)
 19- RST#   - J1.5/J2.5 (VCC/RESET?) - F.14 - RST#
 20- A21    - F.12 - A20
 21- ?
 22- ?      - CNC5.U
 23- A23    - F.2 - A22
 24- ?
 25- ?      - R10.D

 26- ?
 27- ?
 28- ?
 29- ?      - GND
 30- ?      - C20.U
 31- ?      - CL5.L
 32- ?      - GND
 33- ?      - CE40.L/C41.L
 34- ?      - R40.L
 35- ?      - C40.L
 36- ?      - C40.L
 37- ?      - D3.U -D-> 3V3
 38- ?
 39- ?      - GND
 40- ?      - CM1.U
 41- ?      - CL1.L
 42- ?      - CL1.L
 43- ?      - CL1.L
 44- ?
 45- ?      - CL1.L
 46- ?      - CL1.L
 47- 5V     - 5V
 48- ?
 49- ?      - GND
 50- ?

 51- ?
 52- A17    - F.54 - A16
 53- A0     - F.51 - A-1
 54- D7     - F.50 - Q7
 55- D6     - F.48 - Q6
 56- D5     - F.46 - Q5
 57- D4     - F.44 - Q4
 58- D3     - F.41 - Q3
 59- D2     - F.39 - Q2
 60- D1     - F.37 - Q1
 61- D0     - F.35 - Q0
 62- RD#?   - F.34 - OE#
 63- A1     - F.31 - A0
 64- ?      - CM2.R -L-> GND
 65- ?      - GND
 66- ?      - CL2.R -L-> GND
 67- A2     - F.26 - A1
 68- A3     - F.25 - A2
 69- A4     - F.24 - A3
 70- A5     - F.23 - A4
 71- A6     - F.22 - A5
 72- A7     - F.21 - A6
 73- A8     - F.20 - A7
 74- A18    - F.19 - A17
 75- ?

 76- A19    - F.18 - A18
 77- ?
 78- A22    - F.15 - A21
 79- A20    - F.11 - A19
 80- A9     - F.10 - A8
 81- A10    - F.9 - A9
 82- A11    - F.8 - A10
 83- A12    - F.7 - A11
 84- A13    - F.6 - A12
 85- A14    - F.5 - A13
 86- A15    - F.4 - A14
 87- A16    - F.3 - A15
 88- ?
 89- ?      - CM3.R -L-> GND
 90- ?      - GND
 91- ?      - 3V3
 92-
 93- ?      - R42.R -L-> GND
 94- ?      - R41.R -L-> 3V3
 95- ?      - GND
 96-
 97- IN9    - J1.1 (UP)
 98- IN10   - J1.3 (LEFT)
 99- IN11   - J1.2 (DOWN)
100- IN12   - J1.4 (RIGHT)

J - Joypad
F - Flash
N - Noza
.U - Up
.D - Down
.L - Left
.R - Right
-X-> Where the X side of the component is connected to


Notes:
- Pin 7 of the joypads are connected to PAUSE
- Pin 5 of the joypads seems to be used as RESET instead of VCC
- Pin 22 is connected to pin 1 of CNC5, that is a suspicious not soldered connector. CNC5 has only 2 pins. Pin 2 is ground
- Most of pins 25-50 seem to be related to audio and video signal generation
  View user's profile Send private message
  • Joined: 26 Mar 2022
  • Posts: 18
Reply with quote
Post Posted: Mon Apr 03, 2023 12:46 am
A few days ago, I was curious to find out how MSE's 6-button joypad worked, so I opened it. To my surprise, given how the button pads are connected in the board, It's not really a 6-button joypad.

Buttons A and B are connected to the same pin (6) and X, Y, Z only generate a (RESET) signal on pin 5 when all three are pressed at the same time. BTW, if this joypad is connected to a SMS that supplies 5V at this pin, pressing X+Y+Z would short it ground!

So it's really like a 2-button joypad, plus START that acts as PAUSE and X, Y, Z, that acts as RESET.
joypad.jpg (1.62 MB)
joypad.jpg

  View user's profile Send private message
  • Joined: 26 Feb 2021
  • Posts: 158
Reply with quote
Post Posted: Tue Apr 18, 2023 4:45 am
I finally dumped the custom TSOP48 flash from the "PCI MSIII REV7 P1" PCB.

Markings on the chip:
MX S112964
MS132X1E
3H188600

Despite the name (MX S112964) it's actually a 128Mb device with the following custom pinout:



Only a very few bytes are different from the other dump (I dumped it several time to be sure). Could be bit rot or a way to track version.

File in attachment.

[EDIT] NOT! File is too "big" (> 5MB) :D

Get it from there while it's valid:
https://file.io/DD5YBbl746AJ
Pinout.PNG (16.47 KB)
Pinout.PNG

  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14687
  • Location: London
Reply with quote
Post Posted: Tue Apr 18, 2023 4:59 am
Here’s the file.
MS132X1E.zip (7.32 MB)

  View user's profile Send private message Visit poster's website
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Tue Apr 18, 2023 2:15 pm
Apocalypse wrote


A-1 ?
  View user's profile Send private message Visit poster's website
  • Joined: 24 Mar 2021
  • Posts: 120
Reply with quote
Post Posted: Tue Apr 18, 2023 5:38 pm
Flash chips that can be switched between 16-bit data bus and 8-bit data bus are labeled with addresses selecting 16-bit words.

When in 8-bit mode, the D15 pin instead is an input that selects between the first or second byte in each 16-bit word, and when used this way it's called "A-1"
  View user's profile Send private message
  • Joined: 05 Sep 2013
  • Posts: 3761
  • Location: Stockholm, Sweden
Reply with quote
Post Posted: Wed Apr 19, 2023 7:34 am
makes sense! thanks :)
  View user's profile Send private message Visit poster's website
Reply to topic Goto page Previous  1, 2



Back to the top of this page

Back to SMS Power!