Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Prototype M404 BIOS

Reply to topic Goto page 1, 2  Next
Author Message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Prototype M404 BIOS
Post Posted: Sat May 08, 2021 2:22 pm
I have been making changes to the M404 prototype BIOS tonight, but found out it was a complete waste of time.

Does anyone know how to set up an emulator on the PC, as oppose to constantly flashing EPROMS to switch into a real master system?

Meka and Kega both accept the BIOS dumps, Kega does it openly where as Meka needs some renaming of packaged files in the Data folder.

Meka has a debugger and you can step through the code execution and even make changes live.

Only problem is there's no way to even boot the games that should work (jap phantasy star and choplifter) on the emulators using that BIOS, yet alone do anything else useful with the file...
  View user's profile Send private message
  • Joined: 08 Sep 2018
  • Posts: 260
Reply with quote
Post Posted: Sat May 08, 2021 4:33 pm
Try Emulicious, its by far the most accurate emulator for the SMS, you may get further with that.
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13820
  • Location: London
Reply with quote
Post Posted: Sat May 08, 2021 4:43 pm
Emulicious will skip over the BIOS when debugging; I don’t remember if there is a way to disable that.
  View user's profile Send private message Visit poster's website
  • Joined: 24 Mar 2021
  • Posts: 53
Reply with quote
Post Posted: Sat May 08, 2021 6:27 pm
MAME can load and debug a BIOS too. It's actually fairly inconvenient if you want to debug the game.
  View user's profile Send private message
  • Joined: 14 Oct 2008
  • Posts: 399
Reply with quote
Post Posted: Sat May 08, 2021 7:05 pm
Also, Phantasy Star isn't one of the game that should worn on it, it's Fantasy Zone.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 09, 2021 2:38 am
Last edited by L10N37 on Sun May 16, 2021 8:24 am; edited 1 time in total
I'm actually using Maxims disassemblies and notes as a guide, he has previously told which addresses to patch on another topic here to pass check and boot the cartridges.

To be fair, someone has already patched it but he hasn't shared it with the community and has sort of taken ownership of the BIOS.

I did mean fantasy zone - I have the right one because it contains the searched for string at the correct address. I tried adding this string to other roms but obviously nothing is working because of the emulator situation.

The position i'm in is that the MC27C256B I originally had JAP 2.1 bios is somehow corrupted (bad pin showing on flashing software, VCC) not sure what happened there - it won't work and it did on my proto board...

And a batch of 8kb MC27C64A won't even detect on the flashing software as the chips they're labelled as (ST branded) , I think they're rebrands from China where they wipe the writing off and restamped them incorrectly as they only detect as M2764's.. I've flashed a heap and none work.

IF anyone finds a working way to do trial and error via emulation please let me know.

**issue attached
BIOS pins.png (264.63 KB)
BIOS pins.png

  View user's profile Send private message
  • Joined: 24 Mar 2021
  • Posts: 53
Reply with quote
Post Posted: Sun May 09, 2021 3:43 am
Hardware:
On the Nesdev forum we recently had someone come by who had the same problems with 27C64s. Didn't figure out what was wrong; it looked like the programmer thought they were empty and programmed new data in, but in the cartridge they appeared to still have the original contents. I don't even know how that would happen.

I also posted a spreadsheet there (csv file) that will help you figure out what the parts are actually, if you can get the Signature bytes out.

see: https://forums.nesdev.com/viewtopic.php?p=269355#p269355

If the parts you're working with are in ceramic cases, I don't think they've yet figured how to remove the old markings and apply new ones. In epoxy cases, you're assuredly right.

Software:
You can use MAME. Provide it with a copy of the M404 BIOS as "m404prot.rom", don't provide it with any of the other bioses, and tell it to start "sms1" hardware with the debugger and the game you want to troubleshoot.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 09, 2021 7:42 am
Cheers for that! you've helped us out on the Nes forums before ! I will go that route when I get some time.
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Sun May 09, 2021 4:00 pm
I patched the M404 BIOS with the following and it works in emulation (look away now if you wanted to work this out yourself):


0x0167: change 1 byte from 0x0E to 0x08 (this is the length of the string “TMR SEGA”

0x0173: change 1 byte from 0xE0 to 0xF0 (this is the lower byte header address 0x7FF0)

0x017F: change 8 bytes from “COPYRIGH” to “TMR SEGA” (the TMS string in ascii caps)


Lemme know if you want me to send you the bin.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 8:06 am
bloody legend, you're a bloody legend mate! hahaha

I knew you'd only have to patch a few locations with tiny changes!
I'd be more interested in how you worked it out to help me in future hacking endeavours!

I read a guide on the internet when I was a teenager and managed to hex-edit myself through a privacy check on an old windows game... since then not much.

I will make the changes and try it on mame!
I was pretty upset with a UK modding sites attitude to the file - it's not like it's his BIOS - his friend just hacked it for him. Claims it took him weeks of work ... post on here and BAM couple days later it's done haha. SMS power for life !!
  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13820
  • Location: London
Reply with quote
Post Posted: Wed May 12, 2021 9:08 am
The code is checking for text “COPYRIGHT SEGA” at address $7fe0. The hack makes it look for “TMR SEGA” at $7ff0, which is what all retail games have. The tricky part is figuring out which bytes to change.
  View user's profile Send private message Visit poster's website
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 10:38 am
Last edited by L10N37 on Wed May 12, 2021 10:39 am; edited 1 time in total
No luck guys,

Stupid me realised my FPGA based master system / megadrive is the plug and play solution I needed. It's jailbroken and has a folder with every BIOS variation (totally slipped my mind)

I understand how his hack works, thats for sure... but it's not working!

I've confirmed the M404 prototype only opens fantasy zone and choplifter - all good.

But the changes asynchronous suggested still cause a hang on every game (now including the ones that should work)

Also - if it did work - it would break the 2 games that work and every other game would work.

Once it's figured out I'm happy to HDMI capture it direct but it's a no go for now. I could just purchase the one that is working from the UK then compare the file to the original to look for the "unique anti piracy code" he's placed on each sale of the BIOS then patch it back to normal but that wouldn't be any fun.

(mame sucks, always wants more - asks for a file , feed it, asks for more, feed it, asks for more - gave up with that)
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 10:38 am
Last edited by L10N37 on Wed May 12, 2021 11:06 am; edited 1 time in total
It also allows me to go a step further if willing - (cringe thinking about it) but would allow me to test EVERY single SMS rom through it. *derp ...every game would work bar fantasy zone/ choplifter
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 10:46 am
Oh one more important thing to note:

The M404 officially supports 3 games:

Chop lifter
Fantasy zone

and ....Alex kidd 2 (the homebrew)

...hmmm?
Edit: oh, he put both strings in the game ROM

double edit:

It works guys, sweet as - cheers

I changed 0x177 to 00 as suggested by Maxim

"patch the M404 BIOS at 0x177 to 0 to disable the checks (makes it pass the check always). Patch 0x19e to 0xab to make it boot the cartridge. "

Just had to change that back to C0 (will try both your methods now and compare as If maxims always passes, it will not break the original working games)

Edit: just realised you meant the entire header needs patching and wouldn't have a clue how to patch that many bytes to get a working BIOS. Suppose I only want it for my mainboard and it only needs to load an everdrive anyway :)
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 11:18 am
Ok so the M404 asynchronous patch works with every game presumably bar Jap Fantasy zone which only contains the Copyright string. Chop lifter (like Alex kidd 2) contains both at the correct locations.

will share a video and the BIOS in next post in case anyone comes across this thread and wants an M404 - will likely stock them for sale but it would be extremely unlikely that anyone would purchase it - but for now anyone with an EEPROM/ EPROM programmer can have it for free


M404 asynchronous patch:
https://drive.google.com/file/d/1Oq5ROfA14ka6sIEmr7ymX2LLcwbiyk35/view?usp=shari...
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Wed May 12, 2021 11:58 am
Demonstration:

.be
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Thu May 13, 2021 2:19 am
That bump screen never gets old.

I kept the string checks rather than bypass them completely because it acts as a little insertion test for the cartridge.

The M404 BIOS actually performs the 3 tests sequentially and jumps to the cartridge on the first test that passes. So, if patching over the 1st copyright check is causing an issue for JDM Fantasy Zone, we can patch the 2nd copyright string check instead?

I'll post this "alternate" patch tonight when I have the disassembly in front of me.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Thu May 13, 2021 6:22 am
No worries man, sounds perfect. I did order a new legitimate M27C256B and it arrived today. I was going to wait for your alternate patch but I do need some UV lights for whitening old yellowed consoles so I can just erase my EPROMS when the time comes.

Obviously theres something wrong with that batch of rebranded EPROMS from China - 10 of them! with the JAP bios I didn't bother creating a 32kb file to fill the entire M27C256B - it was flashed as is @ 8kb and it worked fine but obviously became corrupted floating around in a draw of parts

This time as an extra step of precaution I've run your original patch idea through HXD's file tools and used "concatenate" to quadrouple the file up to 32kb prior to flashing. Obviously the MEGA SG is super accurate but I was keen as a bean to try it on a real system and its all good :)
1.png (245.49 KB)
1.png

  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Thu May 13, 2021 6:43 am
Test bench with a socketed HY6264A LP-70 WRAM (obviously makes no difference, it's just for testing 8kb SRAMS)

Socketed Z80 (killed one with a heatgun before learning how to service my S-993A Gaojie desoldering gun/vaccuum)

And socketed BIOS


  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13820
  • Location: London
Reply with quote
Post Posted: Thu May 13, 2021 7:55 am
Does it also set the byte at $c000 for compatibility with multi-slot games?
  View user's profile Send private message Visit poster's website
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Thu May 13, 2021 11:48 am
@Maxim good point. It doesn't write the mapped in slot to 0xC000. That may explain the hang for some games. But then it doesn't do some other BIOS stuff either which will mess some other games too.

Anyway, here is new "M404 asynchronous patch":

Address: 0x0146
Old value: 0xCD 0x2E 0xC1
New value: 0x32 0x00 0xC0

Address: 0x0149
Old value: 0xCD 0x35 0xC1
New value: 0xCD 0x2E 0xC1

Address: 0x014C
Old value: 0xCD 0x24 0xC1
New value: 0xCD 0x35 0xC1

Address: 0x016E
Old value: 0x0D
New value: 0x08

Address: 0x018D
Old value: "COPYRIGH"
New value: "TMR SEGA"

Address: 0x0173
Old value: 0xE0
New value: 0xF0


Change Log:
==========
1) Squeezed in a LD (0xC000),A to write the mapped in slot to RAM address 0xC000.
2) Moved the call to the “COPYRIGHT SEGA” check.
3) Moved the call to the “COPYRIGHTSEGA” check (patched to check for “TMR SEGA” instead).
4) Changed from the string length of “COPYRIGHTSEGA” to “TMR SEGA”.
5) Changed the “COPYRIGHTSEGA” string to “TMR SEGA”.
6) Changed the header address from 0x7FE0 to 0x7FF0.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Thu May 13, 2021 12:07 pm
Legendary! Had a PS2 modchip install for a customer tonight but will get onto it asap! You sir, are a true blue gentleman!

Could I have a name of a game that hangs? or a few if you remember?
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Thu May 13, 2021 12:48 pm
Try R-Type and any FM game that replies on 0xC000 having the byte written to Port 0x3E in it.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Fri May 14, 2021 12:25 am
Tried the real system quickly with your original patch, yeah no luck on R-Type. Dang.
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Fri May 14, 2021 2:16 am
It will work with the new patch because I literally squeezed in the required write to RAM address 0xC000.

So out with the old, and in with the new. :)
  View user's profile Send private message
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Fri May 14, 2021 11:29 am
Speaking of bios, the game gear bios starts in what appears to be gg mode, but the cram is set to $30, $3F, $09, which results in red text for gg mode. Here are the results emulating the gg vdp and the sms vdp, respectively. Does anyone know what is happening?
ggvpd.png (1.52 KB)
ggvpd.png
smsvpd.png (1.02 KB)
smsvpd.png

  View user's profile Send private message
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13820
  • Location: London
Reply with quote
Post Posted: Fri May 14, 2021 2:56 pm
I’m not sure what you’re doing here. The palette data written is dependent on whether it detects SMS or GG mode, but neither looks like your screenshots. Maybe your emulation has the wrong behaviour for the detection?
  View user's profile Send private message Visit poster's website
  • Joined: 25 Feb 2013
  • Posts: 248
  • Location: Osaka
Reply with quote
Post Posted: Fri May 14, 2021 3:57 pm
Maxim wrote
I’m not sure what you’re doing here. The palette data written is dependent on whether it detects SMS or GG mode, but neither looks like your screenshots. Maybe your emulation has the wrong behaviour for the detection?


That was it, thank you!

https://www.smspower.org/uploads/Development/majbios.asm
shows that port 2 is used for detection and implementing the readback of port 2 fixed it.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sat May 15, 2021 3:50 am
asynchronous wrote
It will work with the new patch because I literally squeezed in the required write to RAM address 0xC000.

So out with the old, and in with the new. :)


Once again a true legend! man hugs all around, will try it out tonight - super stoked~!
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sat May 15, 2021 8:06 am
asynchronous M404 V2 patch:

https://drive.google.com/file/d/11w4f8K6OepU7f3YquZyQMGeTw8PqqMO5/view?usp=shari...
  View user's profile Send private message
  • Joined: 11 Jul 2009
  • Posts: 16
Reply with quote
Post Posted: Sat May 15, 2021 8:03 pm
Hi, awesome to see this being worked on. I tried the V2 patched bios in Kega emulator and it works great for the most part but i've found a couple of games that don't work. I appreciate the work gone into it and not trying to criticize just provide some feedback :)

Comical Machine Gun Joe - stuck at bump screen

Japanese Fantasy Zone (pal rom works fine) - stuck at the bump screen

Back to the Future III - black screen after bump screen

California Games II - black screen after bump screen

Ghost House - Stuck at bump screen

Pit Pot - Stuck at bump screen

Rygar - stuck at bump screen

Satellite 7 - Stuck at bump screen

Shanghai - Black screen after bump screen

Walter Payton Football - flashing red and black screen after bump screen
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 3:33 am
Just confirmed Ghost House (working) on V1 patch with real master system from this system modded lastnight, give me 10 I will try V2 on my Mega SG as it's going to be the most accurate form of emulation by far.

The V1 was also shown off from my video lastnight with a real system



V1:

Ghost house [working, real system]

Back to the future 3 [black after bumper, real system]

Cali Games II [Black after bumper, real system]

Astro Warrior/ Pitpot 2 in one [full red screen then black, or full blue
screen after bumper, real system **Dirty cartridge confirmed working /both games from menu]

V2:

Comical Machine Gun Joe (Japan) [FPGA, hangs at bios]

Fantasy Zone (Japan) [FPGA, hangs at BIOS]

Back to the Future III [FPGA, black screen post BIOS]

California Games II [FPGA, black screen post BIOS]

Ghost House (Japan) [FPGA, hangs @ BIOS]

Ghose House (Beta version) [FPGA, Confirmed working]

Ghost House (Euro/ US) [FPGA, Confirmed working]

Astro Warrior/ PitPot [FPGA, Confirmed working]

Argos no Juujiken (Japan) AKA Rygar [FPGA, Hangs @ BIOS]

Satellite 7 (Japan) [FPGA, Hangs @ BIOS]

Shanghai (euro/ US) [FPGA, Confirmed working]

Shanghai (Beta: euro/ US) [FPGA, Confirmed working]

Walter Payton Football [FPGA, Flashing red screen as above]
DSCN2169.JPG (4.43 MB)
DSCN2169.JPG

  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 6:20 am
I went through scrappysphinx posts and found one from August 2020 that somehow slipped past the radar

Scrappys friend has a patched version which I'm just going to call the scrappy patch.

For historical purposes it's been stepped through for differences to asynchronous original V1 patch:




scrappysphinx:

offset
======

146: 00 18 33
167: 0E
173: E0
17F: COPYRIGHT SEGA STRING
19E: AB CB


asynchronous V1:

offset:
======

146: CD 2E C1
167: 08
173: F0
17F: TMR SEGA STRING
19E: CB AB




* Am I right to assume that because the scrappy patch still has the COPYRIGHT string that the patch works by completely bypassing the check altogether - as oppose to changing the check so that it passes? Does bypassing the check altogether help the situation?

* Does the scrappy patch hang on the above games as well? Can we have a BIOS that bypasses the check completely but still has the benefits of the asynchronous V2 patch with added compatibility for games that do that RAM address write ?


***
scrappy patch

KEGA:

walter payton: flashing red with a noise
Cali games II: confirmed working
BTTF II: confirmed working
Rygar: BIOS Loops with some graphical corruption
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 10:20 am
Hybrid:

Async V2 patch with Scrappys O19E data (further experiments were done here and @ A10, fixes walter payton football and BTTFII in emulicious, fixes only back to the future II in Kega Fusion, on FPGA also only fixes BTTFII.

https://drive.google.com/file/d/1-JZm3yfw1OuCTCA5D9G1OvbBy6Cv5b_D/view?usp=shari...

The games with a black screen post BIOS (like cali games) are probably able to be debugged by someone with more knowledge. They loop some code and end up at a halt command. A condition is unmet. Cali games II hangs at BIOS but unlike the Jap games theres code looping where as the Jap games just do nothing and actually hanging. This further patching actually got more happening with Rygar as well. It doesn't completely hang, screen goes corrupt blue sometimes.

also: can't load california games II using 2.1JP BIOS either...
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Sun May 16, 2021 1:35 pm
Japanese games will not be loaded by the patched BIOS because they don't have a software header at 0x7FF0 with the "TMR SEGA" string there. Sorry, I thought that was common knowledge.

Export games with a valid software header should work fine with the v2 patch tho.

The data at 0x019E is just the bytes written to port 3E to map in the slots (0xCB = Card Slot, 0xAB = Cartridge Slot, 0x6B = Expansion Slot). I'm not sure why changing the order of slots checked would impact certain games.

To make the BIOS compatible with all games, it would need a patch like what Maxim was talking about. The downside of that sort of patch is it will make the BIOS try to load anything, including poorly inserted cartridges, and even an empty cartridge slot. It also only supports the Cartridge slot.

Let's call this one Patch v3:

(Make these changes to the original M404 BIOS image)

Address: 0x013E
Old value: 0xEB
New value: 0xAB

Address: 0x0141
Old value: 0x7E 0xD3 0x3E 0xE5 0xC5 0xCD
New value: 0x32 0x00 0xC0 0xC3 0x00 0x00

Change log:
=========
1) Hardcoded to support the Cartridge slot only
2) Write the mapped in (cartridge) slot to RAM address 0xC000.
3) Skip all checks and load the cartridge
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 1:44 pm
Yep , in fact the above upload was wrong, 19E was changed somewhere along the line to "00", it broke chop lifter and needs to go back to "AB"

Ok, will give it a go


- What was wrong with california games II though?
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 2:06 pm
Last edited by L10N37 on Sun May 16, 2021 2:20 pm; edited 1 time in total
Walter Payton is still broken :( So is california games II

On the upside we can fit this in here
smspowerM404.png (18.51 KB)
smspowerM404.png

  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Sun May 16, 2021 2:11 pm
I just had a look at L10N37's diff.

The scrappy patch is a NOP then a JR right after Port 3E is written to in order to skip all 3 software checks and just load the cartridge. The bytes at 0x019E are swapped to make the cartridge slot the first slot to be mapped in.

So the scrappy patch only supports the cartridge slot. It also will not load any games like R-Type which need the BIOS to write to RAM address 0xC000.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 2:24 pm
Last edited by L10N37 on Sun May 16, 2021 2:34 pm; edited 1 time in total
So your V3 is perfect for SMSII as they don't support anything other than cartridge anyway

But we have 2 known of broken games
Cali games II is stuck in a nop @ 0x38?
Walter Payton works in emulicious also with prior change of cartridge slot as first check. It doesn't work in Kega or FPGA so therefore assumed not to work in a real system.


- R type is good just tried it on the fully customised SMSPOWER'21 M404 aka your V3

*Also wondering, can we increase the hang time after the logo shows as it varies game to game, so its on display for a couple seconds prior to booting??
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Sun May 16, 2021 2:26 pm
Last edited by asynchronous on Sun May 16, 2021 2:42 pm; edited 1 time in total
No idea why mate.

AFAIK Cali Games 2 has a valid software header so it should load up with the patch 2. And it should definitely load with patch v3 as v3 does no checks.

I hadn't even heard of the Walter Payton football game so I can't say why that's not loading.

Edit: Found a copy of Walter Payton football and tried it in Emulicious with v3 patched. Loaded for me.
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 2:52 pm
asynchronous wrote
No idea why mate.

AFAIK Cali Games 2 has a valid software header so it should load up with the patch 2. And it should definitely load with patch v3 as v3 does no checks.

I hadn't even heard of the Walter Payton football game so I can't say why that's not loading.

Edit: Found a copy of Walter Payton football and tried it in Emulicious with v3 patched. Loaded for me.


Yeah it works in emulicious, it hangs with a red flashing screen on the MEGA SG and in KEGA. Just assuming the MEGA SG is a better emulator than these software based ones.

It's just that game, and california games II (mine became corruped from messing around earlier, software errored in Alex Kidd BIOS, redownloaded, works in Alex Kidd Bios, not with V3 or V1/2)

All I can do is compare what the game code does with a working BIOS compared to here pictured with your V3, it skips the BIOS as Maxim mentioned plus I have no idea how to fix it. This seems to be the broken code or command.

absolute guess work and experimentation - at least you know what you're doing.

**scratch the screenshot, differs every boot
CaligamesII.png (150.54 KB)
CaligamesII.png

  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Sun May 16, 2021 3:16 pm
Lol, you're lucky there's a delay function very close by the block of code.

Not sure I like the modified screen message. I'm a sucker for the factory look.

Anyway, here is patch v4:

Address: 0x013E
Old value: 0xEB
New value: 0xAB

Address: 0x0141
Old value: 0x7E 0xD3 0x3E
New value: 0x32 0x00 0xC0

Address: 0x0144
Old value: -
New value: 0x06 0x05 0x11 0x00 0x00 0x1B 0x7A 0xB3 0x20 0xFB 0x10 0xF6

Address: 0x0150
Old value: -
New value: 0xC3 0x00 0x00


Change log:
=========
1) Hardcoded to support the Cartridge slot only
2) Write the mapped in (cartridge) slot to RAM address 0xC000.
3) Skip all checks and load the cartridge
4) Added 2 sec delay before loading the cartridge
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 3:43 pm
hell yeah!!!

I ran through a debugger step by step

Alex Kidd BIOS

writes A2 to port BF (VDP?)
writes 81 to port BF
writes 00 to port BF
writes C0 to port BF

Reads DF from port BF
Reads C4 from port BF

when using your V3, it reads C4 from port BF and skips reading DF then jumps to some other code that loops (causing a hang) where as the other BIOS didn't, I don't know what that means - but I figured the only thing it could be was some sort of 50/60hz issue. Cali Games II is confirmed working but only by switching to 50hz mode in emulicious. It won't work in Kega Fusion even forcing Euro mode.

I'm sort baffled at my own over analysis of the entire situation as realistically I should have just tried 50hz mode. haha

As for football, that can wait. IT still hangs in Kega
  View user's profile Send private message
  • Joined: 11 Jul 2009
  • Posts: 16
Reply with quote
Post Posted: Sun May 16, 2021 8:34 pm
Its awesome that you guys are committed to getting this working.

I won't pretend to understand any of the technical speak, i can wield a soldering iron and mod a console but have absolutely no knowledge on programming languages.

My friend who "patched" the bios told me he had never worked with Z80 code but did have some basic 6502 and 680x0 knowledge. He said that he'd basically told the system to skip any checks and just boot a cartridge. it worked for quite a few roms but i had about 60 that didn't so your V2 patch was a big improvement.

Looking forward to trying V4 when it appears :)

Thanks chaps
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Sun May 16, 2021 11:28 pm
These guys are turning the ROM back into assembly language which is a low level language and apparently even most actual professional programmers have trouble with as they work high level languages like C which is more human readable.

That's as far as I know - I've only dabbled

As for patching, you don't need programming knowledge to patch addresses in hex, this screenshot will help you out, this is the V4 patch - in red are the changes. You can even use search and "go to" function to jump to the addresses mentioned.

If you could provide a new compatibility list (if you find the time) that would be awesome, and even more helpful if you provide the emulator you're using.



**Hang time is perfect async! that delay is spot on


**California games II for some reason now works on the FPGA based Mega SG, this leaves walter payton football as a non worker and anything else scrappy might find
V4ChangesAsync.png (217.08 KB)
V4ChangesAsync.png

  View user's profile Send private message
  • Joined: 11 Jul 2009
  • Posts: 16
Reply with quote
Post Posted: Sun May 16, 2021 11:54 pm
I didnt realise you were just editing the bios with a hex editor. I think I can manage that. It's 1am here in the UK so will take a look tomorrow and report back :)
  View user's profile Send private message
  • Joined: 14 Aug 2000
  • Posts: 643
  • Location: Adelaide, Australia
Reply with quote
Prototype M404 BIOS
Post Posted: Mon May 17, 2021 2:44 am
@scrappysphinx that’s some pretty good patching there considering your friend wasn’t familiar with the CPU or architecture. No criticism from me whatsoever.

Just so you both know, there are several factors outside of the BIOS that will stop 100% compatibility between all game and all master system:

Chipset region, NTSC/PAL mode, clean physical contact between cartridge and slot, ROM timing and condition, emulation, bad dumps, patched dumps…
  View user's profile Send private message
  • Joined: 27 Jun 2020
  • Posts: 201
Reply with quote
Post Posted: Mon May 17, 2021 3:39 am
asynchronous wrote
@scrappysphinx that’s some pretty good patching there considering your friend wasn’t familiar with the CPU or architecture. No criticism from me whatsoever.

Just so you both know, there are several factors outside of the BIOS that will stop 100% compatibility between all game and all master system:

Chipset region, NTSC/PAL mode, clean physical contact between cartridge and slot, ROM timing and condition, emulation, bad dumps, patched dumps…




With a 100% proper dumped [!] library does anyone know which cartridge games wouldn't load on a regular Alex Kidd or Sonic BIOS (leaving out SMS1 BIOS due to extra slots) or including the SMS1 multiple BIOS but CART only?

Could we patch this small handful of games to work with the M404 BIOS? furthermore, could we produce a patch that we just dump in our ROMS folder and double click and it just patches those games for us? - if the patch causes us to have a non [!] dump but works with M404 V4 I think that would be worth it.

I'd be quite interested in stepping through the debugger to see what initialisations differ from a working verse non working copy of the football game, but that's impossible because it works on emulicious and that's the emu with a debug feature.
  View user's profile Send private message
  • Joined: 14 Apr 2013
  • Posts: 552
Reply with quote
Post Posted: Mon May 17, 2021 7:39 am
Where do I get V4?
With V2 I get the red flashing screen that you described in Emulicious.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 13820
  • Location: London
Reply with quote
Post Posted: Mon May 17, 2021 9:05 am
I think someone with a bit more skill could come in and make a version that has the display of the M404 but the functionality of the 1.3 BIOS (including the final system state) to maximise compatibility...
  View user's profile Send private message Visit poster's website
Reply to topic Goto page 1, 2  Next



Back to the top of this page

Back to SMS Power!